最佳实践是阻止对 DMZ 中公司网站的内部访问
我客户的网络安全人员正在 DMZ 中设置新网站以确保安全。这对我来说完全有道理。不过，她接着表示，最佳做法是公司员工无法在内部访问该网站。例如，为了检查网站是否正常，她建议他们使用手机。
这是新事物吗？这还有道理吗？我从来没有听说过不允许公司员工通过内部网络访问公司网站。我不是安全人员，我是开发人员，所以如果这在金钱上是正确的，请告诉我，这对我来说似乎很不寻常。
这是公司现在正在实施的最佳实践吗？这是建议的方式吗？
非常感谢任何信息。我只是感到困惑和有点震惊。
谢谢！
My client's network security person is setting up their new website in a DMZ for security. This makes total sense to me. However, she proceeded to say that it's a best practice that the company employees not be able to access the site internally. For example, to check if the site was up, she suggested they use their phone.
Is this a new thing? Does it even make sense? I've never heard of not allowing company employees to access the company website over their internal network before. I'm not a security person, I'm a developer, so if this is right on the money please let me know, it just seemed unusual to me.
Is this a best practice that companies are implementing now? Is it the advised way to go?
Any information is greatly appreciated. I'm just confused and a little stunned.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
他们应该阻止来自内部网络的 Windows 域、目录服务和未使用的端口，但应该允许必要的 Web 端口进行管理。 DMZ 的目的是保护您的内部网络免受公共服务器的影响，而不是相反。您不应该让网络安全人员认为风险太低而无法证明与从外部监控服务器相关的额外成本是合理的。如果您的安全人员在网络安全方面有任何经验，他就会知道这是标准做法。如果没有，请将其交给管理层并告诉他们您需要他们支付另一个互联网连接的费用来监控您的服务器，或者要求安全人员在他的防火墙中进行 1 个访问列表更改。
They should be blocking the windows domain, directory services and unused ports from the inside network but should allow the necessary web ports for management. The purpose of the dmz is to protect your internal network from the public server, not the other way around. You shouldn't have to the network security guy that the risk is too low to justify the extra costs associated with monitoring the server from the outside. If your security guy has any experience in network security he'll know that this is standard practice. If not, take it to management and tell them that you need them to pay for another internet connection to monitor your servers or ask the security guy to make 1 access list change in his firewall.
DMZ 中的计算机不应能够“连接”到内部网络中的任何计算机。内部网络中的计算机始终可以连接到 DMZ 中的计算机。
一般来说，员工可以访问在 DMZ 中运行的网站（和其他服务），因此您没有理由限制员工连接到您自己的 DMZ 计算机。
所以回答你的问题：
这是公司现在正在实施的最佳实践吗？
否
这是建议的方式吗？
这并不会让你变得更加安全。
如果此限制背后的基本原理是防止内部计算机可能被您自己的网站分发的恶意软件感染，那么它比被随机网站分发的恶意软件感染更安全。
A machine in DMZ should not be able to 'connect in' to any machine in your internal network. Machines from your internal network can always connect to the machines in DMZ.
Generally employees have access to the websites (and other services) running in the DMZ, so there is no reason why you should be restricting employees to connect to your own DMZ machine.
So to answer your question:
Is this a best practice that companies are implementing now?
No
Is it the advised way to go?
This doesn't make you any more secure that you are.
If the rationale behind this restriction is to prevent possible infection of internal machines from a malware being distributed by your own website, then how is it more secure than getting infected by a malware distributed by a random website.