Chapter 13. Separating Resources

Resource separation is one of the core network defense principles, and it is evident in many security-conscious designs. Grouping resources based on similarities in security-related attributes allows us to limit the attacker's area of influence if he gains access to a system inside the perimeter. The way that you group resources depends on their sensitivity, on the likelihood that they will be compromised, or on whatever criterion you choose as the designer.

We have applied the principle of resource separation throughout this book, perhaps without formally stating so. For example, we used screened subnets to host servers that were accessible from the Internet, presumably because their sensitivity and acceptable exposure differed from systems on the internal network. In addition to segmenting the network, resource separation can be accomplished by dedicating servers to specific tasks, and even by splitting the site into geographically distinct hosting centers. Resource separation also influences the design of software architecture, as we demonstrate in Chapter 15, "Software Architecture."

By the end of this chapter, you will understand practical means of achieving the desired extent of segregation on your network. We present several ways to separate resources within servers and networks as well as explore examples that incorporate such separation. We also discuss chroot, mail relays, split DNS, and wireless networks, and we examine the merits and dangers of using VLANs when implementing security zones.