ISACA Certified Information Systems Auditor (CISA) ExamDomain 5: Protection of Information AssetsEasy
A CISA is auditing an organization's network security. The organization uses a demilitarized zone (DMZ) to host public-facing web servers. During the review, the CISA observes that the firewall rules between the DMZ and the internal network allow all outbound traffic from the DMZ to any port on the internal network. What is the MOST significant security risk posed by this configuration?
- AIncreased latency for internal users accessing DMZ resources.
- BReduced availability of DMZ services due to an overly restrictive firewall.
- CUnauthorized access to internal network resources if a DMZ server is compromised.
- DDifficulty in monitoring traffic flow between the DMZ and the internet.
Show answer & explanationAnswer & explanation
Correct answer: C. Unauthorized access to internal network resources if a DMZ server is compromised.
Allowing all outbound traffic from the DMZ to the internal network creates a significant vulnerability. If a server in the DMZ is compromised, an attacker can exploit this open channel to gain uncontrolled access to the organization's internal systems, bypassing the intended segmentation.
Why the other options are wrong
- A. Increased latency is unlikely to be the primary concern; security risks are more critical.
- B. This rule set is overly permissive, not restrictive, so it would not reduce availability due to restriction.
- D. Monitoring traffic between the DMZ and the internet is typically handled by the external firewall, not the internal DMZ-to-internal firewall rules.
DMZ to Internal Network Firewall Rules
Firewall rules governing traffic flow between the demilitarized zone (DMZ) and the internal network, designed to protect internal resources from external threats while allowing necessary public access.
- DMZ acts as a buffer zone for public-facing services.
- Firewall rules between DMZ and internal network should be highly restrictive.
- Only essential ports and protocols should be open.
Memory trick: DMZ is the 'Welcome Mat,' but don't let guests walk through the 'back door' to your house.