Science DMZ Security

A Science DMZ is a dedicated, separately secured network zone for high-performance science and data transfer systems. This section explains why we suggest protecting those systems with router access control lists (ACLs) and other security practices instead of a stateful firewall in the data path, and how to do that responsibly. The core issue is performance. Firewalls are built for large numbers of slow, ordinary business flows, and they often have small input buffers and processing limits that cause packet loss when a fast data transfer host sends a burst of traffic. ACLs are usually applied in the router's forwarding hardware, so they typically don't slow transfers down.

This isn't a case for weaker security. The approach keeps filtering in place, limits what runs on the data transfer hosts, and adds monitoring and logging. Your institution's firewalls can keep protecting business and end-user systems as they do today. We recognize this stance is debated, so the pages here lay out our reasoning so you can evaluate it for your own environment.

Where to start:

• Best Practices for Science DMZ Security: The practical checklist. Depending on how sensitive your data is, choose from some or all of the following:
  • Controlling access: router ACLs that allow only necessary ports and subnets, plus host-level port control. The objection is to an inline firewall appliance, not to filtering itself.
  • Detecting problems: network and host intrusion detection systems.
  • Keeping records: central logging, flow data collection and analysis (summary records of who talked to whom, when, and how much), and utilization monitoring.
• Risk Analysis: The security reasoning, aimed at architects and the people who approve designs. It argues that for a small set of data transfer applications, commercial firewalls add little over ACLs, and that limiting what runs on your data transfer hosts is part of the security policy. It also argues that moving this traffic out of the enterprise path can make enterprise firewalls tighter. This is a good page to share with a skeptical security team.
• Firewalls vs. Router ACLs: The main statement of our position: why we suggest avoiding firewalls for science traffic, how ACLs fit in, and how the Science DMZ separates science systems from the rest of the network. Start here for the big picture.
• Firewall Performance Issues: The technical reason behind the recommendation. Firewalls often can't keep up with the line rate of a fast host, and their small input buffers overflow when a data transfer sends a burst, causing packet loss and severe slowdowns. Read this if you're wondering whether a firewall is behind your slow transfers.
• Sensitive Data Environments: Read this if your data is regulated, such as health information covered by HIPAA (a US health privacy law) in biomedical research. It explains why adoption has been slower there and how to approach federal security frameworks like FISMA. It doesn't claim a Science DMZ is automatically compliant. Your compliance and risk staff should be involved in any decision.