使用Windows2000和“Whistler”部署安全的外联网Extranets.pptVIP

日程 外联网分类 典型的外联网问题 架构方针 安全方针 协作外联网样例 Active Directory? 管理方案 Extranet 分类 什么是外联网? 定义 Multiple networks connected together to share information and technology assets between members of a community of interest 分类 Purpose Workflow Partner relationship 外联网目的 信息发布 Subscription services, Repair manuals 分发渠道 Order entry and tracking, Customer service 供应链 Inventory control, Corporate portal 协作 Joint RD, Medical record access 基于Web-的工作流 内容发布 (IIS) Personalized data searching and browsing Subscription services, Repair manuals 应用共享 (IIS) One interface to diverse services Corporate purchasing, Service portals 反向代理 (ISA) Cache boosts client and server performance Web interface to legacy applications 基于文件的工作流 共享的数据库 (SQL) Relational integrity, structured queries Medical records, customer service 共享的文件 (NTFS, CIFS, WebDAV) Different applications, file location identifies relationships Branch offices, Joint RD 基于消息的工作流 Email (Exchange) Global reach, no server management Coauthor/edit document EDI XML-based Forms (BizTalk) B2B transactions with different MRP/MRO systems, workflow Distribution channels, supply chains 合作伙伴关联 不对称（Asymmetric） Primary versus secondary partners Primary owns and controls shared assets Distribution: Order entry and tracking Symmetric Peer partners Each one shares assets it owns Each one controls its own assets Collaboration: Medical records 典型的外联网问题 外联网暴露资产 外联网架构方针 资产隔离 Restrict partners to DMZ Well understood, Defense in depth Offsets inconsistent management policies Data copying, Extra hardware admin Connect partners to Intranet One copy of data, No extra hardware Too complex to manage securely (yet) DMZ资产隔离网络分界隔离共享和内部资产 在 DMZ 设立专用的森林-Forest Save training $ Leverage intranet Admin training skills Save Admin time, Avoid errors Manage once in AD … not on every server User accounts Groups Group Policy and Security templates Maximize asset isolation If DMZ server (DC, DNS, CA) compromised … it has no authority on intranet If DMZ account compromise