View source for GP.Data Zone Protection

{{Maturity|4}}
{{Pageheaderbox4GP
|name=Data Zone Protection
|sector=Core
|version=0.3
|owner=J.A.H. Schoonderbeek
|summary=This Pattern realizes a security separation between different Data Transport zones.
}}
Two or more data transport zones may need to be separated because of different security-related requirements. If this is the case, then traffic from one zone traveling to the other zone needs to be processed so as to satisfy the security requirements imposed by the separation. To this end, this pattern may be employed.
In practice, use of this pattern often leads to use of a firewall device, but as security requirements evolve, so may the realization of this pattern.
{{Pattern Realizes
|service=GS.Data Zone Protection
}}
{{Pattern Graphic
|graphic=GP.Data Zone Protection.png
|size=600px
|title=Data Zone Protection
|kind=Generic
}}
{{Generic Pattern Composition}}
{{Generic Pattern Composition Row
|function=GF.Filtering
|choice=Must
|reason=This function performs the actual filtering of data flowing from one data zone to the other. The filtering is based on criteria that are derived from the security requirements, e.g. "no traffic is allowed from the DMZ to the internal network, with the exeption of ...".
}}
{{Generic Pattern Composition Row
|function=GF.Load Balancing
|choice=May
|reason=Since this Pattern often is used as a chokepoint where all data traffic must go through, it may be necessary to include Load Balancing to provide higher availability of this Pattern.
}}
{{Generic Pattern Composition Row
|function=GF.Data Scanning
|choice=Must
|reason=When filtering based on traffic characteristics does not suffice, filtering based on data (content, deep inspection) may be needed. This can be useful for securing message exchange between zones (e.g. e-mail or SOAP messages), but also for deep inspection in certain protocols. This can for example detect malicious commands inside protocol packets, e.g. SQL injection instructions inside a HTTP request. When data scanning reveals a problem, a fitting action must be undertaken by another function (e.g. the Filter may drop the packet or block the sender, or Monitoring may issue an alert). 
}}
{{Generic Pattern Composition Row
|function=GF.Rules Engine
|choice=May
|reason=This function enables the processing of more complex logic, such as the well-known "firewall rules".

Note that the rules may be stored in the Data Zone Protection facility itself, or outside of it, with deployment to this facility.
}}
{{Generic Pattern Composition Row
|function=GF.Logging
|choice=Must
|reason=Since this Pattern is used for security purposes, this function is required to provide security personnel with the necessary logs for security monitoring and auditing.
}}
{{Generic Pattern Composition Row
|function=GF.Distribution
|choice=May
|reason=Since this Pattern often is used as a chokepoint where all data traffic must go through, it is also a good point to locate Distribution. 
}}
{{Generic Pattern Composition Row
|function=GF.Controlling
|choice=Must
|reason=Access to the configuration and operation of this security related Pattern is most always restricted.
}}
{{Table Ending}}
{{Pattern Adjacent Services}}
{{Generic Pattern Adjacent Service Row
|service=GS.Authentication+Authorization
|choice=May
|reason=The Authentication & Authorization Pattern can be linked to this Pattern when this Pattern is to support authorization (and/or authentication), so as to feed the Traffic Filter facility with the results of identity and/or permission validations.
}}
{{Generic Pattern Adjacent Service Row
|service=GS.Facilities Monitoring
|choice=May
|reason=Transport Zone Protection is usually employed to enforce security levels within one or more Data Transport Zones; thus, many events that occur in a Transport Zone Protection facility are of interest to the security officers. This means it is very desirable to have the facility report directly to (a Security instance of) Facilities Monitoring.
}}
{{Table Ending}}
{{Text Footer GP}}