Interpretation of control A9.4.6 - Segregation of Networks

[Midnight]

Does this control suggest segregation of web servers for a service that is used by internet and intranet based users?

Or can the web servers be shared and still satisfy the control?

[smashingvicky]

No, the web server can be shared.....

Vikas Garg
BS7799 Lead Auditor
vikas.garg@bsi-india.com

[sulla]

I think that segregation in networks is one of the most important control in ISO17799.

It isn't just about protecting the core applications or seperating internet and intranets...

Most companies today needs to protect each department from each other so that when one network is compromised, it will be much harder for an employee or an attacker to propagate to other targets within the company.

When we do a pen test.. instead of trying to compromise a secure DMZ directly we will target people who have legitimate access to sensitive systems such as people in operations or development.

Even when development doesn't have direct access to production and all changes have to go through QA... The people in QA only do user acceptance test (UAT), they rarely perform a code security review and look for backdoor or vulnerable code.

Sulla

[Midnight]

Sulla

The point is that the intranet and internet networks are segregated (there are firewalls in place to protect the users).

The users share the same web server for the service, whether the user is based on the internet or intranet.

I don't believe this violates control 9.4.6.