Most firewalls have a 'DMZ' setting, but are they actually a full DMZ firewall? DMZ is a term often used in network security, but it can mean two different things to manufacturers and practitioners. Technically, there is no such thing as a DMZ in a firewall architecture, only a screened-subnet firewall, screened-host firewall or an exposed host, but the term is the industry standard when talking about allowing access to information servers (e.g. web, mail, etc.) from the Internet. So what is a DMZ? DMZ stands for Demilitarized Zone and is, obviously, a military term for the no-go area between two armies where no military activity is allowed. However, in network security terms it is a secure subnet that separates the Internet from the internal machines on your network. This becomes a logical place to implement any Information Servers, as these can be partially opened to the Internet, whilst not allowing direct access to the internal network. So are all DMZ firewalls the same? ...

While I was answering emails and writing another blog post, I was reminded that lots of people ask me about the seriousness of the threat of attack as they are sceptical. So, I decided to turn on additional logging on my router to view all incoming traffic to see what it is blocking silently. I can tell you that in 2 hours on my home connection here I have had 22 different IP addresses making 47 different attempts to connect to me. One tried to launch a Denial-of-Service (DoS) attack on my web server three times (unsuccessfully), and another attached to my web server to view the options available and didn't bother retrieving any pages - this is a classic sign of footprinting before an attack. The first was host 123-204-6-150.dynamic.seed.net.tw and the second was host164-120-static.29-87-b.business.telecomitalia.it. What were the other 20 connection attempts? Well I don't actually have anything else open on my network, but by logging all connection attempts I can view what pe...