Define the external application traffic from vendors,
customers, partners, etc., that can access your data center from
the internet.
Risks to the data center from internet traffic include downloading malware from an
infected external server, downloading "call home" command-and-control software that
enables an attacker to access and control data center assets, and inadvertently allowing
access to the data center from the internet. To reduce the attack surface, allow only
applications, users, and services that you require for business purposes in the data
center. Decrypt, inspect, and log all the traffic that local regulations, laws, and your
business requirements allow. In addition, follow DoS and Zone Protection best practices
to prevent attackers from disrupting the data center (especially web servers) with DoS
attacks.
The following sections show you the type of traffic to allow and how to control it, how
to decrypt the traffic, and how to protect your data center assets from DoS attacks: