 external source. However, this is no reason to reduce the level of system security used internally. If an attacker gets inside, we must also have good host security. High Risk Area - Demilitarized Zone (DMZ) It is common to connect a screened subnet to the firewall. To this subnet, often called a demilitarized zone, public servers such as web servers can be located. Such servers are thus available to the outside and therefore possible targets for attacks. Only computers with a strategic function in the company should be on the DMZ segment. Thorough logging should be applied to all DMZ systems. The log files should be transferred in a secure manner to the inside network for analysis and storage. Alarms should be triggered if an attempted attack occurs. Bastion Host A bastion host is a computer that is continuously monitored, logged and upgraded, and which serves the purpose of being the point of entry to all traffic from outside to inside networks. Proxy Firewall A more advanced firewall is the proxy firewall. It can perform virus control of documents, traffic logging to track intrusions, blocking of JAVA/Active X components. Since the proxy functionality includes analysis of the application layers, it must have separate programs for each application, such as SMTP (e-mail), HTTP (web applications), FTP, Real Audio and Telnet. Security With increasing voice over IP traffic there is a need to mix VoIP and ordinary IP data traffic. Since the data traffic should pass firewalls, there is a need for firewalls supporting the SIP protocol used for mixed traffic. 6.10 CONFIDENTIALITY: ENCRYPTION AND KEY MANAGEMENT 6.10.1 BASIC CRYPTOGRAPHY The first solution to protect IP packets is to simply encrypt the packet. This guarantees that no one can read the content. However, we must remember that encryption does not prevent modification of the packet. It means that it provides confidentiality but not integrity. For example, if a packet consists of just one bit of data: 0 or 1, then it is 0 or 1 in encrypted form and someone ca