Have spent the last half day researching the BlackBerry site and previous postings on this site for whether or not I should install a BES Router (BER) in my new BES 5 upgrade. Previous posting were from 2008/2009 time frame when ver 4.1.X was the main BES beast. To this point I have found only 1 reference in the BlackBerry Enterprise Solution Ver: 5.0 | Service Pack :2 Security Technical Overview that states (page #42):

"The BlackBerry Enterprise Server and BlackBerry Enterprise Server components, with the exception of the BlackBerry Router, do not support installation in a DMZ. For more information about configuring the BlackBerry Router in the DMZ, see Placing the BlackBerry Router in the DMZ."

(The 'BlackBerry Router in the DMZ' document they are referring to is older from 2005.)

In the BES Ver: 5.0 | Service Pack :1 Security Technical Overview it dose not mention anything at all about the BER in the DMZ.


In my previous BES 4.1.6 install we went the extra mile to install a BER in our DMZ for our security group, but is it still a 'Best Practice', or should I rope it back into 1 server? We have 400 users and will be running it on a hardened SteelCloud BES VM. I know the ideas of making the BER hard on the outside to make hackers work harder and that the BES only makes requests outbound initiated requests on 3101, and limiting it to the IP's and domain names of BlackBerry.net/.com...

I guess for the security minded, is the BER in a DMZ still worth it OR best practice with BES 5.0.x?

Thanks for reading my ramblings... -B

Attached Files

BlackBerry_Enterprise_Server-Security_Technical_Overview--1153051-0615043613-001-5.0.2-US.pdf (1.42 MB, 138 views)

Security
A remote BlackBerry Router might enable further security options because the BlackBerry Router does not have encryption keys and therefore does not compromise the security of the BlackBerry Infrastructure if the BlackBerry Router itself is compromised. However, implementing the BlackBerry Router in the DMZ does not necessarily increase security.

Livelink - Redirection

__________________
------------------------------------------------------

Torch 9800 on BES 4.1.6 MR7, Exchange 2003, SQL 2005.
WES 2009-2010 Survivor

I have seen MANY different setups and personally setting the router in the DMZ is not best practice, just preference. Weather the Router is inside the firewall or out, there is still a port that needs to be open so in my opinion, it's 6 of 1 and half a dozen of the other but I'm no firewall / security expert either.