Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be regularly executed which looks for new orders. Each of this order is checked against a list of criteria, if it passes the test, the ordered product keys will get delivered via E-Mail immediately and automatically, without human interaction.

If there is an exploit in PrestaShop and an attacker gains access to the administration or database, all product information is exposed, which could mean a total loss of all product licenses meant to be sold (along with the possible theft of customer information).

Could I restrict possible damage in case of intrusion in the shop system by storing the product keys including the automation script on another server with another database? So, the script on the other server is frequently querying the shop for new orders and sends out the product information stored on its own database on its own server via E-Mail to the customer. The shop system is unaware of the license keys all the time. Also, possible intruders could not discover the other server (except they gain access to webserver access logs).

By the way: An HTTPS connection between the servers can be regarded as obligatory in this case, right? Because sensible information may be transferred.

share|improve this question
    
Please note that I do not intend to ask something specific to the e-commerce solution used but rather the general problem situation itself. –  Shrooms Dec 19 '13 at 19:26
add comment

1 Answer

up vote 3 down vote accepted

I guess your question is more a case of seeking confirmation that your proposed solution (see quote below) is the best or only option.

Could I restrict possible damage in case of intrusion in the shop system by storing the product keys including the automation script on another server with another database?

If that's your question the answer would be: yes.

The second server holding all your assets should not allow inbound traffic, only outbound. This way there is only traffic originating from a secure zone to a untrusted zone and not the other way around.

If you look at the picture on the Dutch NORA Zonering webpage. Your customer would be in the "white" zone, your shop in the "green" dmz zone, your second server in the "yellow" zone and your assets (DB) in the "red" zone. All communication is filtered. Only the yellow zone has access to green (cron), red (DB) and white (e-mail to customer). Google translate does a decent translation by the way.

In your case you may put your assets in the yellow zone as well, if there is no direct access from the white or green zone. You might even use a workstation as these normally only are allowed outbound traffic. But when using for normal web browsing as well so called drive-by-malware would be an issue.

In general from most to least secure traffic:

  • no communication;
  • only outbound or originating from the inside (that's what you propose);
  • inbound allowed via a semi-secure zone which filters;
  • inbound and unfiltered.

Another relevant source: Public DMZ network architecture

share|improve this answer
    
Yes, you are right that I in some way seek confirmation my idea is a good option (but also if there is a better way). As an apprentice for software engineering this is a problem I never faced before or even knew how to call it. Thank you very much for the link, that definitely helps me, not just in this matter. –  Shrooms Dec 20 '13 at 5:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.