Tag Info

New answers tagged

1

@Craig...good practical sensible answer. Since bruce_bana said that cost shouldn't be an issue than this should be realistic to implement after using @DerekM answer (which is also good) to convince the alleged security experts. @DTK...good business CYA answer. This one I would definitely implement If i was bruce_bana. @bruce bana...try this link from this ...


0

Just an interjection from someone who has been living with this type of attack for quite a while now. Don't forget computers aren't the only devices with ROM/firmware! My prior generation Netgear firewall/router had it's firmware overwritten. Expensive mistake after a couple of new builds. Also the kit I was attacked with immediately disallowed BIOS reflash ...


0

Tell your direct manager that you are not authorized to accept that risk on behalf of the company. Point out that the value of the data in the database is $xxx and that that level of risk acceptance must come from someone authorized to do so, and ask him to champion getting a member of executive management to sign-off on the risk acceptance. To estimate ...


1

One good argument is that the bar really isn't that high to separate the web servers and database servers into separate DMZ's. Use a real router/firewall, and put the web servers and database servers on separate VLANs, both of them outside the internal secure LAN, with firewall rules controlling access to the bare minimum required ports from the Internet to ...


9

If you are suggesting that the database server gets moved from being in the same security zone as the web server to being in the same security zone as some internal systems, then one could reasonably conclude that you are reducing security. If status quo is that web server and database server are both in the DMZ, and no connections are permitted from DMZ to ...


23

SANS' "Making Your Network Safe for Databases" (http://www.sans.org/reading-room/whitepapers/application/making-network-safe-databases-24) reads a little dated in some sections, but provides a decent "for dummies" level of guidance in the direction you're after. You could also exhaust yourself poking through the US NIST's resource centre ...


4

Assuming you are attempting to persuade them to do it rather than (necessarily) convince them it is correct: Explain that when their large customers and prospects come to do a security audit they will fail. If the obstacle is the business then that will be the only sufficient, and only necessary, reason.


14

If the database holds card details, it can be very easily argued that you aren't fulfilling the PCI DSS requirement on appropriate protection. It also fails the sanity checks on single points of failure, and protecting your core assets. If the data is worth billions, why would you not spend a few thousand more to add layers of protection? Industry good ...


5

AvID has already covered the main question, but coming at this from a slightly different angle most firewalls will support multiple interfaces and can provide control of traffic between the interfaces. Configuring the multiple interfaces to host each of the aspects of the solution (frontend, middleware, backend) would reduce the risk of onward compromise of ...


33

It's like, "Put the jewelry box outside the house so that robbers won't bother getting in for the TV?" Yes, it is exactly like that. If you don't care about the value of the database, relatively speaking, then sure it makes sense to leave it outside - if the assumption is that the application is horridly insecure, but you need to put it up anyway ...


3

Most malware depends on both knowledge of the operating system and the (hardware) instruction set. That is, most malware is written for a particular class of hardware running a particular operating system. The instruction set of a typical mainframe, e.g. IBM zSeries, is quite different from the Intel x86 instruction set. Although mainframes can and do run ...



Top 50 recent answers are included