Timeline for How do you explain to experts that a database server should not reside in the DMZ?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 27, 2014 at 22:27 | comment | added | bruce bana | Yeah. The two-factor authentication makes the web application very secure. However, the hardware configuration compromises this security measure. Got a large steel gate and guards at the front, then just have a picket fence at the back. | |
| Nov 27, 2014 at 16:39 | comment | added | R15 | I wonder whether the strong authentication is a factor in their thinking...to take the analogy one step further, perhaps they consider the strong authentication to be akin to a guarded perimeter with a mantrap access gate (so in theory only people we trust not to take the jewellery box can get in the garden). Doesn't stop someone jumping over the fence when the guards aren't looking though. | |
| Nov 27, 2014 at 15:18 | comment | added | bruce bana | Nobody really knows how to be lonely until they are surrounded by idiots. sigh | |
| Nov 27, 2014 at 13:48 | comment | added | AviD♦ | Though in that case the better solution would be to leave out a plate of cookies, but I think at that point the analogy starts breaking down.... | |
| Nov 27, 2014 at 13:47 | comment | added | AviD♦ | Hmm... perhaps you should adjust your analogy "Leave the jewelry box outside the house so the robbers don't make a mess in the kitchen when they make a sandwich because they got hungry while doing all the robbing." | |
| Nov 27, 2014 at 13:02 | comment | added | bruce bana | By the way, to give context, the business requires the web application two-factor authentication through password authentication and token key generator... that's how sensitive the data are. So I'm really scratching my head on this one. | |
| Nov 27, 2014 at 12:10 | comment | added | bruce bana | Problem is I'm part of the team that is developing the web application. If information is leaked, it's quite easy to point at the application as the culprit when everything is in the DMZ. We're talking about billions of dollars here... not just petty cash. From my point of view, it's #1. That's why it's frustrating and would really want to kindly educate them without being arrogant. Besides, if port and IP addresses are filtered then the only way to have access to the DB is through DB calls... can someone really use SQL scripts to run a terminal and gain access to other internal systems? | |
| Nov 27, 2014 at 11:40 | history | answered | AviD♦ | CC BY-SA 3.0 |