1

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server.

We provide solutions to clients within an intranet using windows authentication. Our clients normal have 100s of users and the information is sensitive but not critically important I.e. Personal or business info but not credit card numbers. We have a separate web (asp.net) and app server I am just wondering if in security terms if this really adds much since there is no dmz and both boxes exist on the same domain in order to use windows authentication and impersonation.

I am tempted to merge the app and web server for reasons of simplicity, removing delegation issues, cost and scalability.

Really my question is in the scenario above does having a separate web and app server really improve security by a large amount?

Improve this question

2 Answers 2

Reset to default
1

The security of a server is limited by the security of the "weakest" accessible service.

Additionally, if any service on the server is compromised, an attacker will likely be able to compromise the whole box, meaning that all services on the box will be compromised.

Segregation of services to different server means that you are not putting "all your eggs in one basket".

Having the application server on a different, back-end server, makes it much harder for an internet based attacker to gain access, as they have to compromise the front-end web server first. However, without knowing full details of the system it is difficult to judge this - it will be up to you to assess the risks and determine whether this separation is worth it. If the cost to secure it is higher than the cost of breaches, then it is not.

Improve this answer
3
  • Hi I was intending to merge the code so the layers in the app server would sit in the web site (as oppose to an app server), so there are no extra services exposed on the web server.
    – Jake
    Commented May 18, 2015 at 8:54
  • @Jake: Basically the same applies - any security holes on either piece of code could, potentially, allow compromise. More code = more chance of bugs.
    – SilverlightFox
    Commented May 18, 2015 at 8:56
  • 1
    Thank you for your help. I will have a think about it. I think because there is no DMZ in the scenario a lot of the benefits of separate the web and app server are lost but clearly (as you point out) not all.
    – Jake
    Commented May 18, 2015 at 10:33
0

Really my question is in the scenario above does having a separate web and app server really improve security by a large amount?

Short answer is no.

The long answer is... well, maybe

Your clients internal network infrastructures may vary greatly. (flat network, segmented network, etc) You'll also find that while most people can agree on what is considered acceptable risk to an internet facing machine doesn't typically apply when discussing the internal network.

Believe me when I say that I am an advocate for N-Tiered architecture, but in this situation it sounds like it may not be a good fit.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .