Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin access) and update the milestones representing the percentage of the progress made. Whole tracking system is simple, built by a web company with PHP and some database system (not important to the issue) What we need, though, is to automate this process. We have software (based on SQL server) that allows us to extract needed information, repack it into any format and transmit it to that tracking site without the need of any user action.

Problem: Users often forget to update tracking system. Or do it with delays. They are overworked, truth be told, so we (IT) want to make their life easier

Solution: Automate this process using data from our internal system and update tracking in real time.



Them: Out of the question. ISO 27001. Not secure.

Me: Encrypted? Static IP? VPN?

Them: Out of the question. ISO 27001. Not secure.

Other REST?

Out of the question. ISO 27001. Not secure.

Then what?

Some code just for you. Or mabye secured FTP.


What we really need to do to RDP in to see what you have so we can see what we need to extract and how to transmit it.

Oh. Get back to you then.


Context: Webdev/host company in question says that no unencrypted and not by authorized personnel is permitted, as they need to secure shared servers. So they will not expose them to direct outside access.

Now the question is: what is going on? I'm literally feeling dumb from all the emails and apparently communicating in a language one of us does not understand. Am I really toooo stoopyd to even ask proper question?

EDIT: I'm starting to think I'm talking to exceptionally bad account manager with humanist arts degree... "I want to send you some stuff using soap or basic rest or something". "No, we cant give you access to our secure servers but we may allow you to push something basic to our system". Go figure...

  • ISO 27001 is not an answer to design questions.
    – schroeder
    Sep 29, 2015 at 17:06
  • I know. We're looking at rebuilding the whole tracking system and all other web devs say: SOAP? No problems, but static ip, VPN, so on. That i understand. We're using SOAP to do quite a lot of stuff with other suppliers of ours and it works well. Them? not so much... I guess I'm asking who's the stoopyd here, just to make sure. And I don;t think it's design question. More like technical.
    – AcePL
    Sep 29, 2015 at 17:13
  • Edited question a bit.
    – AcePL
    Sep 29, 2015 at 17:23
  • This doesn't sound like a technical problem, but a cultural one. Who's the "them" that offers up "ISO 27001" when you're trying to talk about solutions? Sep 29, 2015 at 17:37
  • I think they do not want to increase the attack surface for their application (and probably also reduce development time) by exposing a new service. So, idea would be that you export the data from your system and it is transported over a well understood secure channel (sftp) OR they connect to your system and pull in the data (which means they do not have to expose a new service but you will have to).
    – jhash
    Sep 29, 2015 at 21:32

1 Answer 1


Well, after several months of just repeating questions to get repeated answers we're moving to different provider. Suddenly REST, JSON and one IP only is secure enough for the other guy be simply ecstatic.

Thanks to all contributing in comments above - it's always good to know that there are people agreeing with you. And you still helped with asking same question in different, better way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .