2

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault).

We are creating a network architecture and have 2 webservers. One of the web servers has access to a very sensitive database (in the "database layer") with an entirely different risk assessment. On a scale of 1-10, this data is a 7. The other web server has meaningless data, a 2/10.

An associate of mine believes that because both are web servers, and because they both allow port 443,80, they should be placed in the same network. They believe that if we set a policy (web servers in insecure zone), all web servers that meet this "policy" should be placed in the same network. I don't agree with this approach. We have tons of address space so why not throw the meaningless web server and its database in a separate network? I understand it is important to define a model for your architecture, i.e. "insecure network","database layer", application layer". But I challenge that just because two servers are a web server, does not necessarily mean they should be in contact with each other. Sure we could implement host based firewall and clever routing, but WHY... I'm worried that if a breach does happen to the meaningless web server, the attacker could, theoretically, obtain access to the very sensitive web server.

I'm not looking for who is right, because I see both sides.

My question is that if two servers are running the same software (web server), should they be placed in the same network, given that they require access to information that is on different (for lack of a better term) threat levels?

Improve this question

2 Answers 2

Reset to default
2

Isolation is never bad. In a very generic overview sense, imagine a submarine. They are designed with the knowledge chances are stuff is gonna blow up in, on or near them. That is why they are compartmentalized allowing a ruptured hull to only floor 1/16 of the submarine. Not coincidentally, submarines are also pretty good at not sinking (and staying sunk).

Presumably your two web servers have different remote desktop (or telnet or SSH your choice) credentials and if they don't, that's already a major issue. Generally, a web server containing 7/10 level secret data (I am going to assume at least quite personal info if not financial or tax related or health info) the password for that machine might be much better thought out, for example, a 16 character crpyto-randomly generated password. At least that is what I might do. Alternatively, my 2/10 secrecy web server might have a easy to remember password cause well, we are humans and lazy. For example, maybe username is admin and password is adminCompanyNameSecret. Still not easy to guess, but much more predictable than a crypto-random password.

I hope you see where I am going here. Naturally as administrators, we will practice more relaxed security precautions on servers that are of a lower value target. The issue is as I am sure you know and realize, once an attacker can get on server A, getting to server B (secure server) on the same network will be much easier than getting into server B from off network.

Therefore there is nothing wrong with keeping both servers on the same network and as you said, it might make sense from an architecture standpoint, but if you do you must do the following:

Treat BOTH the 2/10 and 7/10 secrecy servers as if they were 7/10 secrecy servers. Ensure both are completely up to date on all OS updates, follow good practice with physical access and security, crypto-random passwords and unique usernames. Ensure only a limited few know the passwords etc. If you follow this, you are just as safe as you isolated the two servers. If you treat the 2/10 as a 2/10 secrecy server, you pretty much just degraded the value of the data in the other server to 2/10 as well.

Improve this answer
1
  • Thanks for the answer, and I like the analogy. If we have plenty of private address space, what is the advantage of keeping both servers (given that they are both 7/10 for argument sake) on the same network? What I'm saying is that it doesn't hurt, and actually easier to scale by separating them
    – pm1391
    Feb 2, 2018 at 22:30
0

I strongly suggest they should be separated. As they are two different web servers and serving different content, there are more possible places of vulnerabilities being introduced. Or perhaps the 'less important' web server is not patched/tested frequently as it's not holding any sensitive data anyway, then that is somewhere an attacker could pivot from to the sensitive server instead.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .