2

Possibly basic question from a developer, not a security expert.

AFAIK, a very common setup for web sites is to have 1 or more web servers behind a firewall and load balancer, with the web servers sending requests to a database server via an internal network (not accessible from the outside world).

I have now been told by a security consultant that this is not secure, because if a hacker gains access to a web server, they could then somehow send requests to the database server.

They recommend having an additional server between the web servers and the database server, where the web servers send requests to the additional server, which are then passed on to the database server. The database server would only take requests from the additional server, not from the web servers.

I'm a bit confused why this additional server is needed to make the system secure. Seeing that the web servers need to access the database to serve HTTP requests, how does having the additional server make a difference?

Improve this question
2
  • 2
    "told by a security consultant that this is not secure" - I know that you have probably paraphrased or condensed what the consultant said, but the devil is in the details. This advice seems ... strange. You end up with a neverending string of servers protecting each other. Why is the current set up not sufficient to accomplish the prevent the risk?
    – schroeder ♦
    Nov 14, 2019 at 9:27
  • 1
    Why is the database server in the internal network? If the end goal is that it only speaks to the web servers, why is it in the corporate network?
    – schroeder ♦
    Nov 14, 2019 at 9:32

1 Answer 1

Reset to default
2

This sounds a bit like "Turtles all the way down". I think it depends on how you tier your application and webservers and how your application is designed. In most environments I've seen there are multiple tiers (which are segregated by eachother):

  • Loadbalancer
  • Web tier (generally manages SSL/TLS and static content as well as caching)
  • Application tier (this runs your dynamic content)
  • Database tier (generally sits in an isolated database segment)

This is a common architecture. My assumption is that he's thinking if your web-tier (closest to the internet) is compromised that you wouldn't be able to directly compromise the database as there is an app-tier in between.

The reason some consultants assume this is correct is because there might be different technologies used. For instance your web server maybe running on Apache Webserver but your app-tier may be on SpringBoot.

It is a similar story where people tell you to get two brands of firewalls after eachother, just in case one gets compromised.

Is it a good pattern? It is. is it fool proof? Probably not. I think it's something you can consider, but review whether it makes sense financially to add these tiers versus the risk you are running. Depending on the nature of the data and the cost involved re-engineering you may choose not to follow his advice.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .