We're trying to determine if pushing data through a firewall is more safe than pulling it. The data will be from SSIS to SSIS through the firewall. An advisor here has suggested that pushing the data through the firewall is safer than allowing an external connection in to pull the data out.

Is this so ?


Allowing an inbound connection means opening up a port on your firewall and having a network service listening on that port 24/7 and that creates risk. If you are the client, you reach out to a remote network listener and pull the data back. You don't have that 24/7 risk.

There are some things you can do to lower the risk like IP-whitelisting and monitoring, but it doesn't reduce the risk to zero.

In general, I advise people to make the higher security zone the client. If one side of the connection is more sensitive to you, pull from there. Increase the risk in the zone that's less valuable.

| improve this answer | |
  • Thanks - that seems to be a good answer - push it is I think ... – bhs Jul 23 '13 at 17:58

Theoretically an inbound connection can be considered just as safe as an outbound one -- you can limit the conditions in which inbound connections can be made; trusted source, trusted conditions, etc.

But typically inbound connections are significantly less restricted than outbound ones. Outbound connections happen only when you want them to, to destinations you intend for purposes you know. Inbound connections, unless properly restricted, could be from anyone for any reason.

By and large, attackers come in on inbound connections rather than outbound ones.

| improve this answer | |
  • More particularly, new attacks come in on inbound connections. If an attacker is using an outbound connection, you're already pwned. – Iszi Jul 23 '13 at 17:58

Safer to whom?

In a TCP connection one of the two parties needs to open a set of ports and leave it open for others to connect to. In your situation it sounds like you're trying to determine who has the risk of hosting the server. (you vs them)

I would say leave the server hosted at whomever has the most experience in managing servers.

Hosting a server (HTTP, FTP or anything else) requires patching, and verifying the username/password. If you're a large site, protection from DDoS attacks is important and this adds to the responsibility of whomever hosts the server.

If there happens to be a bug in the server software, then you open up your internal network to hackers, and so this server should be placed in a DMZ. (note: That doesn't mean server-less network isn't immune to hackers, it just limits the ways they can get in.)

| improve this answer | |
  • What I'm trying to determine is if pushing data out of a firewall is safer. Safer for us but the inference from this guy is that an attacker on the other side of the firewall then wouldn't be able to gain access to the server sat within the firewall as the rule on the firewall wouldn't allow traffic in, only out. Does this make it clearer ? – bhs Jul 23 '13 at 11:37
  • We have a terminology mismatch, how does a SSIS push/pull work at a TCP level. Generally speaking how do you push data over TCP? I don't know you, but someone has to be a "listener" If you're pulling, they are the server. If they are pulling, then you are the server. – goodguys_activate Jul 23 '13 at 12:29
  • Thanks for the clarification. So I guess the question would be if you are an attacker sat on the other side of a firewall and I am within the firewall am I better being a server or not ? From the perspective of the attacker. – bhs Jul 23 '13 at 13:03
  • I think we're all confused, or perhaps I'm more confused than anyone else here. Both "push" and "pull", each implying that the local system is the one initiating data transfer, will be seen as an outbound connection. The only times you have an inbound connection is if your system is listening for incoming pushes or pulls (e.g. the local system is passively receiving data, or serving data in responses to remote requests) from another system. – Iszi Jul 23 '13 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.