Questions tagged [architecture]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
32 views

Do i place this service in the DMZ or datacentre(internal)?

I have setup a VM on our internal network and it is assigned an internal IP address. The VM requires connectivity to a couple of internet sites mainly Microsoft and ports are generally 80 and 443. ...
1
vote
1answer
70 views

Should IDM be private or exposed for app login?

In the diagram below, I have two options for authenticating into a protected resource. Both options use an Identity & Access Management (IDM) tool (in this case keycloak) to store credentials and ...
1
vote
0answers
55 views

Has hackers ever used a microarchitectural side channel to launch an attack?

I'm a student of computer architecture and I just got through a class on Hardware Security. We spent a considerable amount of time learning about microarchitectural side channels, reading papers on ...
0
votes
1answer
54 views

Vulnerability in which part of the Android architecture would allow an attacker to take control of the hardware [closed]

This question is intended for better understanding of security features of Android architecture. In particular, I want to know what part of the architecture needs to be secure to prevent an attacker ...
2
votes
1answer
422 views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
0
votes
0answers
28 views

Implications of querying OrientDB directly from front-end

Give that OrientDB exposes a REST HTTP API, and that it seems to have quite a few security features, what are the (especially security) implications of querying OrientDB directly from a front end web ...
1
vote
1answer
101 views

Safety difference between running on localhost versus the private internal ip address?

I am wondering if there is any additional security increase by choosing to run your webserver on an internal private ip address and port like xyz.ab.cd.efg:8080 versus localhost:8080 or 127.0.0.1:8080 ...
0
votes
0answers
40 views

How to perform encryption/decryption in a RESTful system? [duplicate]

I'm not a crypto/security expert and have designed an architecture for encryption/decryption. I'm not sure if its full proof and want to know what people use as industry standard? I'm trying to ...
1
vote
1answer
72 views

Is it acceptable to have SPA + API from security point of view?

We are building something like specific blogging social platform. Architecture was originally intended as to have: single page application: all gui, rendered in the browser on the client frontend: ...
0
votes
1answer
117 views

Exploiting a service on 32bit OS on a 64bit processor with ShellCode

Let's theoretically assume I have an overflow vulnerability on a certain service I want to exploit. The service reside in 32bit Operating System on a 64bit Processor. I'm attempting to wrap my head ...
2
votes
1answer
45 views

Implications re security practices of full account access granted to third parties

I'm working with a company (say, Acme) that does some ongoing data collection and processing for me. The data in question is private but not all that sensitive. Part of Acme's service has password-...
0
votes
1answer
214 views

Are SSH certificates more secure for service accounts?

I'm considering how to deploy a service that needs SSH access to many important boxes in my infrastructure. Rather than store a long-lived SSH private key in a key store that the service could request,...
1
vote
1answer
354 views

Should the Router or Firewall Come First?

Network scenario.... I have a typical enterprise network meaning ISP > Edge Router > Firewall|DMZ > Switch > LAN I know there are several debates about what device comes first, but ...
0
votes
1answer
274 views

API Key via Basic Auth: Send it as a username or as a password?

In APIs that authenticates with a single API key (eg a long random string) via Basic Auth, I have seen that most (eg Stripe, Unbounce) sends the API key as the username, leaving the password field ...
0
votes
1answer
40 views

Debating between architecture options for offline updating of Linux machines in a vertically segregated network

My coworker and I are discussing the pros/cons between two potential architecture options, and I would like to gather feedback on which option is better and why. First, a description of the ...
0
votes
1answer
41 views

a chain of 3 federated IdPs

My client has 5 different identity and access management solutions. Until now they have been asking each one of their suppliers to add 5 trusted parties to their IAM solution, implement different URLs ...
1
vote
0answers
78 views

Is there any advantage in using Google's IAM on Android?

We are building a few corporate apps for field workers / front office. In most cases each user will have their own device, but there are some shared devices (for example reception). The devices are ...
0
votes
1answer
621 views

Where precisely are client X509 certificates stored?

Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
3
votes
2answers
290 views

How does a security countermeasure failure impact a system?

In the context of safety-critical systems, such as transportation systems, it is important to verify if such systems meet/do not meet safety requirements. ISO26262 expresses these requirements as a ...
0
votes
2answers
66 views

OAuth 2.0, what should it be returned in the authorize endpoint if the client_id is wrong and no redirect_uri is passed

We have been working on a OAuth 2.0 IDP implementation, and during the implementation of the authorize endpoint, i couldnt find in the RFC 6749, what should happen if the client_id is not passed in ...
2
votes
3answers
2k views

2 vs 3 tier network architecture

I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
1
vote
1answer
209 views

Separation of devices for VPN / Firewall [closed]

Our company has two separate firewall devices from different vendors (Checkpoint / Cisco) for firewall and VPN access. We're currently evaluating the possibility of migrating to a newer, clustered ...
2
votes
1answer
94 views

Multi Factor and order of authentication [duplicate]

I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers. On major platforms(*), the end-user is: first prompted for credentials (username/...
-1
votes
1answer
78 views

what are steps to do in order to secure my appli web [closed]

I'm asked to secure an appli web and I don't know really which steps I can follow to secure my appli web.
0
votes
0answers
253 views

Pros and cons of extending L3 to the network edge (routed access layer)?

Scenario: Greenfield network rebuild for a SMB distributed over ~10 small campuses with 1 fairly large central campus spread over ~ 100 Miles. You have almost no Cap-ex budget restriction (within ...
1
vote
0answers
67 views

What would you do as first day of CSO or Head of CyberSecurity [closed]

I was asked this question at an interview today and was unable to give a structured answer since there is so many things a head of security can do. The additional info that I had were : - You can ...
0
votes
0answers
40 views

How could an account-based service trust a checksum provided by a client-side application whose code is open source?

Say for example that I was a digital video game provider, and my games were played via a virtual machine. Lets also say that the code for this virtual machine were open source, and that this VM was ...
2
votes
1answer
127 views

How can an old hardware lead to a security failure?

I am working on critical cyber physical systems, and my work and research lead me to some questions. In the following, I assume that the attacker is not able to change the hardware of your system and ...
-2
votes
1answer
93 views

If I put a variable in the private section of a class, will the variable have more protection againsted reverse engineering? [closed]

class LockdownUnlock{ private: /*snip*/ std::string rootCertificate; //Will this protect the data? /*snip*/ public: /*snip*/ }LDUnlock;
0
votes
1answer
1k views

Are there risks in not having a edge firewall? [duplicate]

I am currently working with a client that has all their external traffic going through the core switch and then is being passed to the router and back through the core switch and then to the rest of ...
3
votes
2answers
552 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
0
votes
1answer
441 views

Is INTEL-SA-00075 Detection and Mitigation Tool enough to mitigate IntelME attacks

Is that tool enough to mitigate/protect againts IntelME vulnerability? https://downloadcenter.intel.com/download/26755?v=t If it's not enough I more I can do to protect againts IntelME attacks ?
2
votes
1answer
462 views

Securing an HSM on the network [closed]

I've never had to place an HSM on a network before so I want to ask this question to get a consensus on best practice for this. The HSM will reside on an internal network which will look like this; ...
2
votes
2answers
2k views

DMZ layer for web server/presentation layer

I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
1
vote
1answer
237 views

My company is considering collapsing from multiple independent domains to one trust network

Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the ...
0
votes
2answers
422 views

Design and Security Architecture - where should IPS/IDS be placed?

I am a system architecture working on projects - mostly CDN related projects - and I am currently a bit confused about where the IPS/IDS should be placed. We have a NGINX-based webserver for the edge ...
0
votes
1answer
185 views

What are some possible ways of sending anonymous request to re-crawl to Google? [closed]

This is a proposed architecture for submitting anonymous request to re-crawl the web page to google bot. I tried to come up with the solution given below. The intention of posting it here is to know ...
3
votes
1answer
5k views

How does a smart card work? [closed]

My understanding of smart cards is that they are a complete system on a chip. I.E. they have a processor and memory and can perform calculations independent of the system that is communicating with ...
10
votes
2answers
9k views

CSRF in microservice architecture

What should be proper way to implement CSRF protection in microservice architecture? Where services are stateless. To put CSRF verification on system entry? e.g. Gateway With this option I can't ...
1
vote
2answers
153 views

single secure architecture solution for below 4 threats

An e-commerce website uses LAMP stack hosted on a single rack-mounted server located at a data center. On every transaction, credit card information is stored in the MySQL database at data center. ...
0
votes
1answer
52 views

Active directory based permissions SID, username or email?

My application has a table with the permissions to the screen it has. Which of the following should I use to store the permissions against: sid username email other It's in an internal enterprise
2
votes
1answer
266 views

Which tier to apply security

In my organization we have database as backend, application servers then web servers and then proxy servers. I know it is usually best to have security implemented closest as possible to the data and ...
5
votes
2answers
341 views

Do I need OAuth to pass an API key of a service (now it is passed via copy-paste)?

I have a web application, say http://web.app/. It is local for every given user and accessible without authorisation. It uses an API of a service https://service.app/. The user can log in to it and ...
2
votes
1answer
209 views

Is storing session data in the DMZ ok in an n-tier enterprise web application?

Say I have a standard multi-tier web application with web servers in the DMZ and multiple services only accessible from an authenticated web app. Also let's suppose the web app uses server-side ...
3
votes
1answer
727 views

Self signed SSL certificate in multiple devices - Is this secure enough?

We are trying to design a solution where we have several Smart devices and we can control every smart device from multiple phones. We will generate a Self-signed SSL Server Certificate and embed that ...
1
vote
1answer
66 views

Internet Access by server pattern

I'm trying to get the best picture for my infraestructure. I came across a business case where my app server (far beyond DMZ and protected by 3 levels of firewalls) needs to talk with other (external ...
10
votes
2answers
1k views

Does insert only db access offer any additional security

There are concerns that if our public facing web nodes are compromised, an attacker will gain access to all our data. It just so happens that data entered from outside users only needs to be ever ...
3
votes
1answer
125 views

What are the new risks of using hyperconvergent systems?

There is a trend called "hyperconvergence" where computation, storage and network are all in the same system. I think that this is a step back (everything again in the same machine, like old times) ...
0
votes
2answers
1k views

Msfvenom meterpreter android architectures

Is there any android architecture I can set my meterpreter reverse_http payload to that works on every android phone? Basically, when I don't set any architecture it defaults to dalvik but that ...
0
votes
1answer
1k views

Does stack (UNIX x86, x86-64, ARM) grow up or down, buffer overflow tutorials wrong explained?

when I read something about buffer overflows on the stack, the most or some tutorials show me examples about overwriting local variables (pointers) and then overwriting pointers in the global offset ...