Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [architecture]

The tag has no usage guidance.

-1
votes
1answer
49 views

what are steps to do in order to secure my appli web [closed]

I'm asked to secure an appli web and I don't know really which steps I can follow to secure my appli web.
0
votes
0answers
26 views

Pros and cons of extending L3 to the network edge (routed access layer)?

Scenario: Greenfield network rebuild for a SMB distributed over ~10 small campuses with 1 fairly large central campus spread over ~ 100 Miles. You have almost no Cap-ex budget restriction (within ...
1
vote
0answers
54 views

What would you do as first day of CSO or Head of CyberSecurity [closed]

I was asked this question at an interview today and was unable to give a structured answer since there is so many things a head of security can do. The additional info that I had were : - You can ...
0
votes
0answers
27 views

How could an account-based service trust a checksum provided by a client-side application whose code is open source?

Say for example that I was a digital video game provider, and my games were played via a virtual machine. Lets also say that the code for this virtual machine were open source, and that this VM was ...
2
votes
1answer
113 views

How can an old hardware lead to a security failure?

I am working on critical cyber physical systems, and my work and research lead me to some questions. In the following, I assume that the attacker is not able to change the hardware of your system and ...
-2
votes
1answer
78 views

If I put a variable in the private section of a class, will the variable have more protection againsted reverse engineering? [closed]

class LockdownUnlock{ private: /*snip*/ std::string rootCertificate; //Will this protect the data? /*snip*/ public: /*snip*/ }LDUnlock;
0
votes
1answer
634 views

Are there risks in not having a edge firewall? [duplicate]

I am currently working with a client that has all their external traffic going through the core switch and then is being passed to the router and back through the core switch and then to the rest of ...
3
votes
2answers
294 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
0
votes
1answer
226 views

Is INTEL-SA-00075 Detection and Mitigation Tool enough to mitigate IntelME attacks

Is that tool enough to mitigate/protect againts IntelME vulnerability? https://downloadcenter.intel.com/download/26755?v=t If it's not enough I more I can do to protect againts IntelME attacks ?
2
votes
1answer
279 views

Securing an HSM on the network [closed]

I've never had to place an HSM on a network before so I want to ask this question to get a consensus on best practice for this. The HSM will reside on an internal network which will look like this; ...
2
votes
2answers
643 views

DMZ layer for web server/presentation layer

I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
1
vote
1answer
182 views

My company is considering collapsing from multiple independent domains to one trust network

Currently, we have a number of domains for various purposes like back office, production, DMZ, partners, etc. There has been a change in management thinking to simplification. They want all the ...
0
votes
2answers
315 views

Design and Security Architecture - where should IPS/IDS be placed?

I am a system architecture working on projects - mostly CDN related projects - and I am currently a bit confused about where the IPS/IDS should be placed. We have a NGINX-based webserver for the edge ...
0
votes
1answer
167 views

What are some possible ways of sending anonymous request to re-crawl to Google? [closed]

This is a proposed architecture for submitting anonymous request to re-crawl the web page to google bot. I tried to come up with the solution given below. The intention of posting it here is to know ...
2
votes
1answer
3k views

How does a smart card work? [closed]

My understanding of smart cards is that they are a complete system on a chip. I.E. they have a processor and memory and can perform calculations independent of the system that is communicating with ...
6
votes
2answers
3k views

CSRF in microservice architecture

What should be proper way to implement CSRF protection in microservice architecture? Where services are stateless. To put CSRF verification on system entry? e.g. Gateway With this option I can't ...
1
vote
2answers
141 views

single secure architecture solution for below 4 threats

An e-commerce website uses LAMP stack hosted on a single rack-mounted server located at a data center. On every transaction, credit card information is stored in the MySQL database at data center. ...
0
votes
1answer
47 views

Active directory based permissions SID, username or email?

My application has a table with the permissions to the screen it has. Which of the following should I use to store the permissions against: sid username email other It's in an internal enterprise
2
votes
1answer
174 views

Which tier to apply security

In my organization we have database as backend, application servers then web servers and then proxy servers. I know it is usually best to have security implemented closest as possible to the data and ...
4
votes
2answers
274 views

Do I need OAuth to pass an API key of a service (now it is passed via copy-paste)?

I have a web application, say http://web.app/. It is local for every given user and accessible without authorisation. It uses an API of a service https://service.app/. The user can log in to it and ...
3
votes
1answer
136 views

Is storing session data in the DMZ ok in an n-tier enterprise web application?

Say I have a standard multi-tier web application with web servers in the DMZ and multiple services only accessible from an authenticated web app. Also let's suppose the web app uses server-side ...
3
votes
1answer
385 views

Self signed SSL certificate in multiple devices - Is this secure enough?

We are trying to design a solution where we have several Smart devices and we can control every smart device from multiple phones. We will generate a Self-signed SSL Server Certificate and embed that ...
1
vote
1answer
63 views

Internet Access by server pattern

I'm trying to get the best picture for my infraestructure. I came across a business case where my app server (far beyond DMZ and protected by 3 levels of firewalls) needs to talk with other (external ...
10
votes
2answers
1k views

Does insert only db access offer any additional security

There are concerns that if our public facing web nodes are compromised, an attacker will gain access to all our data. It just so happens that data entered from outside users only needs to be ever ...
3
votes
1answer
118 views

What are the new risks of using hyperconvergent systems?

There is a trend called "hyperconvergence" where computation, storage and network are all in the same system. I think that this is a step back (everything again in the same machine, like old times) ...
0
votes
2answers
782 views

Msfvenom meterpreter android architectures

Is there any android architecture I can set my meterpreter reverse_http payload to that works on every android phone? Basically, when I don't set any architecture it defaults to dalvik but that ...
0
votes
1answer
402 views

Does stack (UNIX x86, x86-64, ARM) grow up or down, buffer overflow tutorials wrong explained?

when I read something about buffer overflows on the stack, the most or some tutorials show me examples about overwriting local variables (pointers) and then overwriting pointers in the global offset ...
2
votes
1answer
131 views

How could I validate a security architecture? [closed]

Assume that I have identified certain vulnerabilities in a system and I have developed a security architecture to defend it. How could I properly validate my architecture (to prove that it does ...
9
votes
2answers
1k views

Is SWIFT (banking) Software Architecture Secure?

With all the news about hacking banks and stealing money from banks over SWIFT, while the vulnerabilities weren't directly related to SWIFT, some questions arise: Are software components of the ...
1
vote
1answer
107 views

Is there any architecture where the data storage is completely separate?

I want the hard disk where my data is stored to be secure from foreign external access. Is there a physical possibility to protect my hard disk or any kind of data storage, like a computer ...
2
votes
1answer
70 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
6
votes
2answers
1k views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
4
votes
3answers
4k views

Is web application connected to a database via an application server more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
0
votes
2answers
99 views

Modular security for a photography UAV?

Is modular security possible? In the context of an embedded device, is it possible to create an add-in module that will be responsible for both communications and security, with his role being ...
2
votes
1answer
126 views

Is it necessary to have security documentations, policies, DRP & BCP's at place in order to execute secure network architectural review?

One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables ...
1
vote
0answers
48 views

Authenticating requests across a two tier application architecture

Consider the following architecture: Users log into a website and issue commands to the website. In parallel, separate software processes ("agents") on different computers connect to the website ...
13
votes
2answers
989 views

Are there any architectures currently out there that use hardware-enforced process isolation? What would it take to add that to x86?

First-time asker/commenter, long-time reader. As someone who's currently doing a lot of thinking & writing about measures that might foundationally improve computer security (ie., involving not ...
2
votes
2answers
512 views

Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from ...
1
vote
0answers
114 views

Docker: Central daemon model is flawed?

I've read this article about CoreOS's new container runtime, rkt, and I'm curious about this section: Why not just fork Docker? From a security and composability perspective, the Docker ...
0
votes
2answers
51 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
0
votes
2answers
155 views

encryption protection against lost password

Here is a plan I am thinking about. I haven't seen this proposed, so I thought I would ask about it. Threat we are guarding against: A lost or stolen laptop leading to exposure of sensitive ...
2
votes
0answers
100 views

If someone hacks our server, how can we prevent them from decrypting data stored in Vault?

I have been tasked with evaluating Vault in our company and the first question asked by an architect was: If someone hacks our server, how can we prevent them from decrypting data stored in Vault? ...
1
vote
2answers
547 views

Separate web and app server windows authentication

I understand that separate web and app server can improve security. Your web server sits in a dmz and then there is firewall between it and the app server. We provide solutions to clients within an ...
1
vote
3answers
320 views

Is this approach to backups secure?

I've got an existing (personal) backup service which I'm rewriting from the ground up to be secure. At present, I just store files (and diffs) in AWS S3 with no encryption. It works fine but I'd like ...
1
vote
1answer
1k views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
8
votes
3answers
6k views

Secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces. One is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
5
votes
2answers
570 views

How should I document my Public Key Infrastructure?

I'm preparing to document a 3 tier PKI (with multiple second level policy CAs) and want to create a document that is useful, technical, and not too overwhelming to the non-PKI expert. I suppose the ...
0
votes
1answer
678 views

using temporary tokens for secure communication with IFRAME

I have questions about our application's security architecture: A critical piece that cannot save state but collects and displays sensitive information is served up in an IFRAME inside a more modern ...
0
votes
1answer
815 views

How to secure sensitive data in application with message queue

Currently we are creating one small service, where we are using some sensitive data from users(not worth zillions but to me it is like password). The idea is that application itself only inserts this ...
61
votes
9answers
11k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...