Re: Three Physical Tiers in the Name of Security?

[Lucas Holt <luke () foolishgames com>]

In addition to these great points, it might be possible to limit  
access to the database by using the approach.  In microsoftland, you  
can use windows authentication or mixed mode on the sql server.  You  
could perhaps limit the windows authentication for the sql server  
only from specific locations easier.  In mixed mode, it means that  
storage of your password for the sql database would not be on the  
webserver.  If it were compromised, the bad guys wouldn't know the  
password or any of the sql queries used.  On the down side, if they  
found a hole in the first tier the app is still exploitable  
potentially.  Its not an unsound idea, but you would certainly need  
to take adequate precautions at each level to make it useful.

On Jul 28, 2005, at 4:27 AM, Lyal Collins wrote:

> I can offer a few thoughts, which may even be relevant.
> The 3 physical tier approach means:
> - web-app layer traffic can be firewalled into specific ports and thus
> specific protocols
> - web-app layer traffic can be "IPS'ed"
> - there is potential for using different OSes in different layers  
> (I did
> note you said this is an MS shop) to avoid the possible monoculture  
> problem
> (e.g. certain attacks agains the OS may work effectivly at all 3  
> layers)
> - in some IT shops, 3 tiers can improve access control and  
> segregation of
> duties by separating the skills needed for each layer/technology  
> base into
> discrete boxes. E.g. why would a DBA or programmer need access to  
> the layer
> that stores SSL certs/private keys?  Of course, if there is ony 1  
> person
> doing all 3 functions, this is moot.
>
> These may offer advantages in your environment - without knowing  
> the risk
> environment/models to be protected against, it's hard to say.
>
> Clearly document the pros and cons for internal decisions/approval  
> should
> clearly articulate the benefits being sought, and set down a future
> architectural direction/intention.
>
> Lyal


Lucas Holt
Luke () FoolishGames com
________________________________________________________
FoolishGames.com  (Jewel Fan Site)
JustJournal.com (Free blogging)
FoolishGames.net (Enemy Territory IoM site)

Think PC.. in 2006 you can own an Apple PCintosh. Whats next, windows  
works?