|
| Inicio → WEBDEV 2024 → Securing a Webdev Dynamic Site that accesses internal Production Servers |
| Securing a Webdev Dynamic Site that accesses internal Production Servers |
| Iniciado por Gautam, jul., 17 2013 9:23 AM - 3 respostas |
| |
| | | |
|
| |
Membro registado
67 mensagems |
|
Publicado em julho, 17 2013 - 9:23 AM |
Hello friends
I'm working on an external public facing web application (in DMZ) that needs to get data from our internal production database.
The website also makes API calls to a second internal production server for validating accounts etc.
How do we secure such a site? For example at the moment IIS and the webdev application server are on a server in the DMZ and so is the webdev application itself. The network guys don't like this arrangement and say this would expose the internal production servers to external risks.
I don't have much knowledge on network security and I am looking for suggestions/ideas on how best to secure such a web application. Unfortunately, the webdev manuals/on-line help does not have much content regarding securing web applications.
Any help/ideas/comments would be welcome.
GautamMensagem modificada, julho, 17 2013 - 9:23 AM |
| |
| |
| | | |
|
| | |
| |
Publicado em julho, 17 2013 - 2:46 PM |
Hi Gautam
First, you should ask the network guys exactly what they are afraid to
expose...
The IIS Server HAS to be accessible from the outside, so has the webdev
server... Without that, there is NO web site...
But, you do NOT need to have the DB on this server... Any other server
of your network (invisible from the outside) can do...
On top of that, if yo are using a HF C/S DB, there is nearly nobody out
there who know anything about it, which increase security... Also,
make sure that your DB is fully password protected and that each file is
encrypted.
On top of that, by using webdev, you are making sure that script
injection is nearly impossible... Even if somebody would gain access to
your web server, they could not modify your pages... They do NOT exist.
They are generated on the fly by the webdev engine, based on the webdev
pages (themselves encrypted, and with a proprietary format known only by
pcsoft)....
So to finish, you should ask the network guys exactly what they are
afraid to expose...
Best regards
--
Fabrice Harari
International WinDev, WebDev and WinDev mobile Consulting
More information on http://www.fabriceharari.com
On 7/17/2013 1:23 AM, Gautam wrote:
Hello friends
I'm working on an external public facing web application (in DMZ) that
needs to get data from our internal production database. The website
also makes API calls to a second internal production server for
validating accounts etc.
How do we secure such a site? For example at the moment IIS and the
webdev application server are on a server in the DMZ and so is the
webdev application itself. The network guys don't like this arrangement
and say this would expose the internal production servers to external
risks.
I don't have much knowledge on network security and I am looking for
suggestions/ideas on how best to secure such a web application.
Unfortunately, the webdev manuals/on-line help does not have much
content regarding securing web applications.
Any help/ideas/comments would be welcome.
Gautam |
| |
| |
| | | |
|
| | |
| |
Membro registado
67 mensagems |
|
Publicado em julho, 17 2013 - 6:15 PM |
Hi Fabrice
Thank you for your response. Your response is very well formed and clear. I have taken a printout of this to show my Network guys. As you rightly pointed out, my DB is actually on a separate server that only the webdev server can access (no access possible from outside). The Db is also password protected and the files are encrypted. So this part is fine.
Their main concern is the calls that are made to the Internal production servers via the API. The network guys are not happy that the site which is hosted on the IIS (exposed to the public) is accessing internal production servers via an API because the calls are being made from the DMZ.
They want a scenario where the IIS is in the DMZ and the application server is within the secure local network and comms between the two taking place via an open port. I personally could not make sense of this.
Would it be possible to have the IIS/Webdev app server in the DMZ and the actual site files on a server that is in the internal network? Would this be any more secure than having the site files also hosted on the same server as IIS?
Thanks and regards
Gautam |
| |
| |
| | | |
|
| | |
| |
Publicado em julho, 18 2013 - 2:26 PM |
Hi Gautam
They want a scenario where the IIS is in the DMZ and the application
server is within the secure local network and comms between the two
taking place via an open port.
Me neither... WHAT application server are we talking about? Webdev? it
has to be with IIS, its the web site, for god sakes!... The webdev site?
it's fully encrypted and pages are generated on the fly...
Now if as you say "Their main concern is the calls that are made to the
Internal production servers via the API. " then you can change THIS
part of the system... My understanding is that this API is NOT
protected/encrypted, which causes the vulnerability, if somebody is able
to access the DMZ... So if I'm right about that, you can:
- write a windev service and install it on the production server
(protected)... This windev service is in charge of calling the API
- from your webdev app, call the windev web service (of course, you make
sure that this communication is fully encrypted) instead of the API
At that point, what will you have:
- IIS, webdev and the webdev site on the DMZ: IIS, you cannot do
anything about. Webdev and its site are encrypted, proprietary and
basically immune to any other attack than brute force (somebody who
gains access to the server can delete the files, but that's about it
- Your DB on a protected server, with encrypted access to it (make sure
that you have also checked the "encrypted communication" checkbox for
your DB
- Your internal API/Production server on a protected machine
- the service allowing you access to this API on the same protected
machine, with communications between it your site fully encrypted
If they still have a problem with that, they will have to explain IN
DETAILS where the problem is, because I don't see it
Best regards
--
Fabrice Harari
International WinDev, WebDev and WinDev mobile Consulting
More information on http://www.fabriceharari.com
Contact me at:
Email: fabrice@fabriceharari.com
Skype ID: fabriceharari
Tel # in the USA: +1 985 746 1422
Tel # in France: +33 970 444 445 (local number 0970 444 445)
I personally could not make sense of this.
Would it be possible to have the IIS/Webdev app server in the DMZ and
the actual site files on a server that is in the internal network?
Would this be any more secure than having the site files also hosted on
the same server as IIS?
Thanks and regards
Gautam |
| |
| |
| | | |
|
| | | | |
| | |
|