Re: System i on the web (was RE: Fooling around with VRPG)

Hi Charles,

While exploits will always exist... they can also always be exploited, no matter which architecture you setup. Even with proxies, firewalls, dedicated devices... one finally needs access to the backend !

In that respect I feel myself more comfortable with an iSeries directly connected to the internet (and with direct I mean seperate NIC - so it can be disabled in case of a DDOS - linked to a DMZ to only allow port 80) where typical Wintel exploits don't make a single chance as opposed to having the webserver on such a Wintel box with all security consequences (ie. a required open access to the backend).

All this combined with proper security on iSeries is in my opinion more unbeatable than any other combination, however it is not the idea of auditors (which BTW can never backup their claims related to iSeries) so usually it's not the way it finally gets setup.

We have a secure system... why would we want to introduce a weak one ?

Kind regards,
Paul


----- Oorspronkelijk bericht -----
Van: Heinz.Sporn@xxxxxxxxxxxxxxx [mailto:Heinz.Sporn@xxxxxxxxxxxxxxx]
Verzonden: woensdag, november 7, 2007 03:46 PM
Aan: wdsci-l@xxxxxxxxxxxx
Onderwerp: Re: [WDSCI-L] System i on the web (was RE: Fooling around with VRPG)

Charles,

clearly "direct" wasn't meant in a technical sense. "Direct" was meant in a logical sense. Port 80 is reflected directly onto an iSeries that acts both as Web Server and mission critical system. If some intruder finds an exploit in your web application it will be used on the very same machine that hold sensible data. You do the math.

I am not getting the separate NIC / DMZ thing. Do you want the iSeries to be inside or outside a DMZ?

Proxy:

Www <--> FW <--> Proxy <--> Web Server <--> iSeries

Mit freundlichen Grüßen