RE: iSeries vs. Unix vs. SQL Server vs. Oracle & Security/Dataseparation???

["Nathan M. Andelin" <nandelin@xxxxxxxxxxxxxxxxxxx>]

> We use W2K for web serving with a socket connection
> to our AS400 to process request for data.

Is the W2K server a weak link in the chain of servers separating your AS/400
from the Internet?  What if the W2K server were compromized?  Would
replacing the W2K server with an additional firewall offer more secure
separation?

> We opened the one port from the DMZ to the internal LAN
> from the web severs to the AS400's only.

Is that any more secure than opening only one port from a firewall to the
OS/400 HTTP Server?

> The listening socket server on the AS400 looks at the first
> few bytes of the request, request identifier, and spawns off
> the correct program to handle the request.

Is a proprietary protocol any more secure than the HTTP protocol?

> The spawned off job is a PJ waiting for action.  Very FAST
> and not a whole lot of CPU on the AS400 side.

Wouldn't performance depend on the number of concurrent requests hitting the
server at the same time?  Or did you write your own multi threaded socket
server?

> I think it is very secure.

I think so too.  But I'm not sure that its any more secure than connecting
to the OS/400 HTTP Server from a firewall.

> You would have to know what the PC program is
> and how to format the request to hack into the AS400.

Since a URL on the W2K server maps to the PC program, it seems to me that
identifying the PC program is irrelevant.  The URL is known.

By using a "session" component on the AS/400, an HTTP request may have
essentially no format too.  Same principle.  Don't disclose the program
interface to the end user.

> If you try a buffer attack on the AS400, well the server program
> is designed to shut down and re-submit itself via *PSSR.

Sounds like a buffer overflow would be an effective denial of service
attack, as well as a way of overloading the AS/400 - disrupting other AS/400
workload.

I'd just like to dispell the idea that front-ending an AS/400 with an W2K
IIS server offers any advantage, particularly where security is concerned.

Nathan M. Andelin
www.relational-data.com