In addition to these great points, it might be possible to limit
access to the database by using the approach. In microsoftland, you
can use windows authentication or mixed mode on the sql server. You
could perhaps limit the windows authentication for the sql server
only from specific locations easier. In mixed mode, it means that
storage of your password for the sql database would not be on the
webserver. If it were compromised, the bad guys wouldn't know the
password or any of the sql queries used. On the down side, if they
found a hole in the first tier the app is still exploitable
potentially. Its not an unsound idea, but you would certainly need
to take adequate precautions at each level to make it useful.
On Jul 28, 2005, at 4:27 AM, Lyal Collins wrote:
I can offer a few thoughts, which may even be relevant.
The 3 physical tier approach means:
- web-app layer traffic can be firewalled into specific ports and thus
specific protocols
- web-app layer traffic can be "IPS'ed"
- there is potential for using different OSes in different layers
(I did
note you said this is an MS shop) to avoid the possible monoculture
problem
(e.g. certain attacks agains the OS may work effectivly at all 3
layers)
- in some IT shops, 3 tiers can improve access control and
segregation of
duties by separating the skills needed for each layer/technology
base into
discrete boxes. E.g. why would a DBA or programmer need access to
the layer
that stores SSL certs/private keys? Of course, if there is ony 1
person
doing all 3 functions, this is moot.
These may offer advantages in your environment - without knowing
the risk
environment/models to be protected against, it's hard to say.
Clearly document the pros and cons for internal decisions/approval
should
clearly articulate the benefits being sought, and set down a future
architectural direction/intention.
Lyal
Lucas Holt
Luke@FoolishGames.com
________________________________________________________
FoolishGames.com (Jewel Fan Site)
JustJournal.com (Free blogging)
FoolishGames.net (Enemy Territory IoM site)
Think PC.. in 2006 you can own an Apple PCintosh. Whats next, windows
works?
