Security Management Strategies for the CIOAccess "Web-based application infrastructure: Extended connectivity means more risk"
This article is part of the January 2003 issue of Negative exposure: Web scanners reveal unknown holes
Typical Web-based application infrastructures (see Figure 1) are segmented based on user trust levels. They contain firewalls to restrict traffic flow to authorized services. External traffic is allowed only to the Web server on ports 80 (HTTP) and 443 (SSL). An IDS monitors traffic for anomalies. All operating systems are hardened. The Web server is secured. An external scan of this IP space would reveal no vulnerabilities. However, add an e-business application on top of this infrastructure, and, by design, Internet users' connectivity is extended enormously. Customers can place their own orders in the organization's processing system, automatically triggering associated events in areas such as billing, the supply chain and the manufacturing line. To make this happen, the application layer allows users to indirectly interact with the Web server, the database server, the SMTP server and the application server. This extended connectivity to an organization's assets brings a whole new set of risks. A failure in the application-layer controls could give ... Access >>>
Access TechTarget
Premium Content for Free.
What's Inside
Features
-
-
Web application security scanners: How effective are they?
by Kelly White & Yong-Gon Chon
How good are Web application scanners at rooting out vulnerabilities? We test two of the leading tools head-to-head to find out.
-
Software code review: Code testing to identify vulnerabilities
New tools ease the burden of building secure code.
-
The declining need of accelerator cards
Cheap, more efficient general-purpose chips are reducing the need for accelerator cards.
-
IT security supports increased federal cybersecurity law, survey finds
by Andrew Briney
IT security supports increased federal cybersecurity law, according to an Information Security survey.
-
Security liability: Who's to blame for a data security breach?
Who's responsible for security breaches? Short answer: everyone.
-
Web application security scanners: How effective are they?
by Kelly White & Yong-Gon Chon
-
-
Web-based application infrastructure: Extended connectivity means more risk
Do you know how Web-based application infrastructures are built and used? Learn how in this story.
-
Understanding encryption and cryptography basics
Cryptography doesn't have to be so cryptic. Here's a primer, in plain English, to walk you through the basics.
-
Product review: ForeScout Technologies's ActiveScout 2.5
ForeScout Technologies's ActiveScout 2.5 stops malicious traffic outside the network perimeter, but only under certain conditions.
-
More cybersecurity laws needed for operational IT security
by Andrew Briney
The U.S. has already adopted several cybersecurity laws, but few affect operational IT security.
-
Information security laws: Are they worth it for your organization?
by Andrew Briney
Who wants the government's help? Who wants to be left alone? Are information security laws worth it for your organization?
-
Web-based application infrastructure: Extended connectivity means more risk
-
Columns
-
Defining IT security resolutions
by Andrew Briney
Editor-in-chief Andrew Briney offers five IT security resolutions for the New Year that he hopes the industry takes to heart.
-
Examining infosec hackers of the past and how they affect cybersecurity laws
Learn about hackers who have been caught in the past and how it effects IT.
-
How to harden Windows to improve security
How to harden a Windows box to improve security without impairing functionality.
-
Using routers to improve network firewall security
As businesses expose systems to the Internet, it's important to revisit how routers can act as the "suspenders" to the firewall "belt."
-
Taking action: Understanding the importance of information security
by Jay Heiser, Contributor
The British have a marvelous word, "whinging"--the practice of complaining without doing anything about it. Security practitioners love to "whinge."
-
Understanding the balance between privacy and security
Cooperation, compromise is needed to resolve the growing tension between security and privacy.
-
Defining IT security resolutions
by Andrew Briney
More Premium Content Accessible For Free
Unlock new pathways to network security architecture
E-Zine
Network security architecture is showing its age at many organizations. With new technology, different data types, and use of multi-generations of ...
Emerging threat detection techniques and products
E-Handbook
Advanced persistent threat (APT) has been a used and abused term in the security industry, but security experts say targeted attacks are a growing ...
The rapid evolution of MDM solutions
E-Zine
Mobile device management (MDM) continues to grow at a feverish pace, both in terms of adoption and mobile security features. BYOD policies, and the ...