Network question

By seperating your servers, you then gain the ability to secure each machine so that it only has to do 1 function.

The more things you put on a server, the harder it becomes to secure it.

As a hacker, if I am port scanning and I see sql services and web services on the same machine. I can usually bet that the machine is not secured and I can attack it with ease. It also helps me in knowing what type of machine I am dealing with.

But if my port scan returns only port 80 with no headerinformation, then I probably would not waste my time trying to attack it.

The point of security is not to make your machine hack proof. There are no machines that are 100% hack proof (- the ones not connected to the net).

The goal is to make your machine less desirable for attack. If I really want to attack and break into your machine, given enough time, I will.

The best books to read on this subject is the Hacking Exposed series.

With regards to your db. At no time should anything other then a web server be talking directly to your db server. For hackers with criminal intent, a db server is where they want to be. That's where the juicy info is.

Obviously, with Small Business Server and personal web server the Microsoft way supports all in one, but for both security and and having everything down at once in the event something goes awry I like to keep 'em seperated.

ever never ever never never have multiple critical servers on a single machine..

DB
App
Web...ALWAYS (with no exception) separate them!

There was a time when I was more or less forced to go against this now hard earned wisdom, because despite the fact that we are the IT professionals of our respective companies -- if our CEOs want something a certain way, and they sign our checks, we sometimes have no choice.

Trust me its no fun managing security or diagnosing problems (or ensuring performance or predicting uptime, etc.) when you have multiple services a machine.

Its been a little while now since I finally convinced the company of the silliness of not have separate servers for designated tasks...now DB, APP, FILE, WEB, MAIL -- they all are separate and distinct.

Havin all that stuff on one vlan / lan is more like 'putting all your eggs in one basket'.

Imagine a security break into your network and there sits all servers that matter most in the open??????/