Security

Ask something
Discussion Locked

Secure database / webserver relationship

0 helpful
10 replies

by e spigle 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We are in the process of converting a very old FoxPro system over to a MS SQL / VB system at the company I work at. We are already utilizing the SQL database to a good extent internally. It currently resides behind our firewall on our LAN and can only be accessed as such for internal usage. Part of our conversion process will bring some web applications online, however. This is where our dilemma enters in and we are trying to analyze the best solution to connect both our inside LAN users and web customers to the same database.

Currently our IIS 6.0 web server resides on a DMZ. We have a few more DMZs at our disposal. What would be the best way to let the web server access the database for the web applications? We have brewed up a couple of ideas, and would love to hear more / get input on what the best solution is. One idea is to have a replicated database out on another DMZ that the web server can access. This database would strictly be used for serving web applications and would be updated from our production database. The problem with this is we really don?t have the hardware resources or programming resources / time to make this happen (the latter per our programmers and the difficulty they say that will entail such a setup with replication). Another idea was to put our production database out on a DMZ for both our internal traffic and the web server to talk to. The big question here is?how secure can we make the database? I suppose there is also the option of just having the web server talk to the database server while it is inside our private LAN, but again?how secure can we make it?

I?m uncertain what all there is to consider, or what all there is for options. I would love to hear what options we have to look at that best weigh security AND making it not so difficult. Any help from here or pointing me to some good resources to research / study-up on this matter would help tremendously.

Thanks for any assistance!

E Spigle

10 replies

by sgt_shultz

i bet you could go a long way to safety maybe if you could get web server to talk to database server with some other protocol or topology. like use ipx/spx on private segment? sorry if this is way off...

by cg it

humm I wouldn't stick a database server on a DMZ anywhere or at anytime. Hackers dream is to find one out there unprotected.

SQL server is well documented on Microsofts site with a boat load of administration, configuration, security manuals/best practices.

I doubt you need programming or additional hardware support for SQL rather configuration support for secure database. visit http://support.microsoft.com/default.aspx?scid=kb;en-us;325757&Product=sql2k as a start for securing data exchanges on SQL

by cg it

the above link is just an example of securing data between client applications and the database server. There are other articles that deal with securing data between web sites and SQL as well. As with all microsoft product documentation, ya gotta wade through tons of articles [all pretty good] to get exactly what you want.

by e spigle

I think more than anything my question is to find out from a structural standpoint *where* to put the server. I want to figure out this step before we move on to securing the data connections as well as hardening the SQL Server and the OS it runs on. The reason I mentioned needing more hardware / programming resources was because of the idea to have a second replicated database of our live one--one that is stripped down, though--to serve as the database that provides for the web applications. The only problem is that we would have to buy some new hardware to accommodate this second database, and we really can't afford to do that right now (we're talking about another SAN that would cost us 5 figures that we can't really do right now). On top of that, it would be programmatically more complex because we would have to accommodate both the regular production database *AND* the replicated one.

Long story short is--I really first need to know where in the structure of LAN / our firewall / DMZs / etc. that this server should be placed. If some of these articles you mention on Microsoft?s site will cover that, then I'll be getting right on it. I bookmarked a number of URLs before I left work yesterday and I will begin crunching on them today.

I am curious about the whole DMZ deal, though. The proposed database DMZ would be a separate DMZ from our web server that does sit behind our firewall still. How would it be more vulnerable on a second DMZ that our web server doesn't sit on? We could easily secure the connection via the firewall from DMZ to DMZ. The only actual server that would be exposed to the Internet itself would be our web server. The reason we thought a DMZ for the database would be good is that it would break the database out of our LAN in the very small chance that someone did compromise it.

Your replies have helped, but haven't really answered what I need, yet.

by erikdr

We've been doing this for 5 years at our multinational with big e-commerce site, and have found only 2 valid models on the market and inside the company. (Both are being used, different ones in US and European site due to different B2B extras.). I'll translate them to the IIS-SQL situation.

Model A: HTTP in DMZ, ASP and SQL internally.

You _can_ put the primary IIS server in the DMZ, but don't have it run any more intelligent stuff like ASP.Net and ODBC itself. Put this in an IIS _application server_ farm in the same Intranet where the database servers also reside. The only protocol to open between both IIS servers is HTTP, and it can be monitored, intrusionchecked etc. (ODBC protocols can not and anything inside the DMZ can ultimately be hacked, so hence not using your proposed model of a full IIS machine in DMZ).

Model B: all logic in Intranet, reverse proxy in DMZ.
Put all IIS stuff in Intranet (behind the fwalls), and use a revproxy (e.g. MS ISA Server 2000/2004 in proxy mode) in the DMZ. Again, a lean and mean device in DMZ and only HTTP to the Intranet.

For more info about the list of pros and cons for models A/B, just yell...

HTH,

- The Netherlands

by ewgny

You should consider putting your web Server on your internal network, and using ISA Server to publish it. Set your ISA up on the perimeter of your internal network and your DMZ where your current web server resides. Redirect your incoming web traffic to the external NIC of the ISA. The ISA in return will handle and retrieve all web requests, without ever allowing a direct connect to your internal web server. This will achieve your objective of allowing access to your internal users as well as the public. Besides being a powerful firewall itself, The ISA server would also have the extra protection of your existing firewall.
It's actually fairly easy to setup
Visit
http://www.isaserver.org
and read about publishing web servers

by e spigle

We are actually going to give ISA server some serious consideration as we see some other opportunities for it to benefit us after looking over it's features. My big question, though--how secure is it? If we keep things like our email and web / application servers on our internal network, how much risk is there for that stuff to be comprimised if the ISA machine is comprimised? From a development and maintenance standpoint, keeping all of those servers on our internal network would be WORLDS easier to deal with. Security obviously becomes a major concern in the scenario, though. I would really like to find out more about ISA server, how secure it is in such a setup, and any other relevant details that will help us make our decision here.

by ewgny

It's very secure. According to Microsoft, there has never been an instance of a properly configured ISA Server ever being compromised. Add to that that you will have it behind another firewall, and you have a very secure solution. It should also be fairly easy to budget. I gave you the correct answer to your question,that solves all of your objectives yet you rejected my answer. I really wonder sometimes why I answer peoples questions.

by e spigle

Wow--easy there. I'm new to TechRepublic Q/A and am only seeking details... didn't realize something came of accepting an answer. I'll find the rest of the details for ISA Server elsewhere, though. Here is your Accepted if that's what you're after.

This discussion is closed to new replies.