Re: More on iSeries web apps and security

["Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>]

One advantage of the separation is that it _forces_ you to treat the
different parts of the application as truly separate. If the web app is
on one machine and the DB on another it's really hard to directly read
the DB from the web layer "just this one time."

In all honesty I don't see a reason to separate the app-server and DB
layer if you've got the machine to handle the two. But I would still
leave the web layer on its own machine, or at a minimum use a separate
partition with its own network card. I just don't like things that talk
to the internet also hosting my backend, too much opportunity for
trouble. Remember, the people looking to cause trouble likely know more
about security and you or I do. It's their "job" to learn how to break
things, where it's our job to serve the business need, and security is
just something we've got to "also do." It's not a fair fight.

-Walden