On 4/17/2011 8:36 PM, Jim Franz wrote:
Joe,
Just because we have this great architecture& OS doesn't mean we can ignore
industry standards. Any public co not following industry standard security
procedures for all the infrastructure (not just our server(s)) is putting
the corp assets at risk and may Sox& the lawyers punish them mightily...
The defense "...it's an i..." doesn't work in court. But there are very
standard methods of running i as the webserver, and for smaller non-public
companies, with precautions and disclosure-go for it. Even IBM's i's own
security people will tell you publicly (at Common& other events) the out of
the box default settings should not be the end of your settings.
Not sure where I said anything about ignoring industry standards, or
said to use the default settings, or even said not to follow the PCS DSS
1.3.7 regulations. The only thing I took issue with was the statement
that databases must be on a separate machine from the web server in
order to be secure. They do not.
In case I haven't been clear, I'll make my statement simply:
applications where the database and the web server reside on the same
machine are not inherently more secure than those where they reside on
different machines. If the application is designed properly, port 80
provides no more access to your database than port 23. And if you want
to say that 5250 applications are insecure, then you have a whole lot of
banks, casinos and other institutions that would beg to differ.
Sorry, I just hate when bad programming on other platforms is used to
justify unnecessary complexity on the i. The i is as nearly unhackable
as any machine can get, and in my opinion putting another machine in
front of it makes it LESS secure rather than more secure. (I'd sure
hate to have some critter go rogue in a Windows front end and start
sending back detailed information about its secure communications with
my database server.)
Unless of course the other machine is another i. Which is what I'd do
to address the credit card regulations - not another machine, per se,
but a separate partition specifically devoted to the cardholder data,
accessed through a service. But I'd only do that to conform with the
regulations, not because I thought it was necessary. I'd be more
worried about a disgruntled operator with a USB drive than I would an
outside hacker, but hey, that's just me.
Joe
midrange.com
