Re: Question re: load balancers as a security device



Load balancers do not provide any type of security. Load balancers
will only distribute the traffic and not deny it. If your ISP manages
all the security devices between you and the hosting facility then at
a minimum you will want to put an additional firewall on your side so
you can have some control of what accesses your network over this site
to site tunnel. This will probably be easier (politically not
technically) in a lager company.

Kevin

On 22 Jan 2008 15:05:28 -0000, <dan.tesch@xxxxxxxxxxx> wrote:
I'm new to a company that has a large number of sites parked on managed servers at a hosting facility - the servers, firewalls and load balancers are exclusive to our use but managed by the ISP.


In reviewing our site design I have seen that the VPN between our LAN and the hosting facility permits all IP traffic in both directions - effectively making these public facing servers part of our LAN in my opinion.


For obvious reasons I'm looking to change this. Nobody is lobbying against the change but a senior developer that was involved in the original design points out that because of the load balancers in front of the servers, the world at large is not able to touch the machines and thus the potential for compromise is limited.


Could I get some comments from this community about how vulnerable or not this type of setup might be? I'm looking for specific info related to the load balancers not commentary about the corporate LAN in this situation - even if the combination of the firewalls and load balancers provide 99.9% protection I think it is a bad idea and would most likely not pass PCI scrutiny.


Thanks

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



Relevant Pages

  • Re: Security/Pen-testing Courses?
    ... and have a strong programming and security background. ... Cenzic finds more, "real" vulnerabilities fast. ... buy it or download a solution FREE today! ...
    (Pen-Test)
  • Re: SQL Injection- Bypassing magic_quotes
    ... Chief Information Security Officer ... Need to secure your web apps NOW? ... buy it or download a solution FREE today! ...
    (Pen-Test)
  • Re: Question re: load balancers as a security device
    ... While I'm not promoting it for a security solution some load balancers do support URL based filtering ... Some Load Balancers include IPS in their devices with additional license. ... buy it or download a solution FREE today! ...
    (Pen-Test)
  • Re: Question re: load balancers as a security device
    ... PURE load balancers are NOT security devices. ... In reviewing our site design I have seen that the VPN between our LAN and the hosting facility permits all IP traffic in both directions - effectively making these public facing servers part of our LAN in my opinion. ... buy it or download a solution FREE today! ...
    (Pen-Test)
  • Re: Security/Pen-testing Courses?
    ... Take the SANS course in the OnDemand format. ... I've recently started working as an application security specialist. ... buy it or download a solution FREE today! ...
    (Pen-Test)