Re: Looking for feedback on public website security config
- From: "Roger Abell [MVP]" <mvpNoSpam@xxxxxxx>
- Date: Fri, 25 Jan 2008 23:34:35 -0700
I probably should not reply as you ask for someone to tell
you they think you are wrong in seeing this as a bad idea.
Although it can be done safely many of us (MVP types)
will immediately say that a DC should be a DC only, that
it should not run an application server (ie. IIS).
Let's assume that your network config is without mistake
and so only tcp 80/443 could route to the box from outside,
and further let us assume that you have the ability to config
the machine with all of the OS level hardening best practices
(which is not trivial with a DC). Even with those you are
still placing (by what you have said) your entire internal
network at risk due to the potential for exploit of their web
application and its use of SQL. From what I heard, that
application level exposure is not within your ability to
control, so you would be saying that you trust their quality
as that could be all that protects your internal network.
Can you configure their machine so that it is isolated
rather than able to contact other internal machines?
Roger
"driley" <driley@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B8346983-9A1C-481C-A834-7F31BF9E5A83@xxxxxxxxxxxxxxxx
In my work environment we have a vendor provided solution running on our
internal network. The solution is in its own domain and there are no trust
relationships to our domain.
The vendor has a web application that they want to publish on the internet
for a limited number of users. The web application uses IIS and is
installed
on their domain controller, which also hosts their application. Some of
our
confidential customer information is stored on this system.
The vendor is trying to tell us that all we need to do to make this system
secure is to install an SSL certificate and open up 80 and 443 on the
firewall. The system sits inside our network and is not in a DMZ or
otherwise
isolated from other internal systems.
The domain controller is not hardened in any way and is running IIS and
SQL.
Basically they want to make a domain controller into a web server and they
are saying that an SSL certificate will make this a secure solution.
Someone tell me if I am wrong in thinking that this sound like a bad idea.
.
- Follow-Ups:
- Prev by Date: Re: How to get Digital Certificate for Outlook 2007?
- Next by Date: Re: Looking for feedback on public website security config
- Previous by thread: MS08-001 and Windows 2003 x64 R2
- Next by thread: Re: Looking for feedback on public website security config
- Index(es):
Relevant Pages
|
Loading
