<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><br>Hello,<br>I have been heaving interesting discussions regarding security implementation of the multi tier web architecture. Long ago I used to be proponent of the fw per layer approach. This would boil down to fw before and between web tier and application and one between db or any other back end form of meta data silo(s). Through experience and lengthly troubleshooting sessions I am weary of FW and persistent connections and work around with socket_keepalive properties. I am specifically referring to apache and ajp proxy plugin but I saw number of production issues with real proxy servers and fw. These days I prefer to have a fw fronting some sort of load balancer on the unsecure subnet and to move web tier to private network without fw between it and app stack. Second instance of the fw I
add between application portal and meta data silo. I see no gain in heaving web servers in the DMZ just to terminate http traffic on the DMZ zone. In my opinion possible exploits will be executed against business logic and application content and/or "database layer" . The web tier is strictly being used to "proxy" dynamic content at this point via binary protocol.<br><br>Any views or comments?<br>Regards,<br><br>Aleksandar (Sasha) Kacanski (NYUMC)<br><div><br></div></div><br>
<hr size=1>Yahoo! oneSearch: Finally, <a href="http://us.rd.yahoo.com/evt=48252/*http://mobile.yahoo.com/mobileweb/onesearch?refer=1ONXIC"> mobile search
that gives answers</a>, not web links.
</body></html>