3

(coming from stackoverflow)

Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)?

I am not specifically talking about WS-* or any other transport-layer security á la SSL/TLS, rather about important standards or certifications that must be obeyed.

Are there any known products (coming from an SAP-environment) that can provide a "high-security proxy" of some sort to expose specific web-services to the internet?

Any buzzwords that a CIO/CTO is aware of about this subject?

Community
  • 1
hotzen
  • 131
  • 3

2 Answers2

3

Whilst the answer given by AaronS gets to the gist of it (rather harshly if I may say so), I think the general principle that applies to any secure solution is defence-in-depth. That is, using several layers of security to prevent against attack, compromise or data leakage.

I'm not going to go into the debate of what percentage of attacks/leaks are internal, but whatever it is, this should not be forgotten or ignored either. You might follow AaronS's suggestion and 'never open your LAN to the internet' and put the server on the DMZ, and an employee might still be able to dump your database onto a memory stick and walk out the door with it.

So if you're looking for buzzwords, I would start with making sure you have network protection (e.g. Firewall, Intrusion Detection/Prevention) in place first, apply all the necessary patches and updates to your software and OS (Hardening). Use network segregation to separate your applications so that data flow is tightly controlled (DMZ is one common example, but other network segmentation models also work). Make sure the web service is developed securely, tested and code reviewed. Even with the best firewall and DMZ in the world, if the application itself is vulnerable, then most of this protection might have limited effect. Since the external facing web service will likely consume data or communicate somehow with internal components, make sure the same methodologies apply to them too. Make sure Authentication and Authorization are used to control access to data. Make sure you have solid monitoring and logging in place... The list goes on. This is by no means a substitute to a proper security architecture / analysis, which the security people in your organisation should be able to perform.

As for the 'high security proxy' you were asking about - there are a few products that provide application layer protection, see Application Firewall on Wikipedia. Those can also be added to the mix, but I would not rely solely on these for your security.

Yoav Aner
  • 5,299
  • 3
  • 24
  • 37
  • Thank you very much for your thourough answer. Are there any fundamental standards or certifications to guarantee parts of this behaviour/protection? – hotzen Feb 07 '12 at 14:40
  • Not sure I completely understand the question. There are lots potentially that try to standardize or prescribe best-practice / requirements. It ranges from high level standards such as the ISO 2700x series, to much more prescriptive standards like PCI/DSS and multitude of best-practice, Top-10, Top-25, guides and checklist. At the end of the day, it's making a balance between risk and cost, and using some common-sense to applying security. – Yoav Aner Feb 07 '12 at 15:08
  • I'm just also looking for these ISO and PCI/DSS standards, thanks! – hotzen Feb 07 '12 at 19:10
2

You don't do it, especially in Banking/Finance sector.

Corporate LAN should never be open to the Internet.

You should put your server in DMZ.

A

AaronS
  • 2,575
  • 5
  • 22
  • 26