Feeds

Governance in the Web 2.0 world

Everything over http

Remote control for virtualized desktops

There are some forces that just cannot be stopped. Block the path, and they'll just go round some other way. Fortunately, here in Devon, where Dartmoor has had no difficulty absorbing the recent rain, that's not a topical observation about the state of my living room. But it is certainly topical on the net.

The classic seven-layer network model has served us well, and continues to do so. Each network interface has an IP address and a lot of ports, some of them allocated by policy to specific network services, others unused. The purpose of having lots of different ports is that different services, having different architectures and semantics for different applications, can use different ports. That way they run independent of each other and without interference on the same network. Simple, secure, and elegant.

What may lie behind a port is another story altogether, and many network services involve components that are very far from secure. Some hark back to another age, when security was not a concern. Others were never written with internet exposure in mind. Or are just badly-written. Even those that are designed to be exposed to the full rigours of today's net require vigilance: your Apache server should be secure against known exploits, but applications you run on it may be much weaker.

Fortunately, nowadays we have firewalls. Packet-filtering firewalls, very simple to understand and deploy. You don't need to be a professional network administrator - just buy a modem/router and you have one that's almost certainly secured by default (all incoming connections are rejected). Thus, the unwashed masses get a measure of protection from their own ignorance. This is a good thing.

But like many good things, it has a downside. The firewall is so simple and useful that it gets into company policies. The systems manager is commonly devalued to a low-skill operator-grade role. A typical policy goes something like, "this is a webserver. We open ports 80 and 443, and firewall everything else". This is a good policy...up to a point. The point in question is where you have a need to run a service for which HTTP is not well-suited.

At this point, the firewall policy and the company's needs are in conflict. Do you (and perhaps your insurers and lawyers) trust your PFY-grade sysop to exercise discretion with your security? For what it's worth, you probably should. Opening a port on a firewall really is that simple (though it does raise a "slippery slope" argument). Or do you allocate a large budget to hire high-powered consultants to tell you what's OK (and p*** off your sysop)? Or do you look for a workaround?

Consider, for example, a thoroughly ordinary requirement - symmetric, stateful two-way communication over a persistent connection. It could be anything from simple chat to a fancy VPN. It can be done over HTTP. There are many ways to deal with state, at the cost of some complexity.

Remote control for virtualized desktops

More from The Register

next story
PEAK APPLE: iOS 8 is least popular Cupertino mobile OS in all of HUMAN HISTORY
'Nerd release' finally staggers past 50 per cent adoption
Microsoft to bake Skype into IE, without plugins
Redmond thinks the Object Real-Time Communications API for WebRTC is ready to roll
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
Mozilla: Spidermonkey ATE Apple's JavaScriptCore, THRASHED Google V8
Moz man claims the win on rivals' own benchmarks
FTDI yanks chip-bricking driver from Windows Update, vows to fight on
Next driver to battle fake chips with 'non-invasive' methods
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Ubuntu 14.10 tries pulling a Steve Ballmer on cloudy offerings
Oi, Windows, centOS and openSUSE – behave, we're all friends here
Was ist das? Eine neue Suse Linux Enterprise? Ausgezeichnet!
Version 12 first major-number Suse release since 2009
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.