Feeds

Governance in the Web 2.0 world

Everything over http

The essential guide to IT transformation

There are some forces that just cannot be stopped. Block the path, and they'll just go round some other way. Fortunately, here in Devon, where Dartmoor has had no difficulty absorbing the recent rain, that's not a topical observation about the state of my living room. But it is certainly topical on the net.

The classic seven-layer network model has served us well, and continues to do so. Each network interface has an IP address and a lot of ports, some of them allocated by policy to specific network services, others unused. The purpose of having lots of different ports is that different services, having different architectures and semantics for different applications, can use different ports. That way they run independent of each other and without interference on the same network. Simple, secure, and elegant.

What may lie behind a port is another story altogether, and many network services involve components that are very far from secure. Some hark back to another age, when security was not a concern. Others were never written with internet exposure in mind. Or are just badly-written. Even those that are designed to be exposed to the full rigours of today's net require vigilance: your Apache server should be secure against known exploits, but applications you run on it may be much weaker.

Fortunately, nowadays we have firewalls. Packet-filtering firewalls, very simple to understand and deploy. You don't need to be a professional network administrator - just buy a modem/router and you have one that's almost certainly secured by default (all incoming connections are rejected). Thus, the unwashed masses get a measure of protection from their own ignorance. This is a good thing.

But like many good things, it has a downside. The firewall is so simple and useful that it gets into company policies. The systems manager is commonly devalued to a low-skill operator-grade role. A typical policy goes something like, "this is a webserver. We open ports 80 and 443, and firewall everything else". This is a good policy...up to a point. The point in question is where you have a need to run a service for which HTTP is not well-suited.

At this point, the firewall policy and the company's needs are in conflict. Do you (and perhaps your insurers and lawyers) trust your PFY-grade sysop to exercise discretion with your security? For what it's worth, you probably should. Opening a port on a firewall really is that simple (though it does raise a "slippery slope" argument). Or do you allocate a large budget to hire high-powered consultants to tell you what's OK (and p*** off your sysop)? Or do you look for a workaround?

Consider, for example, a thoroughly ordinary requirement - symmetric, stateful two-way communication over a persistent connection. It could be anything from simple chat to a fancy VPN. It can be done over HTTP. There are many ways to deal with state, at the cost of some complexity.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
The Return of BSOD: Does ANYONE trust Microsoft patches?
Sysadmins, you're either fighting fires or seen as incompetents now
Intel's Raspberry Pi rival Galileo can now run Windows
Behold the Internet of Things. Wintel Things
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Time to move away from Windows 7 ... whoa, whoa, who said anything about Windows 8?
Start migrating now to avoid another XPocalypse – Gartner
Eat up Martha! Microsoft slings handwriting recog into OneNote on Android
Freehand input on non-Windows kit for the first time
You'll find Yoda at the back of every IT conference
The piss always taking is he. Bastard the.
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.