Feeds

Governance in the Web 2.0 world

Everything over http

Choosing a cloud hosting partner with confidence

There are some forces that just cannot be stopped. Block the path, and they'll just go round some other way. Fortunately, here in Devon, where Dartmoor has had no difficulty absorbing the recent rain, that's not a topical observation about the state of my living room. But it is certainly topical on the net.

The classic seven-layer network model has served us well, and continues to do so. Each network interface has an IP address and a lot of ports, some of them allocated by policy to specific network services, others unused. The purpose of having lots of different ports is that different services, having different architectures and semantics for different applications, can use different ports. That way they run independent of each other and without interference on the same network. Simple, secure, and elegant.

What may lie behind a port is another story altogether, and many network services involve components that are very far from secure. Some hark back to another age, when security was not a concern. Others were never written with internet exposure in mind. Or are just badly-written. Even those that are designed to be exposed to the full rigours of today's net require vigilance: your Apache server should be secure against known exploits, but applications you run on it may be much weaker.

Fortunately, nowadays we have firewalls. Packet-filtering firewalls, very simple to understand and deploy. You don't need to be a professional network administrator - just buy a modem/router and you have one that's almost certainly secured by default (all incoming connections are rejected). Thus, the unwashed masses get a measure of protection from their own ignorance. This is a good thing.

But like many good things, it has a downside. The firewall is so simple and useful that it gets into company policies. The systems manager is commonly devalued to a low-skill operator-grade role. A typical policy goes something like, "this is a webserver. We open ports 80 and 443, and firewall everything else". This is a good policy...up to a point. The point in question is where you have a need to run a service for which HTTP is not well-suited.

At this point, the firewall policy and the company's needs are in conflict. Do you (and perhaps your insurers and lawyers) trust your PFY-grade sysop to exercise discretion with your security? For what it's worth, you probably should. Opening a port on a firewall really is that simple (though it does raise a "slippery slope" argument). Or do you allocate a large budget to hire high-powered consultants to tell you what's OK (and p*** off your sysop)? Or do you look for a workaround?

Consider, for example, a thoroughly ordinary requirement - symmetric, stateful two-way communication over a persistent connection. It could be anything from simple chat to a fancy VPN. It can be done over HTTP. There are many ways to deal with state, at the cost of some complexity.

Secure remote control for conventional and virtual desktops

More from The Register

next story
ONE MILLION people already running Windows 10
A third of them are doing it in VMs, but early feedback focuses on frippery
Sign off my IT project or I’ll PHONE your MUM
Honestly, it’s a piece of piss
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Torvalds CONFESSES: 'I'm pretty good at alienating devs'
Admits to 'a metric ****load' of mistakes during work with Linux collaborators
Sway: Microsoft's new Office app doesn't have an Undo function
Content aggregation, meet the workplace ... oh
Do Moan! MONSTER 6-day EMAIL OUTAGE hits Domain Monster
Customers freaked out by frightful service
Ploppr: The #VultureTRENDING App of the Now
This organic crowd sourced viro- social fertiliser just got REAL
Return of the Jedi – Apache reclaims web server crown
.london, .hamburg and .公司 - that's .com in Chinese - storm the web server charts
NetWare sales revive in China thanks to that man Snowden
If it ain't Microsoft, it's in fashion behind the Great Firewall
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.