Feeds

Governance in the Web 2.0 world

Everything over http

Providing a secure and efficient Helpdesk

There are some forces that just cannot be stopped. Block the path, and they'll just go round some other way. Fortunately, here in Devon, where Dartmoor has had no difficulty absorbing the recent rain, that's not a topical observation about the state of my living room. But it is certainly topical on the net.

The classic seven-layer network model has served us well, and continues to do so. Each network interface has an IP address and a lot of ports, some of them allocated by policy to specific network services, others unused. The purpose of having lots of different ports is that different services, having different architectures and semantics for different applications, can use different ports. That way they run independent of each other and without interference on the same network. Simple, secure, and elegant.

What may lie behind a port is another story altogether, and many network services involve components that are very far from secure. Some hark back to another age, when security was not a concern. Others were never written with internet exposure in mind. Or are just badly-written. Even those that are designed to be exposed to the full rigours of today's net require vigilance: your Apache server should be secure against known exploits, but applications you run on it may be much weaker.

Fortunately, nowadays we have firewalls. Packet-filtering firewalls, very simple to understand and deploy. You don't need to be a professional network administrator - just buy a modem/router and you have one that's almost certainly secured by default (all incoming connections are rejected). Thus, the unwashed masses get a measure of protection from their own ignorance. This is a good thing.

But like many good things, it has a downside. The firewall is so simple and useful that it gets into company policies. The systems manager is commonly devalued to a low-skill operator-grade role. A typical policy goes something like, "this is a webserver. We open ports 80 and 443, and firewall everything else". This is a good policy...up to a point. The point in question is where you have a need to run a service for which HTTP is not well-suited.

At this point, the firewall policy and the company's needs are in conflict. Do you (and perhaps your insurers and lawyers) trust your PFY-grade sysop to exercise discretion with your security? For what it's worth, you probably should. Opening a port on a firewall really is that simple (though it does raise a "slippery slope" argument). Or do you allocate a large budget to hire high-powered consultants to tell you what's OK (and p*** off your sysop)? Or do you look for a workaround?

Consider, for example, a thoroughly ordinary requirement - symmetric, stateful two-way communication over a persistent connection. It could be anything from simple chat to a fancy VPN. It can be done over HTTP. There are many ways to deal with state, at the cost of some complexity.

Internet Security Threat Report 2014

More from The Register

next story
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
Chrome 38's new HTML tag support makes fatties FIT and SKINNIER
First browser to protect networks' bandwith using official spec
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.