I was recently reading through some literature provided by a vendor describing the security behind a particular solution under consideration. The literature in question describes a multi-layered architecture with domain seperation, and use of encrypted channels between client and server. The document explains how the database and application servers are seperated and that the “connection between the Application Server and the Database Server can also be encrypted using SSL”. Brilliant, I think to myself. Sounds like a suitably secure solution for the job in hand. So, being ever diligent, I investigate how it has actually been installed and implemented by the vendor: the originators of the documentation….
Instead of finding something heart-warmingly secure, I instead discover database and application installed on the same patched up file server, open to the global network with no encryption between the clients and the back-end.
Some might – and will – argue that it’s an internal application with no external connectivity and a limited user base. In turn I will argue that it is processing confidential data across an open network contrary to good practice and contrary to the interests of the people who presume that their data is being suitably protected.
I have a couple of frustrations
1) That an enterprise project has already been deployed before information security are made aware and further, that I only became aware because of a coffee machine chat with some-one working on the project
2) That a solution has been deployed with no recourse to any security related process. Sure, some effort has been made on ensuring that strong passwords are used but no thought given to security of the data and no consultation with any internal security resources
So, I am readying myself up for a round of meetings, risk assessments, discussions, debates, late nights, too much coffee, resulting insomnia, eventual madness and finally death…ok, ok, I’m being flippant – it’s a serious matter. But you’ve got to laugh.