Wow, this was a very educational thread for me. I see what the issues are, but to me, for our size and sensitivity of the data involved, it seems like overkill. The entire network infrastructure for our organization is handled by two people, and I could probably rattle off at least 10 security best practices that we aren't following currently that the audit *didn't* find. Not that I'm proud of that, just saying resources for managing this stuff are at a premium. Hopefully some of these opinions will at least provide me with some evidence of due diligence if our regular auditors ask why we didn't immediately go out and set up CF on a separate server. By the way I did do a search on this before I posted, just didn't know it was called distributed mode, I'll go back and scrounge some more too. One last thing, the link a couple people posted explained how to do this with CFMX, is there a document for CF5?
Thanks much everyone John --- John Venable Director of Web Architecture Epilepsy Foundation On Thursday, Aug 7, 2003, at 16:55 US/Eastern, Ben Forta wrote: > John, > > What you are describing is distributed mode, and I am not surprised > that > an audit recommended it - most do regardless of whether it is of value > or not. > > The basic premise is this - any public facing box is a target, and web > servers are public facing. At some level it is good practice to be a > little paranoid and assume that whatever is on your web server box will > get hacked and/or stolen. So, if you do buy that premise, than anything > important should not be on the web server. (incidentally, this is my > primary objection to the use of Access, but that is a separate > discussion). That includes source code, database connections, > passwords, > and more. > > Is there value in this? Possibly. The truth is your source code should > never contain passwords or important things like that anyway. But > access > to databases? Yep, that's a valid concern. > > Is there a downside? Yes. There are performance implications in > separating your application server from your web server, regardless of > which application server it is. > > Some are of the opinion that you should not separate CF from IIS (in > your scenario), rather, keep them coupled but inside your firewall. > Then > have a proxy server outside and only allow it to get to the internal > server. But as to whether or not that is good or bad, that is a debate > unto itself. > > --- Ben > > > > > > -----Original Message----- > From: Venable, John [mailto:[EMAIL PROTECTED] > Sent: Thursday, August 07, 2003 11:10 AM > To: CF-Talk > Subject: Separating IIS from CF > > > We just had a security audit and one of the recommendations was to > separate Cold Fusion and IIS onto two separate systems. I hadn't heard > of doing this, and am really wary of doing this since we are using > Commonspot and I have no idea what ramifications would result. > > Their reasoning for this was pretty vague, so can anyone give me > reasons > why we should and shouldn't do this? The motivation in this particular > case being improved security. > > Thanks > > John > > --- > John Venable > Director of Web Architecture > Epilepsy Foundation > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Archives: http://www.houseoffusion.com/cf_lists/index.cfm?forumid=4 Subscription: http://www.houseoffusion.com/cf_lists/index.cfm?method=subscribe&forumid=4 FAQ: http://www.thenetprofits.co.uk/coldfusion/faq Get the mailserver that powers this list at http://www.coolfusion.com Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
