4 ms·
No one talks about the working parts of security. Like, in this case, having the application on a separate box, and having that box separated by vlans from impo
by tetha 8y ago
No one talks about the working parts of security. Like, in this case, having the application on a separate box, and having that box separated by vlans from important things.
- bluntfang 8y agoI don't think the solution is to put things you don't care about behind vlans and having applications on separate boxes. This box is/was an attack vector. It was holding secrets. Secrets provide other attack vectors.
- tetha 8y agoIt is - it is defense in depth. The application should be secure, and there should be steps to secure it. Especially because a secure application can protect a less secure network setup. But on the other hand, the server or the network should not trust the application to be secure at all. The infrastructural setup should assume the application to be an <exec($_POST['do_me']);>. And that's why the application should be isolated on a system level, on a network level, and as much as possible. That's the good part I mean - the part that worked.