3 ms·
Just deploy it on your local network. No need to expose it to the internet. Sure, authentication is a nice bonus, but a simple firewall goes a long way.
by bouke 7y ago
Just deploy it on your local network. No need to expose it to the internet. Sure, authentication is a nice bonus, but a simple firewall goes a long way.
- jturpin 7y agoI don't get why it ever needs to be on the internet even when it does have authentication. Surely the public/private subnet split is a common practice.
- kirstenbirgit 7y agoThe way I see it, password auth for db servers is the last-resort protection mechanism. If you get to the point where it’s what’s protecting your data, you’re already fundamentally screwed.
- CydeWeys 7y agoYou should definitely have it too, though.
- CydeWeys 7y agoUnless the private subnet is airgapped from the Internet, it's not a good enough separation. Hell, even if it is airgapped, it can still be compromised by viruses on USB sticks and such. You should never be leaving sensitive systems wide open, period, regardless of how secure you might think that network is. Thousands of data breaches have been caused because networks didn't end up being as secure or as separated as hoped for.
- CydeWeys 7y agoDefense in depth is important. Lots of data breaches have been caused because things that should have just been viewable from a local network, weren't, or the network was compromised. Unless you think every single employee is invulnerable to spear-phishing (which is impossible), you should never be leaving anything sensitive wide open on your local network.