2 ms·
I don't get why it ever needs to be on the internet even when it does have authentication. Surely the public/private subnet split is a common practice.
by jturpin 7y ago
I don't get why it ever needs to be on the internet even when it does have authentication. Surely the public/private subnet split is a common practice.
- kirstenbirgit 7y agoThe way I see it, password auth for db servers is the last-resort protection mechanism. If you get to the point where it’s what’s protecting your data, you’re already fundamentally screwed.
- CydeWeys 7y agoYou should definitely have it too, though.
- CydeWeys 7y agoUnless the private subnet is airgapped from the Internet, it's not a good enough separation. Hell, even if it is airgapped, it can still be compromised by viruses on USB sticks and such. You should never be leaving sensitive systems wide open, period, regardless of how secure you might think that network is. Thousands of data breaches have been caused because networks didn't end up being as secure or as separated as hoped for.