The DMZ

« first day (2551 days earlier) ← previous day next day → last day (2627 days later) »

MagicHat

14:11

@RoryAlsop Hi man, how are you ? Here fine... I pass some time trying build an a "Overview Diagram fo Security" focused in the layer 7 - Aplication...

My project live on Cloud, specific GCP, so i think i dont need to worry about, phisical structure Layer 1 - Phisical.

Another thing i think is : "Control the ports of requests", in my case is Web Server Aplication, so i dennied all and allow : 80,443,22/tcp. Well, here start my dubts...

For GCP - So many articles say "Disable SSH", i think is not cloud, and can be FTP insteed, who is more security?

2 hours later…

Rory Alsop

16:21

@MagicHat FTP is always a bad idea. You should never use it. SFTP or anything else in a decent SSL/TLS wrapper is essential

Controlling ports is a good idea - one basic security tenet is to deny all and then only allow those ports you need

Cloud just means "someone else's machine" so potentially you should consider physical - especially if you have concerns about segregation of duties: on the cloud, the same team may have access to your front end, back end, database, app servers etc

And finally, as regards the 7 layer OSI model - in reality it doesn't exist at all, so plan for all aspects