secure pix

[joblack23]

Hi everyone,

I am in need of making one of my server public. We are developing an application that requires a connection from the outside to the app server. My greatest concern is that credit cards will pass trough and so I need to implemnet a secure solution. Any suggestions would be greatly appreciated.

Thx

 

[unclerico]

Well, first of all SSL is a must as I'm sure you know. Second, you're going to need to decide where you want to place your servers. I'm assuming that your application is at least two tiered supporting a front-end server and a back-end datbase on physically separate boxes?? If so I would place the front-end in the DMZ and the back-end on your internal network. Open only the ports needed for communication from the front-end to the database server. If your database solution supports it, encrypt the traffic between the front-end and the back-end.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[North323]

dont forget about being pci compliant

http://www.pcicomplianceguide.org/

have you thought about an application firewall like Cisco ACE XML gateway.

 

[joblack23]

Very much thanks for everyone's reply. You are correct. I will have the website box on the DMZ talking via ports with internal app server. Which PIX would you recomend?

North323: is there anything else that you might consider beyond the Cisco ACE gatway?

Thanks for everyone's help.

 

[andrewis]

If within budget I would consider deploying an SSL reverse Proxy - have a look at bluecoats product portfolio.

You will obviously still need a firewall. Pix is no more so consider an ASA, Its difficult to recommend a firewall without knowing the size of your network and the amount of traffic generated.