Addressing OLTP Solutions with CICS: The Transaction Server ... - Ibm

information being communicated and resources used for communication are
unprotected from mischief or malice.
In general, OLTP systems are built on private networks where you can more
easily protect the privacy of your data. However, as business use of the Internet
grows and more and more private networks are linked to the Internet, the need
for secure communications and networks grows as well.
Internet Security actually consists of two distinct services: network security and
transaction security.
Network security: Network security refers to a corporation′s ability to protect its
computers, memory, disk, printers, and other computing equipment from
unauthorized use. Network security protects against attackers who try to access
information or gain control over machines or resources within a private network.
The most common way of protecting private networks connected to the Internet
from attacks is with firewalls, single points of connection between a private and
public network that allow communications between them to be monitored and
secured. Firewalls differ in their implementation and the degree of protection
they offer. The most common types of firewalls are:
• Screening filter, which uses a router to connect the private network to the
Internet. The screening filter monitors each IP packet flowing through it,
controlling access on both sides. A screening filter cannot control access at
the application layer, however.
• Bastion, a machine placed between the private network and the Internet that
breaks the connection between the two. The bastion relays messages to or
from authorized users and denies access to all others. Bastions can control
access at the user or application layer, but they can be costly if many users
are supported. If an attacker can impersonate an authorized user, the
attacker can get into the private network.
• Dual-homed gateway, which combines a screening filter and a bastion into
either a single machine or a series of machines. The gateway can be
complex and make it hard to find attackers. Alternatively, screening filters
can be used to protect bastions, or a combination of screening filters and
bastions can be used to tailor protection to the subnet or resource being
protected.
A more detailed discussion of Internet firewalls is beyond the scope of this book.
For information see the following URL:
http://www.raleigh.ibm.com/icf/icfprod.html
Transaction security: Transaction Security refers to the ability of two entities on
the Internet to conduct a transaction privately, and with authentication through
digital signatures if required.
There are two aspects to transaction security:
• Authentication. For some users of the Web (in electronic commerce, for
example) it is important that users authenticate themselves to Web servers,
that Web servers authenticate themselves to users, or that both authenticate
to each other. Whatever the form of authentication, it must not be easily
compromised.
• Encryption. For applications in which Web clients and servers exchange
sensitive information, such as userid and password pairs, credit card details,
Chapter 9. Accessing CICS from the Web 141