IBM WebSphere V5.0 Security - CGISecurity

The following secure communications are identified in Figure 11-9:
►
►
►
HTTPS is the secure HTTP connection using SSL. Nodes, which
communicate via TCP/IP using the HTTP protocol, should use secure SSL
communication. The level of security depends on the options set for the
connection.
LDAPS is the secure LDAP connection to a directory server using SSL. Since
LDAP directories store essential and sensitive applications and business
information, the communication should be secured.
IIOP/SSL (IIOPS) is the secure communication for IIOP connections using
SSL. Two application servers are mostly communicating via IIOP, for example
the EJB client and EJB container.
Note: Two application servers can also communicate via HTTP with SOAP
using the Web Services technology. The HTTP communication should be
secured using SSL.
►
SSL is a transport layer security protocol which can be applied to most of the
protocols in use with an e-business application. As shown in Figure 11-9,
other connections without named protocols can also use SSL to secure the
communication.
Other communication channels between nodes can be secured on a transport
layer, for example using IPSEC.
System hardening
In addition to protecting the nodes from being attacked from outside, systems
have to be secured from inside attacks as well. Operating systems security is an
essential part of every system and is provided as mandatory. System hardening
is a global philosophy of system security that focuses strongly not only on
detection, but also on prevention. It involves removing unnecessary services
from the base operating system, restricting user access to the system, enforcing
password restrictions, controlling user and group rights, and enabling system
accounting.
System administrators are responsibile for following the system and corporate
guidelines to ensure security on every level. System security has to be
maintained and set correctly. Part of system security is hardening the system and
preventing attacks from inside and outside.
System hardening relies on the system management guidelines and the
advanced security settings and functions provided by the system.
366 IBM WebSphere V5.0 Security Handbook