IBM WebSphere V5.0 Security - CGISecurity

2.1 SecurityAs new business practices emerge, most enterprises are finding that theirexisting security infrastructure is not capable of meeting the rapidly changing andmore rigorous demands of business over the Internet. The demands of networksecurity have now gone far beyond simply managing user accounts andrestricting access between internal and external networks. These demands nowrequire a sophisticated system that allows fine-grained access control toresources, yet is manageable enough to be tailored to protect systems frommany types of security threats.Security is a fairly vast topic; everything involves security to some extent, in acertain format. There are two main areas which have to be discussed separately:► Physical security► Logical securitySystems have to be protected both from outsiders and insiders. Do not forgetthat not every intrusion or attack is intentional; misuse of a system or improperadministration can also cause damage.2.1.1 Physical securityPhysical security means protection against physical actions. It involves everyphysical element around:► The machine(s) where the application is running.► The room where the machines are operating.► The building where the machines are installed.► The site where the company is located.The listed elements have to be secured against intrusion and damage, whether itbe intentional or not.Physical security also includes the protection of communication channels:► Ground lines► Wireless connectionThe communication network has to be protected against eavesdropping anddamage to the connection (cutting the line).The subject of physical security goes much further than the objective of this bookallows. This short section is only intended as a reminder of the concept of logicalsecurity.6 IBM WebSphere V5.0 Security Handbook