IBM WebSphere V5.0 Security - CGISecurity

The following secure communications are identified in Figure 11-9:►►►HTTPS is the secure HTTP connection using SSL. Nodes, whichcommunicate via TCP/IP using the HTTP protocol, should use secure SSLcommunication. The level of security depends on the options set for theconnection.LDAPS is the secure LDAP connection to a directory server using SSL. SinceLDAP directories store essential and sensitive applications and businessinformation, the communication should be secured.IIOP/SSL (IIOPS) is the secure communication for IIOP connections usingSSL. Two application servers are mostly communicating via IIOP, for examplethe EJB client and EJB container.Note: Two application servers can also communicate via HTTP with SOAPusing the Web Services technology. The HTTP communication should besecured using SSL.►SSL is a transport layer security protocol which can be applied to most of theprotocols in use with an e-business application. As shown in Figure 11-9,other connections without named protocols can also use SSL to secure thecommunication.Other communication channels between nodes can be secured on a transportlayer, for example using IPSEC.System hardeningIn addition to protecting the nodes from being attacked from outside, systemshave to be secured from inside attacks as well. Operating systems security is anessential part of every system and is provided as mandatory. System hardeningis a global philosophy of system security that focuses strongly not only ondetection, but also on prevention. It involves removing unnecessary servicesfrom the base operating system, restricting user access to the system, enforcingpassword restrictions, controlling user and group rights, and enabling systemaccounting.System administrators are responsibile for following the system and corporateguidelines to ensure security on every level. System security has to bemaintained and set correctly. Part of system security is hardening the system andpreventing attacks from inside and outside.System hardening relies on the system management guidelines and theadvanced security settings and functions provided by the system.366 IBM WebSphere V5.0 Security Handbook