@Damon – thanks for taking the time to share your thoughts on this. You’ve helped me get my head around where the client is most likely coming from… not sure I see the risk as all that high, but at least I can talk [a bit more] intelligibly about it.

I came across this post via your account on Twitter. “horrendously insecure” is probably an overreaction, but firewalled two-tier architectures are a common security recommendation, and sometimes a requirement depending on if certain regulations are involved.

The reasoning behind it is that it adds an extra layer of security to the architecture that an attacker must penetrate in the event of a compromise.

As an example, take the scenario where a vulnerability and associated exploit is discovered on the web server. If an attacker compromises that, they then have unrestricted network access to the database server. This means they can attempt brute-force logins, attack other potentially vulnerable software (that may have fallen behind in patching since it’s behind the firewall…), or access other network services (backup agent, nfs?). If the db is behind a firewall, they would need to acquire db credentials (not potentially difficult) and then take over the database server via that specific connection, which may be a more difficult task depending on how well the database software is configured. Assuming that the db server is where the “crown jewels” of the application reside, it will be the likely next target in the event of a web server compromise.

Given that, it is still a limited scenario and something like SQL injection is much more likely these days. And yes, with SQL injection a firewall isn’t going to help. What it eventually comes down to is if the value of the data hosted by the application justifies the cost of the extra security measures. Another option, depending on your infrastructure, is simply using router ACLs to deny all traffic except for the necessary database traffic.

As Vox mentioned, you may be able to justify to the client that you have adequate compensating controls in place. Difficult to do with Windows systems, but on a Unix-based box, if _all_ you have is SSH and SQL open and SSH requires a key to login, the attack surface is greatly reduced.

I hope this has helped. Feel free to shoot me an email if you have any questions.

Then again, I’ve only been doing this kind of stuff for 12 years, so…I may be wrong