Re: Cookie Persistance

ABSOLUTELY AGREE!!!

Now, how many of us who deploy ADC technologies have that much pull in the
application environment to keep those guys in line??  I sure never did.  I
mention JSessionID specifically for a reason folks--it's common and often
deployed very badly.

To say that encrypted cookies are ". . . (or should be) a complete waste of
time . . ." is akin to saying that I shouldn't worry about filtering credit
card or social security numbers from being served up--because the App guys
should NEVER let that happen.  You're right--they shouldn't--but simply
saying that and blaming them doesn't provide the solution.  It's a lot more
fun to blame them when you show how YOU stopped it from damaging the
company. In my case, it only takes an iRule that can be easily acquired in
entirety; the cost of doing it is negligible and the risk it mitigates is
astronomical. 

I have a saying--you don't spend a million dollars to protect a one dollar
bill (unless you're the government); but if you can spend a dollar and
protect a million?  THAT's smart security.  So--that healthy dose of
paranoia tells ME that if you can encrypt cookies on the way out very
easily, with no impact to the application and then you don't have to worry
about what the application guys did or didn't do--THAT is a smart decision. 

Lastly--I said you might want to see if you can.  If you can't, or if the
cost of doing it is more than the perceived risk--don't.

KJ (Ken) Salchow, Jr. | Manager, Technical Marketing
D 651.423.1133
M 612.868.12588
P 206.272.5555
F 206.272.5555
www.f5.com



-----Original Message-----
From: Hamish Marson [mailto:[email protected]] 
Sent: Wednesday, July 01, 2009 10:09 AM
To: Load Balancing Mailing List; Kenneth Salchow
Cc: [email protected]; Load Balancing Mailing List;
[email protected]
Subject: Re: [load balancing] Cookie Persistance

Quoting Kenneth Salchow <[email protected]>:

> Content-Type: text/plain;
> 	charset="iso-8859-1"
> Content-Transfer-Encoding: quoted-printable
>
> BTW--you might also want to see if you can apply encryption to those
cookies
> at the ADC--whether generated by the ADC or the server.  Especially if
> you're using something like JSessionID from the server.  It's a fairly
> simple thing that can dramatically increase your overall security posture.
>

I have to jump in here... Encrypted cookies are (Or should be) a  
complete waste of time.

If you follow the guidelines of basic best practice and security, any  
cookie content SHOULD be an opaque key. With no actual data in it. Any  
cookies you set in an HTTPS session should also be set as a secure  
cookie so it is never presented across an http session (To prevent  
cookie stealing).

Good security practices start with a healthy dose of paranoia. If  
there's no data in a cookie there's only the 'key' aspect of it to  
take care of (i.e. it doesn't matter if someone steals an opaque  
session id a week later. The session has expired therefore the session  
data will no longer be on the server. The data is only vulnerable  
until it expires. But a session cookie that includes data is  
vulnerable forever.



regards
   Hamish.




----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki