Re: SSL w/ PCI best practices

When we weren't doing SSL end-to-end, we offloaded at our load balancer and then sent data to our web servers via clear-text. 

The following are ways that the clear-text traffic could have been intercepted:

1. Mirror a web-server port.
2. Mirror the load balancer port.
3. Access the server remotely or physically in order to run a packet capture.

Since all of those options force you to enter the data center or have an account with advanced privileges, a case could be made that the zone is "secure."

Alternatively, if our web servers had been owned by someone else or offsite, we wouldn't have as much control.


Chris Miller

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of David Coulthart
Sent: Wednesday, February 24, 2010 1:23 PM
To: Load Balancing Mailing List
Subject: Re: [load balancing] SSL w/ PCI best practices

On Feb 24, 2010, at 11:54 AM, Kenneth Salchow wrote:
> Bill-
>
> Thanks for the verification.  I know this was a HUGE security debate 
> back in 2000 when we started doing the ssl termination, but I think 
> over the years people have come to agree on the fact that as long s 
> the traffic stays within a secure zone, with limited electronic and 
> physical access, that it is ok.

Would folks be willing to share any practical documents describing how to create "secure zones?"  I'm currently working on a project to replace our existing load balancer and would really like to push for SSL termination (mainly so I can get the network management benefits of using SNAT).  However, I'm concerned I'll face resistance from our application, systems & security groups regarding the risks of SSL termination.

Thanks,
Dave Coulthart
_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load Balancing Digest http://lbwiki.com Load Balancing Wiki


_______________________________________________
lb-l mailing list
[email protected]
http://vegan.net/mailman/listinfo/lb-l
Searchable Archive: http://vegan.net/lb/archive
http://lbdigest.com Load Balancing Digest
http://lbwiki.com Load Balancing Wiki