Question

This is more of an architectural and security question than anything else. I’m trying to determine if a suggested architecture is necessary. Let me explain my configuration.

We have a standard DMZ established that essentially has two firewalls. One that’s external facing and the other that connects to the internal LAN. The following describes where each application tier is currently running.

Outside the firewall:
Silverlight Application

In the DMZ:
WCF Service (Business Logic & Data Access Layer)

Inside the LAN:
Database

I’m receiving input that the architecture is not correct. Specifically, it has been suggested that because “a web server is easily hacked” that we should place a relay server inside the DMZ that communicates with another WCF service inside the LAN which will then communicate with the database. The external firewall is currently configured to only allow port 443 (https) to the WCF service. The internal firewall is configured to allow SQL connections from the WCF service in the DMZ.

Ignoring the obvious performance implications, I don’t see the security benefit either. I’m going to reserve my judgement of this suggestion to avoid polluting the answers with my bias. Any input is appreciated.

Thanks,
Matt

Answer 1

I do think the remarks made are valid, and in such a case I would probably also try and use as many “defense-in-depth” layers I could possibly come up with.

Plus, the amount of work to achieve this might be less than you’re afraid of – if you’re on .NET 4 (or can move to it).

You could use the new .NET 4 / WCF 4 routing service to do this quite easily. As an added benefit: you could expose a HTTPS endpoint to the outside world, but on the inside, you could use netTcpBinding (which is a lot faster) to handle internal communications.

Check out how easy it is to set up a .NET 4 routing service:

• What’s new in WCF4 Routing Service – or: “Look ma: Just one service to talk to!”
• Creating Routing Service using WCF 4.0, .NET Framework 4.0 and Visual Studio 2010 RC