Hacker News Reader

Comment by skavanagh | Hacker News Reader

Yup! Make administration less confidential, but try and keep it as secure as possible. Inside attacks are a big problem in the financial industry too. I like the idea of controlling it through a hardened web-app, but may need a little help getting there.

View on HN

Why? You can protect against insider threat by auditing the target system itself and streaming said audit logs to write only media.

Building a single point of compromise has no advantages over this and many disadvantages beyond just security.

Auditing can be a deterrent to an attack, but won't necessarily protect you against it. It's a good way of letting you know what has happened after the fact.

Think if you had a DB with financials (credit cards and such) in a isolated DMZ with SSH inbound/outbound blocked

How can you dump the DB and copy it off if all the traffic was "proxied" through this?? It's not like you can scp a tarball anywhere.

You can't forward ports and expose the DB outside of the DMZ either.

And it doesn't take admins to setup auditing or disable forwarding, you have physically disabled it.

I got to say I don't understand the single point of compromise thing. A single point of failure is a bad, but the less points of compromise the better. You identify your critical systems, you protect your critical systems. Spreading things out doesn't make you more secure.

Here is an old white paper on some things to think about SSH in your infrastructure.

http://www.sans.org/reading-room/whitepapers/vpns/security-i...

Your right in saying this is an unproven application!

Reply on news.ycombinator.com