Questions tagged [architecture]
The architecture tag has no summary.
118 questions
0
votes
0
answers
54
views
What are the correct technical terms for OS-level and application-level management of TLS and cryptographic policy?
When writing technical documentation, I want to accurately describe the different parts of an operating system that manage secure communications, such as TLS protocol versions, cipher suites, and ...
- 101
0
votes
0
answers
64
views
Is there any research on quantifying the security risks associated with certain design decisions. e.g. DMZ or No DMZ
I have an application that is designed to be installed in a distributed fashion (Firewall | WebApp in DMZ | Firewall | AppServer | DatabaseServer || Security), but which can also run if everything is ...
- 101
1
vote
0
answers
96
views
Have there been any attempts at implementing declarative security in Go?
A recurring problem when implementing authorisation checks using procedural code is that you end up duplicating a lot of checks across your codebase and it is easy to forget to apply a check, or ...
- 136k
1
vote
0
answers
114
views
Separate DNS servers for non-domian hosts and users
In our organization we have 2 Active Directory DCs which also uses as DNS servers for all our infrastructure (user PCs, domain and non-domain servers, wi-fi clients, vpn users). I have doubts about ...
2
votes
1
answer
177
views
Does revealing semantic similarity scores between AES-encrypted data create an exploitable side channel?
Background: My expertise is in machine learning/AI, not cryptography, so I apologize if I'm missing fundamental security concepts. I'm trying to build a privacy-preserving AI agent system and want to ...
- 123
4
votes
4
answers
1k
views
Ideal system architecture for sensitive data access through DMZ
I'm trying to figure out the best approach for handling external requests. I am working on a system where the application is currently sitting outside (DMZ) and the DB is inside. The specific port ...
- 43
4
votes
2
answers
328
views
Logging Strategy (high costs for storing all logs)
In our organization, we use a GCP setup with Kubernetes. We generate tons of firewall logs as we provide a digital service that generates a high volume of requests from our users. Storing all these ...
- 41
0
votes
0
answers
94
views
Is creating an internal API within a VPN a recommended practice for securing database access for customer-facing applications?
The InfoSec team of the client I work with has mandated that any customer-facing application's backend should not directly access the database for that application. They require we create another ...
- 1
0
votes
0
answers
133
views
Are centralized credentials an antipattern?
At my organization we have a lot of servers. We have many common manual maintenance tasks that we'd like to automate. There's currently three approaches we're fighting over internally:
Ops engineers ...
- 1
1
vote
2
answers
1k
views
In general terms does the use of ARM architecture pose any security benefits or risks over other architectures such as x86 and x64?
For example considering that ARM has TrustZone technology, and a potential reduced attack vector because it is based on a simpler RISC (Reduced Instruction Set Computing) based architecture instead of ...
- 7,733
0
votes
1
answer
376
views
No csrf token, instead sessiontokens?
Will a random-generated-session-key be enough, so that I can end the usage of csrf token? The front end, will receive the token when logged in. It will be stored in «local storage» at the client’s ...
1
vote
1
answer
197
views
In a system architecture, to what extent an admin user should have access to consumer resources?
Let's say I'm building a system, similar to a very simple ecommerce.
Users can sign up as consumer and start buying products.
Purchases are then stored in the database together with the order status, ...
- 23
1
vote
0
answers
194
views
Is there a real gain in terms of security by not using a reverse proxy?
I need to implement a web application consisting of the components
FE (Nginx + React.js)
BE (Java SpringBoot)
DB (MySQL)
For simplicity we will assume that the DB runs in localhost on BE's machine.
...
- 11
0
votes
0
answers
112
views
Prevention of User Tampering the API by Serverless clients which are in sync with the real world client
As we all know, never trust the client, when they send data to your server. However what if you prevent data manipulation by completely restructuring the architecture to something like the following:
...
- 101
0
votes
1
answer
1k
views
SSH over HTTPS or Directly open Non Standard port
We have a situation where we have an architecture that calls for a Web based UI for querying some data and the data input is through rsync over SSH. I think it would be easier to manage and more ...
- 103