Intranet LAN, Internet, Security -Just How good is A5 WAS ??

[forskare]

This thread spanned out of another thread and has to do with security of 'critical data' when usisng a browser to access an in-house app on an intra net. I know I don't know which questions to ask but I suppose the place to start is:

Just how secure is Alpha WAS built in security?

Will other types of security be needed for 'critical data'?

[frankbicknell]

Re: Intranet LAN, Internet, Security -Just How good is A5 WAS ??

I have my data and applications behind a hardware firewall. I use gateway vpn to connect branches. I feel very secure. The Alpha security framework seems to work well. I may at some time open the data to customer access via the internet. The thought of doing that sends shivers down my spine.

[forskare]

Re: Intranet LAN, Internet, Security -Just How good is A5 WAS ??

I have my data and applications behind a hardware firewall. I use gateway vpn to connect branches. I feel very secure. The Alpha security framework seems to work well. I may at some time open the data to customer access via the internet. The thought of doing that sends shivers down my spine.

Is that because of security or just giving them access to the data?

[frankbicknell]

Re: Intranet LAN, Internet, Security -Just How good is A5 WAS ??

Is that because of security or just giving them access to the data?

Connecting my data to the WWW. I think the security is good, but I am not an expert.

[Steve Wood]

Re: Intranet LAN, Internet, Security -Just How good is A5 WAS ??

Will other types of security be needed for 'critical data'? All data is critical.

The WAS is pretty much not important regarding your data security as there really is no way to get to the raw data from a browser. The raw data (DBF tables, SQL tables) are NOT inside the "document root" and therefore not available to any browser user. Where the WAS security does come in if you the programmer, do something specific in your project that leaves grids or dialogs that display data, open to the public - the default condition is that all A5W pages and other components are Deny All. And still, that is for access to pages and component, not the raw data.

The real danger is if you are loose with your FTP, VPN or Remote Desktop connections, passing them out to perhaps other developers like me, and then not changing the access parameters. BTW, there are thousands of hacking attempts per day on all of my servers trying to guess the credentials to my remote desktop.

Because I know how security works, if had FTP access to your web files, I can toggle my privileged to your A5W pages. But that would be violating the first principle, don't share your FTP access, and still, I can only do that with pages, not get to the raw data (unless your FTP pointed to the data or root folder).

If you want to ensure safety IF your DBF tables were stolen, encrypt them. Here is a script from a dialog to encrypt/decrypt from a button (some information faked for security). The default_encryption_key_set("") line sets the "salt" to Alpha's internal value - meaning any Alpha application can use this encrypted file; you can set it to anything you want for more security.

function encryptTables as c (e as p)

msg = "failed"
dim t as P
default_encryption_key_set("")
t = table.open("[PathAlias.ADB_Path]\a_d.dbf",FILE_RW_EXCLUSIVE)
t.encrypt()
t.close()
t = table.open("[PathAlias.ADB_Path]\a_p.dbf",FILE_RW_EXCLUSIVE)
result = t.encrypt()
t.close()

if result =.t.
msg = "successful"
end if
encryptTables = "alert('Encryption "+msg+"');"

end function

function decryptTables as c (e as p)
msg = "failed"
dim t as P
t = table.open("[PathAlias.ADB_Path]\a_d.dbf",FILE_RW_EXCLUSIVE)
t.decrypt()
t.close()
t = table.open("[PathAlias.ADB_Path]\a_p.dbf",FILE_RW_EXCLUSIVE)
result = t.decrypt()
t.close()

if result =.t.
msg = "successful"
end if
decryptTables = "alert('Decryption "+msg+"');"

end function

SQL data security is a different matter, and there are many books on that subject.