
Chapter 2. Access Manager Web-based architecture 35
In Figure 2-1 on page 34, note that the Web server(s) directly serves content and
may perform substantial application processing. Obviously, there is some level of
security risk, depending on the sensitivity of the content and applications
provided by the Web server.
In more advanced scenarios, where content is increasingly driven by complex
applications, there are usually back-end components in the environment. For
example, an application may rely on a large mainframe database, or substantial
portions of the application may execute on back-end systems.
Direct Internet access to such components may present a significant security
risk. Even assuming the Internet-facing firewall uses appropriate filtering to
prevent access, compromise of the firewall could prove disastrous. For this
reason, back-end components may be placed in an internal network, firewalled
from the Internet DMZ, leaving only the Web server component exposed to direct
browser access, as illustrated in Figure 2-2. This “double firewall” architecture
has become common, not only for Internet application access, but increasingly
for internal organization access to critical computing resources as well.
Figure 2-2 Typical advanced Web application architecture
While such architectures successfully address security from a network
perspective, they do not address a larger set of concerns, including:
Security-sensitive information may reside in the static content of Web servers
(for example, human resources, sales, and personal information).
Authentication/authorization may be driven by platform-specific mechanisms.
Internal Network
Data/
Application
Server
Firewall
Web Server
Internet DMZ
Firewall
Internet
Browser
Network Firewall,
often specialized
hardware, such
as Cisco PIX.
Web servers provide
static content and
support application
"front-end" functions.
Often a software
firewall, such as IBM
Firewall or CheckPoint
Firewall-1.
Databases, such as IBM
DB2 or application
servers, such as IBM
WebSphere Application
Server.