IBM Business Process Manager Security: Concepts and Guidance

Chapter 4. Authorization: Access to what 111

4.5.5 Faith in firewalls

And, of course, there’s the ever-present faith in firewalls.

Do not underestimate the amount of information that can be gathered by a curious, motivated,

or perhaps mischievous user. If a user can sniff the network traffic, then they can analyze it. If

they can analyze it, they can spoof it. It is a short path from unencrypted network traffic to

unauthorized access.

Specifically, given Business Process Manager’s ability to perform instance-based

authorization based upon runtime criteria, it is certainly conceivable that someone might be

able to sniff an in-flight process and alter its authorization criteria.

Encrypt all communications links between the following components: ...