Summary

When sufficient perimeter network defenses are in place, many of the threats that affect middle- tier application servers come from inside of an organization. A secure infrastructure that consists of IPSec policies that restrict access to the application server from selected Web servers only, and also provide secure communication channels, is an effective risk mitigation strategy.

This chapter has shown you additional security measures. These measures differ depending on the technology used on the application server.

Internal firewalls on either side of the application server present other issues. The ports that must be open depend on application implementation choices, such as transport protocols and the use of distributed transactions.

For a checklist that summarizes the steps in this chapter, see "Checklist: Securing Your Application Server" in the "Checklists" section of this guide.