EASI Requirements

A key issue in enterprise security architectures is the ability to support end-to-end security across many application components. End-to-end security is the ability to ensure that data access is properly protected over the entire path of requests and replies as they travel through the system. The scope of end-to-end security begins with the person accessing a Web browser or other client program, continues through the business components of the middle tier, and ends at the data store on backend legacy system. The path of data may travel both through public and private networks with varying degrees of protection.

In the enterprise architecture shown in Figure 17.4, a user accesses an application in the presentation layer (a Web browser client sends requests to a Web server), which communicates to mid-tier business components (application servers)^[1]. Frequently, the client request is transmitted through a complex, multitier chain of business components running on a variety of platforms. The request finally makes it to one or more backend legacy systems, which accesses persistent data stores on behalf of the user, processes the request, and returns the appropriate results.

Figure 17.4: Key e-commerce challenge: End-to-end Enterprise Application Security Integration.

To provide end-to-end security, each link in the chain of requests and replies must be properly protected: from the initiating client, through mid-tier business components, to the legacy systems, and then back again to the client. There are three security tiers that comprise any end-to-end enterprise security solution:

• Perimeter security technologies that are used between the client and the Web server. Perimeter security enforces protection for customer, partner, and employee access to corporate resources. Perimeter security protects primarily against external attackers, such as hackers, that are outside of the organization.

• Mid-tier security technologies that are used between the mid-tier business components. Mid-tier security is focused primarily on protecting against insider attacks, but also provides another layer of protection against external attackers.

• Legacy security technologies that address protection of databases and operating system-specific backend systems, such as mainframes and Unix server platforms^[1].