The bxp Infrastructure - Revision history

Thomas Glennon at 12:30, 24 May 2022

2022-05-24T12:30:05Z

Thomas Glennon at 12:24, 24 May 2022

2022-05-24T12:24:33Z

Thomas Glennon at 12:21, 24 May 2022

2022-05-24T12:21:43Z

Meabh Landers at 15:55, 10 February 2021

2021-02-10T15:55:39Z

Robert Carson: /* Security */

2018-02-08T12:06:49Z

‎Security

Robert Carson: /* Database */

2018-02-08T12:03:23Z

‎Database

Robert Carson: /* Web */

2018-02-08T12:03:07Z

‎Web

Thomas Glennon at 10:33, 13 January 2017

2017-01-13T10:33:34Z

Thomas Glennon at 15:35, 1 December 2016

2016-12-01T15:35:50Z

Philip Lacey at 09:54, 4 October 2016

2016-10-04T09:54:05Z

@@ Line 38: / Line 38: @@
-==Security==
+==Firewall Security==
-The high available firewalls are implemented using AWS' network firewalls. This is a managed service with AWS. The Network Firewall includes features that provide protections from common network threats. AWS Network Firewall’s stateful firewall can incorporate context from traffic flows, like tracking connections and protocol identification, to enforce policies such as preventing bxp's metwork from accessing domains using an unauthorized protocol. AWS Network Firewall’s intrusion prevention system (IPS) provides active traffic flow inspection so bxp can identify and block vulnerability exploits using signature-based detection. AWS Network Firewall also offers web filtering that can stop traffic to known bad URLs and monitor fully qualified domain names.
+The high available firewalls are implemented using AWS' network firewalls. This is a managed service with AWS. The Network Firewall includes features that provide protections from common network threats. AWS Network Firewall’s stateful firewall can incorporate context from traffic flows, like tracking connections and protocol identification, to enforce policies such as preventing bxp's metwork from accessing domains using an unauthorized protocol. AWS Network Firewall’s intrusion prevention system (IPS) provides active traffic flow inspection so bxp can identify and block vulnerability exploits using signature-based detection. AWS Network Firewall also offers web filtering that can stop traffic to known bad URLs and monitor fully qualified domain names. For more information visit (https://aws.amazon.com/network-firewall/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc)
 ==Load Balancing==
-The load balancers are implemented using highly available AWS Application/Network Load balancers. This service allows us to protect our encrypted HTTPS connections ensuring the usage of strong TLS1.2 and cipher suite technology.
+The load balancers are implemented using highly available AWS Application/Network Load balancers. This service allows us to protect our encrypted HTTPS connections ensuring the usage of strong TLS1.2 and cipher suite technology. For more information (https://aws.amazon.com/elasticloadbalancing/)
 ==Server Monitoring==

@@ Line 11: / Line 11: @@
 =Physical Infrastructure=
-bxp software is hosted from the AWS data facility hosted within Ireland (eu-west-1)
+bxp software is hosted from the AWS data facility hosted within Ireland (eu-west-1). This Data center and the off-site disaster recovery site for bxp are ISO27001 Certified. (https://d1.awsstatic.com/certifications/iso_27001_global_certification.pdf)
 =Secure Design=
@@ Line 40: / Line 40: @@
 ==Security==
 The high available firewalls are implemented using AWS' network firewalls. This is a managed service with AWS. The Network Firewall includes features that provide protections from common network threats. AWS Network Firewall’s stateful firewall can incorporate context from traffic flows, like tracking connections and protocol identification, to enforce policies such as preventing bxp's metwork from accessing domains using an unauthorized protocol. AWS Network Firewall’s intrusion prevention system (IPS) provides active traffic flow inspection so bxp can identify and block vulnerability exploits using signature-based detection. AWS Network Firewall also offers web filtering that can stop traffic to known bad URLs and monitor fully qualified domain names.
@@ Line 48: / Line 49: @@
 Live 24/7 monitoring from our AWS support team, with alerts and calls to bxp team if required.
 An ISMS for our servers is monitored by Datadog HQ (https://www.datadoghq.com/product/)
@@ Line 55: / Line 57: @@
 ==Database==
 The web servers are implemented using Windows Server on a virtualised basis.

@@ Line 1: / Line 1: @@
 =Overview=
-[[File:stacks_001.png|right|300px]]
+[[File:stacks_001.png|right|300px]]The bxp software (bxp) infrastructure is a multi-tier design to delivery high availability with our own private infrastructure within Amazon Web Services. [[Bxp_software_in_AWS_Cloud_Services]]
-bxp is built on a WAMA stack (Windows, AWS, MySQL, ASP).
+bxp is built on a WIMA stack (Windows, IIS, MySQL, ASP).
@@ Line 12: / Line 11: @@
 =Physical Infrastructure=
 AWS provide numerous high level interconnects to provide redundant Internet connectivity.
@@ Line 28: / Line 38: @@
 ==Load Balancing==
-The load balancers are implemented using CentOS on a virtualised basis.
+The load balancers are implemented using highly available AWS Application/Network Load balancers. This service allows us to protect our encrypted HTTPS connections ensuring the usage of strong TLS1.2 and cipher suite technology.
 ==Web==
-The web servers are implemented using Windows Server 2012 R2 x64 on a virtualised basis.
+The web servers are implemented using Windows Server on a virtualised basis.
 ==Database==
-The database servers are implemented using Windows 2012 R2 x64 on a dedicated rack server basis.
+The web servers are implemented using Windows Server on a virtualised basis.
 =Logical Infrastructure=
@@ Line 71: / Line 85: @@
 Strong security and operational procedure controls ensure this segregation is maintained by all personnel with access. All interactions are auditable.
 ==Server Patching Process==
-Servers are checked for patches and updates daily.  These updates are downloaded and installed as soon as they are spotted. The restart for the updates and patches to take effect is executed nightly.
+Servers are checked for patches and updates daily.  These updates are downloaded and installed on Thursday evenings as part of bxp' scheduled maintenance hours 22:30-00:30. The exception is made for zero-day updates which are conducted asap.

@@ Line 1: / Line 1: @@
 =Overview=
 [[File:stacks_001.png|right|300px]]
-The bxp software (bxp) infrastructure is a multi-tier design to delivery high availability with our own private infrastructure within Sungard Availability Services campus in Parkwest. [[Bxp_software_in_Sungard]]
+The bxp software (bxp) infrastructure is a multi-tier design to delivery high availability with our own private infrastructure within Amazon Web Services. [[Bxp_software_in_AWS_Cloud_Services]]
-bxp is built on a WIMA stack (Windows, IIS, MySQL, ASP).
+bxp is built on a WAMA stack (Windows, AWS, MySQL, ASP).
@@ Line 12: / Line 12: @@
 =Physical Infrastructure=
-Sungard provide numerous high level interconnects to provide redundant Internet connectivity.
+AWS provide numerous high level interconnects to provide redundant Internet connectivity.
@@ Line 71: / Line 71: @@
 Strong security and operational procedure controls ensure this segregation is maintained by all personnel with access. All interactions are auditable.

@@ Line 30: / Line 30: @@
 ==Security==
-The firewalls are implemented using Cisco 5510s.
+The firewalls are implemented using Cisco ASA 5512.
 ==Load Balancing==

@@ Line 1: / Line 1: @@
-= Overview =
+=Overview=
 [[File:stacks_001.png|right|300px]]
-The bxp software (bxp) infrastructure is a multi-tier design to delivery high availability with our own private infrastructure within Sungard Availability Services campus in Parkwest.  [[Bxp_software_in_Sungard]]
+The bxp software (bxp) infrastructure is a multi-tier design to delivery high availability with our own private infrastructure within Sungard Availability Services campus in Parkwest. [[Bxp_software_in_Sungard]]
@@ Line 8: / Line 7: @@
 For more information on stacks [https://www.intechnic.com/blog/which-technology-is-right-for-my-website/ | Stack Information]
 Sungard provide numerous high level interconnects to provide redundant Internet connectivity.
@@ Line 22: / Line 19: @@
 [[File:BER8SER2Infrastructure.png|800px]]
@@ Line 31: / Line 29: @@
-== Security ==
+==Security==
 The firewalls are implemented using Cisco 5510s.
@@ Line 40: / Line 36: @@
-== Load Balancing ==
+==Load Balancing==
 The load balancers are implemented using CentOS on a virtualised basis.
-== Web ==
+==Web==
 The web servers are implemented using Windows Server 2008 R2 x64 on a virtualised basis.
-== Database ==
+==Database==
 The database servers are implemented using Windows 2008 R2 x64 on a dedicated rack server basis.
-= Logical Infrastructure =
+=Logical Infrastructure=
-== Data Segregation ==
+This area is often referred to as multi-tenancy or multitenancy. Multi-tenancy is an architecture in which a single instance of a software application serves multiple customers. Each customer is called a tenant. In the case of bxp, the software does share common functionality, but each system is a separate instance, as is each separate database. [https://en.wikipedia.org/wiki/Multitenancy Wikipedia - Multitenancy]
-== Database segregation ==
+Strong security and operational procedure controls ensure this segregation is maintained by all personnel with access. All interactions are auditable.
+==Server Recovery Process from back-ups==
-Each database is combined with the web segregation to provide full and unique audit trails for all interactions with that database.  This is part of the design of the bxp solution.
+On request from All n One, the target server is booted by Sungard AS from an R1soft Live CD. The Sungard AS engineer is prompted for information to enable the recovery software to connect to the R1Soft server. Once connected, the engineer chooses a server image to recover and a point in time to recover to. The necessary data (disk blocks) are then copied from the Disk Safe on the R1Soft server and written to the disk(s) on the target server. Once this restoration process is complete, the target server can be rebooted without the Live CD and normal service is resumed (subject to any caveats e.g. software licensing tied to the original server's UUID, MAC address changes, etc.)
-Strong security and operational procedure controls ensure this segregation is maintained by all personnel with access.  All interactions are auditable.
+==Server Patching Process==
+The database server is the one exception where as updates are installed weekly and implemented weekly.

← Older revision	Revision as of 15:35, 1 December 2016
Line 97:	Line 97:


	+	== Server Recovery Process from back-ups ==

	+	On request from All n One, the target server is booted by Sungard AS from an R1soft Live CD. The Sungard AS engineer is prompted for information to enable the recovery software to connect to the R1Soft server. Once connected, the engineer chooses a server image to recover and a point in time to recover to. The necessary data (disk blocks) are then copied from the Disk Safe on the R1Soft server and written to the disk(s) on the target server. Once this restoration process is complete, the target server can be rebooted without the Live CD and normal service is resumed (subject to any caveats e.g. software licensing tied to the original server's UUID, MAC address changes, etc.)