Comments on: Always Use Protection http://blog.softlayer.com/2009/always-use-protection/ A Behind the Scenes Look at the Best Hosting Provider in the World Fri, 17 May 2013 09:41:29 +0000 hourly 1 http://wordpress.org/?v=3.4.1 By: Richy C. http://blog.softlayer.com/2009/always-use-protection/comment-page-1/#comment-1190 Richy C. Wed, 06 May 2009 14:28:47 +0000 http://theinnerlayer.softlayer.com/?p=670#comment-1190 Hi James - good post, but I've got a couple of questions Firewalls What's your personal (and even Softlayer's "official" position) on Hardware firewalls vs Software firewalls. Yes, the traffic reaches your server (and hence uses up your bandwidth) on the software firewall and if you come under a DoS it'll drive your CPU usage through the roof - but are there any other disadvantages/advantages? Passwords As Jeff Atwood has just experienced, you should use a different password for different things ( see http://www.codinghorror.com/blog/archives/001263.html ). However, is it worth considering building support for One Time Passwords into your application (such as the Softlayer Portal)? Or, for less security orientated sites, how about only using OTPs? (I asked the same question a few weeks ago on my own blog at http://blog.rac.me.uk/2009/04/16/techy-token-authentication-instead-of-passwords/ but no responses yet :( ). Hi James – good post, but I’ve got a couple of questions

Firewalls
What’s your personal (and even Softlayer’s “official” position) on Hardware firewalls vs Software firewalls. Yes, the traffic reaches your server (and hence uses up your bandwidth) on the software firewall and if you come under a DoS it’ll drive your CPU usage through the roof – but are there any other disadvantages/advantages?

Passwords
As Jeff Atwood has just experienced, you should use a different password for different things ( see http://www.codinghorror.com/blog/archives/001263.html ). However, is it worth considering building support for One Time Passwords into your application (such as the Softlayer Portal)? Or, for less security orientated sites, how about only using OTPs? (I asked the same question a few weeks ago on my own blog at http://blog.rac.me.uk/2009/04/16/techy-token-authentication-instead-of-passwords/ but no responses yet :( ).

]]>