Re:Sandboxing and workload isolation
by tptacek on Saturday August 01, 2020 @12:14AM
(#24017520)
No, it wasn't; you couldn't keep code running in a WAR off the network. For a number of years, practically every sitewide pentest I did was gameovered by SSRF off Java application servers. I never even bothered to figure out how tight the isolation between co-resident applications was on those things.
[ Parent
| on HN ]
Sure you can, by packing the network sensitive code into another Java library and using process internal bean calls across domains.
Now if those guys didn't understood the WebSphere capabilities that is another matter.
The idea behind sandboxed execution environments is to make them resilient to insecure application code. You can't address that problem by stipulating that your application is secure!
Neither did I said that, rather that WebSphere does provide the tooling to create such sandboxes, provided one goes through the effort to create the application architecture in a way that those features at put it use.
It doesn't do magic if the users don't bother to use the tools put at their disposal.
This isn't sandboxing at click of button.