Mitigate Risk By Separating the Workers

E

Eric Hansen

Guest
One strategy that you rarely ever see used in practical situations is separating various services from each other. For example, when I used to work at a web hosting company they had a multitude of servers, but each server carried the load of web+database+email. It wasn't uncommon at all for there to be at least one alert per hour saying that the load was higher than 5.0 (their threshold). Most of the time this was due to either database or web server overload (in either case restarting the service calmed it 99% of the time).

These situations are easy to mitigate, however, and could very well improve the performance all around by just offloading tasks to specific servers. You could also host more people on one server and make management of all the servers even easier as well.

Lets look at another scenario: you have 3 servers that are hosting 500 websites, 50 databases and about 250 emails. That means that at any given time one server is responsible for handling at least 267 requests (800 / 3 = 266.67). For the servers we have these days this isn't horrible, but we all know baseline measurements aren't accurate enough. We have to also account for the fact that there are other services running on each server, dynamic websites aren't usually created very well and some technology (like PHP) can cause a lot of stress very easily on the server.

What if we instead used each server for one purpose? One server would be used for website handling, another for database and lastly email. While this would cause some lag between the website/database and email/database (assuming vhost email set up), being on the same network mitigates that to a fraction of a second, even less when caching is involved.

So now we have 1 server processing 500 websites only, which equals out to about 89 requests at any given time (267 / 3 = 89). When putting into consideration most people use Apache and PHP to handle websites this drastically helps out the load as more resources can be spent processing these requests instead of sharing it across the board.

Even though we haven't touched on it yet there is also a greater security gain from doing this as well, especially in using popular software for the various services: lower chance of losing all data in a security breach.

If you're putting all of your luck into one server to handle web, database, email, etc... then it makes it that much easier to lose all that data should an attack happen on the network. If you separate the work load then if one of the websites you host gets breached you might lose those 500 websites, but you'll still have the database data untouched (especially if you remedy the situation in time ;) ). This could bring some unhappy customers to your support system but knowing not all is lost brings some relief to not only your employees but to your clients as well.
 

Attachments

  • slide.jpg
    slide.jpg
    59.1 KB · Views: 100,338

Members online


Top