George Reese - Java Database Best Practices

To my beautiful wife, Monique, and the child she carries.

Database applicationsrequire an entire network of software in order to function. Even themost basic of database applicationsthe command-line SQLtoolis a complex system involving the database engine and aseparate client utility. Architecture is the space in which all ofthe elements of an application operate. Before we look at each ofthose elements, we should first take a look at the space itself.

Architecture identifies the hardware and software necessary tosupport an application and specifies how those tools communicatewithin a network. When referring to architecture, different peopletend to have different things in mind. In some cases, architecturerefers to the way hardware is placed on a physical network. This kindof architecture is called network architecture .Other times, however, architecture refers to the systemarchitecture the way different logical and physicalcomponents work together to create a complex network application. Thelast kind of architecture is softwarearchitecture , when architecture refers to the design of one of the pieces of software that make upthe system architecture.

is a simple network architecture diagram.

Figure 1-1. A database server in a network architecture diagram

It shows how the network separates the Internet from the network inwhich the web server runs with a firewall. Similarly, this networkdiagram places the database server in a separate network segment,again separated by a firewall. In spite of the fact that very littleabout network architecture is specific to database applications, itcan make a significant impact on the performance of thoseapplications. It is therefore helpful to understand those aspectsmost relevant to database systems.

Segmentation is the way in which thenetwork is divided for performance and security. Routers, bridges,and firewalls are all tools of network segmentation.

The first rule of segmentation is to divide your network into regionsof equal hostility and sensitivity. Hostility describes the attitude of people with access to a given networksegment. The Internet, for example, is considered an extremelyhostile network. Your home networkassuming you have nochildrenis conversely minimally hostile.

Sensitivity represents the risk profile ofthe data within a network segment. A high-risk profile means thatpublic exposure or destruction of the data can cause significantharm. A sensitive network segment is therefore one that houses datathat must be kept private at all costs. IRS database servers have avery high degree of sensitivity, whereas a Quake server ranks on thelow end.

BEST PRACTICE : Place yourdatabase servers on a high-sensitivity, low-hostility networksegment. In other words, you should never place a database serverdirectly on the Internet or a network segment that is even routable tothe Internet.

If two software components have very different levels of sensitivity,they should be on different network segments separated by firewallsthat limit the interaction between their networks. Because databasesserve as primary data storage points, they tend to have highersensitivity profiles than other software components. As a goodgeneral rule of thumb, database servers should be protected in ahigh-security network segment. In , forexample, a firewall separates the web server from the databaseserver.

BEST PRACTICE : Segment your network into regions of equal hostility and sensitivity.

Databasesare the fountain from which data streams to all kinds of applicationson the network. It is therefore criticalespecially forhigh-volume database serversto allocate the necessarybandwidth to database servers. It is not uncommon for databaseservers to be connected to the network through multiple fiber-basedgigabit Ethernet ports.