I am in the process of building a new environment for my company's Customer Relationship Management (CRM) system. This system is a commercially available product which uses SQL Server as its back end database. The CRM system also uses SQL Server Reporting Services (SSRS) to query the CRM database to provide reports. The database which is queried by SSRS is the live OLTP database - there is no separate reporting database.
There is some debate in my team on whether it is acceptable from a security point of view to run SQL Server Reporting Services on the same server which hosts the CRM database, or whether it must be run on a separate server.
The specific security concern is that running SSRS on the server increases the attack surface, which increases the likelihood that the server will be compromised by a bad guy. If the SSRS server were compromised it would be better if it weren't also hosting the CRM database with all its valuable data.
The counter argument is that if a bad guy wants the data, they will attack the CRM database server directly and won't be fooled by the presence of an SSRS server nearby. Also, all of this is on the internal network, so should be at relatively low risk of attack in the first place.
Is running SSRS and an OLTP database on the same server contra-indicated for security reasons?