• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Securing my webserver

K

killboy

Weaksauce
Joined
Aug 16, 2003
Messages
110
Hello, I'm trying to open up a web business and i need some help securing my server against hackers. I've already done security scans and I know the flaws.
Is there any service out there that I can hire to secure my server?

I couldn't find any services (everyone seems to want to sell me security scans... i already have that, i want a company that can FIX IT) so I figured i'd ask here.
Thanks
 
Easy:

1) Get a hardware firewall in front of your webserver, and deny all traffic to your box except which is absolutely neccessary (TCP/80, TCP/443 if you are using SSL).

2) Keep up-to-date with vendor patches.


Congrats, you are now safe from 99% of the attacks on the internet.
 
First and foremost: Education. For example, you didn't tell us what web server you were using, nor what OS. If you want to have any services done by an outside company, you are going to want to be up to date on the terms, if only to make sure they aren't scamming you.

Find out what you are using, and go get some books.
 
I agree with the education bit posted above. If you don't know the server OS, software, etc.. well enough to follow the instructions provided by your 'security scan tool' to fix them, you aren't in a position to run a secure server. yet. Hardware firewall out front will help, patches up to date will also help, like the other guy said, you'll be safe from 99% of the stuff out there. Worms and such anyhow.

More information would be helpful.
 
Automated Security scans are not exactly foolproof, in other words you could be seeing false positives and most automated scans are independent of the acutal web code you'll be running.

Many websites are hacked thru methods that are not a fault of the webserver platform, but more to do with the backend programming of the website itself.

Point is and as others have pointed out, education is the key to running a secure server.
 
Good points SJ, very thorough of you. You are VERY right about the whole false-positive issue. Step one though, for this fellow, is learn up!
 
Because I failed to mention the OS does not mean that I do not know the OS.
We're trying to set up Suse with apache & SSL... and I'd want to have either Plesk or Cpanel running on there too.

Even though they say if you want something done right, do it yourself. I am the manager and do not have time to learn more about linux. Not to mention I haven't really played around with linux much and it would take weeks to get this thing up.

Now, we do have a firewall blocking all the unnecessary ports but the remaining open ports cause security problems. And although I'm pretty sure it's an automated scan, it's still done by a 3rd party organisation and we need to pass it or appeal any false negatives.

Finally, 'patching up' everything to the latest version as an answer.... patching things broke other things and in some cases we already had the latest patches.

So my question remains, where can I get professional help ?
 
killboy said:
Because I failed to mention the OS does not mean that I do not know the OS.
We're trying to set up Suse with apache & SSL... and I'd want to have either Plesk or Cpanel running on there too.

Even though they say if you want something done right, do it yourself. I am the manager and do not have time to learn more about linux. Not to mention I haven't really played around with linux much and it would take weeks to get this thing up.

Now, we do have a firewall blocking all the unnecessary ports but the remaining open ports cause security problems. And although I'm pretty sure it's an automated scan, it's still done by a 3rd party organisation and we need to pass it or appeal any false negatives.

Finally, 'patching up' everything to the latest version as an answer.... patching things broke other things and in some cases we already had the latest patches.

So my question remains, where can I get professional help ?
Click to expand...

Hire a consultant :p ?

Seriously though you need to determine your budget for these kinds of things as security is not a one time thing. Once the platform has been hardened and all security issues "resolved" there still is a need to setup logging and monitoring for potential / unknown security threats and then there is code reviews for any possible flaws in applications as well. Your going to need to ask yourself how specific with security you need to get with your business and since you haven't given any information on what kind of web business, we can't give you a straight answer.

Where to find help? Start with local consultants and tech firms who do computer security. It really depends on if you want someone there in person, or if your content with having all the work done remotely. Try Google as well.

I will tell you this much though, be prepared to shell out some major cash if you want things done right thru the likes of iss.net
 
killboy said:
Because I failed to mention the OS does not mean that I do not know the OS.
We're trying to set up Suse with apache & SSL... and I'd want to have either Plesk or Cpanel running on there too.

Even though they say if you want something done right, do it yourself. I am the manager and do not have time to learn more about linux. Not to mention I haven't really played around with linux much and it would take weeks to get this thing up.
Click to expand...

How critical is this webserver to your business? You are a manager, so I can understand wanting to delegate this out, but you are going to want someone on staff handle this if it's even moderately critical to the business. And that means education. Or a consultant. I've always found it's better to have someone on hand, personally responsible for it, in this kind of situation.

And, if you don't mind me saying, saying you don't have time for it is a cop out. It's not that hard, and if it's important to the business, you should learn enough of it to be passingly familar with the terms. I'm not saying you learn tcp/ip, http, https, ect... inside and out. I am saying know enough on your own so you can do the job if needed. You'll save yourself a bunch of time that way.
 
killboy said:
We're trying to set up Suse with apache & SSL... and I'd want to have either Plesk or Cpanel running on there too.

Even though they say if you want something done right, do it yourself. I am the manager and do not have time to learn more about linux. Not to mention I haven't really played around with linux much and it would take weeks to get this thing up.
Click to expand...

That's really not a good excuse, to be honest. If you're trying to run a webserver - and make sure it's secure - you'll need to hire a server administrator with security experience to maintain the machine. As said above, security is not a checklist (do A, then B, then C, then system is secure!) -- it's an ongoing process, keeping on top of patches, etc. Linux isn't that easy for someone not familiar with it to keep secure, so I'd really recommend finding someone dedicated.

You also need to ensure that your application itself is done using secure coding (an entirely separate train of thought that could go on for hours) so that it doesn't have any flaws in it either. I can secure your Linux/Apache machine as best as I know how, but if your application is vulnerable to SQL injection or you have some other flaw in it, all of my securing will be for nothing - the application will be vulnerable.
 
You must log in or register to reply here.
Back
Top