Securing Public Web Servers ASHRAY PATEL Roadmap Web

  • Slides: 13
Download presentation
Securing Public Web Servers ASHRAY PATEL

Securing Public Web Servers ASHRAY PATEL

Roadmap �Web server security problems �Steps to secure public web servers �Securing web servers

Roadmap �Web server security problems �Steps to secure public web servers �Securing web servers and contents �Implementing secure network for web server �Network Locations for web servers �Firewall and Routers for Web Servers

Web Server Security Problems �Fraud, theft, vandalism, and terrorism �No matter how low the

Web Server Security Problems �Fraud, theft, vandalism, and terrorism �No matter how low the attack success rate, it will still be able to exploit many systems �Attacks may cause significant time/money loss

Web Server Security Problems �Misconfiguration or other improperations of web servers �Vulnerabilities within the

Web Server Security Problems �Misconfiguration or other improperations of web servers �Vulnerabilities within the web servers � Someone could gain unauthorized access �Inadequate or unavailable defense mechanisms for the Web server � DOS attacks

Steps of Securing Public Web Servers �Securing, installing, and configuring Web server software �Employing

Steps of Securing Public Web Servers �Securing, installing, and configuring Web server software �Employing appropriate network protection mechanisms � Ex) Firewalls �Maintaining the secure configuration through application of appropriate patches and upgrades, security testing, monitoring of logs and backups of data and operating system

Steps of Securing Public Web Servers �Using, publicizing, and protecting information and data in

Steps of Securing Public Web Servers �Using, publicizing, and protecting information and data in a careful and systemic manner �Employing secure administration and maintenance processes �Conducting initial and periodic vulnerability scans of each public Web server and supporting network infrastructure � Ex) Firewalls, routers

Securing Web Servers and Content �Two main components to web server security of the

Securing Web Servers and Content �Two main components to web server security of the underlying server application and operating systems security of the actual content � The obvious is not to place any classified, or other sensitive information on a publicly accessible Web server unless other steps have been taken to protect the information via user authentication and encryption � less obvious component of content security is compromised caused by the way particular types of content are processed on a server can lead to a compromise

Implementing Secure Network for Web Server �Network Location � Network location determines what network

Implementing Secure Network for Web Server �Network Location � Network location determines what network infrastructure can be used to protect the Web server � Network location also determines what other portions of the network are vulnerable if the Web server is compromised �Network element configuration � include firewalls, routers, intrusion detection systems, and network switches � Each has an important role to play and is critical to the overall strategy of protecting the Web server through defense

Network Locations �Some places where network locations would be bad are: On their internal

Network Locations �Some places where network locations would be bad are: On their internal production networks, that is they locate their Web server on the same network as their internal users and servers. This location is not recommended because it exposes the internal network to unnecessary risk of compromise placing the Web server before an organization’s firewall or router that provides IP filtering. In this type of the configuration the network can provide little, if any, protection to the Web server. All security has to be provided by the Web server itself, which provides a single point of failure

Firewall and Routers for Web Servers �Firewalls are devices or systems that control the

Firewall and Routers for Web Servers �Firewalls are devices or systems that control the flow of network traffic between networks � They protect Web servers from vulnerabilities inherent in the TCP/IP suite � They also help reduce the security issues associated with insecure applications and operating systems �A common misperception is that firewalls eliminate all risk and can protect against the misconfiguration of the Web server or poor network design � Firewalls themselves are vulnerable to misconfiguration and, sometimes to software vulnerabilities.

Video �https: //www. youtube. com/watch? v=LFDt. Er 4 K 7 G 8

Video �https: //www. youtube. com/watch? v=LFDt. Er 4 K 7 G 8

Conclusion �Web server security problems �Steps to web server security �Securing web servers and

Conclusion �Web server security problems �Steps to web server security �Securing web servers and contents �Implementing secure network for web servers �Firewalls

Works Cited https: //harrietriyadi. wordpress. com/2013/02/02/gui delines-on-securing-public-web-servers/ http: //www. albany. edu/acc/courses/ia/acc 661/sp 800 -44.

Works Cited https: //harrietriyadi. wordpress. com/2013/02/02/gui delines-on-securing-public-web-servers/ http: //www. albany. edu/acc/courses/ia/acc 661/sp 800 -44. pdf http: //www. hanover. com/risksolutions/guidelines-for -securing-public-web-servers. html