To hell and back
Dave Shea sees hell like I have in the past. Here’s my account of: I got cracked and how. This incident forced me to look at security that—I thought previously—wasn’t my job. I almost hung my boots up in the process.
Following this, I wrote a few connected posts: Why phishing works, Clarity of links and Pharming on the web using blogs. The point is—if you make publishing online your business, then there are no excuses for not making its security your business too.
Here’s what I do to ensure my site’s relative security:
- I choose a host, first based on recommendation, good track record.
- I keep my (blogging, content management) software up to date.
- I use sFTP (in passive mode) and SSH to connect to my site for uploading, downloading and modifying things there.
- I use file permissions with care.
- I take weekly backups—all files (at least the modified ones) and databases.
- I avoid inserting unknown scripts (of any kind, particularly javascripts) in my pages. (They pose security threats—open back doors to your site on your server.)
- I pay attention to server logs. (They often have a story to tell. Note: server logs and stat services aren’t one and the same. Usually stat services are unaware of happenings on your server.)
- I pay special attention to modified files on server.
- I hear warning bells when people, security consultants tell me that my site is acting like Paypal’s or some bank’s login. (This is when shit has already hit the fan; and I’ve been there once before.)
Any additional site security tips are most welcome.
Web security is not only a responsibility of the user, but also of the service provider. For the last few years that I have been in this arena, mistakes and misconfiguration at service provider end have caused more compromises than user ignorance. While your pointers on website security are good enough for an average content publisher, I think it is not bad to subscribe to few blogs that talk about latest vulnerabilities. The first and most noted one that comes to my mind is of Jeremiah Grossman.
Talking about Mezzoblue and other DreamHost f**k-up, this time it was the passwords getting leaked. All known security controls are likely to fail once someone can crack open the passwords.
Jun 6, 07 at 16:32Yes, I agree. I have always thought it was of the service provider first. A good service provider is one that keeps the user on his toes to update older and insecure items, that he is responsible for. That way, both win.
Good point, thanks.
Jun 7, 07 at 10:13