Choose a hosting provider - Revision history

Bill at 19:06, 28 May 2014

2014-05-28T19:06:39Z

Bill at 19:00, 28 May 2014

2014-05-28T19:00:05Z

Bill: /* Features */

2014-05-27T18:15:06Z

‎Features

Bill at 17:30, 27 May 2014

2014-05-27T17:30:55Z

Bill: /* Threat Mitigation */

2014-05-26T20:00:11Z

‎Threat Mitigation

Bill: /* Mitigation */

2014-05-26T19:59:16Z

‎Mitigation

Bill: /* Mitigation */

2014-05-26T19:57:31Z

‎Mitigation

Bill: /* Mitigation */

2014-05-26T19:57:00Z

‎Mitigation

Bill: /* Criteria */

2014-05-26T15:33:39Z

‎Criteria

Bill at 15:17, 26 May 2014

2014-05-26T15:17:27Z

@@ Line 7: / Line 7: @@
 *Reputation - are they well known, have they had security breaches or reports of poor support, do they adhere to certain principles inline with that of your organisation - such as data privacy or protection of human rights defenders.
 *Specialisation - do they work in the field of human rights, software applications or general hosting
-*Is mail provided - for many organisation it is not an option to run their own mail server, however, is they do not wish to sue a free service such as [riseup.net Riseup] or [gmail.com gmail], or if they wish to have domain specific email - such as info@mywebsite.org - then it is worth considering services that provide free email accounts.
+*Is mail provided - for many organisation it is not an option to run their own mail server, however, is they do not wish to sue a free service such as [https://riseup.net Riseup] or [https://gmail.com gmail], or if they wish to have domain specific email - such as info@mywebsite.org - then it is worth considering services that provide free email accounts.
 *Hardware specifications - does the server fits my needs? For most websites basic servers are enough but websites with high traffic can demand more stable or dedicated hardware.
 *Operating systems offered - different operating systems provide different functionality and integration with other applications. They also have different degrees of vulnerability and support.

@@ Line 92: / Line 92: @@
 For more details see [[Access_Restrictions#Dedicated/VPS_HOSTING| see]]
-'''System and Software Management'''
+'''System and Software Management''' is primarily concerned with ensuring that the physical system and its software is setup in the most mangeable, maintainable way and that attention is paid to keeping everything up to date to avoid potential vulnerabilities.
 For more details see [[System_Management| see]]
-'''Webserver Setup'''
+'''Webserver Setup''' is an important consideration when hosting a website. There are a variety of steps that can be taken to lock down a webserver and to make sure that no vulnerabilities or accidental leaks occur.
 For more details [[Webserver_setup| see]]
@@ Line 109: / Line 109: @@
 ===Hosted platform===
 For organisation that wish to setup their own custom site based on an existing platform such as Wordpress.com, there are a setup of steps that should be taken to ensure a good level of security. The [[Choosing_A_Host | choosing a hosting provider]] guide should also be consulted.
 '''Platform Security'''
@@ Line 114: / Line 127: @@
 <li>
 Limiting access - Making smart choices that reduce possible entry points available to a malicious person.
 </li>
 <li>Containment - Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.
@@ Line 120: / Line 135: @@
 </li>
 <li>
-Passwords
+Password management - the core component of any digital security strategy is control and management of passwords.
 </li>
 <li>
-File Permissions
+Software updates and system control - allows the user to lock down the system and restrict what applications are running.
-</li>
-<li>
+For more details see [[System_Management| see]]
-Admin user
-</li>
-<li>
-SSL
-</li>
-<li>
-SFTP client
-</li>
-<li>
-Platform updates
 </li>
 </ol>
 ===Shared Hosting===
@@ Line 147: / Line 153: @@
 * http://www.dreamhost.com/web-hosting/
 * http://wpengine.com/ (wordpress only)
 ===Threat Mitigation===
@@ Line 158: / Line 175: @@
 For a basic setup providing a content distribution platform such as a blog users have the option of using existing free services such as Wordpress, Journoportfolio or similar.
 ===Threat Mitigation===

@@ Line 24: / Line 24: @@
 * Server and network statistics, this information helps you track your server and/or website giving you detailed information for debugging, tracking attacks or discovering who is visiting your site.
 * Dynamic components (e.g. adding extra disk space, RAM without rebuilding the machine or having to order a new service)
-* Server access (varies between SSH, SFTP or web based)
+* Server access is the means by which you can physically connect to your server. Options iclude SSH, SSH key, SFTP or web based
-−
 ==Secure hosting setups==

@@ Line 4: / Line 4: @@
 There are several aspects which should be considered when selecting a service host. Below is a general list, this [https://pad.riseup.net/p/rh_ispq document] gives detailed information on each area. eQualit.ie has developed a [https://wiki.deflect.ca/wiki/ISP_reviews review] of existing providers based on experiences with our Deflect network.
-*Price - relative services offered
+*Price - for most groups the cost of the infrastructure will be a major determining factor. however, there are a large number of competitive offers and though this is an important factor it should be used as a boundary to decide what is available not as the sole reason to purchase a service.
 *Reputation - are they well known, have they had security breaches or reports of poor support, do they adhere to certain principles inline with that of your organisation - such as data privacy or protection of human rights defenders.
 *Specialisation - do they work in the field of human rights, software applications or general hosting
-*Is mail provided
+*Is mail provided - for many organisation it is not an option to run their own mail server, however, is they do not wish to sue a free service such as [riseup.net Riseup] or [gmail.com gmail], or if they wish to have domain specific email - such as info@mywebsite.org - then it is worth considering services that provide free email accounts.
-*Hardware specifications
+*Hardware specifications - does the server fits my needs? For most websites basic servers are enough but websites with high traffic can demand more stable or dedicated hardware.
-*Operating systems offered
+*Operating systems offered - different operating systems provide different functionality and integration with other applications. They also have different degrees of vulnerability and support.
-*Supported provided
+*Supported provided - this is an essential aspect when choosing a hosting company. It should also be considered in terms of language support, whether support is provided for software and/or hardware issues.
 *Readily discusses your security concerns and which security features and processes they offer with their hosting.
 *Provides the most recent stable versions of all server software.
@@ Line 19: / Line 19: @@
 It is quite important to consider the possibilities offered by your provider's control panel. If you need to write a support ticket everytime the server has to  reboot, it wont be an efficient process, especially during a crises. Possible features to look out for include
-* Automated operating system installs
+* Automated operating system installs, this feature is hugely useful if it will be necessary to reinstall the operating system on your server. it avoids the need for dedicated time from one of your team members.
-* Server boot and reboot
+* Server boot and reboot, when installing new applications or updating existing software components, or as a means to resolve an issue, the ability to remotely restart your server can be critical. This is dependent on the type of server you are using.
-* Remote console (sometimes known as KVM)
+* Remote console (sometimes known as KVM), this is invaluable in diagnosing issues with your server's physical hardware but equally is a necessity if you wish to perform full disk encryption as a password will have to be entered before the machine has full booted up.
-* Server and network statistics
+* Server and network statistics, this information helps you track your server and/or website giving you detailed information for debugging, tracking attacks or discovering who is visiting your site.
 * Dynamic components (e.g. adding extra disk space, RAM without rebuilding the machine or having to order a new service)
 * Server access (varies between SSH, SFTP or web based)

@@ Line 166: / Line 166: @@
 '''Strong Passwords''' are a core element of any system. The access password for the host should be restricted to those individuals with the organisation that work directly with the server.
-Safe password creation and storage procedures should be followed, as described [|here]
+Safe password creation and storage procedures should be followed, as described [[Access_Restrictions#Dedicated/VPS_Hosting|here]]
 </li>
 <li>

← Older revision		Revision as of 19:57, 26 May 2014
Line 96:		Line 96:

	For more details see [[System_management\| see]]		For more details see [[System_management\| see]]
		+
	'''Webserver Setup'''		'''Webserver Setup'''

@@ Line 86: / Line 86: @@
 ===Mitigation===
 '''Password management''' is the core of any security strategy. For the dedicated and VPS hosting options, there are several modes of control that administrator can apply.
-For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords Force strong passwords]
+For more details [[Access_Restrictions#Dedicated/VPS_Hosting| see]]
-<li>
-Use password aging: the <tt>chaging</tt> command on Linux servers allows checking of password age by user and setting of password aging parameters [http://linoxide.com/linux-command/password-expire-chage-command/ link].
-</li>
-<li>
-In some cases it may be prudent to enabled account locking for accounts that have been under particularly concerted attacks. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html Faillog]. Great care should be taken when enabling user locking as an attacker can simply deny users access to their own services by intentionally locking an account. Generally it is better practice to ban the attacker before the need for account locking is encountered.
-</li>
-<li>
-Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on [https://securityinabox.org/en/keepass_main Keepass]
-</li>
-</ol>
 '''User Management''' on dedicated or VPS systems allow administrators fine grained control of user login and access permissions.
-As well as considering the physical server and it's operating system users must thinking in terms of application security. Especially for those applications which either contain sensitive data or those that provide access routes to the machine for an attacker.
+For more details see [[Access_Restrictions#Dedicated/VPS_HOSTING| see]]
-Below is a set of guides for Apache webserver hardening.
+'''System and Software Management'''
-<li>
-[http://www.tecmint.com/apache-security-tips/ 13 Apache Web Server Security and Hardening Tips]
-<li>
-[http://xianshield.org/guides/apache2.0guide.html Apache 2.0 Hardening Guide]
-</li>
-</ul>
-<ul>
-'''Database hardening'''
-A key approach discussed elsewhere in protecting data, both at rest - on disk - and in use - in memory, is to encrypt these data stores either as part of full disk encryption or as individual restricted encrypted mount points.
+For more details see [[System_management| see]]
-Below are further guides for specific hardening techniques for the MySQL database system.
+For more details [[Webserver_setup| see]]
-<li>
-[http://www.greensql.com/content/mysql-security-best-practices-hardening-mysql-tips MySQL Security Best Practices]
-</li>
-<li>
-[http://rochakchauhan.com/blog/2013/11/19/security-and-hardening-tips-for-mysql/ Security and Hardening Tips for MySQL]
-</li>
-<li>
-[http://www.securethelock.com/2014/01/09/12-steps-for-hardening-mysql-from-attackers/ 12 steps for Hardening MySQL from Attackers]
-</li>
-</ul>
 </div>

@@ Line 92: / Line 92: @@
   password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1
-For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords| Force strong passwords]
+For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords Force strong passwords]
 <li>
-Use password aging: the <tt>chaging</tt> command on Linux servers allows checking of password age by user and setting of password aging parameters [http://linoxide.com/linux-command/password-expire-chage-command/| link].
+Use password aging: the <tt>chaging</tt> command on Linux servers allows checking of password age by user and setting of password aging parameters [http://linoxide.com/linux-command/password-expire-chage-command/ link].
 </li>
 <li>
-In some cases it may be prudent to enabled account locking for accounts that have been under particularly concerted attacks. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html| Faillog]. Great care should be taken when enabling user locking as an attacker can simply deny users access to their own services by intentionally locking an account. Generally it is better practice to ban the attacker before the need for account locking is encountered.
+In some cases it may be prudent to enabled account locking for accounts that have been under particularly concerted attacks. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html Faillog]. Great care should be taken when enabling user locking as an attacker can simply deny users access to their own services by intentionally locking an account. Generally it is better practice to ban the attacker before the need for account locking is encountered.
 </li>
 <li>
@@ Line 112: / Line 112: @@
 </li>
 <li>
-Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, [http://support.suso.com/supki/SSH_Tutorial_for_Linux| SSH tutorial]. Once SSH keys have been set up for all relevant users, disabling password-based logins should be considered.
+Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, [http://support.suso.com/supki/SSH_Tutorial_for_Linux SSH tutorial]. Once SSH keys have been set up for all relevant users, disabling password-based logins should be considered.
 </li>
 <li>
-File permissions should be restricted for critical files. User should only be allowed access to files relevant to their work. Execution as root should be restricted. Discussion of [http://www.linux.com/learn/tutorials/309527-understanding-linux-file-permissions| linux file permissions].
+File permissions should be restricted for critical files. User should only be allowed access to files relevant to their work. Execution as root should be restricted. Discussion of [http://www.linux.com/learn/tutorials/309527-understanding-linux-file-permissions linux file permissions].
 </li>
 </ol>
@@ Line 130: / Line 130: @@
 <ol>
 <li>
-Firewall can be enabled via [http://www.netfilter.org/projects/iptables/| iptables] the guides [http://www.tecmint.com/basic-guide-on-iptables-linux-firewall-tips-commands/| here] and [http://www.cyberciti.biz/faq/category/iptables/| here] describe iptables configuration.
+Firewall can be enabled via [http://www.netfilter.org/projects/iptables/ iptables] the guides [http://www.tecmint.com/basic-guide-on-iptables-linux-firewall-tips-commands/ here] and [http://www.cyberciti.biz/faq/category/iptables/ here] describe iptables configuration.
 </li>
 <li>
@@ Line 142: / Line 142: @@
 Logging and Auditing is a key aspect of server security. All hacking, brute force, DDoS or other attacks should be captured, monitored and analysed.
 <br>
-This [http://www.cyberciti.biz/faq/linux-log-files-location-and-how-do-i-view-logs-files/| guide] describes the location and purpose of common Linux log files.
+This [http://www.cyberciti.biz/faq/linux-log-files-location-and-how-do-i-view-logs-files/ guide] describes the location and purpose of common Linux log files.
 <br>
-To ensure that information is not lost, overwritten or that the logs do not grow infinitely the tool [http://www.thegeekstuff.com/2010/07/logrotate-examples/| Logrotate] can be used.
+To ensure that information is not lost, overwritten or that the logs do not grow infinitely the tool [http://www.thegeekstuff.com/2010/07/logrotate-examples/ Logrotate] can be used.
 <br>
-Installing a tool like Logwatch allows you to monitor and respond to suspicious activity. The following [https://www.digitalocean.com/community/articles/how-to-install-and-use-logwatch-log-analyzer-and-reporter-on-a-vps| guide] describes installing and configuring Logwatch.
+Installing a tool like Logwatch allows you to monitor and respond to suspicious activity. The following [https://www.digitalocean.com/community/articles/how-to-install-and-use-logwatch-log-analyzer-and-reporter-on-a-vps guide] describes installing and configuring Logwatch.
 </li>
 <li>
-[http://selinuxproject.org/page/Main_Page| Security Enhanced Linux(SELinux)] is a kernel level security control mechanism, which enforces a set of rules and procedures for the system. SELinux provides fine grained control for access rights and permissions.
+[http://selinuxproject.org/page/Main_Page Security Enhanced Linux(SELinux)] is a kernel level security control mechanism, which enforces a set of rules and procedures for the system. SELinux provides fine grained control for access rights and permissions.
 <br>
 To check if it is enabled run
@@ Line 173: / Line 173: @@
 </li>
 <li>
-[http://www.fail2ban.org/wiki/index.php/Main_Page| Fail2ban] is an excellent tool that can be used both to combat simple DDoS attacks but also to detect and block brute force login attempts.
+[http://www.fail2ban.org/wiki/index.php/Main_Page Fail2ban] is an excellent tool that can be used both to combat simple DDoS attacks but also to detect and block brute force login attempts.
 </li>
 </ol>
@@ Line 183: / Line 183: @@
 Below is a set of guides for Apache webserver hardening.
 <li>
-[http://www.tecmint.com/apache-security-tips/| 13 Apache Web Server Security and Hardening Tips]
+[http://www.tecmint.com/apache-security-tips/ 13 Apache Web Server Security and Hardening Tips]
 <li>
-[http://xianshield.org/guides/apache2.0guide.html| Apache 2.0 Hardening Guide]
+[http://xianshield.org/guides/apache2.0guide.html Apache 2.0 Hardening Guide]
 </li>
 </ul>
@@ Line 195: / Line 195: @@
 Below are further guides for specific hardening techniques for the MySQL database system.
 <li>
-[http://www.greensql.com/content/mysql-security-best-practices-hardening-mysql-tips| MySQL Security Best Practices]
+[http://www.greensql.com/content/mysql-security-best-practices-hardening-mysql-tips MySQL Security Best Practices]
 </li>
 <li>
-[http://rochakchauhan.com/blog/2013/11/19/security-and-hardening-tips-for-mysql/| Security and Hardening Tips for MySQL]
+[http://rochakchauhan.com/blog/2013/11/19/security-and-hardening-tips-for-mysql/ Security and Hardening Tips for MySQL]
 </li>
 <li>
-[http://www.securethelock.com/2014/01/09/12-steps-for-hardening-mysql-from-attackers/| 12 steps for Hardening MySQL from Attackers]
+[http://www.securethelock.com/2014/01/09/12-steps-for-hardening-mysql-from-attackers/ 12 steps for Hardening MySQL from Attackers]
 </li>
 </ul>
@@ Line 283: / Line 283: @@
 </li>
 <li>
-'''Wordpress Security''' is described in detail in the following [http://codex.wordpress.org/Hardening_WordPress| guide].
+'''Wordpress Security''' is described in detail in the following [http://codex.wordpress.org/Hardening_WordPress guide].
 </li>
 </ol>