Difference between revisions of "Website"

(Created page with "==Definition== A content publishing site may be from an organisation's own site - where they can publish material about themselves, their work and projects and articles or re...")
 
(Undo revision 3895 by Dmitri (talk))
 
(9 intermediate revisions by 3 users not shown)
Line 1: Line 1:
 
==Definition==
 
==Definition==
 +
A website could be an organisation's main information portal - where they can publish material about themselves, their work and projects and articles or reports that they have produced. It can also take the simpler form of a standalone blog where content is shared with their intended  audience, or may be represented as a forum or wiki where user generated content is published and shared.
  
−
A content publishing site may be from an organisation's own site - where they can publish material about themselves, their work and projects and articles or reports that they have produced, it may also contain informational content or guides for users. It can also take the simpler form of a standalone blog where content is shared with their intended or audience, or may be represented as a forum where user generated content can be shared. It may also combine aspects of all these types.
+
An organisation usually depends entirely on their main website as their presence on the Internet and expects it to function at all times.
−
 
+
−
==Secure system setups==
+
−
Depending on available skill level the following secure system setups are possible:
+
  
 
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px">
 
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px">
 
==High Technical==
 
==High Technical==
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
−
===Dedicated Server===
+
===DIY CMS===
−
For a [[Dedicated_Hosting | Dedicated Hosting]] system, the user can either run their own physical hardware or rent this hardware from a provider. The former solution offers total control of the physical hardware, however, there are significant downsides to this approach and should be avoided; it is only recommend under special circumstances such as [[Sensitive_Data | storing sensitive data]]. In the latter case, the hosting agent provides the hardware but the user has total control of the server via remote access. In this scenario, the provider is responsible for replacement of hardware parts that fail or malfunction - this support is generally done through a ticket system and relies on the user to report errors.
+
There are numerous well developed and 'continually maintained' content mangement systems that you can install and configure from scratch. They differ between their application and intended purpose, the majority however relying on a [http://en.wikipedia.org/wiki/LAMP_(software_bundle) LAMP] or [http://en.wikipedia.org/wiki/WAMP#Variants_and_equivalents_on_other_platforms WAMP] backend. Each CMS has its own particular requirements for webserver, database server and PHP configurations, as well as security considerations for them.  
  
 
'''Benefits'''
 
'''Benefits'''
−
*User has total control of the system's software
+
*Total control of the CMS software, plug-ins, themes and preferred configuration
−
*User has total control of access rights
+
*Fine-grained access control and modification of CMS features
−
*User has control of physical network connection, allowing them to whitelist or block connection from allowed or spurious connections
+
−
*Financial cost of hardware malfunction is not an issue as the host is responsible for replacing/repairing failing hardware
+
−
*The host can be chosen to place the server in a different jurisdiction from that of the user to prevent seizure
+
  
 
'''Downsides'''
 
'''Downsides'''
−
*The user does not have physical access to the server
+
*A whole software ecosystem to learn with every new CMS
−
*The host is not responsible for data loss or downtime if the physical server fails
+
*Responsibility for software updates and malware protection
−
*The time taken to repair a hardware malfunction depends on the provider chosen. See [[Choosing_A_Host | Choosing a hosting provider]].
+
*Responsibility for data security
−
*The contract can be terminated by the host and access to the server can be terminated or suspended depending on the host's terms of use.
+
  
−
===VPS===
+
'''Examples'''
−
A Virtual Private Server(VPS) is an instance of a Virtual Operating System running on a much larger server. Typically multiple VPS will be run on a single server. In a VPS environment, you have a dedicated virtual private server but do not control the server on which it is hosted. Resources will be limited, you can not control or harden the outer server.
+
* [http://codex.wordpress.org/Installing_WordPress Wordpress.com] installation
 +
* [https://civicrm.org/ CiviCRM] is an open source CRm environment intended for civil society use.
 +
* [https://www.djangoproject.com/ Custom Django app], allows for creation quickly of high content, high functionality websites. Django's security systems re well [https://docs.djangoproject.com/en/dev/topics/security/ documented] and well integrated. Development of a Django app will require developer time and potentially also some design work.
 +
* [https://drupal.org/ Custom Drupal site], again a ready made configurable solution, with a developed sense of security integration - though as with the other solutions security relies on a holistic approach including server side security.
 +
'''Hosting Requirements'''
 +
*[[Choose_a_hosting_provider#High_Technical]]
  
−
'''Benefits'''
 
−
*The cost of this type of server will typically be significantly cheaper than a dedicated server
 
−
*Depending on the host, the server will be capable of running most standard server software, up to a certain limit
 
−
*Hardware is managed by the hosting provider unless self hosting
 
−
*If self hosting, a single server can be used for multiple purposes and to provide multiple distinct servers
 
−
 
−
'''Downsides'''
 
−
*Processing power will be limited over a dedicated server but, depending on the hosting provider, should be capable of running small to medium capacity websites
 
−
*Bandwidth will also be restricted
 
−
*The user will not have access to the outer server and will thus not be able to harden it
 
−
 
−
===Threats===
 
−
*Social engineering attack
 
−
*Password Bruteforce
 
−
*Service interruption through Denial of Service attack
 
−
*System software exploits
 
−
*SSL spoofing
 
−
*Data loss or data theft
 
−
 
−
===Mitigation===
 
−
'''Password Management''' is the core of any security strategy. For Dedicated and VPS hosting options, there are several modes of control that administrator can apply.
 
−
<ol>
 
−
<li>
 
−
Enforce strong password - a strong password should contain Upper and Lower case characters, Numbers and Special Characters and should be long; greater than 20 characters. It is also possible to restrict the use of previously used passwords. On Linux systems the following command can be used to force complex passwords for users:
 
−
</li>
 
−
password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1
 
−
 
−
For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords| Force strong passwords]
 
−
<li>
 
−
Use password aging, the chaging command on Linux servers allows checking of password age by user and setting of password aging parameters[link for tutorial on chaging]
 
−
</li>
 
−
<li>
 
−
Failed login attempts should result in the locking of the associated user account. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html| Faillog]
 
−
</li>
 
−
<li>
 
−
Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on [https://securityinabox.org/en/keepass_main| Keepass]
 
−
</li>
 
−
</ol>
 
−
'''User Management''' on Dedicated or VPS systems allow administrators fine grained control of user login and access permissions.
 
−
<ol>
 
−
<li>
 
−
Root user login should be disabled by default
 
−
</li>
 
−
<li>
 
−
Secure Shell(SSH) login should be forced, telnet and ftp login access should be disabled by default. To upload files to the server securely user can use Secure FTP(SFTP) clients.
 
−
</li>
 
−
<li>
 
−
Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, [http://support.suso.com/supki/SSH_Tutorial_for_Linux| SSH tutorial]
 
−
</li>
 
−
<li>
 
−
File permissions
 
−
</li>
 
−
</ol>
 
−
'''Software Management'''
 
−
<ol>
 
−
<li>
 
−
System software must always be uptodate. Critical patches are released by software vendors and operating system providers on a regular basis. These handle potential exploits, if your system is not uptodate it may be vulnerable. The clearest example of this is the SSL bug [https://heartbleed.com|HeartBleed].
 
−
</li>
 
−
<li>
 
−
Minimising installed software is an important step in reducing potential vulnerabilities. The system should have the bare minimum of packages and software installed to support its purpose.
 
−
</li>
 
−
</ol>
 
−
'''System Management'''
 
−
<ol>
 
−
<li>
 
−
Firewall, iptables
 
−
</li>
 
−
<li>
 
−
Check listening ports
 
−
</li>
 
−
<li>
 
−
Logging and Auditing
 
−
</li>
 
−
<li>
 
−
Anti-intrusion system,
 
−
</li>
 
−
<li>
 
−
SELinux
 
−
</li>
 
−
<li>
 
−
fail2ban
 
−
</li>
 
−
</ol>
 
−
'''Apache'''
 
−
'''Database'''
 
−
'''Web app'''
 
−
brief desc for these three with link to web app guide
 
 
</div>
 
</div>
 
</div>
 
</div>
Line 122: Line 34:
 
==Intermediary Technical==
 
==Intermediary Technical==
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
−
===Hosted platform===
+
===Hosted CMS===
−
For organisation that wish to setup their own custom site based on an existing platform such as Wordpress.com, there are a setup of steps that should be taken to ensure a good level of security. The [[Choosing_A_Host | choosing a hosting provider]] guide should also be consulted.
+
  
−
'''Platform Security'''
+
'''Benefits'''
−
<ol>
+
* Dependent on hosting package, support and updates will be handled by provider reducing need for tech knowledge
−
<li>
+
* Straightforward and fast to setup
−
Limiting access - Making smart choices that reduce possible entry points available to a malicious person.
+
* Greater usability for low tech users
−
</li>
+
* Potential lower cost
−
<li>Containment - Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.
+
 
−
</li>
+
'''Downsides'''
−
<li>Preparation and knowledge - Keeping backups and knowing the state of your WordPress installation at regular intervals. Having a plan to backup and recover your installation in the case of catastrophe can help you get back online faster in the case of a problem.
+
* Subject to terms and conditions of provider - controversial information or information that draws large scale attacks such as DDoS may cause provider to rescind service.
−
</li>
+
* No control of hardware systems
−
<li>
+
* Reliant on provider for software security updates to be applied
−
Passwords
+
* Limited control of jurisdiction or geography area that site is hosted within.
−
</li>
+
* Reliance on providers support, which may not be available in local language
−
<li>
+
−
File Permissions
+
−
</li>
+
−
<li>
+
−
Admin user
+
−
</li>
+
−
<li>
+
−
SSL
+
−
</li>
+
−
<li>
+
−
SFTP client
+
−
</li>
+
−
<li>
+
−
Platform updates
+
−
</li>
+
−
</ol>
+
−
Hosting install of pre-built software platform, such as Wordpress,
+
  
−
===Shared Hosting===
+
'''Examples'''
−
In a [[Shared_Hosting|Shared Hosting]] environment, your and other website owners shared one server. This includes sharing the physical server and the software applications within the server. Shared hosting services are affordable because the cost to operate the server is shared between you and these other owners. There are, however, a number of down sides, such as being slower.
+
* [http://wordpress.com/ Wordpress.com]
 +
* [http://wpengine.com/ WPEngine]
 +
* [http://tumblr.com Tumblr]
 +
'''Hosting Requirements'''
 +
*[[Choose_a_hosting_provider#High_Technical]]
 +
*[[Choose_a_hosting_provider#Intermediary_Technical]]
  
  
−
===Threat Mitigation===
 
 
</div>
 
</div>
 
</div>
 
</div>
Line 167: Line 65:
 
==Basic Technical==
 
==Basic Technical==
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
 +
 +
===Hosted website===
 
For a basic setup providing a content distribution platform such as a blog user's have the option of using existing free services such as Wordpress, Journoportfolio or similar.
 
For a basic setup providing a content distribution platform such as a blog user's have the option of using existing free services such as Wordpress, Journoportfolio or similar.
−
===Threat Mitigation===
+
 
−
strong passwords, 2 factor auth,
+
Care should be taken when considering a free service that offers a hosted CMS. Some free hosted CMS will not offer a good experience as sites that are problematic or troublesome may be taken offline without notice and with no recourse as the provider is under no obligation to serve the user.
 +
 
 +
'''Benefits'''
 +
* No technical barrier to entry
 +
* Support provided by commerical company, with an interest in protecting their reputation both in terms of uptime but also in terms of avoiding security breaches
 +
* Greater likelihood of support in local language - at least in terms of documentation
 +
 
 +
'''Downsides'''
 +
* Lack of control of any systems underlying website
 +
* Reliance on provider for support
 +
* Subject to providers terms and conditions, which may restrict publications
 +
 
 +
'''Examples'''
 +
* [http://squarespace.com SquareSpace]
 +
*
 +
*
 +
'''Hosting Requirements'''
 +
 
 
</div>
 
</div>
 
</div>
 
</div>
  
 
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px">
 
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px">
 +
 
==Comparison Matrix==
 
==Comparison Matrix==
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 180: Line 98:
 
{| class="wikitable" width="60%"
 
{| class="wikitable" width="60%"
 
| style="padding: 10px;"|  
 
| style="padding: 10px;"|  
−
| style="padding: 5px;"| '''Dedicated Server'''
+
| style="padding: 5px;"| '''DIY CMS'''
−
| style="padding: 5px;"| '''Virtual Private Server'''
+
| style="padding: 5px;"| '''Hosted CMS'''
−
| style="padding: 5px;"| '''Shared Hosting'''
+
| style="padding: 5px;"| '''Hosted Website'''
−
| style="padding: 5px;"| '''Cloud Service'''
+
 
|-
 
|-
 
| style="padding: 10px;"|  
 
| style="padding: 10px;"|  
 
| style="padding: 5px;"| High technical skill
 
| style="padding: 5px;"| High technical skill
−
| style="padding: 5px;"| Requires Intermediary technical skill
+
| style="padding: 5px;"| Intermediary technical skill
−
| style="padding: 5px;"| Intermediary/Basic
+
 
| style="padding: 5px;"| Basic
 
| style="padding: 5px;"| Basic
 
|-
 
|-
 
| style="padding: 10px;"|  
 
| style="padding: 10px;"|  
−
| style="padding: 5px;"| Allows disk/data encryption
+
| style="padding: 5px;"|  
−
| style="padding: 5px;"| Allows encryption within VPS
+
| style="padding: 5px;"|  
−
| style="padding: 5px;"| Limited or no control of data encryption
+
| style="padding: 5px;"|  
−
| style="padding: 5px;"| Depends on provider but usually not provided
+
 
|-
 
|-
−
| style="padding: 10px;"|
+
 
−
| style="padding: 5px;"| SSH and private key login
+
−
| style="padding: 5px;"| Enforce secure login for VPS
+
−
| style="padding: 5px;"| Login via CPanel or Custom interface - some hosts offer 2 factor auth
+
−
| style="padding: 5px;"| Depends
+
−
|-
+
−
| style="padding: 10px;"|
+
−
| style="padding: 5px;"| User access control and restriction
+
−
| style="padding: 5px;"| User control
+
−
| style="padding: 5px;"| Control via user accounts added through management software
+
−
| style="padding: 5px;"| Control via management software
+
−
|-
+
−
| style="padding: 10px;"|
+
−
| style="padding: 5px;"| Allows SSL cert, must setup and provide own cert
+
−
| style="padding: 5px;"| SSL cert, must setup and provide own cert
+
−
| style="padding: 5px;"| Allows only shared SSL cert, most host provide shared cert
+
−
| style="padding: 5px;"| Most host platforms will provide SSL support by default
+
−
|-
+
−
| style="padding: 10px;"|
+
−
| style="padding: 5px;"| Total control of applications and software
+
−
| style="padding: 5px;"| Control of software within VM, limited access to hardware depending on type of VM
+
−
| style="padding: 5px;"| Application control only via management interface
+
−
| style="padding: 5px;"| Depends on cloud server - certain services with provide data access restrictions but this is a non-ideal scenario
+
−
|-
+
−
| style="padding: 10px;"|
+
−
| style="padding: 5px;"| Manually maintained and updated
+
−
| style="padding: 5px;"| Server is patched but VPS remains responsibility of user
+
−
| style="padding: 5px;"| Patches and updates provided by host - though may lag behind depending on quality of hosting
+
−
| style="padding: 5px;"| Depending on scale of provider - patching and support will be provided to protect their reputation
+
−
|-
+
−
| style="padding: 10px;"|
+
−
| style="padding: 5px;"| Limited supported - hardware support and replacement depending on provider
+
−
| style="padding: 5px;"| Similar to dedicated support
+
−
| style="padding: 5px;"| Support is generally in terms of management software - hardware is automatically monitored by hosts
+
−
| style="padding: 5px;"| Similar to shared though support is specific to the platform hosting
+
−
|-
+
−
| style="padding: 10px;"|
+
−
| style="padding: 5px;"| Anti-ddos and brute forcing via fail2ban, botnetdbp deployment
+
−
| style="padding: 5px;"| Provider may or may not mitigate DDoS attacks
+
−
| style="padding: 5px;"| DDoS attacks will receive some or limited mitigation depending on quality of host, generally they will not protect against large scale attacks and may force the website to be removed
+
−
| style="padding: 5px;"| Depending on the provider if the attack crosses their threshold for protection they may shut down the website or ask it to leave
+
 
|}
 
|}
 
</div>
 
</div>
 
</div>
 
</div>
 +
</div>
 +
 +
[[Secure_hosting_guide|Back to front page]]
 
[[Category: Secure Hosting ]]
 
[[Category: Secure Hosting ]]

Latest revision as of 05:29, 25 August 2015

Definition

A website could be an organisation's main information portal - where they can publish material about themselves, their work and projects and articles or reports that they have produced. It can also take the simpler form of a standalone blog where content is shared with their intended audience, or may be represented as a forum or wiki where user generated content is published and shared.

An organisation usually depends entirely on their main website as their presence on the Internet and expects it to function at all times.

High Technical

DIY CMS

There are numerous well developed and 'continually maintained' content mangement systems that you can install and configure from scratch. They differ between their application and intended purpose, the majority however relying on a LAMP or WAMP backend. Each CMS has its own particular requirements for webserver, database server and PHP configurations, as well as security considerations for them.

Benefits

  • Total control of the CMS software, plug-ins, themes and preferred configuration
  • Fine-grained access control and modification of CMS features

Downsides

  • A whole software ecosystem to learn with every new CMS
  • Responsibility for software updates and malware protection
  • Responsibility for data security

Examples

  • Wordpress.com installation
  • CiviCRM is an open source CRm environment intended for civil society use.
  • Custom Django app, allows for creation quickly of high content, high functionality websites. Django's security systems re well documented and well integrated. Development of a Django app will require developer time and potentially also some design work.
  • Custom Drupal site, again a ready made configurable solution, with a developed sense of security integration - though as with the other solutions security relies on a holistic approach including server side security.

Hosting Requirements

Intermediary Technical

Hosted CMS

Benefits

  • Dependent on hosting package, support and updates will be handled by provider reducing need for tech knowledge
  • Straightforward and fast to setup
  • Greater usability for low tech users
  • Potential lower cost

Downsides

  • Subject to terms and conditions of provider - controversial information or information that draws large scale attacks such as DDoS may cause provider to rescind service.
  • No control of hardware systems
  • Reliant on provider for software security updates to be applied
  • Limited control of jurisdiction or geography area that site is hosted within.
  • Reliance on providers support, which may not be available in local language

Examples

Hosting Requirements


Basic Technical

Hosted website

For a basic setup providing a content distribution platform such as a blog user's have the option of using existing free services such as Wordpress, Journoportfolio or similar.

Care should be taken when considering a free service that offers a hosted CMS. Some free hosted CMS will not offer a good experience as sites that are problematic or troublesome may be taken offline without notice and with no recourse as the provider is under no obligation to serve the user.

Benefits

  • No technical barrier to entry
  • Support provided by commerical company, with an interest in protecting their reputation both in terms of uptime but also in terms of avoiding security breaches
  • Greater likelihood of support in local language - at least in terms of documentation

Downsides

  • Lack of control of any systems underlying website
  • Reliance on provider for support
  • Subject to providers terms and conditions, which may restrict publications

Examples

Hosting Requirements

Comparison Matrix

DIY CMS Hosted CMS Hosted Website
High technical skill Intermediary technical skill Basic

Back to front page

Retrieved from "https://learn.equalit.ie/mw/index.php?title=Website&oldid=3896"