Dedicated Server

For a Dedicated Hosting system, the user can either run their own physical hardware or rent this hardware from a provider. The former solution offers total control of the physical hardware, however, there are significant downsides to this approach and should be avoided; it is only recommend under special circumstances such as storing sensitive data. In the latter case, the hosting agent provides the hardware but the user has total control of the server via remote access. In this scenario, the provider is responsible for replacement of hardware parts that fail or malfunction - this support is generally done through a ticket system and relies on the user to report errors.

Examples

• http://www.ovh.com/ca/en/dedicated-servers/hosting/
• http://www.soyoustart.com/ie/offers.xml
• http://www.hetzner.de/en/hosting/produktmatrix/rootserver
• http://www.coolhousing.net/hosting-dedicated-servers.html

Benefits

• User has total control of the system's software
• User has total control of access rights
• User has control of physical network connection, allowing them to whitelist or block connection from allowed or spurious connections
• Financial cost of hardware malfunction is not an issue as the host is responsible for replacing/repairing failing hardware
• The host can be chosen to place the server in a different jurisdiction from that of the user to prevent seizure

Downsides

• The user does not have physical access to the server
• The host is not responsible for data loss or downtime if the physical server fails
• The user is responsible for detecting and reporting hardware faults on some providers
• The time taken to repair a hardware malfunction depends on the provider chosen. See Choosing a hosting provider.
• The contract can be terminated by the host and access to the server can be terminated or suspended depending on the host's terms of use.

VPS

A Virtual Private Server(VPS) is an instance of a Virtual Operating System running on a much larger server. Typically multiple VPS will be run on a single server. In a VPS environment, you have a dedicated virtual private server but do not control the server on which it is hosted. Resources will be limited, you can not control or harden the outer server.

Examples

• https://www.linode.com/pricing
• https://chhost.net/virtual-server/
• https://www.tilaa.com/orders/add

Benefits

• The cost of this type of server will typically be significantly cheaper than a dedicated server
• Depending on the host, the server will be capable of running most standard server software, up to a certain limit
• Hardware is managed by the hosting provider unless self hosting
• If self hosting, a single server can be used for multiple purposes and to provide multiple distinct servers

Downsides

• Processing power will be limited over a dedicated server but, depending on the hosting provider, should be capable of running small to medium capacity websites
• Bandwidth will also be restricted
• Potential risk of provider, law enforcement or other state forces accessing contents of virtual server without user's awareness.
• The user will not have access to the outer server and will thus not be able to harden it

Threats

• Social engineering attack
• Password brute force
• Service interruption through denial of service attack
• System software exploits
• SSL man-in-the-middle attacks
• Data loss or data theft

Mitigation

Password management is the core of any security strategy. For the dedicated and VPS hosting options, there are several modes of control that administrator can apply.

For more details see

User Management on dedicated or VPS systems allow administrators fine grained control of user login and access permissions.

For more details see see

System and Software Management is primarily concerned with ensuring that the physical system and its software is setup in the most mangeable, maintainable way and that attention is paid to keeping everything up to date to avoid potential vulnerabilities.

For more details see see

Webserver Setup is an important consideration when hosting a website. There are a variety of steps that can be taken to lock down a webserver and to make sure that no vulnerabilities or accidental leaks occur.

For more details see

Hosted platform

For organisation that wish to setup their own custom site based on an existing platform such as Wordpress.com, there are a setup of steps that should be taken to ensure a good level of security. The choosing a hosting provider guide should also be consulted.

Benefits

• Hardware is managed and maintained by the hosting provider
• There is no need to build custom software
• Using an install of an existing platform, such as Wordpress.com, means that software patching and bug fixing is handled by a dedicated group
• Once the solution is setup, secured and configured management is minimal
• The software platform will provide support for the core functionalities of managing a website such as user creation, content uploading and provide mechanisms for exporting/backup

Downsides

• The provider must be carefully chosen based on the information in this document
• Software updates must be performed by the organisation
• Backup is the organisations responsibility
• No support is provided for configuring or managing the platform

Platform Security

1. Limiting access - Making smart choices that reduce possible entry points available to a malicious person. For more details see see
2. Containment - Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.
3. Preparation and knowledge - Keeping backups and knowing the state of your WordPress installation at regular intervals. Having a plan to backup and recover your installation in the case of catastrophe can help you get back online faster in the case of a problem.
4. Password management - the core component of any digital security strategy is control and management of passwords. For more details see
5. Software updates and system control - allows the user to lock down the system and restrict what applications are running. For more details see see

Shared Hosting

In a Shared Hosting environment, your and other website owners shared one server. This includes sharing the physical server and the software applications within the server. Shared hosting services are affordable because the cost to operate the server is shared between you and these other owners. There are, however, a number of down sides, such as being slower.

Examples:

• http://www.easyweb.com
• http://www.dreamhost.com/web-hosting/
• http://wpengine.com/ (wordpress only)

Benefits

• Host provided support for software and hardware
• Reduced technical needs for organisation
• Standardised software components

Downsides

• Heavily relies on the hosting providers technical and support abilities
• Danger that compromise to another unrelated site could compromise user's site.
• Your security is tied to that of others using the same system
• Limited or no control over security procedures - relies heavily on abilities of hosting provider

Threat Mitigation

For a basic setup providing a content distribution platform such as a blog users have the option of using existing free services such as Wordpress, Journoportfolio or similar.

Examples:

• Wordpress
• Tumblr
• Journo Portfolio
• Joomla

Benefits

• Host provided support for software and hardware
• Very low technical needs for organisation
• Easy setup and quick start

Downsides

• Heavily relies on the hosting providers technical and support abilities
• No control over system software or hardware
• Limited security options

Threat Mitigation

1. Strong Passwords are a core element of any system. The access password for the host should be restricted to those individuals with the organisation that work directly with the server. Safe password creation and storage procedures should be followed, as described here
2. Malware is core vulnerability for the devices used by those managing and logging into the hosted system. Malware, keyloggers and viruses provided a straightforward means of attack.
   The attacker does not need to hack or compromise the server, instead via infection through phishing emails or malicious websites the attacker can log and store the passwords and other critical information.
   To mitigate this threat all individuals who work with or have login access to the server must have anti-virus installed, a firewall and have an up to date system. For more information [|see]
3. Two factor Authentication should be enabled where available as this will make compromising a system significantly more difficult.
4. Wordpress Security is described in detail in the following guide.