Difference between revisions of "Choose a hosting provider"

(→‎Mitigation)
 
(18 intermediate revisions by the same user not shown)
Line 2: Line 2:
 
===Criteria===
 
===Criteria===
  
−
There are several aspects which should be considered when selecting a service host. Below is a general list, this [https://pad.riseup.net/p/rh_ispq| document] gives detailed information on each area.
+
There are several aspects which should be considered when selecting a service host. Below is a general list, this [https://pad.riseup.net/p/rh_ispq document] gives detailed information on each area. eQualit.ie has developed a [https://wiki.deflect.ca/wiki/ISP_reviews review] of existing providers based on experiences with our Deflect network.
  
−
*Price - relative services offered
+
*Price - for most groups the cost of the infrastructure will be a major determining factor. however, there are a large number of competitive offers and though this is an important factor it should be used as a boundary to decide what is available not as the sole reason to purchase a service.
 
*Reputation - are they well known, have they had security breaches or reports of poor support, do they adhere to certain principles inline with that of your organisation - such as data privacy or protection of human rights defenders.
 
*Reputation - are they well known, have they had security breaches or reports of poor support, do they adhere to certain principles inline with that of your organisation - such as data privacy or protection of human rights defenders.
 
*Specialisation - do they work in the field of human rights, software applications or general hosting
 
*Specialisation - do they work in the field of human rights, software applications or general hosting
−
*Is mail provided
+
*Is mail provided - for many organisation it is not an option to run their own mail server, however, is they do not wish to sue a free service such as [https://riseup.net Riseup] or [https://gmail.com gmail], or if they wish to have domain specific email - such as info@mywebsite.org - then it is worth considering services that provide free email accounts.
−
*Hardware specifications
+
*Hardware specifications - does the server fits my needs? For most websites basic servers are enough but websites with high traffic can demand more stable or dedicated hardware.
−
*Operating systems offered
+
*Operating systems offered - different operating systems provide different functionality and integration with other applications. They also have different degrees of vulnerability and support.
−
*Supported provided
+
*Supported provided - this is an essential aspect when choosing a hosting company. It should also be considered in terms of language support, whether support is provided for software and/or hardware issues.
 
*Readily discusses your security concerns and which security features and processes they offer with their hosting.
 
*Readily discusses your security concerns and which security features and processes they offer with their hosting.
 
*Provides the most recent stable versions of all server software.
 
*Provides the most recent stable versions of all server software.
Line 19: Line 19:
 
It is quite important to consider the possibilities offered by your provider's control panel. If you need to write a support ticket everytime the server has to  reboot, it wont be an efficient process, especially during a crises. Possible features to look out for include
 
It is quite important to consider the possibilities offered by your provider's control panel. If you need to write a support ticket everytime the server has to  reboot, it wont be an efficient process, especially during a crises. Possible features to look out for include
  
−
* Automated operating system installs
+
* Automated operating system installs, this feature is hugely useful if it will be necessary to reinstall the operating system on your server. it avoids the need for dedicated time from one of your team members.
−
* Server boot and reboot
+
* Server boot and reboot, when installing new applications or updating existing software components, or as a means to resolve an issue, the ability to remotely restart your server can be critical. This is dependent on the type of server you are using.
−
* Remote console (sometimes known as KVM)
+
* Remote console (sometimes known as KVM), this is invaluable in diagnosing issues with your server's physical hardware but equally is a necessity if you wish to perform full disk encryption as a password will have to be entered before the machine has full booted up.
−
* Server and network statistics
+
* Server and network statistics, this information helps you track your server and/or website giving you detailed information for debugging, tracking attacks or discovering who is visiting your site.
 
* Dynamic components (e.g. adding extra disk space, RAM without rebuilding the machine or having to order a new service)
 
* Dynamic components (e.g. adding extra disk space, RAM without rebuilding the machine or having to order a new service)
−
* Server access (varies between SSH, SFTP or web based)
+
* Server access is the means by which you can physically connect to your server. Options iclude SSH, SSH key, SFTP or web based
−
*
+
  
 
==Secure hosting setups==
 
==Secure hosting setups==
Line 86: Line 85:
 
===Mitigation===
 
===Mitigation===
 
'''Password management''' is the core of any security strategy. For the dedicated and VPS hosting options, there are several modes of control that administrator can apply.
 
'''Password management''' is the core of any security strategy. For the dedicated and VPS hosting options, there are several modes of control that administrator can apply.
−
<ol>
 
−
<li>
 
−
Enforce strong password - a strong password should contain Upper and Lower case characters, Numbers and Special Characters and should be long; greater than 20 characters. It is also possible to restrict the use of previously used passwords. On Linux systems the following command can be used to force complex passwords for users:
 
−
</li>
 
−
password required pam_cracklib.so minlen=12 lcredit=1 ucredit=1 dcredit=2 ocredit=1
 
  
−
For more detail, refer to the guide [http://www.linux-faqs.info/security/force-strong-passwords| Force strong passwords]
+
For more details [[Access_Restrictions#Dedicated/VPS_Hosting| see]]
−
<li>
+
 
−
Use password aging: the <tt>chaging</tt> command on Linux servers allows checking of password age by user and setting of password aging parameters [http://linoxide.com/linux-command/password-expire-chage-command/| link].
+
−
</li>
+
−
<li>
+
−
In some cases it may be prudent to enabled account locking for accounts that have been under particularly concerted attacks. On Linux systems, the faillog command can be used to check failures and to set failure limits. For more details see [http://www.cyberciti.biz/tips/rhel-centos-fedora-linux-log-failed-login.html| Faillog]. Great care should be taken when enabling user locking as an attacker can simply deny users access to their own services by intentionally locking an account. Generally it is better practice to ban the attacker before the need for account locking is encountered.
+
−
</li>
+
−
<li>
+
−
Use Password Management software - a tool such as Keepass, or KeepassX for Linux and Mac, allows users to easily generate, store and mange complex difficult to crack passwords. Refer to this guide for details on [https://securityinabox.org/en/keepass_main Keepass]
+
−
</li>
+
−
</ol>
+
 
'''User Management''' on dedicated or VPS systems allow administrators fine grained control of user login and access permissions.
 
'''User Management''' on dedicated or VPS systems allow administrators fine grained control of user login and access permissions.
−
<ol>
 
−
<li>
 
−
Root user login should be disabled by default - the <tt>sudo</tt> package should be installed and all superuser actions should be run through it.
 
−
</li>
 
−
<li>
 
−
Secure Shell(SSH) login should be forced, telnet and ftp login access should be disabled by default. To upload files to the server securely user can use Secure FTP(SFTP) clients.
 
−
</li>
 
−
<li>
 
−
Private keys should be used for SSH login access. The following guide gives details on generating and setting up public/private keys for SSH login, [http://support.suso.com/supki/SSH_Tutorial_for_Linux| SSH tutorial]. Once SSH keys have been set up for all relevant users, disabling password-based logins should be considered.
 
−
</li>
 
−
<li>
 
−
File permissions should be restricted for critical files. User should only be allowed access to files relevant to their work. Execution as root should be restricted. Discussion of [http://www.linux.com/learn/tutorials/309527-understanding-linux-file-permissions| linux file permissions].
 
−
</li>
 
−
</ol>
 
−
'''Software Management'''
 
−
<ol>
 
−
<li>
 
−
System software must always be up to date. Critical patches are released by software vendors and operating system providers on a regular basis. Updates frequently contain fixes for potential vulnerabilities and bugs, if your system is not up to date it may be at risk. A recent example of this is the SSL bug [https://heartbleed.com HeartBleed].
 
−
</li>
 
−
<li>
 
−
Minimising installed software is an important step in reducing potential vulnerabilities. The system should have the bare minimum of packages and software installed to support its purpose.
 
−
</li>
 
−
</ol>
 
−
'''System Management'''
 
−
<ol>
 
−
<li>
 
−
Firewall can be enabled via [http://www.netfilter.org/projects/iptables/| iptables] the guides [http://www.tecmint.com/basic-guide-on-iptables-linux-firewall-tips-commands/| here] and [http://www.cyberciti.biz/faq/category/iptables/| here] describe iptables configuration.
 
−
</li>
 
−
<li>
 
−
To protect the server it is important to audit the open ports on the machine. To check listening ports you can run
 
−
<br>
 
−
netstat -tulpn
 
  
 +
For more details see [[Access_Restrictions#Dedicated/VPS_HOSTING| see]]
  
−
</li>
+
'''System and Software Management''' is primarily concerned with ensuring that the physical system and its software is setup in the most mangeable, maintainable way and that attention is paid to keeping everything up to date to avoid potential vulnerabilities.
−
<li>
+
−
Logging and Auditing
+
−
</li>
+
−
<li>
+
−
Anti-intrusion system,
+
−
</li>
+
−
<li>
+
−
[http://selinuxproject.org/page/Main_Page| Security Enhanced Linux(SELinux)] is a kernel level security control mechanism, which enforces a set of rules and procedures for the system. SELinux provides fine grained control for access rights and permissions.
+
−
<br>
+
−
To check if it is enabled run
+
−
<br>
+
−
sestatus
+
−
<br>
+
−
To enable run
+
−
<br>
+
−
setenforce enforcing
+
−
<br>
+
−
To adjust the SELinux config is available at
+
−
<br>
+
−
/etc/selinux/config
+
−
</li>
+
−
<li>
+
−
[http://www.fail2ban.org/wiki/index.php/Main_Page| Fail2ban] is an excellent tool that can be used both to combat simple DDoS attacks but also to detect and block brute force login attempts.
+
−
</li>
+
−
</ol>
+
−
<ul>
+
−
'''Apache hardening'''
+
  
−
As well as considering the physical server and it's operating system users must thinking in terms of application security. Especially for those applications which either contain sensitive data or those that provide access routes to the machine for an attacker.
+
For more details see [[System_Management| see]]
  
−
Below is a set of guides for Apache webserver hardening.
+
'''Webserver Setup''' is an important consideration when hosting a website. There are a variety of steps that can be taken to lock down a webserver and to make sure that no vulnerabilities or accidental leaks occur.  
−
<li>
+
−
[http://www.tecmint.com/apache-security-tips/| 13 Apache Web Server Security and Hardening Tips]
+
−
<li>
+
−
[http://xianshield.org/guides/apache2.0guide.html| Apache 2.0 Hardening Guide]
+
−
</li>
+
−
</ul>
+
−
<ul>
+
−
'''Database hardening'''
+
  
−
A key approach discussed elsewhere in protecting data, both at rest - on disk - and in use - in memory, is to encrypt these data stores either as part of full disk encryption or as individual restricted encrypted mount points.
+
For more details [[Webserver_setup| see]]
−
 
+
−
Below are further guides for specific hardening techniques for the MySQL database system.
+
−
<li>
+
−
[http://www.greensql.com/content/mysql-security-best-practices-hardening-mysql-tips| MySQL Security Best Practices]
+
−
</li>
+
−
<li>
+
−
[http://rochakchauhan.com/blog/2013/11/19/security-and-hardening-tips-for-mysql/| Security and Hardening Tips for MySQL]
+
−
</li>
+
−
<li>
+
−
[http://www.securethelock.com/2014/01/09/12-steps-for-hardening-mysql-from-attackers/| 12 steps for Hardening MySQL from Attackers]
+
−
</li>
+
−
</ul>
+
  
 
</div>
 
</div>
Line 202: Line 109:
 
===Hosted platform===
 
===Hosted platform===
 
For organisation that wish to setup their own custom site based on an existing platform such as Wordpress.com, there are a setup of steps that should be taken to ensure a good level of security. The [[Choosing_A_Host | choosing a hosting provider]] guide should also be consulted.
 
For organisation that wish to setup their own custom site based on an existing platform such as Wordpress.com, there are a setup of steps that should be taken to ensure a good level of security. The [[Choosing_A_Host | choosing a hosting provider]] guide should also be consulted.
 +
 +
'''Benefits'''
 +
* Hardware is managed and maintained by the hosting provider
 +
* There is no need to build custom software
 +
* Using an install of an existing platform, such as Wordpress.com, means that software patching and bug fixing is handled by a dedicated group 
 +
* Once the solution is setup, secured and configured management is minimal
 +
* The software platform will provide support for the core functionalities of managing a website such as user creation, content uploading and provide mechanisms for exporting/backup
 +
 +
'''Downsides'''
 +
* The provider must be carefully chosen based on the information in this [https://pad.riseup.net/p/rh_ispq document]
 +
* Software updates must be performed by the organisation
 +
* Backup is the organisations responsibility
 +
* No support is provided for configuring or managing the platform
  
 
'''Platform Security'''
 
'''Platform Security'''
Line 207: Line 127:
 
<li>
 
<li>
 
Limiting access - Making smart choices that reduce possible entry points available to a malicious person.
 
Limiting access - Making smart choices that reduce possible entry points available to a malicious person.
 +
 +
For more details see [[Access_Restrictions#Dedicated/VPS_HOSTING| see]]
 
</li>
 
</li>
 
<li>Containment - Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.
 
<li>Containment - Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.
Line 213: Line 135:
 
</li>
 
</li>
 
<li>
 
<li>
−
Passwords
+
Password management - the core component of any digital security strategy is control and management of passwords.
 +
 
 +
For more details [[Access_Restrictions#Dedicated/VPS_Hosting| see]]
 
</li>
 
</li>
 
<li>
 
<li>
−
File Permissions
+
Software updates and system control - allows the user to lock down the system and restrict what applications are running.
−
</li>
+
 
−
<li>
+
For more details see [[System_Management| see]]
−
Admin user
+
−
</li>
+
−
<li>
+
−
SSL
+
−
</li>
+
−
<li>
+
−
SFTP client
+
−
</li>
+
−
<li>
+
−
Platform updates
+
 
</li>
 
</li>
 
</ol>
 
</ol>
−
Hosting install of pre-built software platform, such as Wordpress,
 
  
 
===Shared Hosting===
 
===Shared Hosting===
Line 240: Line 153:
 
* http://www.dreamhost.com/web-hosting/
 
* http://www.dreamhost.com/web-hosting/
 
* http://wpengine.com/ (wordpress only)
 
* http://wpengine.com/ (wordpress only)
 +
 +
'''Benefits'''
 +
* Host provided support for software and hardware
 +
* Reduced technical needs for organisation
 +
* Standardised software components
 +
 +
'''Downsides'''
 +
* Heavily relies on the hosting providers technical and support abilities
 +
* Danger that compromise to another unrelated site could compromise user's site.
 +
* Your security is tied to that of others using the same system
 +
* Limited or no control over security procedures - relies heavily on abilities of hosting provider
  
 
===Threat Mitigation===
 
===Threat Mitigation===
Line 249: Line 173:
 
==Basic Technical==
 
==Basic Technical==
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
−
For a basic setup providing a content distribution platform such as a blog user's have the option of using existing free services such as Wordpress, Journoportfolio or similar.
+
For a basic setup providing a content distribution platform such as a blog users have the option of using existing free services such as Wordpress, Journoportfolio or similar.
 +
 
 +
'''Examples:'''
 +
* [http://wordpress.com/ Wordpress]
 +
* [https://www.tumblr.com/ Tumblr]
 +
* [https://www.journoportfolio.com/ Journo Portfolio]
 +
* [http://www.joomla.org/ Joomla]
 +
 
 +
'''Benefits'''
 +
* Host provided support for software and hardware
 +
* Very low technical needs for organisation
 +
* Easy setup and quick start
 +
 
 +
'''Downsides'''
 +
* Heavily relies on the hosting providers technical and support abilities
 +
* No control over system software or hardware
 +
* Limited security options
 +
 
 
===Threat Mitigation===
 
===Threat Mitigation===
−
strong passwords, 2 factor auth,
+
 
−
</div>
+
<ol>
 +
<li>
 +
'''Strong Passwords''' are a core element of any system. The access password for the host should be restricted to those individuals with the organisation that work directly with the server.
 +
 
 +
Safe password creation and storage procedures should be followed, as described [[Access_Restrictions#Dedicated/VPS_Hosting|here]]
 +
</li>
 +
<li>
 +
'''Malware''' is core vulnerability for the devices used by those managing and logging into the hosted system. Malware, keyloggers and viruses provided a straightforward means of attack.
 +
<br>
 +
The attacker does not need to hack or compromise the server, instead via infection through phishing emails or malicious websites the attacker can log and store the passwords and other critical information.
 +
<br>
 +
To mitigate this threat all individuals who work with or have login access to the server must have anti-virus installed, a firewall and have an up to date system. For more information [|see]
 +
</li>
 +
<li>
 +
'''Two factor Authentication''' should be enabled where available as this will make compromising a system significantly more difficult.
 +
</li>
 +
<li>
 +
'''Wordpress Security''' is described in detail in the following [http://codex.wordpress.org/Hardening_WordPress guide].
 +
</li>
 +
</ol>
 
</div>
 
</div>
  
 +
</div>
 
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px">
 
<div class="toccolours mw-collapsible mw-collapsed" style="width:800px">
 +
 
==Comparison Matrix==
 
==Comparison Matrix==
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">

Latest revision as of 19:06, 28 May 2014

Criteria

There are several aspects which should be considered when selecting a service host. Below is a general list, this document gives detailed information on each area. eQualit.ie has developed a review of existing providers based on experiences with our Deflect network.

  • Price - for most groups the cost of the infrastructure will be a major determining factor. however, there are a large number of competitive offers and though this is an important factor it should be used as a boundary to decide what is available not as the sole reason to purchase a service.
  • Reputation - are they well known, have they had security breaches or reports of poor support, do they adhere to certain principles inline with that of your organisation - such as data privacy or protection of human rights defenders.
  • Specialisation - do they work in the field of human rights, software applications or general hosting
  • Is mail provided - for many organisation it is not an option to run their own mail server, however, is they do not wish to sue a free service such as Riseup or gmail, or if they wish to have domain specific email - such as info@mywebsite.org - then it is worth considering services that provide free email accounts.
  • Hardware specifications - does the server fits my needs? For most websites basic servers are enough but websites with high traffic can demand more stable or dedicated hardware.
  • Operating systems offered - different operating systems provide different functionality and integration with other applications. They also have different degrees of vulnerability and support.
  • Supported provided - this is an essential aspect when choosing a hosting company. It should also be considered in terms of language support, whether support is provided for software and/or hardware issues.
  • Readily discusses your security concerns and which security features and processes they offer with their hosting.
  • Provides the most recent stable versions of all server software.
  • Provides reliable methods for backup and recovery.
  • Provides encryption options for hosting of sites or mail

Features

It is quite important to consider the possibilities offered by your provider's control panel. If you need to write a support ticket everytime the server has to reboot, it wont be an efficient process, especially during a crises. Possible features to look out for include

  • Automated operating system installs, this feature is hugely useful if it will be necessary to reinstall the operating system on your server. it avoids the need for dedicated time from one of your team members.
  • Server boot and reboot, when installing new applications or updating existing software components, or as a means to resolve an issue, the ability to remotely restart your server can be critical. This is dependent on the type of server you are using.
  • Remote console (sometimes known as KVM), this is invaluable in diagnosing issues with your server's physical hardware but equally is a necessity if you wish to perform full disk encryption as a password will have to be entered before the machine has full booted up.
  • Server and network statistics, this information helps you track your server and/or website giving you detailed information for debugging, tracking attacks or discovering who is visiting your site.
  • Dynamic components (e.g. adding extra disk space, RAM without rebuilding the machine or having to order a new service)
  • Server access is the means by which you can physically connect to your server. Options iclude SSH, SSH key, SFTP or web based

Secure hosting setups

Depending on available skill level the following secure system setups are possible:

High Technical

Dedicated Server

For a Dedicated Hosting system, the user can either run their own physical hardware or rent this hardware from a provider. The former solution offers total control of the physical hardware, however, there are significant downsides to this approach and should be avoided; it is only recommend under special circumstances such as storing sensitive data. In the latter case, the hosting agent provides the hardware but the user has total control of the server via remote access. In this scenario, the provider is responsible for replacement of hardware parts that fail or malfunction - this support is generally done through a ticket system and relies on the user to report errors.

Examples

Benefits

  • User has total control of the system's software
  • User has total control of access rights
  • User has control of physical network connection, allowing them to whitelist or block connection from allowed or spurious connections
  • Financial cost of hardware malfunction is not an issue as the host is responsible for replacing/repairing failing hardware
  • The host can be chosen to place the server in a different jurisdiction from that of the user to prevent seizure

Downsides

  • The user does not have physical access to the server
  • The host is not responsible for data loss or downtime if the physical server fails
  • The user is responsible for detecting and reporting hardware faults on some providers
  • The time taken to repair a hardware malfunction depends on the provider chosen. See Choosing a hosting provider.
  • The contract can be terminated by the host and access to the server can be terminated or suspended depending on the host's terms of use.

VPS

A Virtual Private Server(VPS) is an instance of a Virtual Operating System running on a much larger server. Typically multiple VPS will be run on a single server. In a VPS environment, you have a dedicated virtual private server but do not control the server on which it is hosted. Resources will be limited, you can not control or harden the outer server.

Examples

Benefits

  • The cost of this type of server will typically be significantly cheaper than a dedicated server
  • Depending on the host, the server will be capable of running most standard server software, up to a certain limit
  • Hardware is managed by the hosting provider unless self hosting
  • If self hosting, a single server can be used for multiple purposes and to provide multiple distinct servers

Downsides

  • Processing power will be limited over a dedicated server but, depending on the hosting provider, should be capable of running small to medium capacity websites
  • Bandwidth will also be restricted
  • Potential risk of provider, law enforcement or other state forces accessing contents of virtual server without user's awareness.
  • The user will not have access to the outer server and will thus not be able to harden it

Threats

  • Social engineering attack
  • Password brute force
  • Service interruption through denial of service attack
  • System software exploits
  • SSL man-in-the-middle attacks
  • Data loss or data theft

Mitigation

Password management is the core of any security strategy. For the dedicated and VPS hosting options, there are several modes of control that administrator can apply.

For more details see

User Management on dedicated or VPS systems allow administrators fine grained control of user login and access permissions.

For more details see see

System and Software Management is primarily concerned with ensuring that the physical system and its software is setup in the most mangeable, maintainable way and that attention is paid to keeping everything up to date to avoid potential vulnerabilities.

For more details see see

Webserver Setup is an important consideration when hosting a website. There are a variety of steps that can be taken to lock down a webserver and to make sure that no vulnerabilities or accidental leaks occur.

For more details see

Intermediary Technical

Hosted platform

For organisation that wish to setup their own custom site based on an existing platform such as Wordpress.com, there are a setup of steps that should be taken to ensure a good level of security. The choosing a hosting provider guide should also be consulted.

Benefits

  • Hardware is managed and maintained by the hosting provider
  • There is no need to build custom software
  • Using an install of an existing platform, such as Wordpress.com, means that software patching and bug fixing is handled by a dedicated group
  • Once the solution is setup, secured and configured management is minimal
  • The software platform will provide support for the core functionalities of managing a website such as user creation, content uploading and provide mechanisms for exporting/backup

Downsides

  • The provider must be carefully chosen based on the information in this document
  • Software updates must be performed by the organisation
  • Backup is the organisations responsibility
  • No support is provided for configuring or managing the platform

Platform Security

  1. Limiting access - Making smart choices that reduce possible entry points available to a malicious person. For more details see see
  2. Containment - Your system should be configured to minimize the amount of damage that can be done in the event that it is compromised.
  3. Preparation and knowledge - Keeping backups and knowing the state of your WordPress installation at regular intervals. Having a plan to backup and recover your installation in the case of catastrophe can help you get back online faster in the case of a problem.
  4. Password management - the core component of any digital security strategy is control and management of passwords. For more details see
  5. Software updates and system control - allows the user to lock down the system and restrict what applications are running. For more details see see

Shared Hosting

In a Shared Hosting environment, your and other website owners shared one server. This includes sharing the physical server and the software applications within the server. Shared hosting services are affordable because the cost to operate the server is shared between you and these other owners. There are, however, a number of down sides, such as being slower.

Examples:

Benefits

  • Host provided support for software and hardware
  • Reduced technical needs for organisation
  • Standardised software components

Downsides

  • Heavily relies on the hosting providers technical and support abilities
  • Danger that compromise to another unrelated site could compromise user's site.
  • Your security is tied to that of others using the same system
  • Limited or no control over security procedures - relies heavily on abilities of hosting provider

Threat Mitigation

Basic Technical

For a basic setup providing a content distribution platform such as a blog users have the option of using existing free services such as Wordpress, Journoportfolio or similar.

Examples:

Benefits

  • Host provided support for software and hardware
  • Very low technical needs for organisation
  • Easy setup and quick start

Downsides

  • Heavily relies on the hosting providers technical and support abilities
  • No control over system software or hardware
  • Limited security options

Threat Mitigation

  1. Strong Passwords are a core element of any system. The access password for the host should be restricted to those individuals with the organisation that work directly with the server. Safe password creation and storage procedures should be followed, as described here
  2. Malware is core vulnerability for the devices used by those managing and logging into the hosted system. Malware, keyloggers and viruses provided a straightforward means of attack.
    The attacker does not need to hack or compromise the server, instead via infection through phishing emails or malicious websites the attacker can log and store the passwords and other critical information.
    To mitigate this threat all individuals who work with or have login access to the server must have anti-virus installed, a firewall and have an up to date system. For more information [|see]
  3. Two factor Authentication should be enabled where available as this will make compromising a system significantly more difficult.
  4. Wordpress Security is described in detail in the following guide.

Comparison Matrix

Dedicated Server Virtual Private Server Shared Hosting Cloud Service
High technical skill Requires Intermediary technical skill Intermediary/Basic Basic
Allows disk/data encryption Allows encryption within VPS Limited or no control of data encryption Depends on provider but usually not provided
SSH and private key login Enforce secure login for VPS Login via CPanel or Custom interface - some hosts offer 2 factor auth Depends
User access control and restriction User control Control via user accounts added through management software Control via management software
Allows SSL cert, must setup and provide own cert SSL cert, must setup and provide own cert Allows only shared SSL cert, most host provide shared cert Most host platforms will provide SSL support by default
Total control of applications and software Control of software within VM, limited access to hardware depending on type of VM Application control only via management interface Depends on cloud server - certain services with provide data access restrictions but this is a non-ideal scenario
Manually maintained and updated Server is patched but VPS remains responsibility of user Patches and updates provided by host - though may lag behind depending on quality of hosting Depending on scale of provider - patching and support will be provided to protect their reputation
Limited supported - hardware support and replacement depending on provider Similar to dedicated support Support is generally in terms of management software - hardware is automatically monitored by hosts Similar to shared though support is specific to the platform hosting
Anti-ddos and brute forcing via fail2ban, botnetdbp deployment Provider may or may not mitigate DDoS attacks DDoS attacks will receive some or limited mitigation depending on quality of host, generally they will not protect against large scale attacks and may force the website to be removed Depending on the provider if the attack crosses their threshold for protection they may shut down the website or ask it to leave


Back to front page

Retrieved from "https://learn.equalit.ie/mw/index.php?title=Choose_a_hosting_provider&oldid=535"