Last updated on April 24, 2020.
Web security, your site and your network
Web sites are unfortunately prone to security risks. And so are any networks in which web servers are connected. Setting aside risks created by employee use or misuse of network resources, your web server and the site it hosts present your most serious sources of security risk.
Web servers by design open a window between your network and the world. The care taken with server maintenance, web application updates and your web site coding will define the size of that window, limit the kind of information that can pass through it and thus establish the degree of web security you will have.
Is your site or network at risk?
"Web security" is relative and has two components, one internal and one public. Your relative security is high if you have few network resources of financial value, your company and site aren't controversial in any way, your network is set up with tight permissions, your web server is patched up to date with all settings done correctly, your applications on the web server are all patched and updated and your web site code is done to high standards.
Your web security is relatively lower if your company has financial assets like credit card or identity information, if your web site content is controversial, your servers, applications and site code are complex or old and are maintained by an underfunded or outsourced IT department. All IT departments are budget-challenged, and tight staffing often creates deferred maintenance issues that play into the hands of any who want to challenge your web security.
Web security risk - should you be worried?
If you have assets of importance, or if anything about your site puts you in the public spotlight, then your web security will be tested. We hope that the information provided here will prevent you and your company from being embarrassed - or worse.
It's well known that poorly written software creates security issues. The number of bugs that could create web security issues is directly proportional to the size and complexity of your web applications and web server. Basically, all complex programs either have bugs or at the very least, weaknesses. On top of that, web servers are inherently complex programs. Web sites are themselves complex and intentionally invite ever greater interaction with the public. And so the opportunities for security holes are many and growing.
Technically, the very same programming that increases the value of a web site, namely interaction with visitors, also allows scripts or SQL commands to be executed on your web and database servers in response to visitor requests. Any web-based form or script installed at your site may have weaknesses or outright bugs and every such issue presents a web security risk.
Contrary to common knowledge the balance between allowing web site visitors some access to your corporate resources through a web site and keeping unwanted visitors out of your network is a delicate one. There is no one setting, no single switch to throw that sets the security hurdle at the proper level. There are dozens of settings if not hundreds in a web server alone, and then each service, application and open port on the server adds another layer of settings. And then the web site code... you get the picture.
Add to that the different permissions you will want to grant visitors, prospects, customers, partners and employees. The number of variables regarding web security rapidly escalates.
A web security issue is faced by site visitors as well. A common web site attack involves the silent and concealed installation of code that will exploit the browsers of visitors. Your site is not the end target at all in these attacks. There are, at this time, many thousands of web sites out there that have been compromised. The owners have no idea that anything has been added to their sites and that their visitors are at risk. In the meantime visitors are being subject to attack and successful attacks are installing nasty code onto the visitor's computers.
Web server security
The world's most secure web server is the one that is turned off. Simple, bare-bones web servers that have few open ports and few services on those ports are the next best thing. This just isn't an option for most companies. Powerful and flexible applications are required to run complex sites and these are naturally more subject to web security issues.
Any system with multiple open ports, multiple services and multiple scripting languages is vulnerable simply because it has so many points of entry to watch.
If your system has been correctly configured and your IT staff has been very punctual about applying security patches and updates, your risks are mitigated. Then there is the matter of the applications you are running. These too require frequent updates. And last there is the web site code itself.
Web site code and web security
You site undoubtedly provides some means of communication with its visitors. In every place that interaction is possible you have a potential web security vulnerability. Web sites often invite visitors to:
- Load a new page containing dynamic content
- Search for a product or location
- Fill out a contact form
- Search the site content
- Use a shopping cart
- Create an account
- Logon to an account
In each case noted above, your web site visitor is effectively sending a command to or through your web server - very likely to a database. In each opportunity to communicate, such as a form field, search field or blog, correctly written code will allow only a very narrow range of commands or information types to pass - in or out. This is ideal for web security. However, these limits are not automatic. It takes well trained programmers a good deal of time to write code that allows all expected data to pass and disallows all unexpected or potentially harmful data.
And there lies the problem. Code on your site has come from a variety of programmers, some of whom work for third party vendors. Some of that code is old, perhaps very old. Your site may be running software from half a dozen sources, and then your own site designer and your webmaster has each produced more code of their own, or made revisions to another's code that may have altered or eliminated previously established web security limitations.
Add to that the software that may have been purchased years ago and which is not in current use. Many servers have accumulated applications that are no longer in use and with which nobody on your current staff is familiar. This code is often not easy to find, is about as valuable as an appendix and has not been used, patched or updated for years - but it may be exactly what a hacker is looking for!
Known web security vulnerabilities and unknown vulnerabilities
As you know there are a lot of people out there who call themselves hackers. You can also easily guess that they are not all equally skilled. As a matter of fact, the vast majority of them are simply copycats. They read about a KNOWN technique that was devised by someone else and they use it to break into a site that is interesting to them, often just to see if they can do it. Naturally once they have done that they will take advantage of the site weakness to do malicious harm, plant something or steal something.
A very small number of hackers are actually capable of discovering a new way to overcome web security obstacles. Given the work being done by tens of thousands of programmers worldwide to improve security, it is not easy to discover a brand new method of attack. Hundreds, sometimes thousands of man-hours might be put into developing a new exploit. This is sometimes done by individuals, but just as often is done by teams supported by organized crime. In either case they want to maximize their return on this investment in time and energy and so they will very quietly focus on relatively few, very valuable corporate or governmental assets. Until their new technique is actually discovered, it is considered UNKNOWN.
Countering and attempting to eliminate any return on this hacking investment you have hundreds if not thousands of web security entities. These public and private groups watch for and share information about newly discovered exploits so that an alarm can be raised and defense against unknown exploits can be put in place quickly. The broad announcement of a new exploit makes it a KNOWN exploit.
The outcome of this contest of wills, so to speak, is that exploits become known and widely documented very soon after they are first used and discovered. So at any one time there are thousands (perhaps tens of thousands) of known vulnerabilities and only a very, very few unknown. And those few unknown exploits are very tightly focused onto just a very few highly valuable targets so as to reap the greatest return before discovery. Because once known the best defended sites immediately take action to correct their flaws and erect better defenses.
Your greatest web security risks: known or unknown?
Your site is 1,000 times more likely to be attacked with a known exploit than an unknown one. And the reason behind this is simple: There are so many known exploits and the complexity of web servers and web sites is so great that the chances are good that one of the known vulnerabilities will be present and allow an attacker access to your site.
The number of sites worldwide is so great and the number of new, as of yet undocumented and thus unknown exploits so small that your chances of being attacked with one is nearly zero - unless you have network assets of truly great value.
If you don't attract the attention of a very dedicated, well financed attack, then your primary concern should be to eliminate your known vulnerabilities so that a quick look would reveal no easy entry using known vulnerabilities.
Web security defense strategy
There are two roads to accomplish excellent security. On one you would assign all of the resources needed to maintain constant alert to new security issues. You would ensure that all patches and updates are done at once, have all of your existing applications reviewed for correct security, ensure that only security knowledgeable programmers do work on your site and have their work checked carefully by security professionals. You would also maintain a tight firewall, antivirus protection and run IPS/IDS.
Your other option: use a web scanning solution to test your existing equipment, applications and web site code to see if a KNOWN vulnerability actually exists. While firewalls, antivirus and IPS/IDS are all worthwhile, it is simple logic to also lock the front door. It is far more effective to repair a half dozen actual risks than it is to leave them in place and try to build higher and higher walls around them. Network and web site vulnerability scanning is the most efficient security investment of all.
If one had to walk just one of these roads, diligent wall building or vulnerability testing, it has been seen that web scanning will actually produce a higher level of web security on a dollar for dollar basis. This is proven by the number of well defended web sites which get hacked every month, and the much lower number of properly scanned web sites which have been compromised.
Web security using a web site security audit
Your best defense against a attack on your web site is to regularly scan a competently set up domain that is running current applications and whose web site code was done well.
Web site testing, also known as web scanning or auditing, is often provided by a hosted service. For simplicity, we suggest a service that requires no installation of software or hardware and is done without any interruption of web services.
A good vulnerability scanner will look for known issues using a complete database of security vulnerabilities. The security vulnerability database will contain each kind of exploit with a known combination of web site weaknesses that must be present to be accomplished. Thus by examining a server for the open port, available service and/or code that each known exploit requires, it is a simple matter to determine if a server is vulnerable to attack using that method.
Vulnerability scanners can quickly run through an entire database of over ten thousand vulnerabilities and can report on which are present and better yet, confirm the thousands that are not. With that data in hand you and your staff can address your actual web security vulnerabilities and, when handled, know that your site is completely free of known issues regardless of what updates and patches have been done and what condition your code is in or what unused code may reside, hidden, on your site or web server.
A vulnerability scanner can be run on a regular basis so that your site will be tested against new vulnerabilities as they become known and provide you with solid data as to whether action is vital, needed or low priority. You will also be alerted if new code has been added to the site that is insecure, a new port has been opened that was unexpected, or a new service has been loaded and started that may present an opportunity to break in.
In complex, large systems it may be that daily web scanning is the ONLY way to ensure that none of the many changes made to site code or on an application may have opened a hole in your carefully established security perimeter!
Looking for a vulnerability scanner? Learn about Fortra Vulnerability Management.