CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.5  Security Baselines            9  3.5.3  Application Hardening

3.5.3.1  Updates 1 2 3 4 3.5.3.3  Email Servers

Hardening Third-Party Server Applications

In order to harden the applications on your web server, you need to find out what third party applications and tools are on your web server. These may be a mix of end-user applications such as CRM applications and programming environments like Java or Perl. If your developers were given free reign over the server in order to roll out an application in a timely fashion, ask them what they installed in addition to their own code. Otherwise, you probably have some idea of what run-time environments like a java application server were installed on your web server.

After you have made that list, take a long, hard look at that list of third party applications on your server. Do you REALLY need ALL of them? Each additional application is another potential point of vulnerability. Particularly, if you’re running a database and storing sensitive data on your web server (or anywhere on the same side of your firewall as your web server), strongly consider moving the database to another machine. Your web server is a security compromise waiting to happen. You want to take all possible steps to minimize not just the chances of a break-in, but also the loss the company incurs, if one occurs. It’s bad enough for a web server to get “rooted”. It’s worse for the attacker to make off with a list of 20,000 credit card numbers because he had access to the database stored on the same server.

Once you know the applications you MUST have on the server, check the vendor’s web site and security sites for information about current vulnerabilities and take the recommended steps. Also double-check any configurations with security in mind.

3.5.3.1  Updates 1 2 3 4 3.5.3.3  Email Servers