CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.5  Security Baselines            9  3.5.3  Application Hardening

3.5.3.1  Updates 1 2 3 4 3.5.3.3  Email Servers

Hardening Custom Applications

The area of hardening applications, such as ASP pages, that your own organization’s developers wrote (or that a long-gone dot-com-heyday web consultancy created for you) is a tricky one. Unlike for web server and application platform software, there’s no web site you can go search to look for bugs in “ourinternalapp” “version 2.4”. Rather than merely keeping your eyes and ears open for the latest flaws, you must proactively look for and prevent flaws in local, homegrown applications.

After you think your web server and server applications are secure, consider running a web security scanner on a regular basis, to make sure that you have made all necessary security improvements (as far as the scanner knows, at least), and to make sure that periodic web site and system maintenance doesn’t undo your work on securing the server.

For example, the Stealth HTTP Scanner will check for thousands of known vulnerabilities, and allow you to add your own tests, should you run into an issue it is not yet aware of.³⁷⁰ Another CGI scanner to consider is whisker, available at http://www.wiretrip.net/whisker, which runs on Perl on Windows or UNIX. If the scanner finds any additional vulnerability, correct them, and re-run the scanner.

3.5.3.1  Updates 1 2 3 4 3.5.3.3  Email Servers