4 ms·
The reason nobody shared their one true checklist for security is that it doesn't exist. Well secured systems get owned every day, and tons of bad ones never ha
by trotsky 14y ago
The reason nobody shared their one true checklist for security is that it doesn't exist. Well secured systems get owned every day, and tons of bad ones never have trouble due to luck and lack of incentive.
Most extensive security procedures contain a lot of questionable advice and few will prevent human error which most compromise can be traced back to.
The only semi-universal list amounts to
1) use keys for ssh
2) block/turn off everything except your (web) service
3) automated security updates or some sort of failsafe procedure to install security updates very regularly (this is by far the most common error)
4) Learn about web application security threats especially sql injection and consider them at design and implementation and have some kind of regular review (this can be very difficult to get right)
5) Avoid storing anything that makes you a particularly desirable target like bitcoins or secret defense plans as anything can be hacked with enough incentive.
Most everything else probably won't make too much of a difference to you.
- robomartin 14y ago> 3) automated security updates or some sort of failsafe procedure to install security updates very regularly (this is by far the most common error) This isn't clear. Are you saying you think automating these updates is good or bad? > 5) Avoid storing anything that makes you a particularly desirable Well, in some cases your user's uid and pwd is the most valuable chunk-o-data a would be attacker wants. > Most extensive security procedures contain a lot of questionable advice List? > and few will prevent human error which most compromise can be traced back to. I think this would be the power of having a canonical auto-provision script on Github that many can review and contribute to. The script could certainly take the form of sections that could be commented out as needed. In other words, a well documented and reviewed set of recommendations that someone could edit based on pier-reviewed information in the comments and then use to automatically configure a server. That, I think, could be of value.
- adamsaleh 14y agoAs far as one true checklists go, I really like NSA Guide to securing RHEL. http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2.pdf http://www.nsa.gov/ia/_files/os/redhat/NSA_RHEL_5_GUIDE_v4.2... and TLDR version: http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731.pdf http://www.nsa.gov/ia/_files/factsheets/rhel5-pamphlet-i731.... It is starting to get a little bit dated (RHEL 5 is quite old), but general rules still apply and usually they explain their reasoning.