The Concept of Server Hardening

What is server hardening?

Server hardening, in its simplest definition, is the process of boosting your server's protection using viable, effective means. Web server hardening is vital in keeping your data and operating environment protected at all times.

Hardening in general is comprised of different levels, known as defense in depth. This defense in depth is made up of the host level, the application level, the operating system level, the user level, the physical level and all other sublevels in between. The hardening process then includes placing various security measures at each of these layers.

Importance of Web Server Hardening

Server hardening aims to protect your servers from all possible security loopholes. Its importance becomes more clear when you understand the risks and vulnerabilities of running a server. Websites and applications are fragile entities in the virtual world. Without enhanced protection, your site may come crashing before you know it.

It is a fact that many servers today are being attacked countless times in a day - thousands or even more in just 24 hours. Since all servers are susceptible to attacks, the best defense comes from the protection of heightened security measures.

It is good to be aware that at initial or default configuration, most operating environments and servers are not designed with security as its main focus. The defaults concentrate more on the usability and functionality. This implies that without hardening, your servers are running on very weak defenses.

Common Hardening Methodologies

There are a number of viable ways to implement web server hardening. For better results, consider the services consultants and professional providers. Their expertise can elevate your security up a notch.

Common hardening methods include, but not limited to the following:

• Use two different network interfaces in the server. One will be for the network and the other will be for the administrator.
• Create a secure remote administration for the server.
• Keep operating systems updated with the latest, most robust versions. Also make sure that your security patches and hot fixes are constantly updated.
• Closely monitor the security bulletins applicable to your operating system, applications and other software.
• Properly configure a system firewall.
• Consider installation of hardware firewall.
• Install virus, malware and spyware protection.
• Avoid having open network ports. Only keep those that are required to meet your specific needs.
• Disable unnecessary services.
• Avoid the use of insecure protocols for processing requests, especially those that send information (i.e passwords) in plain text.
• Keep a backup for all your data and files.
• Remove unused accounts from the server.
• Enforce strong account and password policies.
• Secure separate partitions.
• When hosting multiple applications, make sure that each has their own accounts separate from the others.
• Never provide write access to web content directories.
• Install and configure a web application firewall (WAF)
• Remove administrative shares if not needed.
• Closely monitor failed login attempts. Lock accounts after a specified number of failures.

Most importantly, do not ever connect your server to the Internet without being fully hardened.

For starters however, it is good to dig more into the importance of enhanced security. Then, you will realize how crucial it is for your business to avail of proper web server hardening.

Yawig outsource server hardening services to the clients who want to protect their server from external threats. Yawig web server hardening prepares the server to defend attacks.