Ask HN: How to secure a website?

#1

Post by devcheese » Thu, Feb 11, 2016, 9:56 PM UTC

So I'm new to deploying apps to production, I'm curious of everything I need to do to make a website secure. As of now, I only know to setup SSL, I imagine there is more beyond that.

Re: Ask HN: How to secure a website?

#2

Post by mtmail » Thu, Feb 11, 2016, 10:06 PM UTC

http://guides.rubyonrails.org/security.html is a good introduction for webapps written in Ruby/Rails and their countermeasures.

It's better to ask the same question on a forum or StackOverflow as most frameworks have countermeasures or configuration options included (salting password, inspecting HTTP headers, preventing SQL injection).

Re: Ask HN: How to secure a website?

#3

Post by tmaly » Thu, Feb 11, 2016, 10:26 PM UTC

lockdown all ports except 22, 80, and 443 with iptables.

setup a fail2ban to update iptable rules to detect repeated hack attempts and ban their ip address.

Re: Ask HN: How to secure a website?

#4

Post by sumodirjo » Fri, Feb 12, 2016, 2:54 AM UTC

Using Cloudflare / Sucuri in front of your website won't hurt

Re: Ask HN: How to secure a website?

#5

Post by rmdoss » Fri, Feb 12, 2016, 5:52 PM UTC

SSL doesn't have much to do with securing your website. If you are worrying about security, I would recommend to try to find solutions to solve the:

-integrity -availability and -confidentiality

Of your server and app. For integrity, look for file integrity monitors (OSSEC is a good open source project that does that).

For availability: load balancers, ddos protection, auto scaling are all things to look for. Products like CloudFlare and Sucuri can do it in the cloud for you automatically.

For confidentiality, try isolating your server, setting up firewalls to deny all by default, restricting access, keeping it updated, etc.

thanks,