From the perspective of a complete server administrator novice, are all of the mainstream "hacks" due to the complexity of these applications? For example, if I were to setup a basic, updated Ubuntu Server LAMP stack with a MySQL database, is this system vulnerable? I understand how to protect against XSS and SQL injection and how to hash and salt passwords properly, but where can I begin to learn about implementing basic, hard server security? Additionally, how can I hope to secure my web app if corporations with entire security departments are failing to secure theirs?
how can I hope to secure my web app if corporations with entire security departments are failing to secure theirs
Excellent question. The answer really is, if you are running a "web app" with any kind of sensitive information, you need to have a security expert configure and administer your systems, or become one yourself, and you need to stay on top of every update.
Now, there are basic things you can do that will eliminate most of the casual script kiddie attackers. Firewalls. Defense in depth. Keeping up with patches. Google or any good book on computer security will provide this information. But the sad truth is, if a smart, determined attacker has you in his sights, you will most likely lose. And even the automated tools are getting better and better.
I think we are starting to see a tipping point in the web. More and more high profile sites are getting compromised. We have learned that China has been inside US government, utility, and industrial systems for years. Right now I would not trust any sensitive, personal information to any website or cloud service. I think we are going to see some major, consequential attacks on government, banks, and other commercial entities in the coming years. At some point I believe we are going to need to rethink the cost/benefit equation of having everything connected to everything.
> Right now I would not trust any sensitive, personal information to any website or cloud service.
A friend of mine put together an open source project that uses cryptography to store your data in the cloud securely, so it's certainly possible. [1]
It's also possible to write complex software and not be vulnerable, though 99.999% of the time companies (start-ups and otherwise) seem more concerned with an MVP and new features than security. If you design a system from the ground up with security as a core feature, then you have a CHANCE of having a system that won't be vulnerable to script kiddies every other week. On top of that you need to be sure to protect against social engineering, but that's another discussion.
I don't even know if it's possible to use something like Rails (or Ruby, even) and be secure for the long term without having to deal with constant updates and patches. On the other hand, I HAVE used complex systems that were designed from the ground up to be secure and that simply NEVER turned out to have a security vulnerability after the first few releases. (Anything by DJB, for example. [2] Some of those tools have gone 15+ years with no vulnerabilities. Compare the constant sendmail or bind security exploits, numbering in the hundreds at this point, to DJB's qmail and djbdns.)
Until it's a priority, it's always going to be an afterthought, by definition. People will use Rails or the framework du jour, despite the fact that such frameworks are designed with the same "get it done and release ASAP" philosophy that most commercial sites are developed with, and then everyone wonders at security holes. Sigh.
> a basic, updated Ubuntu Server LAMP stack with a MySQL database
After just apt-get'ing that, the system is of course always vulnerable to the next as-of-yet-undisclosed 0day vulnerability in the base software.
As soon as you start adding useful scripts of the "P" variety (as in "LAMP") then you are at the mercy of those scripts not having any vulnerabilities.
If you wrote those scripts yourself, then yes, xss, sqli, rfi etc are all issues you need to consider. The OWASP pages could be a useful place to start getting a feeling of the most common pitfalls.
The typical LAMP-stack out of the box is nowadays relatively safe. They were a lot unsafer earlier.
So, how to keep safe:
1. The app itself:
If you have a small web app, you have an incredible advantage that makes your web app potentially way more secure than that of a big corporation: You write the code and you know the inside outs of the system. And you are probably the only one having passwords etc. to the system.
In a big corp, sometimes the interns write some code and they have no clue of web app security. From an attacker's perspective, one security hole is enough.
So, if you know about web app security, you're probably better off than any other big corp.
2. The server infrastructure:
If you worry about the server architecture, get a managed dedicated server. There's probably not really a guarantee that this system is set up perfectly, but there might be trustable hosters that know what they're doing.
- Keep everything up-to-date (apt-get update, apt-get upgrade).
- Don't install software you don't know or can't trust
- use SSH only with public key authentication, remap port 22 to something else
- use SFTP + SSL for your website
- don't include any third party JS-software that messes with your website. Personally, I don't even include Google Analytics. I self-host everything and install only stuff that is trustable.
- don't use the root user if not necessary
There's this "myth" going on that every system is hackable. This is only partly true. You can't do anything against 0-day hacks, but if you protected your web app against XSS, SQLI etc. and your software is uptodate, there's hardly any chance that you get hacked.
What makes every system "hackable" is the human factor. The secretary that gives out her password to some guy on the telephone who pretends to be the technical administrator of server X. Are you likely to get social engineered? Probably not.
