Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

Question

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server.

Here we have to work with facebook Payment API.

We need to secure enough our Gaming Web Server, Memcached Server & MySQL Server.

• We have SSL Certificate
• We Monitors Logs Everyday

Is those enough, or any suggestion from you please?

Answer 1

I would make sure you have these things:

• Firewall
• Host Based Intrusion Detection system on all your machines (OSSEC is a free one, but you have to tweak the rules a little)
• Web Application Firewall

These solutions will significantly reduce the chance of a succesful attack by scanners etc. To have reasonable assurance you should also invest in a pentest.

Now since you have different servers, you should have frontend and backend servers. The backend can contain your MySQL servers since no users should have direct access to them.

Answer 2

I think you first need to look at the basics, such as having good firewall rules, keeping your software up to date etc. But this is the case with any server.

More specifically for you, my guess would be that the code for your game would be the most likely entry point for people who are up to no good. Examples are XSS, SQL injections etc. This is what i would focus on. If you work in a team, check eachothers code to make sure that the number of possible security holes is reduced as much as possible.