Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities).

This application uses asp.net membership provider for user authentication and the data is gets validated from front and back end before submitting input and encrypted query string is used. I am plane to use Ultimate hosting plan for Godaddy which comes with Malware Scanner and SSL Certificate.

Are these security measures enough? As there is staff personal information in the database.

If not what other measures I can set.

share|improve this question
    
If you have a working server, why not save money and give access to it on your office firewall? You could partition it in one of several ways so that it can't be used to attack the rest of your lan. –  lynks Jan 10 '13 at 19:49
    
@lynks from a security perspective, I'd suggest that should be a last resort, rather than a first resort. As a general rule, it will (virtually) always be more secure to host externally, so it's typically not the best idea to poke holes in your LAN security for web apps that don't need to be there. –  Xander Jan 10 '13 at 22:54
    
@Xander it doesn't need to be in the LAN, a cheap firewall can put it in a different subnet. I'm just saying why pay for something you already have. –  lynks Jan 11 '13 at 0:45

1 Answer 1

up vote 3 down vote accepted

If that's the only thing you've thought about, then likely the answer is "no, that's not enough". I'm assuming that's not really all you have thought about, but just in case...

"Enough" is something that is determined after a detailed threat analysis by someone (or a team of someones) that knows what they are doing. Web applications are wonderful attack surfaces, and while Microsoft made it relatively easy to properly build a reasonably secure website using ASP.NET, it's still very easy to not build a secure website.

Simply putting something together and putting out there isn't enough, even for a website that contains no sensitive data.

There are many threats to worry about:

  • SQL Injection attacks
  • Cross-Site Scripting (XSS)
    • Someone figures out a way to get your website to serve up malicious JavaScript. Usually this is done by injecting the script into a database and then counting on the developer to not know enough to escape the database output. It can also be done if the attacker has access to your file system, but putting the payload in the database is much more common.
  • Cross-Site Request Forgery (XSRF)
    • This is when someone uses XSS to put a malicious JavaScript on YOUR website that then goes and performs unauthorized transactions (often without your user's knowledge) on another website. (This is why it doesn't matter if your site has sensitive information or not. If you aren't coding to prevent XSS, your website can be used to attack websites that do have sensitive data.

Those are only the first thing to pop into my head. There are a ton of other issues to be concerned with. But this forum isn't meant for that type of in-depth answer.

I suggest starting here: http://msdn.microsoft.com/en-us/library/ff649100.aspx Once you've digested that, I'd strongly recommend becoming familiar with the OWASP Top 10. http://www.owasp.org/index.php/Top_10_2010-Main You're asking about a small sliver of the things you need to be concerned about.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.