Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am sorry if this is a too trivial question, but once I was told that only a fool is sure of anything: as I am not sure about this question, I am willing to risk my neck by asking it anyway, all in the name of learning and keeping my stuff secure.

Here it goes; background information:

I want to build a website which does not need any fancy functionality. There are no login forms and it is purely written in HTML and CSS. In fact there is not even input fields; just a 'Who we are', 'What we do' and how to 'Contact us' kind of thing.

Question:

Should I be worried that there might be some way of exploiting this site somehow?

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

Let's look at the technology stack of a dynamic website:

  • Your code, in whatever language you chose, e.g. PHP or ASP.NET
  • The script engine, e.g. PHP engine or .NET CLR
  • The web server, e.g. Apache or IIS
  • System services, e.g. SSH and FTP
  • The operating system
  • If you're on a VPS, the virtualisation technology that hosts your instance, e.g. VMware.
  • The hardware
  • The network infrastructure, e.g. switches, DNS provider, etc.

Now compare that to the technology stack of a static website:

  • Web server
  • System services
  • Operating system
  • Virtualisation technology if any.
  • Hardware
  • Network infrastructure

So, you've removed the top two layers of the technology stack by going for static. It is true that a large percentage of attacks are focused at the web application code and engine, but you still have a number of attack vectors to worry about.

Off the top of my head, here are a few:

  • Service passwords (e.g. SSH, FTP, RDP) for the server.
  • Web server vulnerabilities.
  • Service vulnerabilities.
  • OS vulnerabilities.
  • Virtualisation software (hosting management) passwords.
  • Domain provider account passwords.
  • Network infrastructure misconfiguration.
share|improve this answer
    
Thanks for structuring it so well. Complementing what Cristian said above, I will definitely keep note of this as a good guide to look for. Really appreciate both of your answers. Cheers. –  Lex Feb 5 '13 at 23:07
add comment

If the content of the website is very simple like you describe, then the security risk lies with the web server, the OS, the hosting infrastructure and the security of the password for the hosting.

A web server can be improperly configured and security updates can be missing. Other services running on the same OS can be vulnerable to attacks. The hosting company can be breached and your site modified. And lastly, your password for the website file upload is a weak spot. There is a lot of malware that looks for FTP and SSH credentials that can allow it to change your website, usually to attack your website's visitor.

share|improve this answer
    
Your answer makes sense, Cristian and it put me to think: thank you. I guess perhaps the way would be to run our own dedicated server, with minimal installation such as CentOS minimal or the lightest version of FreeBSD for example and make sure it is as tight as possible. Thanks again. Lex. –  Lex Feb 5 '13 at 23:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.