3

I have an Asp.net site. Which hosting system do I need to secure it adequately* against anyone reading private information that's on the server? This is assuming I'm not worried about the sysadmins getting it.

Note: Even if no one gets control of the site - the problem remains of reading the information.

Note 2: I am not asking about anyone hacking my site directly such as by sql injection. Rather by getting around the site, such as by using another account on the web host to get to my information.

So:

  • Is shared hosting enough?
  • Do I need a VPS, and is it really any safer than shared?
  • Or - Must I set up my own server, and appropriate ISP etc.? If so - will it actually be more secure - since I am no expert on the subject?
  • Can Windows Azure be of help here?

If I am asking this incorrectly, such as addressing a moot point because of some "weaker link", etc. Please correct me.

* Yes, I know. "Adequately" is not an exact term. But any information from the experts (-that's you!) might be helpful: Can most Windows shared hosts be cracked (in the sense mentioned above) by any hacker in an hour? Or will an expert hacker have to dedicate a week for it? The security level needed here is not anywhere like that of financial institutions', I'm looking for "good enough".

Improve this question
1
  • One "weaker link" here is the security of your own software. What have you done to ensure that your software prevents unauthorized users from accessing private information?
    – jdigital
    Dec 5, 2013 at 11:32

4 Answers 4

Reset to default
3

The difference between shared hosting and VPS hosting in this context is the mechanism used for separation. Shared hosting uses file permissions to prevent users from exploiting each other, while VPS uses virtualization containers.

In both scenarios, a properly-secured server (by definition) can protect you. And in both cases, it's possible for software vulnerabilities or server misconfigurations to lead to exploitation by another tenant on the server.

However, with a VPS, you're more likely to get a secure configuration than with shared hosting, simply because shared hosting is so much more difficult to do right. That's not to say that a VPS is safe, it's just more likely to be safer.

If security is a primary concern, then don't do either.

Improve this answer
5

Since your question is strictly about local exploitation rather than remote exploitation, I'll address it from that angle.

First of all, trust must exist between you and your host provider. Having a shared hosting, VPS, or even your own completely separate hardware as a server with that host are almost always the same. Your host provider is able to access your code, your database, and everything you're keeping on their servers.

As for your concern about other sites accessing your site, it depends; it all depends on the server's configurations. If the server is configured securely: access rights and directory permissions are set in secure fashion (each user has access rights to his own directories), server-side interpretation engine's (for example, PHP) threads are separate and all run under separate users, etc.

The most likely scenario in well configured shared hostings is exploiting a vulnerability in one site and then using a privilege escalation exploit to gain root access and from there the attacker can reach your site. In this case, having a VPS (even one with a system with an unpatched privilege escalation vulnerability) still offers more security than a shared hosting.

Those concerns must be discussed with your provider before signing a contract with them.

Improve this answer
2
  • About the privilege escalation exploit - they can even simply buy hosting from the hosting provider and proceed from there.
    – ispiro
    Dec 5, 2013 at 12:09
  • @ispiro That is indeed possible.
    – Adi
    Dec 5, 2013 at 12:36
4

With a VPS you are only depending on yourself for security. With shared hosting there is always a liability of other people's website on the server being insecure and in the end leading to the compromise of your website.

On the other hand if you aren't an expert on setting up a VPS yourself, it might be a good idea to get shared hosting anyway as the chances of you configuring something insecurely by accident are quite large.

Azure is a reputable Cloud hosting provider where you can also can get dedicated application hosting. Personally I think this is a good idea as they should cope with issues of shared hosting adequately (note that this is a subjective opinion based on Microsoft's reputation). So I doubt that just anyone can see your information. EXCEPT Microsoft Employees. You trust your provider with your information, which means that they can read it in the end.

Are they allowed to do this? Probably not when it comes to regulations or corporate policy. Can they do it? Yes they can.

Improve this answer
0
2

As secure your ASP.Net application may be, I strongly advise you to go for the VPS option, if you are wishing to keep private or confidential information on it.

Is shared hosting enough?

Shared hosting can be convenient, however in the case of storing private and confidential data, it is not recommended. Whilst storing such data happens all the time on shared hosting, by doing so, you are only increasing the security risks for yourself.

Do I need a VPS, and is it really any safer than shared?

Yes, a VPS would indeed be safer than shared hosting if configured and secured correctly.

  1. Imagine that you are on shared hosting with approximately ~100 or so other web applications (a common practice nowadays).
  2. Now, imagine the likeliness of a vulnerability in any one of these 100 or so web applications, which could give the attacker access to the server (e.g. sqli --> escalation of privileges --> uploads a shell --> can now execute commands on the server)
  3. Performs a variety of possible vectors to gain access to your hosting account.

I must note, that finding vulnerabilities on the 100 or so web applications would not be something which is that difficult. Considering that I can search for websites on a particular IP address via the "ip:" operator on Bing, it only makes it easier for the attacker to sift through possible targets located on the same server. 

Or - Must I set up my own server, and appropriate ISP etc.? If so - will it actually be more secure - since I am no expert on the subject?

Since you mention that you are no expert, it may be worthwhile investing in "managed" VPS hosting, where security assistance can be requested from the hosting vendor. Alternatively, there are a few good links here, which may help you: http://technet.microsoft.com/en-us/windowsserver/ff843381

Can Windows Azure be of help here?

As for this question, I can only comment on the fact that Azure is established and is run by a large corporation, perhaps giving a bit more piece of mind. However, I can not judge how much Windows Azure will help you, as I personally have never used it.

To sum up: If you can afford a VPS based solution, and have the time to secure it, I urge you to go for this option. Shared hosting is dangerous when storing such data

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .