Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm developing a web application for mobile devices on my local server in my laptop. My laptop is connected to company network via LAN. And, my project manager, wants to check the web application which runs on my local server via his phone through WIFI. Further, I'm using fedora 15, and don't have any anti-virus software. Is there are any security problem for my personal data which is on my lap?

How can he access the web application, other than WIFI enable mobile devices?

share|improve this question
    
Hi @Kugathasan, can you share some more information, such as which webserver, etc? As I understand it, you're only asking about security of your OS, as far as allowing external web access to it - and not about the security of the application itself, and its data, is that correct? –  AviD Jul 24 '11 at 9:57
    
Yea, I'm not asking about the security of the application, but, about my personal data on my laptop. –  Abimaran Kugathasan Jul 24 '11 at 10:09
    
Holy hackeysack! If I were you I would shutdown my laptop right now and use a live boot CD to scan for malware. –  this.josh Jul 24 '11 at 21:47
    
The application isn't tested yet! –  Abimaran Kugathasan Jul 25 '11 at 0:40

3 Answers 3

If your web application isn't being run as you, but a dedicated user with access only to the correct folders/files, then it should be fine.

Of course, if either the operating system/server/application/hardware drivers etc has a vulnerability in it that enables read access to any folder, then you'll have a problem!

Check you don't allow arbitrary code execution in your app, check everything's up to date and all should be fine.

share|improve this answer

Is there are any security problem for my personal data which is on my lap?

Yes! This is extremely dangerous. In this scenarion his phone could act as a internet gateway. Depending on how secure his phone is, it may expose your laptop directly to internet based attacks. Given that you aparently have no protections on your laptop I advise against it.

How can he access the web application, other than WIFI enable mobile devices?

Through any web capable device. Through a destop or laptop computer on the company network. Through a mobile device specificly configured for testing. If you have a appropriatly secured internet facing web server, then he can access it through any web capable device connected to the internet.

Protect your data, if not your entire laptop.

Provide integrity monitoring for your data. You can do this by generating cryptographic hases (MD5, SHA1) and storing the hashes offline. This can be done easily with sha1sum, md5sum, or openssl. You can store the hashes on a CD-ROM, USB flash driver, or other removable media.

Provide confidentiality for you data. Create an encrypted container or disk with LUKS, tryecrypt, or OpenGPG. Store your private files in the encrypted container (folder) or drive.

While I'm offering unsolicited advice... Backup your files. If you have hashes, backup your hashes. If you have an encrypted disk backup the disk in encrypted form. If you have an encrypted folder or container, backup the container or folder in encrypted form. Don't make it easy to breach your data's integrity or confidentiality through you backups.

share|improve this answer

I think Rich Bradshaw is correct on using a dedicated user to run the web server. Furthermore, you can:

  • run the services in chroot mode (nginx example)
  • use one of the many virtualization solutions available (e.g. VirtualBox )to run a simple virtual machine only for this server and/or development

In the end, security is always about a compromise between easy and safe. It's easier to run a local un-chrooted server on your development environment than going through the trouble of configuring it or having a dedicated VM; it's certainly not as secure.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.