I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
I'm asking this for purely academic reasons. I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
In what cases does a webserver need an antivirus software installed? When it is not required? If it is required sometimes, what should be considered when choosing the right one to install? (In my ...
How do I ensure I have my SSL configuration setup securely?
What are some best practices, recommendations, required reading for securing an Apache Server?
What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user? Edit: I am mainly thinking of securing the server from the users themselves and between ...
If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
We are trying to decide which webserver to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?