I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container.
The app will deal with sensitive financial data, so security is top priority. The app is expected to handle a very heavy load, with tens of thousands of requests being sent to it per second.
If there is a significant security boost, then security takes priority over speed. The logic is simple: If I have a serious breach and lose the faith of my customers/investors, an extra 500ms in load time won't help me.
I already consulted with a security expert at a well-known company in San Francisco, and they recommended using Jetty.
They advised that while there would be a performance drop from Apache Tomcat, the security gains were so significant that it was worth it. They also recommended Jetty over Nginx. They said that Apache and Nginx were written in C, and as such, contained more security vulnerabilities than a server written in an interpreted language like Java.
They also advised me not to use a web server in languages like Python and Ruby, citing potential security flaws.
I then learned that Google App Engine switched from Apache Tomcat to Jetty for their web server/servlet container, and that strengthened the argument. InfoQ article - Why Google Chose Jetty
So while there seemed to be a lot of strong arguments going for Jetty (security expert's suggestion, Google's choice), I wanted to open this discussion up to the InfoSec community on Stack Exchange.
In your opinion, which of the following is the most secure, if we ignore for a minute the app code that is written on top of it?
- Apache Tomcat
- Python/Ruby based Web Server
- Node.js Web Server
- others that I haven't mentioned