Dedicated application server security

Question

I'd like to expose a machine running Windows Server 2012 to the internet. I plan to run a single application that uses a specific port (say 12345) and then use RDP through 3389 to logon and manage it. I would use the firewall to block access to all but these two ports.

Assuming the single application itself is secure, I'd like to know whether there are aspects of security I need to consider, and if so, what they are.

Update 9/26/16 Sorry I didn't respond sooner; one of my email filters marked your reply as read. Thanks for replying.

I plan to rent a server, or virtual server, from someone like 1&1. Based on your response I guess I'd rent two and use one as a router. Maybe all of their servers sit behind a router - I'll have to ask.

I've noted your bulleted suggestions and they all make sense. I'll look into smart CDN services.

I think I understand the matter of dealing with DDOS attacks on the open ports but I'm not quite clear about how the machine is vulnerable if I've blocked all ports except for the application and RDP. Could you expand on this a little?

Answer 1

I wouldn't recommend connecting any machine direct to the Internet if you can help it. There are too many attack vectors that you are exposing yourself to, many of which will be unknown.

In any case, doing so would be very unusual indeed. In almost every case, you would connect the server via a router that would have at least some basic protections built in. Things such as invalid packets and basic Denial of Service attack protection are common. You would also use that to limit the incoming open ports and forward incoming traffic to the correct internal IP address (NAT).

In addition, you need to make sure that:

• The server & its software is constantly patched. Ideally, patches should be pushed from a trusted server deeper inside a protected internal network.
• You are running anti-malware protection. At least Windows Defender.
• You should turn off every process that isn't needed and uninstall all unnecessary software and services
• You should move the RDP connection onto a non-standard port. You can do this at the router/firewall using port forwarding or on the server itself.
• You can also configure the RDP server to use TLS which will provide additional protection over the standard RDP traffic.
• You must make sure there are no default user names on the server and that any user ID's have very strong passcodes, especially admin users.
• You should use another machine - preferably further inside a protected network - to grab logs from the server and those logs should be monitored for unusual activity. This should be done automatically using a monitoring system.

You might also want to think about denial of service attacks. If the application that is being served is a web service, you might consider using a smart CDN service such as Cloudflare to provide smart caching and DDOS protection. In that case, you can restrict incoming connections to the app port to only be from the CDN.

Of course, how much effort you put into this depends partly on the value of the information the server is handling. But you also have some responsibility to the rest of the Internet to ensure your server doesn't end up as part of a botnet.