0

We're developing a Software, using Git and some web based organsiation software on one of our members webspace. This webspace is as far isolated, thus none could access it without knowing the address.

Now, we anted to launch a Webiste for our Studio and Product and I wanted to rent another webspace of a different provider as this would be (in my opinion) safer. For better understaning I use "Production" for our production server and "Website" vor the Webspace only containing our websites.

Imagine an attack on our Website. Either (D)Dos or something that bricks our files. In this case we could say goodbye to our files and have to use a older backup, losing important progress.

Using two seperated Spaces would IMHO just affect the Website, as there are no links to our "secret" Productionspace.

This is the best scenario I could think of, as it would be the most obvious thing for a malicious attacker that wants to troll us, to attack our "public" space and hope he will destroy/mess up our production files that are likely on the same space.

What do you think? Ist this the best method? Or am I conpletely wron here?

1

If you do not have the resources to be able to reasonably secure a deployed web application or web presence and segregate your internal network from that web presence then I would recommend outsourcing the hosting of the "public" presence. With that said you now have two resources that you must ensure are secured from threats. The hosting company will certainly take care of some of that for you, but the web application itself will be your responsibility to secure.

In my opinion, segregation is always important. The problem is that segregation can be difficult. Many people that think they have segregation of their network sorted out, do not in fact have segregation figured out and attackers can pivot through things like backup or development networks.

Now I will qualify that with the fact that just because you have segregated your "public" presence and your "private" presence does not leave you in the clear. Take HBGary for example - They had credentials stolen from their vulnerable web application that were used to log into someone's email (password replay attack) then they social engineered the SysAdmin posing as an exec who desperately needed SSH access while "travelling in Europe".

If your two networks can co-exist separately then I would definitely advise doing so, just keep in mind that this is not the silver bullet against compromise.

P.S.

Imagine an attack on our Website. Either (D)Dos or something that bricks our files. In this case we could say goodbye to our files and have to use a older backup, losing important progress.

Please do yourself a favour and take frequent offline backups.

| improve this answer | |
  • @PS Jup, that's the plan. Since this is not my Server and I have no control over it i rely on the promises of the owner. Thanks foru your answer, though :) – pguetschow Dec 16 '16 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.