I'm in the process of setting up a network and it needs a site for users to be accessible on the internet. I keep reading about not having a public server on a local network, domain etc etc. And that it must be in a DMZ.

Now I'm no security expert by any means but say there is a firewall between the internet and the network that was setup "correctly" with the "best" possible security and had one port forward to the internal web server. Assuming also that the web application code (PHP in this case) was also secure and all user passwords where secure, what possible way is there to compromise the system and get internal access to the network?

I understand that a DDOS is possible (assuming you don't have some detection system against that) but such attacks doesn't get you internal access. And in this case its not a big organisation or anything, so a DDOS or smilier is unlikely unless a bot stumbles on our public IP.

What I dont get even more is how can just a plain HTML, CSS and JS site be compromised? PHP and server side code can obviously be a big security risk if it was badly done as it runs on the server. But if properly coded....

I might be blind but I seriously dont understand how well written code, closed ports and a properly setup firewall would allow a system compromise. As far as I see having open ports with ssh, ftp and such are what can allow you to compromise a system.

Hope I'm not beeing a big idiot. :)

closed as too broad by Xander, AJ Henderson, Adam Katz, schroeder Oct 20 '17 at 14:08

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    It's a bit of broad question. You might want to consult a professional within your organisation, or outsource for one. – ISMSDEV Oct 19 '17 at 12:18
  • Too broad. It is same like asking stupid broad question like : why I am poor. – mootmoot Oct 19 '17 at 15:08
  • You appear to be asking: "If everything is perfect, how can there be flaws? And then how can those flaws be exploited?" There are just too many assumptions and logic games there to be answerable. – schroeder Oct 20 '17 at 14:12

Assuming also that the web application code (PHP in this case) was also secure and all user passwords where secure [...]

That's like saying "assuming that the lock is unpickable and the house has no windows, how could a burglar possibly break in?" You can't assume that, it's completely unrealistic. No code is perfectly secure unless it was written by the Gods themselves (and they wouldn't write it in PHP). And users do pick bad passwords and reuse them on all sorts of places, unless off course your users are Gods as well.

  • 1
    Gods default password is 'admin', everyone knows that – ISMSDEV Oct 19 '17 at 12:15
  • Thanks for the explanation. But I don't fully agree. A lock is pickable and it's known how to do it. But there are secure ways of coding and it remains secure till someone finds a hole. But then it gets patched. So I understand that's its not impossible to compromise but my point is there is no publicly known way of doing it AFAIK. In this case the users will certainly have secure passwords as there is only about 10 and they won't have much choice. – Abdullah Seba Oct 19 '17 at 12:24
  • 2
    Might be that no one knows how to compromise your site right now, but a determined attacker might still be able to find a flaw if they start looking. And if that "someone" who finds the vulnerability is your adversary, she will not be sending you a patch. – Anders Oct 19 '17 at 12:31
  • 2
    There are secure ways of coding. Well kind of, but any mistake done at any level could open a breach. Even OpenSSL which is a secure piece of code, and is thoroughly reviewed did contain such an error. That what Anders means when he speaks of god: a perfect program written by a perfect programmer should be secure, but AFAIK no human being is perfect... – Serge Ballesta Oct 19 '17 at 12:37
  • 2
    And that is a very reasonable decision to make. People often forget security isn't about creating a fortress when a fence will do. It's about striking a balance with cost/usability/risk. – iainpb Oct 20 '17 at 7:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.