0

My backend is hosted on AWS-EC2 running ruby on rails. My frontend is hosted on aws-s3 using angular-js. My DB is MongoDB.

All APIs have an authentication token for user security. Every server is https enabled with cloud-front aws. My backend have only 80/443 port opened, and 22 for my private IP. My clients ask me about the security features of this iot-system. What are the habits that I need to keep in mind to make the system secure from external threats?

External threats include someone hacking the data on my DB? someone stealing user account details/credentials using phishing? DNS spoofing?

P.S.: I use CloudFront for SSL certificates and they route my data using https, convert all connections from HTTP to https. All of my stacks is on AWS from DNS to my frontend.

|improve this question
  • 1
    I can suggest OpenVAS which finds out vulnerabilities in your we server. – defalt Oct 25 '17 at 10:01
  • Maybe you could specify in your post, what external threats exactly do you mean – skooog Oct 25 '17 at 10:04
  • This is too broad. Have a look at OWASP top ten for a start on where you should look to evaluate and improve the security. – Steffen Ullrich Oct 25 '17 at 10:45
  • It is very broad yes, but I can also understand that someone that does not work in InfoSec wants to ask the question: "I told my clients I deliver secure stuff, where do I start to make this true?". And where to ask if not here? – Wealot Oct 30 '17 at 10:03
1

To be the one to make this comment: you can never be 100% sure. But you can:

  • Use vulnerability scanners (credentialled and uncredentialled) regulary (every week?) to make sure public vulnerabilities have been patched and you have not accidentally opened your webserver up to the outside world. Try using OpenVAS or Nessus (or any other) for vulnerability scanning. Try using OWASP ZAP every now and then to see if you have any webvulnerabilities
  • Run the SSLlabs scanner on your site every month to make sure you are still up to date with encryption
  • Run your code through a source code scanner (can someone say which one is easy and good?)
  • Think of secure processes to run through when administrating your website. So how do you work with passwords and autorisations (I do not know if you have employees)
  • Take the OWASP testing guide and try to run through it yourself. Also look at the OWASP cheat sheets for administrating and developing your website and webservices
  • Hire a pentesting company once a year to do a real "once over" to see if you have vulnerabilities that you yourself and the automatic scanners do not have the expertise to find (mostly in business logic and more indepth vulnerabilities)

I am assuming here that you are not a security professional, so cannot do everything yourself. But I think if you make use of automated scanners and hire pentesters once a year you are as secure as you can be in normal circumstances. If you have no money for pentesters you will have to try to do most things yourself (OWASP testing guide is a real help!). If you have tons of money you should hire a security professional to constantly help in improving the security of your organisation.

|improve this answer
1

In my opinion the best method is to perform a pentest. Ethical hacking performed by professionals will give you the flaws of your website.

Anyway, some common checks are:

  • Have your website ssl with a good certificate?

I mean a certificate made by an authorized entity, not a self-signed certificate.

  • Do you have HSTS activated?

This is to automatically redirect clients requesting the page in plain (http) to the secure (https) version.

  • Have my website the security headers?

The usual protections against clickjacking, XSS and others. Check this: https://geekflare.com/http-header-implementation/

  • Are you sure the content displayed is the desired content to show?

Check if there are "residual" files on the server's browseable folders. Check if the private part of the website can't be accessed directly by url bypassing login... all of the basic checkings.

  • Are you sure your server version and technology is up-to-date?

Usually, old versions of any webserver or technology (Apache, php, wordpress, nginx, etc) are vulnerable to some attacks.

  • Do you have any kind of protection against DoS?

In your case, if the website is hosted on AWS you can talk to your provider (Amazon) for this service.

  • Execute a SAST analysis on your code using a source code scanner tool. <- I added this to answer to Wealog asking for this on his answer.

Checkmarx is a very good option but it's expensive. HP Fortify can do the job too but is expensive too. For mobile apps there are some free solutions like androbugs, drozer or mobsf. For other kind of apps I don't know a good tool for free.

This can be valid to start. But remember, pentest is the key in my opinion.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.