2

What are the best ways to keep a website safe without web security and cybersecurity knowledge? Will a top WAF service (commercial) be sufficient for handling most (of course not for all, more specific 95%) attacking activities?

Thanks for your all comments.

To be more specific: What kinds of tools or services should I use for our cloud-hosted dynamic (vendor-developed CMS with PHP) and ordinary company websites to keep them safe, besides WAF, SSL, immediately updating and secure coding (which is not a practical way since we do not have sufficient secure coding experience)? The practical way to keep our site safe, I figured, would be to use third party tools or service, based on ROI. The vulnerabilities are mostly caused by not-secure coding.

|improve this question

closed as too broad by Steffen Ullrich, forest, Rory Alsop♦ Feb 21 at 8:38

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    I consider this question as too broad . It is like asking a generic question on how to keep a transport device working without having a clue how this works. First, you either learn how this works or hand over the maintenance to a professional. Then, it widely depends on the kind of device and the use case: a bike which you use for your own and a bus used to transport others are widely different in needed maintenance and risks associated with neglected maintenance. All of this is true for website too. For example: for a website consisting of only static pages no WAF is needed. – Steffen Ullrich Feb 21 at 6:43
  • 1
    Make it html only. No data input possibility, no security problem. – Overmind Feb 21 at 7:33
  • 3
    A WAF is the most useless thing you can put on top of your service if you don't know anything about security and is unwilling to learn about it. The same can be said to many security tools like IDS, IPS, Firewall, automated vulnerability scanner, automated pentester, static/dynamic code analyser, and a whole host of other stuffs. In the right hand, they're great tools, but they're otherwise just distractions when you want something that you can just set and forget. – Lie Ryan Feb 21 at 9:15
  • WAFs should be fine-tuned for best performance, especially to prevent attacks tot he business logic, and that also requires competence. An easier way to limit attacks to cloud services from third parties in certain scenarios is restricting access, for example based on IP filtering, VPNs or HTML authentication. – Enos D'Andrea Feb 21 at 9:16
5

what are best ways to keep a website safe without web security and cybersecurity knowledge?

Shut it down, delete the code.

But since this is not the answer you want to hear, let's take a deeper dive:

Depending on the website we're talking about - Is it a CMS like WordPress? Is it something an intern clicked together in Dreamweaver? Is it a simple index.html only containing an address and a phone number? - it's impossible to give informed recommendations. So try to get a basic understanding of what area you want to improve next and ask a more focused question.

However, as a general rule of thumb you can do the following:

  • Keep it up to date!
  • Get a pentest from a reputable source to get your most critical vulnerabilities and fix them ASAP.
  • If you use a regular CMS you can start by scanning it with a vulnerability scanner like OpenVAS/Nessus
  • If you coded/customized it yourself (e.g. no off the shelf CMS) you can additionally run it through SAST (static application security testing) and DAST (dynamic application security testing) tools.
  • OWASP has a plethora of guidelines, checklists, cheat sheets etc. - read them, apply them.
  • Don't forget about key-, password- and access management to the website and infrastructure. The best website security is useless if you enable unauthenticated SSH to your production server. Same goes for social engineering.
  • Get another pentest after you fixed your issues to find even more issues (quality management is a cycle for a reason).
  • Set up secure network segregation between dev, test and prod.
  • Monitor network traffic with IDS/IPS.
  • Logging, logging and more logging - log everything: access, failed logins, destinations, successful logins etc. etc. (but beware of GDPR et al).
  • And most importantly, get educated. Read up on everything web security related. Watch tutorials, read books, news sites, blogs etc.

Or, if you really care about your website's security, hire a professional to guide you through this process. My guess is that this option will be more thorough, more secure and a lot cheaper than trying to fix this on your own.

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.