1

Context

The company I work in is starting to have a more dynamic website, which can process sensitive user information. With so, we want to improve our security. We are a healthcare company from Brazil, and recently a lot of data has been exposed through national hackers specifically against healthcare companies. We do not have the resources to hire an information security expert yet, but we want to begin our firsts "baby steps".

I'm not an information security expert but I would like to start entering this security area a little bit more.

Question

I'm using CloudFlare on our website because of its CDN, but I also see that it has firewall capabilities. I understand why Firewall is important.

I want to know which filters is more commonly used or which filters are more important.

This question comes with a learning process as well, so if you may improve your answer with:

  1. Should I care about this or something else first?
  2. If a hacker wants to access our information, will this difficult the process for him?
  3. Which filters should I consider the most?

For example, I assume that filtering countries is not so efficient because if someone really wants to access my data they can use a VPN or similar. Is this thinking correct?


Below a GIF with all CloudFlare's options available:

cloudflare firewall options

4
  • 1
    Do you have the WAF enabled? That's the firewall that will protect you against vulnerabilities in your web app.
    – nobody
    Commented Jan 19, 2021 at 17:59
  • 6
    In my eyes "process sensitive user information" / "healthcare" and "not hire an information security expert" do not go together well Commented Jan 19, 2021 at 20:40
  • @HagenvonEitzen I understand, but unfortunately we are a small network of independent healthcare professionals. Indeed is very harsh for us to hire an information security expert. The main flaws that happened in our competitors is that they used in-company servers and national - not very reliable - ERP. We have everything in the cloud with Dropbox and an internationally famous ERP. Our web server which is on HostGator, just now started to process some information. We are in a learning process. Would greatly appreciate an answer.
    – RA828
    Commented Jan 19, 2021 at 20:48
  • some questions: what service are you using from hostgator? what functions within the service? (ie. shared hosting? php? db? wordpress?) .. there are positive arguments for hosting if you aren't capable of managing your own host (and maybe infrastructure). What applications are you using to collaborate and handle sensitive information?
    – brynk
    Commented Jan 20, 2021 at 11:50

2 Answers 2

2

Referring to the firewall of your real server:
You should close all ports except the ones needed for your application, which will probably be 443 for HTTPS. Furthermore, when using Cloudflare, you should block all requests except those coming from Cloudflare itself, since it will be acting as a proxy.

Referring to the Cloudflare "Firewall":
The main function of Cloudflare is preventing DDoS attacks and slowing down crawlers. It might also offer some protection against an attacker finding your original server and probing it for vulnerabilities if configured correctly, but there are near infinite ways your server's original IP address could be leaked.
The Cloudflare Web Application Firewall is a useful tool for defining custom responses and rules for certain routes and visitors. This is not as easy as "type XY into this input field and your app is protected".

Cloudflare will not stop most sophisticated attacks. Your data can still be threatened in a myriad of ways, and Cloudflare does not offer 100% protection against even "basic" attacks like SQL injections or XSS attacks. It will do absolutely nothing if an attacker gains admin access by social engineering, phishing, credential stuffing, physical theft of computer hardware, etc.

Keep in mind that by using Cloudflare, Cloudflare will be able to read, log and even manipulate every single request between your server and your users. They act as a perfect Man-in-the-Middle, trusted by both server and client.
The gain of DDoS protection comes at the cost of having to trust Cloudflare 100% - if the company or a single admin inside their organisation goes rogue, or an outside attacker breaks into Cloudflare, you're compromised.
This is especially important to consider if you're bound by some EU data protection laws that forbid transfer of user data to US companies.

I also have to agree with the other commenters that you should look into getting at least an audit by an independent security professional. It will be cheaper in the long run.

-1

For a website, minimum standard is to close all ports but 80 and 443 (for HTTP and HTTPS)

You could also add a plugin such as ModSecurity on your web server.

1
  • port is not one of the options
    – schroeder
    Commented Jul 3, 2021 at 20:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .