I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities).

This application uses asp.net membership provider for user authentication and the data is gets validated from front and back end before submitting input and encrypted query string is used. I am plane to use Ultimate hosting plan for Godaddy which comes with Malware Scanner and SSL Certificate.

Are these security measures enough? As there is staff personal information in the database.

If not what other measures I can set.

  • If you have a working server, why not save money and give access to it on your office firewall? You could partition it in one of several ways so that it can't be used to attack the rest of your lan.
    – lynks
    Jan 10 '13 at 19:49
  • @lynks from a security perspective, I'd suggest that should be a last resort, rather than a first resort. As a general rule, it will (virtually) always be more secure to host externally, so it's typically not the best idea to poke holes in your LAN security for web apps that don't need to be there.
    – Xander
    Jan 10 '13 at 22:54
  • @Xander it doesn't need to be in the LAN, a cheap firewall can put it in a different subnet. I'm just saying why pay for something you already have.
    – lynks
    Jan 11 '13 at 0:45

If that's the only thing you've thought about, then likely the answer is "no, that's not enough". I'm assuming that's not really all you have thought about, but just in case...

"Enough" is something that is determined after a detailed threat analysis by someone (or a team of someones) that knows what they are doing. Web applications are wonderful attack surfaces, and while Microsoft made it relatively easy to properly build a reasonably secure website using ASP.NET, it's still very easy to not build a secure website.

Simply putting something together and putting out there isn't enough, even for a website that contains no sensitive data.

There are many threats to worry about:

  • SQL Injection attacks
  • Cross-Site Scripting (XSS)
    • Someone figures out a way to get your website to serve up malicious JavaScript. Usually this is done by injecting the script into a database and then counting on the developer to not know enough to escape the database output. It can also be done if the attacker has access to your file system, but putting the payload in the database is much more common.
  • Cross-Site Request Forgery (XSRF)
    • This is when someone uses XSS to put a malicious JavaScript on YOUR website that then goes and performs unauthorized transactions (often without your user's knowledge) on another website. (This is why it doesn't matter if your site has sensitive information or not. If you aren't coding to prevent XSS, your website can be used to attack websites that do have sensitive data.

Those are only the first thing to pop into my head. There are a ton of other issues to be concerned with. But this forum isn't meant for that type of in-depth answer.

I suggest starting here: http://msdn.microsoft.com/en-us/library/ff649100.aspx Once you've digested that, I'd strongly recommend becoming familiar with the OWASP Top 10. http://www.owasp.org/index.php/Top_10_2010-Main You're asking about a small sliver of the things you need to be concerned about.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.