Attack Vectors for Purely Static Website (HTML and CSS)

Question

I am sorry if this is a too trivial question, but once I was told that only a fool is sure of anything: as I am not sure about this question, I am willing to risk my neck by asking it anyway, all in the name of learning and keeping my stuff secure.

Here it goes; background information:

I want to build a website which does not need any fancy functionality. There are no login forms and it is purely written in HTML and CSS. In fact there is not even input fields; just a 'Who we are', 'What we do' and how to 'Contact us' kind of thing.

Question:

Should I be worried that there might be some way of exploiting this site somehow?

Answer 1

Let's look at the technology stack of a dynamic website:

• Your code, in whatever language you chose, e.g. PHP or ASP.NET
• The script engine, e.g. PHP engine or .NET CLR
• The web server, e.g. Apache or IIS
• System services, e.g. SSH and FTP
• The operating system
• If you're on a VPS, the virtualisation technology that hosts your instance, e.g. VMware.
• The hardware
• The network infrastructure, e.g. switches, DNS provider, etc.

Now compare that to the technology stack of a static website:

• Web server
• System services
• Operating system
• Virtualisation technology if any.
• Hardware
• Network infrastructure

So, you've removed the top two layers of the technology stack by going for static. It is true that a large percentage of attacks are focused at the web application code and engine, but you still have a number of attack vectors to worry about.

Off the top of my head, here are a few:

• Service passwords (e.g. SSH, FTP, RDP) for the server.
• Web server vulnerabilities.
• Service vulnerabilities.
• OS vulnerabilities.
• Virtualisation software (hosting management) passwords.
• Domain provider account passwords.
• Network infrastructure misconfiguration.

Answer 2

If the content of the website is very simple like you describe, then the security risk lies with the web server, the OS, the hosting infrastructure and the security of the password for the hosting.

A web server can be improperly configured and security updates can be missing. Other services running on the same OS can be vulnerable to attacks. The hosting company can be breached and your site modified. And lastly, your password for the website file upload is a weak spot. There is a lot of malware that looks for FTP and SSH credentials that can allow it to change your website, usually to attack your website's visitor.