1

I have security concerns over a web based application. I want to limit access to the application only to a whitelisted IP addresses. Here are my thoughts on that:

To host the application myself.

The application is only required to be accessible during office hours (8am - 4pm). I'll use an internet router to put it online so that other offices from remote locations can access it. With this architecture, I can only give access a whitelisted IP address.

A challenge I have with this, is the database security and backup. I feel the database will be safer online than on my local server, so I plan to use an online database server, then grant access to only one host (which is the external static IP address of my internet router).

I have not done something like this before. So my question is; what are the consequences of this architecture? Also, I will appreciate more advice and suggestions on how to secure and limit access to this application.

|improve this question

migrated from webmasters.stackexchange.com Nov 23 '13 at 14:43

This question came from our site for pro webmasters.

  • What do you mean by "database will be safer online than on my local server"? – Joel L Nov 23 '13 at 17:08
  • @JoelL I mean in terms of backup and physical safety issues like theft or damage. – Chibuzo Nov 23 '13 at 21:49
  • — Yes. But what exactly do you mean by "local" and "online" — the question is rather confusing as to what exactly your plan is. By "online", do you mean "3rd-party hosted database server"? – Joel L Nov 23 '13 at 22:15
  • @JoelL yes, 3rd-party hosted database server. By local, I mean, running my own server, from the office. – Chibuzo Nov 24 '13 at 23:17
  • Is the web server running IIS? Are you on a domain? – k1DBLITZ Nov 26 '13 at 15:39
1

Keeping the database online actually increases your attack surface, but if you plan to use a hosting company that creates and secures this for you, it might be helpful. As far as security for this, you would want to make sure all connections to the database use ssl. This prevents plain text passwords from being sniffed. You would also want to make the password complex enough to prevent brute forcing. As far as limiting the ip address that can connect, this does help, but keep in mind most attacks attempt to originate from queries passed through sql injection. Your application seems to be web based, so if an attacker was able access a page that queried the database, the ip address wouldn't stop the attempted injection. Not to discourage however. Ip whitelisting, deny everyone else, would be a good step, but you will want to monitor/access the application using the database for any vulnerabilities.

|improve this answer
  • Thanks for the answer. I plan to use LINQ to SQL for database, it does escape the queries, so do you think I should rely on it to handle SQL injections attacks? – Chibuzo Nov 27 '13 at 8:21
  • Frameworks such as LINQ help out a great deal, however it's still possible, it depends on how it's used. There are things a programmer can do, often when overworked, bored, etc, that can negate the security put in place. It's also important to keep up to date about the latest vulnerabilities. New ways to hack surface all the time. It's a never-ending cycle – tuson Nov 28 '13 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.