Background: I'm considering switching from shared web hosting to VPS for added security. However - managed VPS's costs much more than unmanaged ones. So, assuming:

  • I secured my website against any type of sql injection and the like.
  • I Keep my password secure .
  • I set Windows update to automatic.
  • The web hosts themselves don't 'attack' the computer (because if they do - there's really not much I can do about it anyway).

Is there anything else I must do to make it safe? (Safe. Not impenetrable.) Am I correct in assuming that most vulnerabilities are of software run on the operating system, and not the operating system (Windows) itself?

And a specific issue: It seems from what I've read - that there is need for closing ports. But why? A port doesn't do anything - it's the applications listening to it which might be vulnerable - but if an application is listening to a port - it supposedly needs to do that, and you can't just close the port.


I do realize that security is a continuous effort, and that obviously my own software might contain security flaws. What I'm looking for is an 'aha!' type of answer like - "Ports are not dependent on the software listening to them!"

closed as too broad by GdD, Adi, Iszi, user10211, Xander Dec 9 '13 at 14:18

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I assume the downvotes are not so much that this is a beginner's question (although we do have an expectation that questions are of a certain level) but because the question itself is not really answerable as there are far too many answers. – Rory Alsop Dec 9 '13 at 13:34

First off, you say you have secured your website against, "any type of sql injection and the like." What this means, at best, is that you have secured it to a standard that you think is good enough at that point of time, but it may still be insecure.

I'll give you the basic overview:

  • Microsoft WIndows itself, when written, has many vulnerabilities, both known and unknown
  • All applications have vulnerabilities
  • Applications and operating systems are patched over time, but new vulnerabilities are discovered
  • Every open port could allow an attack, depending on what vulnerabilities are present in the application listening on that port

The general guidance is that you should:

  • Install your platform, install the O/S and patch up to date
  • Remove all unneeded applications
  • Follow Windows hardening guide
  • Install only those applications needed and patch up to date
  • Follow hardening guides for these applications
  • ...etc etc

You cannot secure something. You can only reduce the risk of a successful attack, and even then, this is a continuous process.

Update: rolling up comments

Although the only application you need on there is a web server, Windows out of the box has many applications listening on various ports. These should all be hidden from the outside world unless you have good reason (may be needed to connect remotely etc. in which case you need to secure that application) - and you can do this by disabling the application or blocking the port at the firewall etc.

  • Rolled up those comments into my answer for clarity. – Rory Alsop Dec 9 '13 at 15:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.