Background: I'm considering switching from shared web hosting to VPS for added security. However - managed VPS's costs much more than unmanaged ones. So, assuming:
- I secured my website against any type of sql injection and the like.
- I Keep my password secure .
- I set Windows update to automatic.
- The web hosts themselves don't 'attack' the computer (because if they do - there's really not much I can do about it anyway).
Is there anything else I must do to make it safe? (Safe. Not impenetrable.) Am I correct in assuming that most vulnerabilities are of software run on the operating system, and not the operating system (Windows) itself?
And a specific issue: It seems from what I've read - that there is need for closing ports. But why? A port doesn't do anything - it's the applications listening to it which might be vulnerable - but if an application is listening to a port - it supposedly needs to do that, and you can't just close the port.
I do realize that security is a continuous effort, and that obviously my own software might contain security flaws. What I'm looking for is an 'aha!' type of answer like - "Ports are not dependent on the software listening to them!"