Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm developing a web application for mobile devices on my local server in my laptop. My laptop is connected to company network via LAN. And, my project manager, wants to check the web application which runs on my local server via his phone through WIFI. Further, I'm using fedora 15, and don't have any anti-virus software. Is there are any security problem for my personal data which is on my lap?
How can he access the web application, other than WIFI enable mobile devices?
If your web application isn't being run as you, but a dedicated user with access only to the correct folders/files, then it should be fine.
Of course, if either the operating system/server/application/hardware drivers etc has a vulnerability in it that enables read access to any folder, then you'll have a problem!
Check you don't allow arbitrary code execution in your app, check everything's up to date and all should be fine.
Is there are any security problem for my personal data which is on my lap?
Yes! This is extremely dangerous. In this scenarion his phone could act as a internet gateway. Depending on how secure his phone is, it may expose your laptop directly to internet based attacks. Given that you aparently have no protections on your laptop I advise against it.
How can he access the web application, other than WIFI enable mobile devices?
Through any web capable device. Through a destop or laptop computer on the company network. Through a mobile device specificly configured for testing. If you have a appropriatly secured internet facing web server, then he can access it through any web capable device connected to the internet.
Protect your data, if not your entire laptop.
Provide integrity monitoring for your data. You can do this by generating cryptographic hases (MD5, SHA1) and storing the hashes offline. This can be done easily with sha1sum, md5sum, or openssl. You can store the hashes on a CD-ROM, USB flash driver, or other removable media.
Provide confidentiality for you data. Create an encrypted container or disk with LUKS, tryecrypt, or OpenGPG. Store your private files in the encrypted container (folder) or drive.
While I'm offering unsolicited advice... Backup your files. If you have hashes, backup your hashes. If you have an encrypted disk backup the disk in encrypted form. If you have an encrypted folder or container, backup the container or folder in encrypted form. Don't make it easy to breach your data's integrity or confidentiality through you backups.
I think Rich Bradshaw is correct on using a dedicated user to run the web server. Furthermore, you can:
In the end, security is always about a compromise between easy and safe. It's easier to run a local un-chrooted server on your development environment than going through the trouble of configuring it or having a dedicated VM; it's certainly not as secure.
