Can any of you security experts help me make a decision on how to deal with staffing for an initial hardening for an Apache server running MySQL and PHP?

We are working on a new site have to do initial hardening and I don't know if we should have the sysadmin do it or if we should get a security expert to do it. I know our sysadmin can do it, but is he "a security expert", definitely not. I did find this old post on how to harden an Apache server and I think he could follow the instructions. I also read the post on outsourcing security and want to clarify that most of it was not relevant because we would hire someone local for this.

So my questions:

Are there pros/cons to having a security expert do initial hardening for a MySQL server? If the security expert does the initial hardening, will I end up having to deal with the security expert again for routine changes?

We can pay more for better work, I just don't know if it is a good idea in long run and can use your expert advice.

  • We can not really answer this question because we don't know how competent your sysadmin is. Did you consider asking him if he feels up to the task or if he would recommend to hire someone? – Philipp May 4 '14 at 13:38
  • He feels up to the task and is not enthusiastic about having someone else do it. I think he really wants to maintain control and feels insulted. While some questions are opinion-based, the pro's and con's listed really have helped me make my decision. I wanted to know what was usually done and why. – SuziG May 8 '14 at 12:16

What generally is done is to hire a security expert who creates a custom webserver hardening standard and baseline, adjusted to your company's needs. The standard defines which security controls should be in place, technology independant. Then the baseline can be technology specific, e.g. IIS or Apache,...

The baseline can be implemented by your system administrators, however, you should perform routine audits (can be done by the expert or other independant auditor) on the machines (once every year or half year) to confirm that the baseline is implemented correctly. Any defects to the baseline should be documented during the audit and presented back to the administrators and a a response on why the particular webserver didn't adhere to the baseline.

| improve this answer | |
  • 1
    Also, the standard / baseline should itself be reviewed periodically, e.g. once a year, or when a new system (with a different model) is deployed. – AviD May 4 '14 at 10:36

Do initial hardening yourself, so you get a feeling for the possibilities. Then hire a security professional to do a more in-depth security audit. This way more eyes looked at it, which is generally increasing the quality of the work (and security).

| improve this answer | |
  • I agree, As a consultant in a different field you want to in house ownership and use the consultant for advice & education. Don't treat the problem as a black box only the consultant understands – Doug T. May 4 '14 at 14:46

The wording of the question seems to imply, to me at least, that it's a very binary approach. Personally I don't much care for that level of siloism and believe the process should be much more collaborative.

  1. The initial benchmark should be primarily determined by the security person, with input from the systems person.
  2. The systems person should determine the technical methods by which to implement the benchmark, with input from the security person.
  3. The security person should then validate the plan and either approve it or recommend changes where appropriate. (repeat 2 and 3 until approved)
  4. The systems person then implements plan.
  5. The security person validates the implementation to verify it was implemented according to the plan and actually addresses the benchmark.

It's also very important to then regularly validate the technical implementation against the benchmark to make sure the system doesn't drift over time and, just as important, that the benchmark still makes sense.

Over time we should assume that patches are applied, the software is updated, and even the way people use the application changes. All of this and more affects the threat profile and can possibly change what protections even make sense for the system. It can mean that the system no longer follows the benchmark, the benchmark is too strict, or not strict enough. System security is not a point in time which is exactly why you'll often see the phrase "Security Program" used.

| improve this answer | |
  • Good observations and steps,it should really be more cooperative than I initially thought. I think that presenting it like you explained in the steps will help my sysadmin feel like a part of the process rather than just someone who is there to do what the consultant says. – SuziG May 8 '14 at 12:23
  • @SuziG: It really does. We're all in this together. Thinking otherwise leads to siloism which ends up being rather unpleasant for everyone involved. – Scott Pack May 8 '14 at 13:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.