Apart from keeping platform up-to-date, installing SSL certificate, installing security plugins, providing password policy stronger, restricting exe file upload etc some common steps should also be cared for protecting the websites.
1. We should restrict uploading of the ZIP file
ZIP and other compressed files can contain virus, Trojans, and other malware, in fact, it's rather common because putting the malware into a compressed archive is an easy way of bypassing your anti-virus/anti-malware software until the archive is decompressed. Even it is not uncommon for unscrupulous people to fake a Zip file. Let’s take virus.exe for the example. Rename the virus.exe file to virus.zip.exe and you have the default setting in Windows Explorer of hiding extensions of known file types, it would appear the file is called virus.zip. An unsuspecting user would think the file is a Zip file, even if it had the wrong icon. Double clicking it would execute the virus infected file.
2. File uploading location should be isolated
It should be isolated from other parts of Server and this location should not be in the root location. In this situation, virus/malware will not affect other part or have a minimal impact. This location should keep limited permissions as only those which are required.
3. Each publically accessible website should be isolated from other
With a system vulnerable to directory traversal, an attacker can make use of this vulnerability to step out of the root directory and access other parts of the file system. This might give the attacker the ability to view restricted files, or even more dangerous, allowing the attacker to execute powerful commands on the web server which can lead to a full compromise of the system.
Depending on how the website access is set up, the attacker will execute commands by impersonating himself as the user which is associated with “the website”. Therefore it all depends on what the website user has been given access to in the system. For more details have a look at this link- https://www.acunetix.com/websitesecurity/directory-traversal/
4. Web Application Firewall can be configured for protecting the web application.
L7LB – Layer 7 load balancer.
Disadvantages (If Web Application Firewall is not there):
After Scanning, attacker can exploit the website
An attacker can steal the user credentials.
Disadvantages (If Web Application Firewall is there):
Increase the possibility of DDOS attack – After implementation of WAF, every packet will be scanned (Not only payload but also deep scanning) so in real time scanning, Uploading and downloading speed can reduce. So denial of service attack is a possibility under it. And the client can face some problem during data submission.
In either instance, there is going to be a performance impact on the ability of the web server to serve concurrent requests. That goes without saying.
Given that, to maintain the ability to serve the same or a similar level of requests, either more web servers or more hardware is required.
To some degree, depending on the architecture of the application, this could potentially be mitigated using tools such as Varnish to cache static content, content which doesn’t need to be inspected by a WAF.
Advantages (If Web Application Firewall is there):
In these days, ransomware is the biggest threat of IT organization. So cyber security is more important than speed and we are configuring WAF (Web Application Firewall and reverse proxy) then security will improve.
As it will have the skill to analyze the payload of the packet and make choices depending on the real content, in addition, it provides content filtering abilities. Being able to analyze the whole network packet instead of only the network interfaces and addresses means they have more extensive logging abilities also, for example, program-specific commands, which provide tips that are useful for working with policy execution and security events.
5. Reverse Proxy server implementation:
A reverse proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. These resources are then returned to the client like they originated from the Web server itself.
After using the reverse proxy, the original IP (IP of the server where the website(s) is (are) hosted) will be invisible in client domain and it may be public or private IP.
References:-
