4 ms·

I am interested in learning more about securing web servers (nginx, nodejs). Is there a book in this bundle that could help me? If you know any good books, plea

I am interested in learning more about securing web servers (nginx, nodejs). Is there a book in this bundle that could help me? If you know any good books, please recommend me one.

lghh 9y ago
I'm in the same boat as you and have been reading The Web Application Hacker's Handbook that comes in the $1 tier and have been liking it. Bummed I bought it a few weeks ago when it showed up in this.
CameronBanga 9y ago
I don't think you'll find a better group of books for $15, if your goal is to learn about security in general. Most of the stuff here is general crypto, which is very helpful with respect to just learning about computer security, though not necessarily focused on securing something like nginx specifically. You'll learn a lot more about security in general though, which will make it easier to learn about security specific platforms. I can't recommend this collection enough. I'd make the purchase, then dive into a couple and read whatever you find most interesting. I don't believe any will have the top keys of security technology X, Y, or Z. But you'll learn a lot in general, and it will be much easier to read other security how-tos and tutorials on locking down specific platforms.
dsacco 9y ago
Read The Tangled Web. It's an excellent book for developers that covers defensive tactics for securing web resources. The beauty is that it approaches the subject with developers in mind, not developers looking to become penetration testers (which is why I wouldn't recommend The Web Application Hacker's Handbook for your use case).
- lawnchair_larry 9y ago
  Which chapter(s) of The Tangled Web do you feel would benefit a web server administrator? It is a great book, but it is almost entirely focused on attacking browsers. It's not clear to me what changes someone might make to their nginx configuration (for example) in light of the information provided in the book.
  - dsacco 9y ago
    I didn't read that out of The Tangled Web. It did cover attacks, but it was also a solid guide on shoring up defenses for developers. To circle back to your question - nginx is fairly robust out of the box, but The Tangled Web will cover extra configuration steps. For example - how to securely handle and serve files uploaded by users, including file naming conventions. Other best practices for configuring things like TLS and CORS will also be covered, which are in the purview of any developer setting up a web server. My interpretation of the book was that it covered attacks that are executed through the browser (especially via user input) insofar as it's instructive for developers to learn how to avoid them.
mkagenius 9y ago
Try this security checklist: https://github.com/FallibleInc/security-guide-for-developers/blob/master/security-checklist.md https://github.com/FallibleInc/security-guide-for-developers...
lawnchair_larry 9y ago
There is not actually much to do with respect to securing web servers. For the most part, you're at the mercy of their code and you really shouldn't try to mess with it or you are probably making things worse. As far as securely configuring them, that's maybe 2 pages worth of material and should be in their respective manuals. Beyond that, your options are standard host hardening and network segmentation. I actually don't think that is really covered in any of these. Securing the web application running on those servers, however, is a book worth of material. All of these are too old for any mention of nodejs, but Web Application Hackers Handbook will have some generic web attack coverage.

I am interested in learning more about securing web servers (nginx, nodejs). Is there a book in this bundle that could help me? If you know any good books, please recommend me one.

lghh 9y ago

I'm in the same boat as you and have been reading The Web Application Hacker's Handbook that comes in the $1 tier and have been liking it. Bummed I bought it a few weeks ago when it showed up in this.

CameronBanga 9y ago

I don't think you'll find a better group of books for $15, if your goal is to learn about security in general. Most of the stuff here is general crypto, which is very helpful with respect to just learning about computer security, though not necessarily focused on securing something like nginx specifically. You'll learn a lot more about security in general though, which will make it easier to learn about security specific platforms. I can't recommend this collection enough. I'd make the purchase, then dive into a couple and read whatever you find most interesting. I don't believe any will have the top keys of security technology X, Y, or Z. But you'll learn a lot in general, and it will be much easier to read other security how-tos and tutorials on locking down specific platforms.

dsacco 9y ago

Read The Tangled Web. It's an excellent book for developers that covers defensive tactics for securing web resources. The beauty is that it approaches the subject with developers in mind, not developers looking to become penetration testers (which is why I wouldn't recommend The Web Application Hacker's Handbook for your use case).

lawnchair_larry 9y ago
Which chapter(s) of The Tangled Web do you feel would benefit a web server administrator? It is a great book, but it is almost entirely focused on attacking browsers. It's not clear to me what changes someone might make to their nginx configuration (for example) in light of the information provided in the book.
- dsacco 9y ago
  I didn't read that out of The Tangled Web. It did cover attacks, but it was also a solid guide on shoring up defenses for developers. To circle back to your question - nginx is fairly robust out of the box, but The Tangled Web will cover extra configuration steps. For example - how to securely handle and serve files uploaded by users, including file naming conventions. Other best practices for configuring things like TLS and CORS will also be covered, which are in the purview of any developer setting up a web server. My interpretation of the book was that it covered attacks that are executed through the browser (especially via user input) insofar as it's instructive for developers to learn how to avoid them.

mkagenius 9y ago

Try this security checklist: https://github.com/FallibleInc/security-guide-for-developers/blob/master/security-checklist.md https://github.com/FallibleInc/security-guide-for-developers...

lawnchair_larry 9y ago

There is not actually much to do with respect to securing web servers. For the most part, you're at the mercy of their code and you really shouldn't try to mess with it or you are probably making things worse. As far as securely configuring them, that's maybe 2 pages worth of material and should be in their respective manuals. Beyond that, your options are standard host hardening and network segmentation. I actually don't think that is really covered in any of these. Securing the web application running on those servers, however, is a book worth of material. All of these are too old for any mention of nodejs, but Web Application Hackers Handbook will have some generic web attack coverage.