3 ms·

For people that self-host and manage security themselves, what steps do you take to actively monitor that you haven't been hacked? I understand how people woul

For people that self-host and manage security themselves, what steps do you take to actively monitor that you haven't been hacked? I understand how people would set up their own backups and automate security updates, but what do you do to monitor that there hasn't been an intrusion without you noticing (e.g. login attempts, successful logins that aren't you, files changed, root kits, data stolen)? How does that compare to what managed services and hosting companies with teams who benefit from economies of scale would do for you?

cersa8 5y ago
You can run an automated rootkit detector, but I doubt anyone able to get that far will be caught that easily. Your best bet is using application specific monitoring, eg for WordPress there are excellent tools like Wordfence that monitor login attempts, file changes and block common attacks. For my custom apps I will be alerted on brute force attempts, weird queries (sql injection attempts) and pretty much any anomaly is logged and will stand out. Another big one is monitoring for weird resource usage, I use Netdata for this. But doing some upfront hardening is the most effective way. I have yet to be hacked (as far as I can tell) operating multiple VPS servers in 10 year+ timespan. But have worked with companies that frequently had their servers compromised due to poor security practices.