3 ms·
In general, you only need to make 1 mistake for your website to be vulnerable to what looks like a trivial hack. The mistake could be anything from an insecure
by EwanToo 15y ago
In general, you only need to make 1 mistake for your website to be vulnerable to what looks like a trivial hack.
The mistake could be anything from an insecure form input parser, through to not updating your web server to the latest update.
Once one hacker finds that vulnerability, it looks like it's an easy thing to do to take down or modify the side, but the finding of it can be extremely time consuming.
On the other side, look at who didn't go down in the recent Anonymous attacks - CBS and Universal Music went down, but Sony, EMI, Warner, etc, remained up.
Anonymous only had to find a couple of major relevant corporations that were vulnerable to make a big impact, it doesn't matter that the other dozens (100s?) of suitable targets were more secure.
- JakeFratelli 15y agoIf it only takes 1 mistake, would having a hot backup or failover be a best practice, so that if something does happen, you can immediately channel traffic to a live site?
- EwanToo 15y agoQuite often the failover is just a DNS change to a static page saying "Sorry, we're currently unavailable". The difficulty of having a hot backup is preventing a hacker repeating their attack immediately after you fail over.
- JakeFratelli 15y agoThanks EwanToo - that makes perfect sense. A combination of some security monitoring system that notifies you of the vulnerabilities along with someone to update your system is needed. But what if the updates have dependencies, for instance, incompatible Ruby gems or so. At that point, do you have to make the tradeoff of security risk vs time to update all gems/resolve incompatibility issues/deal with bugs in latest release?
- EwanToo 15y agoExactly, if you've got a complex environment, you might not even know that one of your suppliers deployed an insecure ruby gem (or any other package), but you'll want to do full testing before upgrading. All this leaves big windows of opportunity for attacks.