The Web security isn't always the main concern of Web site owners. It should be, in
particular when the web site manages data from its visitors or customers or if there is a possible
illicit use of the web site's data.
The below information is technical. It is intended for System Administrators, Network
Administrators and Webmasters. This article must be considered as a check list. It isn't intended
to be exhaustive.
We focus on vulnerabilities, general information, intrusion detection and web
security, network security, security architecture, Qmail et Sendmail modules, CGI. We give some
links to good specialized knowledge sources.
Avoiding security flaws
To avoid security flaws, we must know it. So the first step is to
identify the risks. Then we must try to anticipate the possible risks in a given context. By
context, we intend both the technical context and the commercial and competitive background.
Knowledge sources on vulnerabilities
Top 20 vulnerabilities of servers and networksby SANS Institute. As well as
many quality resources: publications to download, news and training. English.
ModSecurity is an open source intrusion detection and
prevention engine for web applications. Operating as an Apache Web server module, the purpose of
ModSecurity is to increase web application security, protecting web applications from known and
unknown attacks. ModSecurity is dual licensed. It is freely available for general use under the GNU
General Public License. Alternatively, it is available under a license suitable for distribution in
closed-source commercial systems. http://www.modsecurity.org, English.
Security architecture : a pretty good technical resources offered by securit: security
architecture, security of services, OS security, networks security, PKI and cryptography,
organization and regulations. French.
Website monitoring services to ensure that the website is available and performs adequately
from various regions Worldwide. Problems are notified via email, phone, SMS, AIM, Yahoo!, MSN, ICQ,
Pager. Online check tool. Reporting and control panel. 30 days free trial.
