Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1118306" data-attributes="member: 96560">I can sort of count the hackers that try to attack my fortified ubuntu web site. Thats because the logs show attempts to fetch non-existant pages. Pages that are partciular to Wordpress, various .js and php scripts that I don&#039;t have, login pages, database stuff and so on. And they always try it multiples times and my reporting tool shows the count. I estimate around 5-6 hackers every week. If I count all the individual instances then there would be a lot more.Two years ago, I put up an obnoxious fake IT security firm web site using wordpress under the name No Hackers Here as an experiment. It was taken down by attackers within a month.What does that tell you? Hackers don&#039;t just attack big corporates where the rewards are huge. They also attack things they don&#039;t like, like security firms and security sites like mine. And they might not like sites like MT and [USER=1]@Jack[/USER] can weigh in on this.Here are my 2 cents&#039; worth of advice if you are considering setting up a security related site.a. don&#039;t have any moving parts if possible. Static web sites are safer.&nbsp; No js, no cgi,b. don&#039;t use wordpress. While wordpress itself may be secure, it&#039;s various plug-in&#039;s aren&#039;t.c. deploy on a cloud provider where you can control your security measures. Web hosting sites sometimes offer very little security mechs.d. if you must have input fields, then don&#039;t trust any input. Do a whole lot of validation server side.e. if you accept payment, then hand off the payment processing to paypal or similar. Don&#039;t do it yourself. If you do it yourself you assumeresponsibiity over the credit card numbers which hackers want.f. if you must have code, then do SAST, DAST and IAST.g. go over the OWASP checklist and make sure you follow their suggested best practices.</blockquote>

[QUOTE="Victor M, post: 1118306, member: 96560"] I can sort of count the hackers that try to attack my fortified ubuntu web site. Thats because the logs show attempts to fetch non-existant pages. Pages that are partciular to Wordpress, various .js and php scripts that I don't have, login pages, database stuff and so on. And they always try it multiples times and my reporting tool shows the count. I estimate around 5-6 hackers every week. If I count all the individual instances then there would be a lot more. Two years ago, I put up an obnoxious fake IT security firm web site using wordpress under the name No Hackers Here as an experiment. It was taken down by attackers within a month. What does that tell you? Hackers don't just attack big corporates where the rewards are huge. They also attack things they don't like, like security firms and security sites like mine. And they might not like sites like MT and [USER=1]@Jack[/USER] can weigh in on this. Here are my 2 cents' worth of advice if you are considering setting up a security related site. a. don't have any moving parts if possible. Static web sites are safer. No js, no cgi, b. don't use wordpress. While wordpress itself may be secure, it's various plug-in's aren't. c. deploy on a cloud provider where you can control your security measures. Web hosting sites sometimes offer very little security mechs. d. if you must have input fields, then don't trust any input. Do a whole lot of validation server side. e. if you accept payment, then hand off the payment processing to paypal or similar. Don't do it yourself. If you do it yourself you assume responsibiity over the credit card numbers which hackers want. f. if you must have code, then do SAST, DAST and IAST. g. go over the OWASP checklist and make sure you follow their suggested best practices. [/QUOTE]

Verification