snorggy said:
if there is no such thing as a 100% secure system, how do you define what is adequately secure? not being snarky.. serious question.
Yeah, it's a good question too. The important thing to remember is that most intrusions are PEBKAC (problem exists between keyboard and chair), so you can force users to jump through hoops to successfully authenticate but then if you go too far you end up forcing them to put their login details on a post-it on their monitor.
At the fundamental level you need to:
- Have a sysops team who know every piece of software on your servers and zealously watch the security alerts list for each application so that they can issue emergency patches 24/7. By the time a vulnerability is discovered it can already be in the wild, so you basically have a ticking timebomb sitting in your data-center until you patch it. Hyperbole perhaps, but unpatched systems scare the living shit out of me.
In addition to this you'll need to make sure that you have a staging environment to test those patches otherwise you might end up having to perform a rollback after an update to get your system back up and running. Easy to do on a staging environment, really hard to do on a live production environment being used by your customers.
- Don't trust user input, ever. I could go into a lot of detail about this but I think Blimblim has already discussed it a lot in these threads. You need to at the very least ensure that all user input is escaped before being used in database queries to protect against SQL injection, but it's considered to be good practice to go deeper and look for other junk in their input too, script tags which might indicate that they're trying to execute a XSS attack as an example.
- Use encryption a lot. Anything involving user information should be transmitted over SSL (https) and anything sensitive going into your database should be stored in a format which can't be easily parsed by humans. For example, passwords are usually stored as a hash, and when you login to a service the inputted password is munged with the same algorithm, and the result compared.
- Close all your ports that aren't in use. If any of your software (e.g. SSH server) shouldn't be open to the public then lock those ports down to a safe IP range which you own. As an example, if I need to do any remote work on our systems I have to first connect to the office VPN and then connect to the server. Also, I don't have a password for any of these systems; they're all secured using public-keys which are managed and installed to our (managed) workstations by our sysops team. This makes it a lot harder to impersonate one of our staff and compromise the system.
- Nobody but your most trusted sysadmins should know the passwords to anything. The easiest way to do this is to develop all of your applications to expect the environment to inform them of their settings, rather than the other way around. The added benefit of this is that all of your large applications can be deployed to any of your environments and be running in seconds, obviously a pretty handy thing to do in case of disasters.
- If possible, use a double opt-in system for authentication. An example would be the dongles given out by Blizzard for Battle.net accounts, or Google sending a PIN to your phone when you login. Basically it's the idea that you can at the very least protect against remote exploitation by requiring a physical presence to authenticate.
And that's just a handful of things off the top of my head, I'm an enterprise architect so you'd get a much more detailed answer from a sysadmin. At any rate those examples should give you a good idea of the kinds of things which an independent audit for lax security would check for. Again, doing those things doesn't make you 100% impenetrable but not doing them is like leaving your front-door unlocked.
Edit:
Vagabundo said:
We have plenty.
PSN security was lax; you have Linux servers running out of date software and a pretty shoddy network setup. We have passwords stored either in plaintext or using a hashing system without a salt.
Welp, if this is true then yeah fuck these guys.
He knew about the PSN hack and the 70 million accounts that were affected.