How to secure your web server?

A web server is funny thing. It needs to be accessible to the world in order to function properly, and at the same time it needs to be tightly secured against a large number of persistent threats. Keeping your server safe is an ongoing process. It means navigating the tightrope of protection and usability and finding the optimum compromise between the two.

When considering how to best secure your web server, there are endless options. While it can be a daunting proposition, securing your web server doesn't have to be complicated. It comes down to a simple idea, and something already mentioned here - process.

Taken to extremes, the options look like this - on the one hand, a server in a dark closet, running at peak performance but disconnected from the outside world. That server is totally secure, but not very useful. At the other end of the spectrum is a server connected to the network but completely unsecure. This server may be useful, but not for long. You'd have better luck leaving your bag unattended in an airport or the keys in your car in a bad neighborhood. Striking the balance between security and availability is the goal, and the only way to achieve that is through a tightly managed ongoing process.

"Set it and forget it" doesn't work in this arena. Maintaining your security edge means constant updates to filters and blacklists, regular application of security patches, and around the clock staffing. In short, unless your core business includes those skill sets, the best way to deliver the security you need is through outsourcing to a managed services provider.

Two things hold true - owning and operating a bulletproof security is very expensive, and cutting corners on security will end in disaster. Smart, responsible business can't afford either of those options. By integrating a managed services provider into your security processes, you off load the most time consuming and expensive aspects, maximizing your investment by leveraging economies of scale that wouldn't otherwise be possible. An enterprise class host gives you access to technology and personnel at a fraction of the actual cost. There's scant comparison between a firewall appliance that you buy at the local office superstore and a industry grade firewall capable of procession millions of requests per second.

Proper security for your dedicated server needs to be an end to end process ingrained in your corporate culture. An employee who is careless with a password can be just as dangerous a threat as an anonymous overseas hacker, and everyone has a role to play. The foundation of your security and however is rooted in key applications and hardware and the people needed to run them. If you're web server is already managed by a quality dedicated server provider, they should offer firewall, intrusion protection, anti-virus and other security services. If your provider doesn't offer robust security features, or if you're still providing your own server management and security, it's time to strongly consider other options. What you save in time and money you just might gain in peace of mind.