Maintaining Security For Websites on Host Servers

Web hosting is one the most vulnerable areas on the web to hackers and virus attacks. There are innumerable number of hosts, who offer free web space for small websites. These being free are not effectively monitored, and dubious elements set up their malicious sites that affect web traffic and data security. A majority of “phishing” sites operate in this manner. Hosts offering free web space must have security checks to discourage such sites from setting up base. Besides, affecting the traffic flow, search engines label the servers hosting such sites, as suspicious and prevent free flow of data.Virtualization has been the latest concept to take the hosting industry by storm. The idea to spread out computing load over a vast array of servers is indeed logical and full of potential. However, for individual servers, there is a management tool that is present on the hosting server. It has the ability to control processes and key settings on each of the virtual servers. An attack directed to this management layer can compromise the data and performance of all the virtual machines, it controls. Hence, it becomes necessary to prevent stack overflow on the host operating system and each of the guest systems. Vital procedures like copying or creating a virtual machine and changing configuration files should be restricted to the management application.Another area of risk is grant of administrative access. The management and guest operating systems have super user accounts known as root accounts, to provide uncontrolled access. The risk is higher, when these accounts are known to many administrators, who need privileged access to the server. The host operating system can be manipulated to copy the virtual machines. Also, audit logging feature can be tampered with by unscrupulous elements. The Payment Card Industry (PCI) standard requires that administrators should use unique IDs to access confidential information.Host servers that provide virtualized service have accounts and have access to all virtual sessions that take place. This lays open the private information for these account holders. Hence, it is necessary to avoid use of shared accounts on host and client systems. Also, the accessibility should be restricted to areas, which are of prime concern to each. There should be a clear segregation between access rights to host server and virtual servers.Securing Windows Server 2008 configured for Hyper-V role is important because the integrity of each client system depends on that of the host. Operating Hyper-V with Server Core installation present in Windows Server 2008 improves security. Server Core installation lacks the Explorer shell, applications, and services that act, as a target for attack. Incorporating an Intrusion Detection System (IDS) can help to secure the server to a great extent. Tools like MySQL can be used by dubious users to pry open loopholes in the system. Information can be used by clients that connect to the server, to gain access in ways that are not normally intended. Accounts that allow anonymous access or theft of passwords can open up the system to attacks.For systems running Linux, there are simple methods to minimize security lapses. Using the minimum number of services that are necessary is advisable. Firewalls can be setup to secure against attacks that are based on default-reject protocols. There should be a clear and minimum number of services that are operated across the network. Security can be also enhanced by improvement in daily operations. Instead of using the normally accepted ports, like common port of 22, one can use other ports to run applications. These are found to be equally efficient in functions.