PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

388 Chapter 16 Web Application Security
you purchase the operating system, especially in the case of Microsoft Windows, Red
Hat or SuSE Linux, or Sun Microsystem’s Solaris Operating System. For other operating
systems, such as FreeBSD, Ubuntu Linux, or OpenBSD, you typically go to the website
representing their organized communities and see what latest security fixes they are recommending.
Like all software updates, you should have a staging environment in which you can
test the application of these patches and verify their successful installation before performing
the operation on any production servers.This lets you verify that nothing has
broken in your web application before the problem gets to your live servers.
Being smart with the operating system and security fixes is definitely worth your
while: If there is a security fix in the FireWire subsystem of a particular operating system,
and your server has no FireWire hardware anywhere inside, it is probably a waste of
time to go through the whole deployment process for that fix.
Run Only What Is Necessary
One of the problems many servers have is that they come with large amounts of software
running, such as mail servers, FTP servers, the capability to work with Microsoft
file system shares (via the SMB protocol), and others.To run our web applications, we
need the web server software (such as IIS or Apache HTTP Server), PHP and any related
libraries, the database server software, and often not much else.
If you are not using any of those other pieces of software, shut them off and disable
them for good.That way, you do not have to worry about them being safe. Users of
Microsoft Windows 2000 and XP operating systems should definitely run through the
list of the services that their server is running and shut off those that are not needed. If
in doubt, do some research—it is highly likely that somebody on the Internet has already
asked (and received an answer to) what a particular service does and whether it is necessary.
Physically Secure the Server
We mentioned previously that one of our security threats is somebody coming into our
building, unplugging the server computer, and simply walking off with it.This is, tragically,
not a joke.With the average server not being a terribly cheap piece of hardware,
the motivations for stealing server computers are not limited to corporate espionage and
intellectual theft. Some people might just want to steal the computer for resale.
Thus, it is critical that servers used to run your web applications are kept in a secure
environment, with only authorized people given access to it and specific processes in
place for granting and revoking access to different people.
Disaster Planning
If you ever want to see a truly blank look, ask your average IT manager what would
happen to their servers, or indeed their entire data center, if the building in which it was