I explain practical web security tips on how you can secure your existing web servers, going beyond previous styles of server security and protecting web applications at a server level too. I will talk about how at Creare we are leading the way on web security through a mix of development standards and server security. More details at: http://northernoptic.com/2015/09/10/the-lead-devel…ity-junade-ali/ Thanks to James Bavington and Rob Kent for motivation, support and ideas. * If your business is dependant on security, consult a professional.

1. Practical Web Security
Junade Ali (@IcyApril)
Lead Developer at Creare, Creare are one of the UK’s
largest Digital Agencies for SMEs.

2. Creare hosts thousands of websites, facing
over 2.5 million security attacks monthly.
Until recently we did too little at a web
application level.

4. Under Attack
Prior to us relaunching our brand on the rooftop of Google
headquarters in London, we were hit by a large scale attack.

5. So how did we stop it?

6. Development Standards
• Use vulnerability scanning (WPScan, Vega, etc).
• Enforce secure development (SQL
injection/XSS/CSRF protection, secure hashing
with bcrypt/PBKDF2 and setting up site-wide
SSL).
• OWASP Top 10
• For SSL/TLS consider the SSLLabs standards.

7. Search WP plugins on wpvulndb.com
Finding vulnerable WordPress plugins before installation.

8. Turning to Hosting
Web
App

9. Web Application Firewall
• If you run a web application, consider a Web
Application Firewall.
• Useful in cases where you are hosting other
people’s code.
• For Apache: Mod_Security
• For Nginx: NAXSI
• Commercial options too: Qualys, Sucuri, etc.

10. The First Layer
Web
App
WAF

11. Not a Real Bruteforce

12. A Real Bruteforce

13. BruteForce Protection
• Make your defence aggressive.
• Block IPs which make persistent login attempts.
• On Linux: Fail2Ban
• Ban repeat offenders with Recidive jail.

14. The Second Layer
Web
App
Fail2Ban
WAF

15. Use Specialist Hosting
• Creare is migrating hosting from previous
unspecialised web hosts to ones which
understand the technology.
• When developing Magento or WordPress we now
use specialist PaaS hosts who can offer
specialised security.

16. Hosting Added
Web
App
Server Fail2Ban
WAF

17. Make Tough Friends

18. CloudFlare
• Low cost (or free!) managed SSL. Free traffic
filtering, CDN and caching.
• Pro accounts get Web Application Firewalls for
PHP, Magento, WordPress, etc.
• Creare can enable CloudFlare without even
changing name servers.
• Creare offers free Railgun: 143% HTML load time
improvement, 90% decrease in TTFB.

19. Preventing Data Leaks
Attempting to view a non-existent SFTP config file.

20. SEO Benefits - Rankings
A large online retailer’s Google rankings after having their
server hardened, site wide SSL and CloudFlare installed.

21. Slides at: ju.je/leadsec
Web
App
CloudFlare
Server Fail2Ban
WAF