What are the most important server security settings for you to configure?

Server security begins with a robust foundation, and selecting a strong password is paramount. Opt for complex combinations of letters, numbers, and special characters. Regularly update passwords and avoid using easily guessable information. Implementing multi-factor authentication (MFA) provides an additional layer of defense against unauthorized access.

Choose a strong password or two-factor authentication by default, if practical. Disable root login (on Linux) and use 'sudo' instead. You might also allow remote login only from a number of IP addresses.

It is important to note that certain services, such as SSH, may use a cryptographic key pair for authentication instead of a password. This authentication method offers better security than password-based authentication.

Rename the administrator account. This can help prevent brute-force attacks that target the default administrator account name

L'idée étant de favoriser l'authentification par mot de passe fort, bien entendu le renouveler périodiquement, mais également d'accompagner les utilisateurs dans leur quotidien en leur fournissant des méthodes simples pour choisir facilement un mot de passe qui respecte les règles de sécurité mais également des outils intuitifs capables de diminuer le nombre d'identifiants à retenir.

Securing data in transit is critical. Enable encryption protocols such as SSL/TLS to safeguard communication between servers and clients. This prevents eavesdropping and ensures the confidentiality and integrity of sensitive information. Regularly update and configure encryption settings to align with the latest security standards.

When it comes to SSL/TLS encryption it is also important to consider that your server supports the latest SSL/TLS version and avoid deprecated versions. Another activity that is relevant to this is certificate pinning. Certificate pinning forces your client app to validate the server's certificate against a known copy. After pinning your server's certificate inside your client app, your client should check the basic validity of the cert as in No

Encryption is to me the most important aspect of information systems security. Even if your network is compromised ( Man in the Middle Attack), encrypttion will protect your data. Encryption is what secures VPNs as well as classified networks using encryption devices to secure them as well.

Everywhere where you can use encryption - just use it. simple and clear. If you need more symbols to this explaining - my apologize.

Encryption is one of the most important actions, since only if you have the encryption key will you be able to read the data stored on the server.

Implementing a robust firewall is essential to control incoming and outgoing network traffic. Restrict access to only necessary ports and services. Regularly review and update firewall rules to adapt to changing security requirements. Consider network segmentation to isolate critical components and enhance overall server security.

In my experience, a deep understanding of network security is key to ensuring server installations meet best practice. Firewall rules that meet the usage requirements of the server needs to be implemented and continuously reviews as part of life-cycle management of the device.

Using rule "drop all and next allow something" most time better than the "allow all and next restrict something" most cases of hacking began with the words “who needs us anyway?”

This is a major consideration for protecting confidential and military contract work. Layering with internal firewalls can give engineering teams the ability to have internal test networks and safe spaces to build non-standard work environments that would have to have greater scrutiny if they operated outside the firewall and in the regular company network space.

Follow best practices for Firewall configuration. In AWS perspective we create Security group which we attach at the Instance level . Create a seperate Security Group for SSH and RDP and add rules as required. Create a seperate Security Group for all other protocols (say http and https). We can attach multiple security group to Instance (server) Another firewall in AWS is Network Access Control list which can be attached at Subnet level (also called Stateless ) where we can deny the traffic by adding rules in ascending order.

If possible, apply updates from trusted sources automatically. You can have a two-step process: first, update testing and pre-production, then if all tests pass, launch the update of production servers. Avoid updates the day before weekends or holidays (in case something goes wrong).

Une chose à souligner : c'est la possibilité d'acquérir des outils capables de gérer les mises à jour aussi bien des systèmes que des logiciels utilisés sur le système d'information. Chacun de ces logiciels, s'ils ne sont pas mis à jour suffisamment tôt, peuvent fournir des failles de sécurité et de vrais opportunités aux attaquants.

In AWS perspective Amazon Inspector is the service which continuously scan workload for software vulnerabilities unintended network exposure . AWS Inspector scan EC2 Instance, ECR Container images for vulnerability findings

Maintaining an up-to-date server environment is crucial for security. Regularly apply patches and updates to address vulnerabilities and enhance system stability. Utilize automated patch management tools to streamline the update process and ensure that security patches are promptly implemented.

Patches and security updates are critical in keeping your network safe. the trouble with this is being able to update without breaking what your developers have made, being able to roll back updates when it does, and staying ahead of the compliance police. Automating patch deployment is the challenge here. If you leave networks unmatched, they will get hacked.

Real-time monitoring and auditing are vital for detecting and responding to security incidents promptly. Implement logging mechanisms to track user activity, system events, and potential security breaches. Regularly review logs and set up alerts for suspicious activities to enable a proactive security posture.

This kind of auditing that is mentioned wont help you much, and I have never done much of it. You cant stop hackers by monitoring CPU.

No one like be blind. Monitoring tools is you eyes, so keep your eyes wide open. Collect as much metrics as you can to do but without affect to system load. This metrics must help your business instead be an obstacle for it.

Before analysing the performance of your servers, I think it's important to be able to check that there are no rootkits installed. Software such as rkhunter and chkrootkit can be used to identify modifications to executables on the machine. Monitoring the connection file on the machine /var/log/auth.log under debian allows you to monitor access. If you need traceability, it may be possible to link the connection file to a needle printer or to send the modifications to another machine.

1. Kill all defaults - passwords, accounts. 2. Turn on encryption. 3. Check all application access - users, methods, communication. 4. Limit DBA privileges if possible. 5. Test backup and more importantly Recovery.

What if, you have done everything, you monitor activities and found not issue but still your data are dissmised, leaked? Is the human part of the system? I say yes. There is no solution if we do leave people outside

Regular testing of restoring from a recent backup is imperative. Restore to a copy of your system and run automated tests to ensure the restored image is perfect. Backups may fail, but the reatore process may change, too, as software updates are applied that changes libraries and other parts of the restore process.

Crucial security settings to prioritize on servers include enabling firewalls, implementing principle of least privilege, installing latest updates/patches, setting up VPNs, using SSH keys for access, configuring logging/monitoring, and having a proper backup & recovery plan.

Making backups is all well and good, but it's also important to be able to recover them. Putting in place an efficient service restoration plan is even more important.

Implement Dynamic Penetration testing both internal and external to proactively check for any vulnerabilities on your network and take mitigating action before it’s too late.

A chain breaks at its weakest link. It is very much the same with servers. Think holistic, assume no trust, think the impossible, ... But give all security aspects the same attention. Do not waste time to be perfect on some security aspects and ignore the others.

Implement defence in depth Zero trust Red team activities to test your defence regularly and stringent process in place to implement mitigating controls across service lanes

Beyond the core settings, consider implementing intrusion detection and prevention systems (IDPS) to identify and mitigate potential threats. Conduct regular vulnerability assessments to proactively identify weaknesses in your server environment. Limit user privileges and employ the principle of least privilege to reduce the impact of a potential security breach. Collaborate with a security community to stay informed about emerging threats and best practices. Finally, conduct periodic security audits to assess the effectiveness of your server security settings and make necessary adjustments to stay ahead of evolving threats. By integrating these practices, administrators can establish a robust and resilient server security posture.

Inspect the configuration against the most recent CVEs -to not have any security shortcomings- and setup the server for continuous auditing of its security posture.