how can i best implement a web-based application to ensure it does not get hacked into.
the web app will be written in PHP and mYSQL . The I.T. department is not well-versed in this area and their not sure if they need to install some type of network appliance to require users to login first, then access the web based app.
we will have users working from home as well as traveling on the road so it needs to be web-based for easy access but yet very secure. which hardware will be recommended to set this up?
the programmers are recommending using a ssl certificate but this does not do much in terms of securing the program or deterring someone from hacking into the web app. again, this needs to be setup so anyone can access this from a PC both internally or externally without having a vpn client setup on their machine.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
You might also want to take a look at the OWASP site. It's all about Web Application security. One of the project list the top ten vulnerabilities:
http://www
Also a good reference is the PCI Data security standard, which although is for businesses working with Credit Cards, it could be a good reference:
https://www.pcisecuritysta
To be very frank..PHP and mYSQL ...opensource and not well secured and all s/w have their own vulnaribilities that can be dealt only after they are been detected by the developer themselves...so just chill and secure the server normally with...
* Better IIS configuration... Disable WebDev
* Security Updates - uptodate in server
* Updated AV
* Updated FW with better Rules and keep track then and there.
* Check for any MySql injection then and there...
Note : One more thing always try to use difrnt port rather using default DB port for MsSql or MySql whatever it is... Change Port number and use the in code whil;e accesing the DB.
Business Accounts
Answer for Membership
by: acromentPosted on 2009-02-02 at 07:51:03ID: 23527966
A few comments...
1) re-complie the kernel of your web server to eliminate services/devices you do not need.
2) make sure you stay current with security updates for your OS, PHP version, and MySQL.
3) build into your application secure user policys.
4) Lock down the root account and admin group on your server
5) VPN would be the more secure way of doing this - if you need the highest level of security consider using a web based VPN.
6) USE SSL.
7) place the server in a DMZ or secure network behind your firewall - protected from outside traffic.
8) monitor the logs on your server regularly.