Trying to secure an internal web app that will go public - certificates?

Posted on 2012-08-22
Last Modified: 2012-08-27
We are looking to inherit a web application that will be hosted internally within our network. It will have to be made public so external users can use it, but management wants to avoid VPN. The application will host many private information, so I need to be sure that the web server is completely secure to my best ability. Need some helpful tips from experts to give me a good scope of what might need to be done. Here are my ideas:

- Install a SSL certificate to encrypt external to internal
- Look into Secure ID type method where we could manipulate certificates?
     - So we can issue certs to those that need to connect
     - Revoke certs that are no longer needed
     - Only those with certs will be able to view the URL link (such as, if no cert the link would be blocked...?

Anyone of any best practices that would help me setup this scenario?
Question by:Techneut
    1 Comment
    LVL 10

    Accepted Solution

    SSL will protect the data as it is transmitted over the Internet from the server to the client. Using SSL is a best practice for all web pages that contain confidential information.

    However, you also need to protect the private information in storage. First, you should separate the data from the web server by storing all the private information on an internal server that is not directly accessible from the Internet. Your web server will connect to that internal server to access the private information.

    Second, you must ensure that the web server has a hardened configuration. If you do not have the internal expertise to ensure that there are no problems with the web server configuration, you should hire a security professional to help you get that right.

    Third, you must apply all relevant security patches and have a mechanism in place to evaluate and apply new security patches as they are released.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
    SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    17 Experts available now in Live!

    Get 1:1 Help Now