初创公司需要采取哪些最低限度的安全预防措施？
我正在与一家初创公司合作，主要从事系统管理工作，我遇到了一些我不太满意的安全问题。 我想判断我的期望是否准确，因此我正在寻找其他人在这种情况下所做的事情以及出现的风险/问题的一些见解。 特别是，将管理工具置于 VPN 后面、定期安全更新（操作系统和工具）等措施有多重要。
请记住，由于这是一家初创公司，主要目标是获得尽可能多的功能门很快，所以我需要尽可能多的理由来获取安全资源（即升级的停机时间，应用程序安全修复的开发时间）。
背景信息：
- 应用程序是 LAMP 以及自定义 java 客户端服务器。
- 在接下来的 3 个月内，我预计该网站将有大约 10,000 名匿名访问者以及多达 1000 名经过身份验证的用户。
- 年轻观众（16-25 岁）的黑帽子数量肯定高于平均水平。
预先感谢您的回复，我欢迎任何相关建议。
I'm working with a start-up, mostly doing system administration and I've come across a some security issues that I'm not really comfortable with. I want to judge whether my expectations are accurate, so I'm looking for some insight into what others have done in this situation, and what risks/problems came up. In particular, how critical are measures like placing admin tools behind a vpn, regular security updates (OS and tools), etc.
Keep in mind that as this is a start-up, the main goal is to get as many features as possible out the door quickly, so I'll need as much justification as I can get to get the resources for security (i.e. downtime for upgrades, dev time for application security fixes).
Background Info:
- Application is LAMP as well as a custom java client-server.
- Over the next 3 months, I project about 10k anonymous visitors to the site and up to 1000 authenticated users.
- Younger audience (16-25) which is guaranteed to have an above average number of black-hats included.
Thanks in advance for your responses, and I'll welcome any related advice.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（10）
另外，不要忘记您需要保护您的服务器免受当前（即即将离职）员工的影响。 由于员工破坏，一些初创公司被彻底消灭，例如 http://www.geek.com/articles/news/disgruntled-employee-kills-journalspace-with-data-wipe-2009015/
Also, don't forget you need to have your server secured from current (that is, soon-to-be-past) employees. Several startups were totally wiped due to employee sabotage, e.g. http://www.geek.com/articles/news/disgruntled-employee-kills-journalspace-with-data-wipe-2009015/
如果从第一天起就没有考虑安全性并将其内置到应用程序及其基础设施中，那么以后对其进行改造将变得更加困难。 现在是时候构建定期操作系统/工具修补、升级等流程了。
由于您的公司依赖于保留现有用户并吸引新用户，因此您应该根据用户对违规行为的反应来表达您的担忧。 高层会明白用户是你的面包和黄油。
If security isn't thought of and built into the application and its infrastructure from day one it will be much more difficult to retrofit it in later. Now is the time to build the processes for regular OS/tool patching, upgrades, etc.
Since your company is dependent on keeping existing users and attracting new ones, you should present your concerns along the lines of how the users would react to a breach. The higher-ups will understand that the users are your bread and butter.
声誉就是一切，尤其是对于初创公司而言。 作为一家初创公司，您在可靠性/安全性/...方面没有悠久的历史 - 因此一切都取决于用户在开始使用您的应用程序时是否给您“无罪推定”。
如果您的服务器遭到黑客攻击并且您的用户注意到这一点，您的声誉就会消失。 一旦它消失，您的应用程序和功能是否是“下一个新事物”就不再重要了。 无论安全漏洞是否轻微，人们都不会再信任您的应用程序/公司。
因此，我认为安全是重中之重。
Reputation is everything here, especially for a startup. As a startup, you don't have a long history of reliability/security/... - so all depends on users to give you the 'benefit of the doubt' when they start using your app.
If your server gets hacked and your users notice that, your reputation is gone. Once it's gone, it doesn't matter whether your app and your features are the 'next new thing' or not. It doesn't matter whether the security breach was minor or not - people won't trust your app/company anymore.
So, I would consider security to be the top priority.
我同意斯特凡关于声誉的观点。 您不想因为缺乏安全性而遭到黑客攻击。 这不仅会损害你的网站和公司，而且会让你看起来很糟糕，因为你负责这件事。
我个人的意见是尽你所能，因为无论你做多少，都会有漏洞。
不幸的是，像测试和文档这样的安全性往往是事后才想到的。 您确实应该确保在站点/软件生命周期的早期进行风险评估，并继续进行评估。 我认为修补所有软件的安全漏洞非常重要。
I agree with Stefan about reputation. You don't want to get hacked because you were lacking on security. Not only will that hurt your site and company, it will look bad on you since you're in charge of that.
My personal opinion is to do as much as you can because no matter how much you do there will be vulnerabilities.
Unfortunately security like testing and documentation are often afterthoughts. You should really make sure to do risk assessments early in your site/software's life and to keep on doing assessments. I think it is important to patch all software for security holes.
这些可能是显而易见的：
还值得一提的是，正如您所说，应该适当地设置网络架构。 您绝对应该有一个像样的防火墙并尽可能地锁定。 有些人建议将您的系统放置在不同品牌的双防火墙之间，这样，如果其中一个防火墙存在严重漏洞，第二个防火墙很可能不会存在相同的漏洞，您就会安全。 这一切都取决于你能负担得起，因为它是一家初创公司。
These will probably be obvious:
It's also worth mentioning that, as you said, the network architecture should be set up appropriately. You should definitely have a decent firewall that's locked down as much as possible. Some people recommend putting your systems between dual firewalls of different makes so that in the event one of them has a critical vulnerability, the second will most likely not have the same vulnerability and you'll be safe. It all depends on what you can afford since it's a startup.
如果您明确地试图吸引那些倾向于尝试破解系统的用户，那么您可以肯定您的系统将受到攻击。
您应该向管理层建议，如果他们不认真对待安全问题，那么您应该直接在网站上发布公司的银行对账单和会计账簿（以明文形式），并在主页上提供显眼的链接。 至少这样，你可以告诉他们，最终结果大致相同，但他们不太可能为了得到他们想要的东西而破坏其他一切。
我认为声誉问题对这些受众的影响也可能略有不同——他们可能会原谅你被黑客攻击，但他们可能不会原谅你成为一个容易攻击的目标。
If you're explicitly trying to attract the sort of users who are inclined to try to crack systems, then you can pretty well bet that your system will come under attack.
You should suggest to the management that if they're not going to take security seriously, then you should just go ahead and post the company's bank statements and accounting books (in clear text) on the site, with a prominent link from the home page. At least that way, you can tell them, the end result will be about the same, but they're less likely to damage everything else to get what they're looking for.
I'd think that the reputation issue might have a slightly different cast with this audience, too -- they may forgive you for being hacked, but they probably won't forgive you for being an easy target.
确保您知道服务器正在运行的版本和补丁级别，不仅仅是操作系统，还包括所有相关组件以及实际执行机器的所有内容。
然后确保您的进度不会落后超过一天。
不这样做会带来很大的痛苦，而且你不会听说其中的大部分 - 我过去的大多数雇主永远不会公开承认被黑客入侵，因为这对他们来说很糟糕，所以你可以假设系统正在左右被黑客入侵这些事件对公司造成严重后果，但你只是没有听说过其中大多数事件。
Make sure you know what version and patch level your servers are running, not just the OS, but all related components and everything that is actually executing the the machine.
Then make sure you are never more than a day behind.
Not doing so leads to much pain, and you don't hear of most of it - most of my past employers would never publicly admit being hacked as it reflects badly on them, so you can assume systems are getting hacked left and right with pretty serious consequences to companies, you just don't hear about most of these events.
这里有一些基本的“安全”措施，虽然更多是被动的而不是主动的，但仍然是一些需要考虑的事情。
1) 备份策略，当然不仅仅是针对那些侵入您网站的人，但如果可能的话，最好将所有内容恢复到黑客攻击前的状态，确保它可靠，最重要的是在近乎实时的恢复演习中进行了测试< br>
2) 缓解措施，至少在餐巾纸上的某个地方制定计划，说明服务器被黑客攻击时如何反应
3）保险，找到了解网络业务世界以及这些事情造成的损害的保险公司，购买保单
4）有人已经提到了员工破坏问题，你事先对你的员工进行了筛查，对吗？ 背景调查很便宜，而且可以挖掘东西......
A few basic "security" measures here that while are more reactive than proactive, are some things to consider.
1) Backup strategy, of course not just for those who hack into your site, but it is nice to restore everything back to pre-hack days if possible, make sure it's reliable and most importantly was tested in a near-live restore drill
2) Mitigation, have plans in place at least on a napkin somewhere for how to react if the server is hacked
3) Insurance, find insurance companies that understand the world of cyber-business and the damages resulting from these things, buy policies
4) Someone already mentioned employee sabotage problems, you're screening your employees beforehand right? Background checks are cheap and do dig up stuff...
我最好的建议是监控。
没有完美的安全性，关键在于接受风险并在必要时预防风险。 但是，如果您没有适当的监控，您将无法知道某件事（攻击）是否成功以及它是如何发生的。
因此，请保持系统更新并安装一些轻量级工具来正确监控它。 如果您有自定义应用程序，请在其中添加日志记录。登录错误生成的错误（输入错误）、密码失败或任何用户生成的错误。
至于轻量级的监控工具，有很多免费/开源的：
My best suggestion is monitoring.
There is no perfect security and it is all about accepting risks and preventing them when necessary. However, if you have no monitoring in place you will have no way to know if something (an attack) has succeeded and how it happened.
So, keep your system updated and install a few lightweight tools to monitor it properly. If you have custom applications, add logging in there. Log on error-generated errors (bad input), failed passwords, or any user-generated error.
As for lightweight tools to monitor, there is quite a few free/open source:
查看 Mod Security 以了解软件设置中的各种可能性：
在 Google 上搜索“mod_security howto example”
开始的简单示例： http://www.ghacks.net/2009/07/15/install-mod_security-for-better-apache-security/
Have a look at Mod Security for the various possibilities in the software setup:
Do a Google search for "mod_security howto example"
Simple example to start: http://www.ghacks.net/2009/07/15/install-mod_security-for-better-apache-security/