[Alert] This Week's Essential Security Settings Checklist: Hardening Web Services for Developers

Continuously monitoring vulnerability information related to the latest IT and Web development is an indispensable task for security personnel. However, no noteworthy severe vulnerabilities or cyber-attack news have been reported in the past 24 hours. While this is a good situation, we must not neglect permanent security measures to always be prepared for the latest threats. This article provides a comprehensive checklist of best practices for security settings that engineers should review and implement this week. Please make use of it to continue secure Web service operations.

Basic Settings to Review Immediately

• ✓**Update OS and Middleware:** Ensure that server OS (including Linux distributions), PHP, Apache/Nginx, databases, and other middleware are always kept up-to-date with the latest stable versions and that security patches are applied.
• ✓**Stop Unnecessary Services and Close Ports:** Stop services that are not essential for operation (e.g., FTP, Telnet, older versions of web servers) and close associated unnecessary ports with a firewall.
• ✓**Appropriate Firewall (including WAF) Configuration:** If a Web Application Firewall (WAF) is deployed, verify that the latest signatures are applied and appropriate rules are configured. Reconfirm that server-level firewalls are also configured based on the principle of least privilege.
• ✓**SSH/RDP Access Restriction and Multi-Factor Authentication:** For administrative access via SSH or RDP, allow connections only from specific IP addresses, and enforce public key authentication or multi-factor authentication (MFA) in addition to password authentication.

Strengthening Account and Access Management

• ✓**Enforce Strong Password Policies:** Confirm that policies enforcing complex passwords (length, character types, regular change requirements, etc.) are applied to user and service accounts.
• ✓**Recommend Regular Password Changes:** For critical accounts, such as administrator accounts, recommend regular password changes and verify their implementation status.
• ✓**Inventory and Delete Unused Accounts:** Periodically inventory accounts that are no longer needed due to employee departures or project completion, and promptly delete them.
• ✓**Access Control Based on the Principle of Least Privilege:** Review whether Access Control Lists (ACLs) and IAM policies are appropriately configured so that each user and service has only the minimum privileges necessary to perform their duties.

Secure Web Application Operation

• ✓**Thorough Input Validation (XSS, SQLi Countermeasures):** Confirm that all user input values are subjected to strict server-side validation, sanitization, and escaping, and retest for vulnerabilities such as Cross-Site Scripting (XSS) and SQL Injection.
• ✓**Enforce HTTPS and Utilize HSTS:** Ensure that all communications are encrypted with HTTPS and that HTTP Strict Transport Security (HSTS) is properly configured.
• ✓**Apply Security Headers (CSP, X-Frame-Options, etc.):** Confirm that HTTP security headers such as Content Security Policy (CSP), X-Frame-Options, and X-Content-Type-Options are properly configured and contribute to clickjacking and cross-site scripting countermeasures.
• ✓**Abstract Error Messages and Prevent Information Leakage:** Ensure that publicly displayed error messages do not contain information about the system or internal structure, keep them abstract, and record detailed error logs internally only.

Monitoring and Log Management

• ✓**Continuous Monitoring of Access Logs and Error Logs:** Constantly monitor access logs and error logs from web servers, applications, databases, etc., and regularly check for abnormal access patterns or errors.
• ✓**Centralized Collection and Analysis of Security Event Logs:** Consolidate security-related logs (authentication failures, privileged operations, etc.) centrally and establish a system for analysis using tools such as SIEM (Security Information and Event Management).
• ✓**Consider Implementing Intrusion Detection Systems (IDS/IPS):** Consider implementing IDS/IPS (Intrusion Detection/Prevention Systems) to detect and defend against unauthorized communications and attack patterns.

Backup and Recovery Plan

• ✓**Automate Regular Backups:** Confirm that regular backups of important data such as databases, file systems, and configuration files are automated and reliably executed.
• ✓**Verify Backup Data Integrity:** Periodically verify that backup data is not corrupted and can be reliably restored.
• ✓**Develop and Test a Disaster Recovery Plan (DRP):** Prepare a Disaster Recovery Plan (DRP) detailing service recovery procedures in case of severe failures or cyber-attacks, and conduct regular tests.

Reference Information