I disagree.

When the cost of the security is significantly higher than the value of the asset being protected, it's a bad thing; especially for a government agency using public funds.

That being said, you do have to consider the PR value of the system; defacing the website of a computer security firm is more damaging than doing the same to the website of a grocery store.

Rob

Sent on the Sprint® Now Network from my BlackBerry®

-----Original Message-----

From: Miguel Gracia <mgracia (at) grayhairsoftware (dot) com [email concealed]>

Sender: listbounce (at) securityfocus (dot) com [email concealed]

Date: Tue, 19 Jun 2012 16:58:24

To: marco cohen<marcocohen2 (at) gmail (dot) com [email concealed]>; security-basics (at) securityfocus (dot) com [email concealed]<security-basics (at) securityfocus (dot) com [email concealed]>

Subject: RE: protecting web apps for governaments

There is no such thing as too much protection. If the company feels comfortable with this and thus requests nothing less, then it is worth having. From a technical standpoint, it may be overkill but it may be a requirement depending on audits done on the company and/or web apps.

-----Original Message-----

From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On Behalf Of marco cohen

Sent: Tuesday, June 19, 2012 11:23 AM

To: security-basics (at) securityfocus (dot) com [email concealed]

Subject: protecting web apps for governaments

HI all

Im doing a consulting for one of the governaments in europe.

the idea is to create a most secure segment in which we will locate all the web apps of the gov and to protect them from any attack. we will buy equipment like SIEM, HIDS IPS, Firewalls and WAF and prevention of DDOS attacks.

but additionaly to this I am working on policies to implement heardening of operation system of those servers.

I am considering also politices of code review (in this process algo input validation), and twice a year pentest to all the 200 web sites.

I am wondering if also doing code review for every change in the those web apps + pentest 2 time a year + WAF.

ISNT THAT TO MUCH FOR PROTECTING THE WEB SERVERS??

thanks a lot!

marco

------------------------------------------------------------------------

Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1

------------------------------------------------------------------------

------------------------------------------------------------------------

Securing Apache Web Server with thawte Digital Certificate

In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1

------------------------------------------------------------------------

[ reply ]