Уровень 0 · материалов: 7
В кластер входят документы, описывающие стратегию комплексной многоуровневой защиты серверной и прикладной части веб-ресурсов, и не входят документы, посвященные узким аспектам безопасности без привязки к системному подходу.
Общие признаки: принцип эшелонированной обороны (defense-in-depth), конфигурация безопасности сервера, мониторинг и контроль доступа, защита веб-приложений от атак
Группа выше: Защита веб-приложения и сервера
Смысл: The main idea is to provide a language-agnostic security baseline for web developers to avoid banal vulnerabilities. It highlights the philosophy that security must be implemented in layers: at the server, the application logic (input/output), and the data storage levels.
A comprehensive security cheat sheet for web developers covering server hardening, input validation, client-side distrust, and secure password encryption.
Смысл: The main idea is to implement a 'defense-in-depth' approach to web development by securing session cookies, separating data retrieval from state-changing actions, and maintaining a strict zero-trust policy regarding all client-side input.
The author outlines three critical web security rules: use HttpOnly cookies to prevent XSS session theft, use POST requests with tokens for actions to prevent CSRF, and never trust data coming from the browser.
Смысл: The main idea is to provide a practical, multi-layered approach to server-side security for web applications, moving from basic software choice and configuration to advanced monitoring and external protection services.
A technical guide on hardening Linux web servers using Nginx, PHP-FPM, security headers, firewalls, and monitoring tools to protect against common web vulnerabilities.
Смысл: The main idea is that web security requires developers to move beyond a superficial understanding of security functions and actively understand attacker methodologies to build truly resilient applications.
A comprehensive primer for web developers on identifying and preventing common security vulnerabilities such as SQLi, XSS, and LFI/RFI.
Смысл: The main idea is that comprehensive security requires a layered approach (Defense in Depth). Fixing a single vulnerability is insufficient if the underlying server configuration, credential management, and file integrity monitoring are neglected.
A security expert restores a compromised browser game by fixing critical server misconfigurations, patching SQL injections, and implementing file integrity monitoring to evict a persistent hacker.
Смысл: The main idea is that server security is achieved through a multi-layered approach combining cautious administration, strict access control, minimal software exposure, and continuous monitoring.
A comprehensive checklist of basic security measures for nix web servers, covering SSH, software configuration, permissions, and network filtering.
Смысл: The main idea is that any server exposed to the internet is under constant attack by automated bots, making proactive, multi-layered security configuration essential to prevent resource theft and legal liabilities.
A technical guide demonstrating the intensity of automated SSH attacks on new VDS servers and providing a tiered roadmap from basic to expert security hardening.