Got your own email or web server? Ten top security tips

The following information has been compiled thanks to the help of The Australian Communications and Media Authority (ACMA).

Got your own server? Make sure it is secure…

The Internet can offer your business many benefits – but it can also expose you to increased security risks. This section of our web site helps you understand the basics of good computer and Internet security.

Many small businesses rely on the Internet to communicate with customers, suppliers and business partners. Other businesses go a step further: instead of using general email accounts provided by Internet Service Providers (ISPs), they choose instead to run their own web and email servers.

While running your own server can cut costs and bring greater flexibility, it can also expose you to bigger security risks.

If your business runs an email or web server, you probably rely on it to send and receive email and to present your online presence to the world. Inadequate security practices can disrupt your business, expose sensitive information, cost you money and put your computers at risk of being hi-jacked by spammers.

Most spam is sent out via spammers who take control of computers just like yours: don't let security lapses allow these people to take advantage of you.

Why care about security? What's the connection with spam?

Information held in IT systems is crucial for the operation of many businesses. Good security policies and practices help preserve the confidentiality, integrity and availability of data and services.

Spammers actively hunt for computers with security vulnerabilities. Spammers use these compromised computers both as a platform from which to attack other computers, and as a conduit for sending vast amounts of illegal spam.

If your business networks have been compromised, this can result in the disclosure of sensitive information, corruption of data, business downtime, damage to your reputation and the hassle of removing your business from spam 'blacklists'. You are also financially liable for the excess ISP data charges that accrue when your computer is used to send spam.

Like all forms of security, computer security costs money. A security policy outlines the chosen balance between risks, possible consequences and cost. Developing and following a security policy requires management support, skills and input and is not simply an issue of technology.

Top ten security tips

This section presents 10 ways you can improve the security of your server (that is, ensure it is not compromised) and build a strong security policy. You can learn more about any of these security tips by browsing in a computer bookshop or by using your favourite Internet search engine.

1. Use a firewall

A firewall is your computer network's first line of defence against intruders. Firewalls can block all traffic between your network and the Internet that is not explicitly allowed. Firewall software is built into modern operating systems and can also be purchased as special-purpose hardware. Basic firewall settings to help get you started are readily available from your vendor or the internet.

2. Keep up to date with security patches

Most operating systems are supported by automatic updates ('security patches') that fix vulnerabilities found in important software components. You should either use the 'automatic update' option, or subscribe to a security-related mailing list and install these patches when necessary.

3. Protect yourself against viruses

Viruses and other malicious software, such as worms and Trojan horses, can alter or erase data on your computers; allow spammers and other intruders to use your computer and network; and may replicate and spread to others.

If you run an email server, you can install anti-virus software at the server to filter out email viruses before they reach users.

Each individual computer should also have up-to-date anti-virus software. Viruses and worms spread fast, so your anti-virus software must be updated regularly.

4. Use hard-to-guess passwords

Passwords are surprisingly easy to guess. Read the simple rules described in AusCERT's 'Choosing Good Passwords' guide (see 'General Security', below).

5. Check and alter default settings

After installing software, check the configuration / setting options – you may find the software has extra features you don't need or want. Turning off unnecessary services is a good security precaution.

6. Back up your software

Back up your data regularly. Verify your backups from time to time.

7. Monitor your servers

Your servers can be compromised without your knowledge. Monitoring your servers can alert you to intrusions as they occur, as well as allowing you to check the servers are working properly. Turn on the 'logging' function as a first step. Ask your vendor or an expert about the best way to monitor your network.

8. Join security-related mailing lists

Reputable organisations such as AusCERT offer free mailing lists that allow subscribers to keep an eye on the latest security risks and tips.

9. Secure your mail server: Close open relays!

Mail servers are very attractive targets to hackers and spammers because they exchange data between external users and internal users.

'Relaying' is a feature in mail servers that allows the server to forward mail from one external domain to another. If you run an 'open relay', spammers will quickly find your computer and use it to send spam, which may result in your server being blacklisted – which will stop you from being able to send legitimate emails.

10. Secure your web server: Close open proxies!

Web servers are large, complex, and highly configurable (that is, they can be fine-tuned to suit your needs). As such, they are often targeted by hackers and spammers. Make sure you know what you are doing if you are setting up such a server. If in doubt consult an expert,

The two most popular web servers are Apache and Microsoft Internet Information Server (IIS). The default installations of both servers are often adjusted to improve security (see the links below).

Modern web servers can also run as 'proxy servers', a feature which allows users to forward web requests through your servers. If you run an 'open proxy', allowing open access to your proxy, spammers will quickly find your server and misuse your generosity, which could harm your reputation and result in your business being placed on spam blacklists.

Need more help? Options and more useful links

Seek expertise: Talk to friends or hire a technical consultant who can provide help through training, setup, ongoing administration and/or security.

Outsource: ISPs and other service providers offer IT solutions that include security management. 'Bundled' services cost may more than a one-off equipment purchase, but the comfort of knowing someone is on your side when it comes to IT security and support may be worth it.

General Security

The AusCERT National Information Technology Alert Service offers a free mailing list notifying subscribers of the latest threats and vulnerabilities affecting computer systems http://national.auscert.org.au

AusCERT publishes useful security-related papers, including: 'Steps for Recovering from a UNIX or NT System Compromise' and 'UNIX Security Checklist'
http://www.auscert.org.au/Information/Auscert_info/papers.html

The SANS Top 20 Internet Security Vulnerabilities, list is regularly updated, and is organised into two top-10 lists – one each for Microsoft and UNIX systems http://www.sans.org/top20

Dozens of sample security policies, ranging from anti-virus processes to VPN access http://www.sans.org/resources/policies

Microsoft security

The 'Microsoft Baseline Security Analyser' is software that scans your Microsoft Windows systems and suggests changes to settings to improve security
http://www.microsoft.com/technet/security/tools/mbsahome.mspx

The 'Microsoft e-Security Guide for Small Business' has tips, tricks, and do-it-yourself security information
http://www.microsoft.com/smallbusiness/gtm/desktopsecurity/pdf.mspx

'Recovering from an Incident' security guide from the CERT/CC
http://www.cert.org/nav/recovering.html

UNIX security

'UNIX Configuration Guidelines' from the CERT/CC
http://www.cert.org/tech_tips/unix_configuration_guidelines.html

Mail Server security

'Security Resources for Exchange Server' 2003
http://www.microsoft.com/exchange/techinfo/security

'Sendmail Secure Install'
http://www.sendmail.org/secure-install.html

Web Server Security

Securing Apache
see http://httpd.apache.org/docs-2.0/misc/security_tips.html
or
http://www.securityfocus.com/infocus/1694

IIS lockdown tool
http://www.microsoft.com/downloads/details.aspx?FamilyID=DDE9EFC0-BB30-47EB-9A61-FD755D23CDEC

Installing and securing IIS servers
http://www.windowsecurity.com/articles/Installing_Securing_IIS_Servers_Part1.html

The 'Windows 2000 Web Services' page has links to a range of IIS security articles http://www.microsoft.com/windows2000/technologies/web

Other articles that may help:

What Is Spam?
Why Is Spam A Problem?
Australia's Anti-Spam Law
How can I avoid sending spam?
Spam Exemptions
Government/Industry spam actions
Security tips for your server