Re: Stay aware of security

[rpc]

I fully agree; system and network security are of utmost importance, especially in a threat model which includes large loss of revenue.

However, most people think that security is reading about the latest exploits and techniques. This is not enough.

Security must be pro-active. Most public exploits have been known to the blackhat community for a very long time. Devise an overall security architecture that matches your threat model.

Also, I can't tell you how many times during a security audit I've compromised machines through finding holes in home grown code. Yes, worry about patching and maintaining your daemons, but damnit have someone security audit your source!

On the Perl front, CGI scripts tend to be the worst in security, and best in accesibility. This is due to the overwhelming amount of novice Perl coders who have web whacking jobs.

In particular, please, please, please: if you load a template or any dynamic content via a CGI script don't get the template or content filename from the client if you can help it. I have (legally) compromised dozens of websites using insecure template loading alone.

In short, audit your code!