Introduction

Securing your e-commerce site is more than planning and implementing a secure network architecture. Although these are great starts for a site, the most visible and often-attacked component is the site's server itself. In fact, in the last few years, Web hacking has become so common that some sites have begun to archive and hype Web site defacements. Attacks against Web servers are very common and in many cases they are among the most trivial of attacks to commit.

Protecting your site against Web-based attacks has to begin with the design of the site itself. Selection and proper installation of the Web server software, followed by the appropriate hardening techniques, must be applied to each and every site you design. Modifications, patches, and upgrades may also impact the security baselines, so they too must be considered. But with all the software choices and configuration options available, how do you choose what is right for your site?

The first step toward designing a secure Web site is choosing a server that suits the needs of your organization. This requires reviewing the features of a number of different Web servers, as well as the cost of the software. This chapter provides you with information on features included with numerous types of Web servers and security features in particular. It will also take a closer look at two of the most popular servers: Apache Web Server and Internet Information Server (IIS).

After your server has been properly installed and configured, you must then...