up vote -1 down vote favorite
1
share [g+] share [fb]

We all hear about spectacular stories in the medias about high profile companies' server going down or being hacked or being attacked. However, it does not necessarily mean that it happens all the time to all companies.

My question is: how often do servers go down because they are being attacked or hacked? Do servers go down more often for other reasons?

link|improve this question
92% accept rate
1  
Port 22 is often attacked on any server with a public IP. Check your /var/log/secure to see if someone is trying brute ssh attacks – Chris Ting May 30 '11 at 16:32
feedback

closed as not constructive by Ben Pilbrow, joeqwerty, Scott Pack, gravyface, Antoine Benkemoun May 30 '11 at 18:53

This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.

1 Answer

up vote 1 down vote

Based on firewall logs I have seen, it probably happens all the time. Firewalls are constantly being probed daily, even in small companies. The reason you don't hear more about it is that big names, like Sony, are so recognizable, and get all the news. In addition, large companies tend to expose more attack surfaces to the Internet, since they want to provide more service. This makes them more vulnerable, and likely to be attacked, and to hit the news.

Small companies often do not have a dedicated IT staff, and have no proactive support, only reactive. In a case like this, I could see attacks going under-reported, and missed altogether. There is no one there to even realize they have been attacked...this assumes the hacker comes in and goes out quietly. Also, many small companies are not very good at patching or making sure their anti-virus is up-to-date and working well. Then internal computers get infected, and can give a hacker the keys to the door.

Although possible, I doubt that attacks, unless they are denial of service intended, are going to bring down servers. The hacker doesn't want that...most don't want you to know they have been there, and they very well may want to come back.

link|improve this answer
Thanks for input. Would you say a good firewall configuration and login/password policy is the most important aspect of securing servers? – JVerstry May 30 '11 at 16:58
1  
Here is what I would say is important: Make sure that you only let in what you need to let in. Do a full external port scan to check what you are letting in. If you have things that are for the public, put them on a DMZ. One of the most important things is patching since a lot of attacks happen from the inside: Windows update, browser plugins www.mozilla.com/plugincheck/ (works on most browsers, not just Mozilla), and any other programs that could be attacked. Then you have general security principles, like passwords, restricting permissions to only what users need. – KCotreau May 30 '11 at 17:03
1  
If what you have is really important, you can also implement intrusion detection systems. Personally, for most small businesses, I don't like them to host their own website, since that is often a common area of attack...if it is not on their servers, there is potentially less damage, asusming they are not stock piling credit card info on them. There are just so many things to look at, but these are just the ones off the top of my head. – KCotreau May 30 '11 at 17:07
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.