Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security:
How do I deal with a compromised server?.
Finding how a hacked server was hacked
File permissions question
The last one isn't directly related, but it highlights how easy it is to mess up with a web server administration.
As there are several things, that can be done, before something bad happens, I'd like to have your suggestions in terms of good practices to limit backside effects of an attack and how to react in the sad case will happen.
It's not just a matter of securing the server and the code but also of auditing, logging and counter measures.
Do you have any good practices list or do you prefer to rely on software or on experts that continuously analyze your web server(s) (or nothing at all)?
If yes, can you share your list and your ideas/opinions?
I received several good and interesting feedback.
I'd like to have a simple list, so that can be handy for the IT Security administrators but also for the web factotum masters.
Even if everybody gave good and correct answers, at the moment I prefer the one of Robert as it's the most simple, clear and concise and the one of sysadmin1138 as it's the most complete and precise.
But nobody consider the user perspective and perception, I think it's the first that have to be considered.
What the user will think when will visit my hacked site, much more if you own sensible data about them. It's not just a matter of where to stock data, but how to calm angry users.
What about data, medias, authorities and competitors?