I have set up IIS 7.5 with some web applications, that are meant for internal use as well as for some of our customers.

The information inside them is important to some extent, but not like credit card data. Just customer details, i.e. email addresses and passwords (for login purposes) ... this is probably the most sensitive data.

I have web forms authentication set up for logins. Currently the port open is :80xx and not 80. So the user has to enter...

www.ourdomainname.com:80xx to get to the application. I do not want that extra ip at the end.

  1. What are the disadvantages to using port 80? And do I have to be
  2. concerned about any security issues?

In short:

  1. In general, its easier to find out, you have public web apps. Still everyone can scan all range of ports and find your apps on different ports.

  2. Your apps may contain vulnurabilities like XSS, non protected pages and handlers (no authentication access, bugs, SQL Injections, you name it) so any person can exploit them in a different ways, from gaining access to your protected data just for fun to taking over your server, selling your databases to third parties e.t.c.

As long as you dont have obvious bugs in your apps (SQL Injection, all pages require authentication) and use SSL (at least self signed) you are most likely fine.

  • Thanks for your reply. If I get everything in there apart from the ssl. How important is ssl? If someone is typing a password on the internet on my page, how much effort would it take someone to steal that password if its not ssl? (trying to see if it would be worth it for my projects) – sprocket12 Dec 19 '12 at 11:58
  • Well, it depends. Password can be stealed in public wifi zones or even ISP staff can sniff your passwords for $$$. Its always your desicion how secure you should be. Imagine someone will manage to still all your customers PWs, so what? Someone can spam your customers with offensive materials, your customers won't trust you, you loose customers and business, is it worth SSL? – ADOConnection Dec 19 '12 at 12:46
  • Okay so say I did want SSL. If I am self certified would my users have to keep accepting "This sites certificate is not certified by xyz" or some similar message? Because I have seen this message many times and can put users off, thinking they may be hacked or something. – sprocket12 Dec 19 '12 at 13:10
  • If you have a Domain Controller, and people who use your apps are members of this domain and SSL certificate was issued by this domain controller then they won't see warning. In all other cases they will. Important thing at this moment is that its really hard to determine whether person is under attack (men in the middle certificate substitution) or not. – ADOConnection Dec 19 '12 at 13:23
  • Yes so I would need a commercial certificate as customers who are not on the domain will want to use the application. They cost $$$. Maybe worth me researching. Thanks for all your help. – sprocket12 Dec 19 '12 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.