-1

We are a small early stage startup with not so much money to spend.

We have less than 3 servers that we want to monitor for security issues.

Our website is essentially on one server having:

  • Ubuntu
  • A Single-Page-App (full javascript)
  • An API (Play/Scala/Netty) with MongoDB and ElasticSearch behind and an Apache reverse proxy

As you can understand, I'm more interested by server monitoring rather than application monitoring (not really looking for SQL injections, XSS or other things like that, I guess no tool is able to test that automatically on a JS app + API stack)

Is there any offering available, or open source product to monitor such things and alert us on security issues?

We are looking for a free or cheap tool, easy to use. Preferable a cheap SaaS offering, or a tool that can be run on a developer's computer (and not something that targets a 10000 computer network and should be run as image on vShpere or KVM, like some offers i've seen)

I have seen products like Nessus, Qualys, BeyondSecurity with SaaS offerings but it's extremely difficult to understand if these offers are affordable as it seems we always have to contact a sale to obtain any price, or the minimum number of ips to scan is > 250, or the price is > 3000$

Our cloud provider has made our server vulnerable temporarily (a shame: the firewall stopped working, opening very sensitive and easy to exploit ports to the outside world). At least we would like to be alerted for such things, and possibly a little more than a simple port scan.

Have you come up with any solution for this kind of task? Are there open-source tools reliable, easy to use for a regular developer and up to date?

1 Answer 1

3

Product or service recommendations are off-topic for this site.

Having said that, I would like to speak to your paragraph:

Our cloud provider has made our server vulnerable temporarily (a shame: the firewall stopped working, opening very sensitive and easy to exploit ports to the outside world). At least we would like to be alerted for such things, and possibly a little more than a simple port scan.

You should be layering your security. Your host-based firewall, iptables, should be blocking these "sensitive" and "easy to exploit" ports as a backup to your hosting provider's firewall. There's no "hard" costs involved and it's pretty simple to configured.

I also question that you're running "easy to exploit" services on an OS instance that is running Internet-exposed services. Even if you firewall off those exploitable services a vulnerability that allows for remote code execution on the machine might still be used to attack those services. (Given the recent Shellshock vulnerabilities I don't think this is an unreasonable concern.) If they're not able to be hardened then I'd look at architectural changes that isolated those services to machines with a smaller attack surface exposed to the Internet.

3
  • sorry, even for open-source tools recommendation? Yes this is what we have done since then, but we don't have any sysadmin so we learn on the go... Oct 22, 2014 at 13:55
  • 1
    @SebastienLorber - It's the nature of the site. Product and service recommendations become out-of-date very quickly, diminishing the relevance of the site. Site topic concerns aside, security is a process and a mind-set, not a product or service. You should consider employing a security consultant if you're not able to bring your team up to speed on the issues. It needs to be an ongoing process within your company, not something that's "fire and forget". Oct 22, 2014 at 13:57
  • yes, it's just a first step we are trying to achieve here. We lack money (even for a SaaS service, a consultant, or more servers). Thanks for the advices that i'll try to apply when we will be able to :) Oct 22, 2014 at 14:27

Not the answer you're looking for? Browse other questions tagged .