Particularly with Docker a lot of security can now happen at the OS level. This is great because it requires no changes to code, particularly for super legacy apps where there simply is no way to secure say PHP 5.4.
HTTP Security Headers. These are big. There are 8 or 9 of them now. Content Security Policy especially.
GeoIP Blocking. Also this is big. I think AWS WAF lets you even filter down to the state level now if you want. This dramatically reduces the open ip space you’re exposed to. Easy to circumvent yes, but still large benefits.
4096 SSL keys. Also would disable anything below TLS 1.1 (TLS 1.2 would be better).
SPF, DKIM, and DMARC records for DNS address.
IP Blacklists. Lots of known malicious IP lists you can download daily and block with IPTables. If you’re using Docker, you can block via Apache mod_rewrite and a fast look up dbm file (convert from txt to dbm via httptxttodbm tool).
ModSecurity. A pain to setup sometimes, but it’s not bad. Just enable a few options and you’re ready to go.
HTTP Security Headers. These are big. There are 8 or 9 of them now. Content Security Policy especially.
GeoIP Blocking. Also this is big. I think AWS WAF lets you even filter down to the state level now if you want. This dramatically reduces the open ip space you’re exposed to. Easy to circumvent yes, but still large benefits.
4096 SSL keys. Also would disable anything below TLS 1.1 (TLS 1.2 would be better).
SPF, DKIM, and DMARC records for DNS address.
IP Blacklists. Lots of known malicious IP lists you can download daily and block with IPTables. If you’re using Docker, you can block via Apache mod_rewrite and a fast look up dbm file (convert from txt to dbm via httptxttodbm tool).
ModSecurity. A pain to setup sometimes, but it’s not bad. Just enable a few options and you’re ready to go.