Home
 

Customer Support

Search for keywords:

Browse by category:

A security company says my server is vulnerable, what
can I do?

Network, server, and application security is gaining importance and visibility for several reasons, including the wider adoption of industry security standards, and the continuing growth of electronic commerce. We are aware of this importance and take numerous measures to enhance security of our infrastructure.

While remote security scans can identify problems, our experience is that they also produce numerous false reports, which has led to the publication of our policy on vulnerability scanning.

Our Scan-Related Support:
  • Managed Servers: If a security company tells you that there are vulnerabilities on your Modwest managed server, please forward the complete report and we will assist you however we can.
  • Self-managed VPS: Please consult the documentation for your selected Linux distribution (Debian, Fedora, CentOS, or Ubuntu), and Parallels support resources (Knowledge Base, Forums) for information on making any changes needed.
  • Shared System (and Resellers): If a security scan produces an alert associated with server software (such as PHP), and you have been a customer since before May 2009, you should consider requesting upgrade to our new hosting environment. Updates are no longer available for the old environment.

    If you are already hosted in the new environment, please read below for information on interpreting scan results.


Notice to Security Vendors:

If you have produced a comprehensive report for a customer we share, and there are items which you require to be resolved for the customer to "pass" your scan, then please send a concise email to support@modwest.com (with our mutual customer CC'd), containing the following:
  • The company or organization name that has hired you to scan their site
  • The domain name of the website scanned
  • Your company and contact information
  • A concise list of the items that must be resolved for compliance. Including the IP address of the host being scanned, and individual issues identified by CVE ID.

Interpreting Scan Results:

Our experience is that security scans always produce "false positives"; that is, they report vulnerabilities which do not in fact exist. Some of the more common errors we've seen:

Web Application Installations: Some scans will conclude that a certain software package is installed in your website, such as Joomla, or Kayako eSupport, or PHproxy. If the report is correct and you or your webmaster have installed the software mentioned, you should contact the vendor or follow the recommended upgrade procedures. On the other hand, if the software does not exist anywhere in your site, then you should notify the security company that their scan produced a false positive.

Specific Vulnerability Reports: Many scan reports will include a "CVE #" along with each claimed vulnerability. Common false positives we've seen include:
Modwest PHP Hosting      Copyright 2000-2009 by Modwest, Inc.      About    |    Blog    |    Community    |    Design    |    Jobs    |    Contact