The security basics most servers are still missing
Not firewalls and intrusion detection. The unglamorous things that stop the attacks that actually happen.
Most servers are not compromised by sophisticated attacks. They are compromised by a bot trying "admin/admin" a hundred thousand times, and eventually finding a door someone left open.
What actually gets exploited
Brute force on SSH and mail. We see thousands of attempts a day on every server we manage — automated, relentless, and completely stoppable.
Software nobody updated. An outdated plugin or an unpatched library is how most sites get taken over. There is no cleverness involved; the exploit is public and a bot is scanning for it.
Credentials in the wrong place. Passwords in a config file inside the web root, keys committed to a repository, database users with far more permission than they need.
# Lo que frena la mayoria de los ataques realesPermitRootLogin no # nadie entra como rootPasswordAuthentication no # solo llaves # fail2ban: bloquea al que insistemaxretry = 3bantime = 3600The one that saves you
Backups. Not because they prevent anything, but because they are the difference between a bad afternoon and a closed business. Offsite, automated, and tested — an untested backup is a guess.
Every recovery we have ever done came down to the same question: is there a backup, and does it work? Everything else is negotiable.
Dealing with this yourself?
We manage infrastructure, automation and AI for companies that would rather focus on their business. Tell us what is breaking.
Start a conversation
