Because very few apps are silos, we need to ensure that the backend is also secure using security best practices.
It goes without saying that if your backend servers are vulnerable, your entire system is also vulnerable. This includes your app, the data it processes, and your infrastructure (one vulnerable server can often serve as a foothold for an invading attacker).
Although we can't cover every scenario, we can give a few guidelines:
Prevent
rootfrom logging in directly; requiresudofrom specific accounts in order to perform tasks requiring administrative privileges.Create accounts for your specific applications and grant them only the rights they actually need to have (avoid programs running on your server as
root).Configure SSH to permit authentication only via key. Not only is it nice to log in from a trusted machine without a password, it can also enhance security by preventing password authentication (passwords are shorter...