A complete Richweb web application server system consists of:

• An application server connected at one of our secure colo facilities, a database server, and a network firewall. All management of Richweb servers is done remotely either via a browser interface or via secure shell (software updates and database restoration if the customer requests a restore).
• A browser installed on the client PCs. (MS IE9, IE10, Safari, Chrome and Firefox suggested; system should work with older browsers but they are not officially supported).
• An embedded database (Firebird, MySQL RDBMS engines are loaded on the server).
• A secure (SSL) web interface for end users and Program Administrators
• Housekeeping programs that update the system automatically each night.

Richweb has a monthly scan performed by Qualys Scanner – qualys.com. Results are reviewed and any level 3, 4 or 5 vulnerabilities are addressed immediately. (Levels 3 and above are considered potential attack vectors, levels 1 and 2 are information gathering). If a level 1 or 2 issues is possible to address, Richweb will address the issue (many level 1 or 2 issues are false positives in fact). In this packet of information are the scan results against several servers at one of Richweb’s data centers. These scan results are very representative of the overall security posture that Richweb is able to achieve. We have address ALL outstanding serious security exposures and/or vulnerabilities that were detected by the scans continually.

In addition, Richweb profiles all of the applications that are requested for hosting by our clients into 2 categories: “unknown/not measured” and “dangerous”. Dangerous applications are those apps that are known to be poorly written via source code audit and/or have a continual stream of disclosed vulnerabilities. Richweb takes additional security precautions such as extra outbound packet filters and increased host based intrusion detection measures when a client insists on hosting an app classified as dangerous. Of course Richweb’s first step in this process is to educate the customer about the application in question in an effort to remove the need for hosting the application in the first place (perhaps a suitable more secure replacement app is available).

As part of OCC (Federal Banking Regulators) Pen testing that was done for a Richweb client using a Richweb server hosting a production (live) representative set of applications no successful penetration was achieved during testing. In addition Richweb firewalls have been pen tested several times by different clients with no successful penetration. Real world experience has shown our servers to be maximally secure with password weakness being the only exploited attack vector in the last 8 years. As we all realize, passwords are only as secure as the client administrator can keep them.

The cabinets which house the servers are locked; the servers are locked at the BIOS level. Only authorized (by Richweb) data center personnel have access to the servers (as directed by Richweb).

All source code, server configuraton files and server system files that detail setup are checked into and managed with the industry leading open source code management software Subversion. Richweb uses Subversion over SSL protected HTTPS sessions so no source code or config files are pulled via clear text protocols at any time.

Richweb does not maintain or create accounts for Richweb management purposes to client database instances unless authorized and instructed to do so by an authorized Program Administrator of the client in question. This authorization should be given via the telephone. Some clients have made arrangements with Richweb whereby certain actions can be taken via emails from the PA/PM but usually these directives are issues via telephone conferences or conversations. A written email will then be sent for confirmation of any action that is to be taken. This provides an audit trail for the access that was granted. Richweb logs all time spent supporting a client in our EMS project management system. The EMS system project logs will contain these notes and actions taken.

All databases and web applications and websites hosting services are virtualized. This means that the server is in and of itself a virtual server. This technology allows for quick and efficient backup as well as restoration of the complete operating image of both the server and its services as well as the applications and the data the applications need.

Richweb maintains additional server capacity at its backup data centers. These servers are idle when a customer is not using an image on the server in disaster recovery mode.

Backups of the filesystem and the databases are handled by 2 separate backup processes.

Full backups of each customer database are cut to disk on the local server and then replicated back to Richweb’s NOC via the rsync+ssh protocol, which is an industry standard for secure, fast, efficient remote file replication.

Database backups can be arranged for weekly, twice weekly, or daily intervals depending on how fast the data is updated.

Richweb takes monthly and/or weekly full filesystem backups of your vserver. Monthly backups are standard, weekly backups can be arranged if you have a fast changing site that places content or data on the filesystem.

Richweb also takes a nitely incremental backup of each vserver. This incremental backup is written over each nite so if you inadvertantly delete a file or directory contact Richweb immediately and we can fetch the backup from the disk image.

Custom backup schedules can also be arranged with Richweb. Some customers like to have images of disks or databases zipped up and uploaded to a customer ftp server or dropped to dvd, cdrom, usb hardrive, or tapedrive.