A baseline is a snapshot in time when things are good or are performing their best. The reason for this is two-fold: one, it will give you an opportunity to put your measures and metrics in place to measure security. If this goes awry, it will affect your uptime and the availability of your site to the clients and customers who may want your goods and services. The second reason for establishing this base line is to help you design procedures that assure you are doing everything you can to protect yourself. If you are working with more than one person, you will want to work with your staff to come up with a set of metrics that are meaningful, will yield actionable data, and can be proven under most circumstances. A good metric that's often used is the "uptime" of an important system. However, just giving me a figure and saying that it is up and running does not tell me anything 95% of the time. There are many factors involved in this measurement. Establishing what is important to that number is your baseline uptime number. While it may not be spoken, you can be assured that most people will be unforgiving if you don't have the perception of 100% uptime. Note that I said perception. As you know, with Joomla!, you can switch the site off and put up a friendly message stating that its down for maintenance, or an upgrade. This could be a ruse on your part if you are defaced, to simply cover it up while you activate your disaster recovery plan. On the whole, this baseline will be your model of a secure (as you can make it) site. Here's an instance to consider. You set up your fancy new website, using say version 1.0.15 from the Joomla Forge site. You research your extensions carefully, and you follow the directions to install them. Your site is up and you submit it to Google for the entire world to see. Let's say you even advertise that your site is up and running for business! A few brisk weeks of sales, and you are happy. Then one day you wake up and find that you've been attacked by some third-world punk who defaced your site! Barring anything else, that alone would give most customers a pause to purchase from you.

What happened in our fantasy example? Here, you did not rename htaccess.txt to .htaccess and put in some base controls to stop ordinary kiddie scripts. Having a baseline of understanding would prevent a mistake such as this from happening.

That is a good question, and is VERY dependent on your site and your situation. There are a few common things that should be a part of your baseline measurement, for instance, log files. Your baseline should have a way to collect and review them. There are several logging tools from the community and you will have to pick one. In any case, the logs should be collected every "x" minutes. This metric would yield all kinds of actionable data relating to security.

Here is an example:

Our required data points are as follows:

You can see a simple example, on monitoring attacks by IP/type of attack. However, and I strongly caution you to think this through, if that extension in our example were vulnerable, you would not be reading the footprints these lamers left behind. You would likely be mopping up the damage. This example is to show you how to collect actionable data. The following is an example of a report you may produce for your site showing % of attacks by visitors:

The things you may wish to measure include the following:

These are just a few examples of what kind of things you can measure. Some may apply to you; some may not apply to you.

You cannot measure anything without a tool or a set of standards. How you measure is as important as what you measure. In the previous example, we may be running the logging tool BSQ-SITE SITES (visit: bs-squared.com to review this logging tool) to collect our stats. If so, we will have crafted a simple process to use this tool and to respond to the events. For example, as this chapter was being written, the author stopped to review his own logs. Sure enough, three attempts were made to use "kiddie-scripts" to break into the site. They were not successful because the site was not running the vulnerable scripts they were attacking. The actionable data, that is the standard policy, is to block the IP address. This is not because of the concern that they may eventually get in, rather it helps to filter the attempted criminal activity from real paying customer activity. We are concerned with both, and taking time for reviewing log entries only to discover multiple attempts to break in is a waste of time if you do not take action. Additionally, it is doubtful that anyone who attempts this will come back with intent to spend money. Hence, locking them out saves time, bandwidth, money, frustration, and potential future attacks. Once you have determined your metrics, take time to decide how you will measure them.

The tools that can be used to gather these statistics are abundant:

These are just a few of the tools available out there. The author doesn't recommend a particular one, because each tool measures things slightly differently, and with different emphasis on how they collect statistics. The key take away: Pick a tool that will gather the data you need. Learn it, keep it updated, and use it.

For the most part in our example site, the stats were gathered from the log files that are written constantly. In fact, there is so much log data collected that you could write an entire volume on logging alone. Other sources may be a credit card authorization and verification system, such as authorize.net. They will collect information that would not be picked up by our tracking systems at all. This could help you establish a trend that could impact you. For instance, you might be held liable in some instances for credit card fraud. Knowing that fraudulent activity is taking place will help you negate the effects. Again, establish the baseline, measure, and create actionable data.

If you have a brand new site, then establishment of your baseline should be a part of your design criteria. In other words, design it as if you were adding an extension. Later, we'll cover some tools that are available, and should be a part of your site. More than likely if you have an established a site, this is a bit of a different tack. You will need to ensure that you are safe and secure by adding in the items that are missing, for instance, a common problem is leaving Register Globals ON. This could be part of cleanup, and will secure your site. Once you have done all the right things then you are ready to establish that snapshot.

You have several items to establish here. Some are technical in nature, and some are social in nature.

The author recently switched the anti-virus prevention and detection from a well-known package to Kapersky (see www.kapersky.com), and it (kapersky) found three viruses on his machine that the very popular package seemed to have missed. This is not an endorsement of Kapersky; however, it is a worthwhile package to consider. It has hourly updates, it has a running total of new threats discovered, the time to put out a patch, and much more. Whatever you do, put the metric of anti-virus updating in place. The following is a list of a few things to consider for measuring and doing: