14.2. Web Server Security

The lowest level of attack and least likely place for penetration is the Web server. Both Apache Web server and Microsoft IIS are hosting literally millions of Web sites with few publicized breaches. Although such widespread adoption doesn't prevent the possibility of a security problem, the servers are very well debugged and protected.

Apache is even less likely to be the vector of an attack, since the execution of Web scripts (such as PHP or Perl) is not handled by the Web server itself, but rather a plug-in or component. Since script execution engines are perhaps the most directly vulnerable to attack, the Apache Web server itself does not have this point of jeopardy.