secure deployment
	-last phase where system administrator will get involved for the first time
	-configuration mistakes can lead to vulnerabilities and attacks
	-compare checksum before delivery and after delivery of the package to avoid tampering

host level security practices
	-physical security of the server, ensure it is protected from unauthorized physical access
	-harden the server with general things in mind such as
		-verified patches and updates
		-remove the unused services
		-remove unused or insecure protocols
		-dedicated accounts, remove unused accounts, enforce strong password policy
		-apply NTFS file system
		-verify shared directories
		-verify opened ports and monitor them
		-secure registry by applying windows ACL

network level security practices (router)
	-router firmware is updated
	-unused protocols are removed
	-ingress and egress filterning applied-filtering on incoming packets and outgoing packets for
	-disable unused management interface in the router
	-web facing administration is disabled on the router
	-unused services are disabled
	-all logging is enabled,centralized and secured
	-IDS is in place

network level security practices (firewall)
	-firewall and OS is patched
	-filter only allows required traffics in both direction
	-all permitted and denied traffics are logged

network level security practices (switch)
	-security pathces are tested and installed
	-VLAN should not be over used or over trusted
	-remove all the insecure defaults such as passwords, GUIS
	-disable unused services
	-switched traffics are encrypted

application level security practices
	-Web Application Firewall (WAF) is needed as traditional firewall will not be able to secure web servers
	-is a rule base filter that analyzed traffics before it reaches web application
	-firewall protecs network and os, IDS protects OS and web server, WAF proctecs web applications
	-waf should not replace application security such as authentication  and user input filtering
	-should be monitored and maintained always
	-if WAF manages the session by itself, then it can prevent session fixation and anti-automation

web contrainer(tomcat) security practices
	-install what you need only
	-configure proper passwords
	-remove server banner, check slides for configuration, will appear in exam
	-start tomcat with security manager-prevents untrusted applets to execute
	-configure default servlet not to serve index pages
	-replace default error pages
	-replace server.xml with server-minimal.xml
	-protect shutdown port by disabling the port
	-setting the port attribute to -1 make sure that only the process owner can shutdown the tomcat
	-restrict access to tomcat manager applications
	-verify maxpostsize, 0 or negative value will disable the limit

oracle database level security practices
	-enforce password policy
	-set case sensitivity if needed
	-lock the expired accounts
	-implement least privilege principle
	-user password profiles
	-disable remote administration
	-enable data dictionary protection
	-configure encryption on the client and the server
	-use VPD if needed
	-database vault-prevent attack from insiders
	-disable recycle bin
	-use audit as needed, also FGA