Adobe Coldfusion Server

The completely reimagined Adobe ColdFusion (2021 release) offers a modular, secure, and containerized approach to building applications that can run across multiple cloud providers or on-premises. You can now switch between cloud service providers without having to rewrite your application. Adobe ColdFusion Security Best Practices (Server Auto-Lockdown) September 22, 2020 By Michaela Light Leave a Comment Most security features and protocols focus on prevention.

Adobe Coldfusion Server
Adobe Coldfusion Application Server
Adobe Coldfusion Server Installation Guide

Adobe ColdFusion is a development platform that uses CFML to quickly build modern web apps. In comparison to other languages, ColdFusion is easier to learn, use, deploy and adapt. ColdFusion also has built-in functions for commonly-used tools, like database access and PDF creation, which help web apps flourish. ColdFusion has its own web server that you can use to develop ColdFusion applications, without depending on an external web server, such as Internet Information Server (IIS), Apache, or Sun Java System Web Server. Adobe does not recommend using the built-in web server in a production environment.

Most security features and protocols focus on prevention. Firewalls, security analyzers, and proper coding all keep hackers away. And sometimes, unfortunately, security breaches still occur.

What then?

Contents

A hacker roaming the contents of your company’s server should be treated like any active burglar. First, by sounding the alarms. Then preventing the robber’s movement.

That’s what ColdFusion Server Auto-Lockdown does: it stops hackers dead in their tracks even after they have gained access. Once a hack is detected, a lockdown can be implemented to keep the remaining, unhacked parts of your server safe.

And it works at the flick of a virtual switch.

In this article, you will learn:

What is Server Auto-Lockdown?
How does Server Auto-Lockdown keep your app secure?
How to get the most out of Server Auto-Lockdown.

Let’s talk about it!

What is Server Auto-Lockdown?

This feature was introduced with ColdFusion 2018. Developers and ColdFusion fanatics like myself welcomed the tool, using it so often it became essential for network security.

The server auto-lockdown feature offers several advantages:

Ease of use
Speed
Effectiveness
A quick return to normal functioning

The Auto-Lockdown automates what used to be a painstaking, 50-step process that often took so long, hackers got whatever they wanted without a problem. The process lasted hours and required nerves of steel.

While developers dutifully followed the lockdown checklist, hackers had free reign to whatever parts weren’t shut — and there were many. Hackers tend to be precise, and don’t rummage around too much. So the overall effectiveness of the lockdown was minimal.

The problem was the lockdown’s intensive checklist process. In order to become familiar, you needed to run a lockdown several times. In other words: you either had a lot of hacks, or you wasted a lot of time.

The Auto-Lockdown does what it’s name implies: it automates that 50 step process, sparing a developer the headache of running through a Cold War-style checklist. It lets users lockdown the entire server with just one click.

Besides keeping your data safe, the lockdown also has rollback support so operations can get back to normal quickly. It essentially undoes itself as quickly as it is launched.

Now with the tired old habit of performing a system-wide checklist, your team can instead spend time finding the weakness the hacker exploited.

How does Auto-Lockdown work?

You may wonder how something that removes virtually everyone’s access to your computer can be effective if the person’s already snooping around. Sometimes, being reactionary is your only option.

Auto-Lockdown’s a crafty little tool. It creates virtual ramparts, a fortress, a moat, and a blockade of soldiers around your server. How?

The lockdown, when initiated, limits access to all designated parts of the server, giving you instant ability to control who can access what. This is absolutely critical for an in-progress hack.

By controlling access, it protects your company’s data from someone with unauthorized access. Quite often, these hackers gain entry via common tools such as an SQL injection.

(Ideally, you’d have used ColdFusion’s laundry list of security tools and third-party add-ons to prevent the hack in the first place.)

By stopping a hacker cold in his or her tracks, the lockdown limits the damage they can do.

It could even be preventative if, for example, you’re concerned a recently-fired developer is feeling a bit vengeful. I’ve seen stranger things happen in my years as a ColdFusion consultant.

How to get the most out of Server Auto-Lockdown

The reactionary nature of using the Auto-Lockdown may make it seem like a tool you’ll hopefully never need. But don’t be so hopeful. Make sure you and your team are familiar with it before you ever need it.

Once you modernize to the newest version of ColdFusion 2018, put the Auto-Lockdown on your to-do list. Here’s how:

Set it up right out of the box. Make it one of the first tools you run through as soon as you install ColdFusion.
Follow Pete Frietag’s guide to Server Auto-Lockdown from the first to last page, making yourself and your team familiar with the process. These free PDF downloads walk you through the process, step-by-step, and are written by one of the preeminent ColdFusion security experts. Many developers don’t even know these guides exist — and hackers hope you never find them.
Keep the manual lockdown process handy as well. Using both at the same time will increase the odds your server stays safe. You can’t be too pedantic when it comes to security.

This may seem obvious, but preventative care is usually the best way to avoid any security hangups. Your best bet is to not find yourself in a position to need the Auto-Lockdown.

This may seem a bit obvious, but I’ve also guided a client through a lockdown while thinking “This could have been avoided.”

How?

Use proactive measures like routinely scanning for security flaws with Security Code Analyzer or HackMyCF. These tools dig up many of the same security lapses that hackers exploit. You want to find them before the hackers do.
Set limits on database access — the fewer people allowed into your server, the lower the odds of a hack. You’ll want to leave access for whoever tasked with running the lockdown. This is often one of your most dependable and least-absent developers, or yourself.
Make sure your developers write secure code. Duh. This makes your app and servers less vulnerable to hacks and SQL injections which can lead to datanapping and ransom requests, among other hacker tricks.
Use a web application firewall (WAF) as the first line of defense. (FuseGuard works well).

Most security measures are preventative. But sometimes, hackers get through. What then? It’s imperative you stop them before they wreak havoc on all your company’s data. That’s Server Auto-Lockdown’s main task: to prevent a brief hack from turning into a worst-case-scenario.

Michaela Light is the host of the CF Alive Podcast and has interviewed more than 100 ColdFusion experts. In each interview, she asks 'What Would It Take to make CF more alive this year?' The answers still inspire her to continue to write and interview new speakers.Michaela has been programming in ColdFusion for more than 20 years. She founded TeraTech in 1989. The company specializes in ColdFusion application development, security and optimization. She has also founded the CFUnited Conference and runs the annual State of the CF Union Survey.

And to continue learning how to make your ColdFusion apps more modern and alive, I encourage you to download our free ColdFusion Alive Best Practices Checklist.

Because… perhaps you are responsible for a mission-critical or revenue-generating CF application that you don’t trust 100%, where implementing new features is a painful ad-hoc process with slow turnaround even for simple requests.

What if you have no contingency plan for a sudden developer departure or a server outage? Perhaps every time a new freelancer works on your site, something breaks. Or your application availability, security, and reliability are poor.

And if you are depending on ColdFusion for your job, then you can’t afford to let your CF development methods die on the vine.

You’re making a high-stakes bet that everything is going to be OK using the same old app creation ways in that one language — forever.

All it would take is for your fellow CF developer to quit or for your CIO to decide to leave the (falsely) perceived sinking ship of CFML and you could lose everything—your project, your hard-won CF skills, and possibly even your job.

Luckily, there are a number of simple, logical steps you can take now to protect yourself from these obvious risks.