Since I'm quite beginner to information and websites security, I'd like to ask more experienced people about and idea, that just crossed my mind (probably isn't my original discovery! :]).
With introduction of so many new top-level domains, would it increase my website security, if I would move "control panel" to a separate subdomain or even top-level domain? For example:
- all-users frontend: http://www.example.website,
- admins-only backend: http://www.example.management.
Users are using first link only. They may even not be aware of the fact, that the other domain exists, as it can be further secured on server side, to disallow all traffic from outsite company network. Plus you don't have access to even a piece of management tools, if you login through first domain, you have access to your account's control panel only. But, never to anything related to entire website management.
For obvious reasons, both websites would use the same database (I don't take replication as an option here -- see end of text) and both top-level domains would most likely be parked on the same server / hosting (low cost project -- see end of text), but with a complete separation of each other.
This is proposed as contrary to "standard" websites, with RBAC system implemented, where -- if admin-level user logs in, he or she gains access not only to his or her account control panel, but also to entire website management tools, system toys etc. all based on determining his or her access rights.
Would implementation of separation of frontend and backend increase website security in any noticeable or reasonable way? Or would that be just a waste of time, money and resources?
One of my colleges claims, that nowadays intruders doesn't care for something like breaking into account or control panel or gaining someone's password. Nowadays intrusions are based on DDoS attacks and physically "killing" server. If that is true, then my proposed solution brings nothing. An effective attack would put down entire server, with both frontend and backend, no matter, how many domains it uses.
BTW: We're talking about low-class website, with up to 10k-100k users, a home-grown project, that turned out to become a bit more interesting. Hosted on one server. Without multi-server hosting, without database replication, without DDoS attack mittigation etc. We're not talking about another Facebook or this class service, as in this case they most likely have much, much better solutions than multi-domain.