This is not a definitive list, but more a list of some things to consider. I'll go into more details on some of the suggestions below. I am probably missing some stuff and some may be enabled by default (recaptcha?).
- Magento Security Scan Tool
Audit ALL custom/third party modules
Using restrictive filesystem permissions
- IP Restrictions on SSH/SFTP
IP restrict the admin panel (Can be done on code level or server config)
Setup a WAF (Web application firewall)
Custom Admin Panel URL
Setting up admin user accounts
- Use unique secure passwords
- Restrict permissions as much as you can
- Setup 2FA
File Modification Reports
1. Magento Security Scan
2. Audit ALL custom/third party modules
Even if it is from a reputable/large company, the main concerns are XSS and SQLi exploits
Pretty self-explanatory, just tries to restrict attack origins to yours/clients office and home ips.
You can potentially make some of the files/directories immutable with chattr, which would prevent all users from modifying them without first removing the immutable flag which you need root access to do.
6. Setup a WAF
Can usually prevent XSS/SQLI exploits and block malicious connections.
PRODSECBUG-223 the SQLi issue a few months ago was patched on Sucuri's WAF shortly after being announced.
Pretty self-explanatory, an additional method to try and prevent brute force attacks
8. Custom Admin Panel URL
Again, another method to try and prevent people from brute forcing / abusing leaked credentials.
9. Setting up admin user accounts
Using unique secure passwords on admin accounts is pretty important. Or at very least use a password with a low leak count
Restrict the Admin users as much as you can, so in the case that their account gets compromised the whole backend does not.
Does the order processing staff really need access to the CMS pages/blocks where they could place malicious JS?
Does the content management staff really need access to the payment/shipping method config options?
In the case admin credentials are leaked/harvested, 2FA can prevent access to the system.
To setup 2FA, you need to install an additional module. I would recommend using the MageSpecialist module as this has been endorsed by the
Magento Community Engineering program.
For installation/setup instructions refer to the official docs here.
10. File Modification Reports
Setting up a report that runs daily/weekly that shows what files have changed, excluding things like
var/cache etc can be an effective way to spot early signs of your system being compromised