Users with a requirement for administrative access, whether IT staff or business workers, should be assigned only those privileges necessary for them to accomplish their required tasks. Operating systems have granular levels of control so that administrative tasks can be assigned to specific users, without the need to grant overall administrative access rights. Web consoles for cloud services will also often offer graduated levels of administrative access, depending on the service. Remember that in almost all cases, less is more.

There is a reason that software vendors regularly patch and update their operating systems and applications. While many patches are to solve functional problems, there are almost always security patches that need to be applied in order to maintain server security. For example, Microsoft¹ had released an emergency patch for Windows Server to plug a hole in its security.

Unpatched servers are one of the biggest sources of malware infections on the Internet, so unless you are planning to keep a server disconnected from the outside world, you need to make sure that, at the very least, security patches are applied as they appear and are tested. For cloud-based servers and applications, you may need to regularly update client software running on your end to make certain that the latest security fixes have been applied.

Keeping up to date on these changes can also create staffing issues, especially at smaller businesses where the IT department may consist of just a handful of people. One solution to this problem is to outsource these sorts of tasks to an outside vendor or partner, to allow your in-house staff to focus on mission-critical tasks.

Many applications, especially those with web-based or collaborative components, have their own security models. Because the applications themselves may have elevated security privileges based on the needs of the application, allowing unsecured access to the applications and their resources can compromise the security of the hosting servers.

Specific applications, such as web servers, will have their own security processes that need to be followed. Proper installation and management of the applications will prevent the sort of user-introduced errors that can compromise server security.