NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
9. Administering the Web Server
After initially deploying a Web server, administrators need to maintain its security continuously. This
section provides general recommendations for securely administering Web servers. Vital activities
include handling and analyzing log files, performing regular Web server backups, recovering from Web
server compromises, testing Web server security regularly, and performing remote administration
securely.
9.1 Logging
Logging is a cornerstone of a sound security posture. Capturing the correct data in the logs and then
monitoring those logs closely is vital. 72 Network and system logs are important, especially system logs in
the case of HTTPS-protected communications, where network monitoring is less effective. Web server
software can provide additional log data relevant to Web-specific events. Similarly, Web applications
may also maintain their own logs of actions.
Reviewing logs is mundane and reactive, and many Web server administrators devote their time to
performing duties that they consider more important or urgent. However, log files are often the only
record of suspicious behavior. Enabling the mechanisms to log information allows the logs to be used to
detect failed and successful intrusion attempts and to initiate alert mechanisms when further investigation
is needed. Procedures and tools need to be in place to process and analyze the log files and to review alert
notifications.
Web server logs provide—
Alerts to suspicious activities that require further investigation
Tracking of an attacker’s activities
Assistance in the recovery of the system
Assistance in post-event investigation
Required information for legal proceedings.
The selection and implementation of specific Web server software determines which set of detailed
instructions (presented below) the Web server administrator should follow to establish logging
configurations. Some of the information contained in the steps below may not be fully applicable to all
manufacturers’ Web server software products.
9.1.1 Identifying the Logging Capabilities of a Web Server
Each type of Web server software supports different logging capabilities. Depending on the Web server
software used, one or more of the following logs may be available [Alle00]:
Transfer Log—Each transfer is represented as one entry showing the main information related to the
transfer.
72
For more information on logging, see <strong>NIST</strong> SP <strong>800</strong>-92, Guide to Computer Security Log Management, which is available at
http://csrc.nist.gov/publications/nistpubs/.
9-1