NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

More documents

Recommendations

Info

GUIDELINES ON SECURING PUBLIC WEB SERVERS sources. The following are some important points to consider when contemplating the deployment of ASP.NET [Ziri02]: ASP.NET relies heavily on the host OS and Web server application for security. Client security is well integrated with Web server and host OS authentication services. ASP.NET supports Microsoft Code Access Security, which provides methods for the content developer or administrator to constrain privileges. ASP.NET is relatively immune to buffer overflows. ASP.NET is a well-documented and mature technology. Java EE is based on Java technology (see Section 6.4.1) and provides a type of server-side applet called a servlet. The Web server first determines whether the browser’s request requires dynamically generated information from a servlet, which processes the request and generates an HTTP response, a Java Server Page (JSP), or a static HTML page. If a servlet is required, the Web server can then locate or instantiate a servlet object corresponding to the request and invoke it to obtain the needed results. If a JSP is requested, Java EE compiles the JSP into a servlet, then instantiates and invokes it to obtain a response. If a static HTML page is requested, Java EE simply returns the HTML content like a traditional Web server. The Java EE server typically populates itself with the servlet objects, which remain inactive until invoked. Thus, little or no startup overhead is associated with execution of the servlet objects. A Web server may also offload the handling of servlets to another server. By relying on Java portability and observing a common API, servlet objects can run in nearly any server environment. Servlets allow developers to take advantage of an object-oriented environment on the Web server, which is flexible and extendible. Moreover, untrusted servlet objects can be executed in a secure area, with the dynamically generated information being passed from the secure area into the remaining server environment [<strong>NIST</strong>01]. Some important points to consider when contemplating the deployment of Java servlets [Ziri02]: Java EE is tightly integrated with host OS security and Web server authentication for strong security. Java EE facilitates secure programming by— • Leveraging security of Java language • Using a strong security model supporting constraints by developers and server administrators • Employing secure error handling. Java EE is a well-documented and mature technology. A large amount of robust third-party code from IBM, Sun, Apache Foundation, and other developers is available for use with Java EE. PHP is a scripting language used to create dynamic Web pages. With syntax from C, Java, and Perl, PHP code is embedded within HTML pages for server-side execution. PHP is commonly used to extract data from a database and present it on a Web page. Most major Windows and Unix Web servers support the 6-14
GUIDELINES ON SECURING PUBLIC WEB SERVERS language, and it is widely used with the mySQL database [<strong>NIST</strong>01]. The following are some important points to consider when contemplating the deployment of PHP: The latest version of PHP available should be used because older versions have numerous security vulnerabilities. PHP provides a number of options that simplify development; some of these options (e.g., the register_globals option, which converts all input parameters into PHP variables and may override values in the PHP script) can make it more difficult for novices to develop secure programs. Much of the freely available third-party code for PHP is poorly written from a security perspective. 43 6.4.3 Server-Side Content Generator Security Considerations When examining or writing an active content executable or script, consider the following: The executable code should be as simple as possible. The longer or more complex it is, the more likely it will have problems. The executable code’s ability to read and write programs should be limited. Code that reads files may inadvertently violate access restrictions or pass sensitive system information. Code that writes files may modify or damage documents or introduce Trojan horses. The code’s interaction with other programs or applications should be analyzed to identify security vulnerabilities. For example, many CGI scripts send e-mails in response to form input by opening up a connection with the sendmail program. Ensure this interaction is performed in a secure manner. On Linux/Unix hosts, the code should not run with suid (set-user-id). The code should use explicit path names when invoking external programs. Relying on the PATH environment variable to resolve partial path names is not recommended. Web servers should be scanned periodically for vulnerabilities, even if they do not employ active content (see Section 9.4.1). Network security scanners may detect vulnerabilities in the Web server, OS, or other services running on the Web server. Web application vulnerability scanners specifically scan for content generator vulnerabilities (see Appendix C for more information). Web content generation code should be scanned and/or audited (depending on the sensitivity of the Web server and its content). Commercially available tools can scan .NET or Java code. A number of commercial entities offer code review services. Web content generation code should be developed following current recommended practices. <strong>44</strong> For data entry forms, determine a list of expected characters and filter out unexpected characters from input data entered by a user before processing a form. For example, on most forms, expected data 43 <strong>44</strong> There are a number of reasons for the poor security of many PHP scripts. The most obvious is that many scripts are written without concern for security. In addition, because of the relative ease of coding PHP scripts, many novices who have little knowledge of secure programming create and often freely distribute poorly written scripts. OWASP is compiling a guide containing Web application development best practices on their site at http://www.owasp.org/index.php/OWASP_Guide_Project. 6-15
Page 1 and 2:
Special Publication 800</st
Page 3 and 4:
GUIDELINES ON SECURING PUBLIC WEB S
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15 and 16: GUIDELINES ON SECURING PUBLIC WEB S
Page 65: GUIDELINES ON SECURING PUBLIC WEB S
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
Page 141 and 142:
show all

NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

Create successful ePaper yourself

Delete template?

Save as template?