NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
9.2 Web Server Backup Procedures..............................................................................9-5
9.2.1 Web Server Backup Policies and Strategies ................................................9-5
9.2.2 Maintain a Test Web Server .........................................................................9-7
9.2.3 Maintain an Authoritative Copy of Organizational Web Content ..................9-8
9.3 Recovering From a Security Compromise ...............................................................9-9
9.4 Security Testing Web Servers ...............................................................................9-11
9.4.1 Vulnerability Scanning ................................................................................9-11
9.4.2 Penetration Testing ....................................................................................9-12
9.5 Remotely Administering a Web Server ..................................................................9-13
9.6 Checklist for Administering the Web Server ..........................................................9-14
Appendices
Appendix A— Online Web Server Security Resources....................................................... A-1
Appendix B— Glossary .......................................................................................................... B-1
Appendix C— Web Security Tools and Applications .......................................................... C-1
Appendix D— References ...................................................................................................... D-1
Appendix E— Web Server Security Checklist...................................................................... E-1
Appendix F— Acronym List................................................................................................... F-1
Appendix G— Index................................................................................................................G-1
List of Tables and Figures
Figure 7-1. SSL/TLS Location within the Internet Protocol Stack .............................................7-3
Table 7-1. SSL/TLS Cipher Suites............................................................................................7-7
Figure 7-2. Sample CSR...........................................................................................................7-9
Figure 7-3. Sample Encoded SSL/TLS Certificate..................................................................7-10
Figure 8-1. Simple Single-Firewall DMZ ...................................................................................8-2
Figure 8-2. Two-Firewall DMZ ..................................................................................................8-2
Figure 8-3. Service Leg DMZ....................................................................................................8-3
Figure 8-4. Outsourced Web Server Hosting............................................................................8-4
vi