NIST 800-44 Version 2 Guidelines on Securing Public Web Servers
NIST 800-44 Version 2 Guidelines on Securing Public Web Servers
NIST 800-44 Version 2 Guidelines on Securing Public Web Servers
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
GUIDELINES ON SECURING PUBLIC WEB SERVERS<br />
Executive Summary<br />
The World Wide <strong>Web</strong> (WWW) is a system for exchanging informati<strong>on</strong> over the Internet. At the most<br />
basic level, the <strong>Web</strong> can be divided into two principal comp<strong>on</strong>ents: <strong>Web</strong> servers, which are applicati<strong>on</strong>s<br />
that make informati<strong>on</strong> available over the Internet (in essence, publish informati<strong>on</strong>), and <strong>Web</strong> browsers<br />
(clients), which are used to access and display the informati<strong>on</strong> stored <strong>on</strong> the <strong>Web</strong> servers. This document<br />
focuses <strong>on</strong> the security issues of <strong>Web</strong> servers. 1<br />
Unfortunately, <strong>Web</strong> servers are often the most targeted and attacked hosts <strong>on</strong> organizati<strong>on</strong>s’ networks.<br />
As a result, it is essential to secure <strong>Web</strong> servers and the network infrastructure that supports them. The<br />
following are examples of specific security threats to <strong>Web</strong> servers:<br />
Malicious entities may exploit software bugs in the <strong>Web</strong> server, underlying operating system, or<br />
active c<strong>on</strong>tent to gain unauthorized access to the <strong>Web</strong> server. Examples of this unauthorized access<br />
include gaining access to files or folders that were not meant to be publicly accessible (e.g., directory<br />
traversal attacks) and being able to execute commands and/or install software <strong>on</strong> the <strong>Web</strong> server.<br />
Denial of service (DoS) attacks may be directed to the <strong>Web</strong> server or its supporting network<br />
infrastructure, denying or hindering valid users from making use of its services.<br />
Sensitive informati<strong>on</strong> <strong>on</strong> the <strong>Web</strong> server may be read or modified without authorizati<strong>on</strong>.<br />
Sensitive informati<strong>on</strong> <strong>on</strong> backend databases that are used to support interactive elements of a <strong>Web</strong><br />
applicati<strong>on</strong> may be compromised through command injecti<strong>on</strong> attacks (e.g., Structured Query<br />
Language [SQL] injecti<strong>on</strong>, Lightweight Directory Access Protocol (LDAP) injecti<strong>on</strong>, cross-site<br />
scripting [XSS]).<br />
Sensitive informati<strong>on</strong> transmitted unencrypted between the <strong>Web</strong> server and the browser may be<br />
intercepted.<br />
Informati<strong>on</strong> <strong>on</strong> the <strong>Web</strong> server may be changed for malicious purposes. <strong>Web</strong> site defacement is a<br />
comm<strong>on</strong>ly reported example of this threat.<br />
Malicious entities may gain unauthorized access to resources elsewhere in the organizati<strong>on</strong>’s network<br />
via a successful attack <strong>on</strong> the <strong>Web</strong> server.<br />
Malicious entities may attack external entities after compromising a <strong>Web</strong> server host. These attacks<br />
can be launched directly (e.g., from the compromised host against an external server) or indirectly<br />
(e.g., placing malicious c<strong>on</strong>tent <strong>on</strong> the compromised <strong>Web</strong> server that attempts to exploit<br />
vulnerabilities in the <strong>Web</strong> browsers of users visiting the site).<br />
The server may be used as a distributi<strong>on</strong> point for attack tools, pornography, or illegally copied<br />
software.<br />
<strong>Web</strong> servers may also face indirect attacks to gain informati<strong>on</strong> from their users. In these attacks, the user<br />
is persuaded or automatically directed to visit a malicious <strong>Web</strong> site that appears to be legitimate. The<br />
identifying informati<strong>on</strong> that is harvested may be used to access the <strong>Web</strong> site itself or form the basis for<br />
1<br />
For more informati<strong>on</strong> <strong>on</strong> securing <strong>Web</strong> browsers, see <str<strong>on</strong>g>NIST</str<strong>on</strong>g> Special <strong>Public</strong>ati<strong>on</strong> <str<strong>on</strong>g>800</str<strong>on</strong>g>-46, Security for Telecommuting and<br />
Broadband Communicati<strong>on</strong>s (http://csrc.nist.gov/publicati<strong>on</strong>s/nistpubs/).<br />
ES-1