NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
• Source and destination IP addresses
• Source and destination port numbers
• Network protocol
For network events, capture packet header information to assist with the analysis and forensics
process
Update with new attack signatures frequently (e.g., on a daily to weekly basis, typically after testing
the updates).
In addition, it is critical that network-based IDPSs and their underlying OSs are hardened because
network-based IDPSs are often a target of attackers. In particular, the network-based IDPSs should not
respond to any type of system interrogation through their monitoring interfaces. If remote management is
desired, it should be conducted through an out-of-band means (e.g., separate isolated network). Although
sometimes difficult to administer and interpret, IDPSs are a critical early warning system that can provide
the Web server administrator with the necessary information to defend the Web server from attack
[<strong>NIST</strong>07].
8.2.3 Network Switches
Network switches are devices that provide connectivity between two or more hosts located on the same
network segment. They are similar to hubs in that they allow communications between hosts, but, unlike
hubs, the switches have more “intelligence” and send communications to only those hosts to which the
communications are addressed. The benefit of this from a security standpoint is that when switches are
employed on a network, it is much more difficult to eavesdrop on communications between other hosts on
the network segment. This is extremely important when a Web server is on a network segment that is
used by other hosts. For example, if a hub is used and a host on the DMZ is compromised, an attacker
may be able to eavesdrop on the communications of other hosts on the DMZ, possibly leading to the
compromise of those hosts or the information they communicate across the network. For example, e-mail
servers in their default configurations receive unencrypted passwords; a compromise of the Web server
would lead to the exposure of e-mail passwords by sniffing them from the compromised Web server.
Many switches include specific security settings that further enhance the security of the network by
making it difficult for a malicious entity to “defeat” the switch. Some examples include the ability to
minimize the risk of Address Resolution Protocol (ARP) spoofing and ARP poisoning attacks. 71 If a
switch has these security capabilities, they should be enabled (see appropriate manufacturer
documentation).
Switches can have a negative impact on network-based IDPSs (see Section 8.2.2). Most network
switches allow network administrators to configure a specific port on the switch, known as a span port, so
that it replicates all the switch’s traffic to the port used by the IDPS. This allows a network-based IDPS
to see all traffic on a particular network segment. However, under high loads, the switch might have to
stop sending traffic to the span port, causing the IDPS to be unable to monitor network activity. Also,
other devices use span ports, and there are typically very few span ports on a switch; therefore, it might
not be possible to connect an IDPS to a particular switch because its span ports are all in use.
71
ARP poisoning occurs when an attacker successfully updates the ARP cache on a target host with a forged ARP entry. This
is generally used to redirect network traffic for malicious purposes.
8-11