Web Server Security Requirements Guide

Version

SRG-APP-000006-WSR-000008

Vuln IDs

V-40806

Rule IDs

SV-53048r1_rule

During the operation of a web server, updates and maintenance will need to occur. The only users that may have access to the web server content and scripts are privileged users. Content and script files used by the web server may expose privileged access to data, business logic, backend databases, etc., revealing information and processes not needed by a non-privileged user and information an attacker would need to continue reconnaissance of the network environment. Privileged users are users that act in the role of system administrator, web administrator, or some other role used for web administration. In an environment where non-privileged users are capable of accessing content and scripts, the web server, to include hosted applications, could become compromised and unstable.

Checks: C-47354r1_chk

Review the web server documentation and configuration to determine where server content and scripts are located. Verify the users who can change these files are privileged users. If users other than privileged users may change server content and scripts, this is a finding.

Fix: F-45974r1_fix

Configure the web server to protect the server content and scripts from changes made by non-privileged users.

b

Web server system files must conform to minimum file permission requirements.

AC-16 - Medium - CCI-001399 - V-40807 - SV-53049r1_rule

RMF Control

AC-16

Severity

M

CCI

Version

SRG-APP-000006-WSR-000009

Vuln IDs

V-40807

Rule IDs

SV-53049r1_rule

During the operation of a web server, updates and maintenance will need to occur. The only users that may have access to the web server system files are privileged users. System files are those files needed by the web server to operate. Allowing only privileged users access to the system files alleviates the possibility of non-privileged users changing web server executables, starting and stopping of web server services, and from causing the web server from becoming unstable from improper modification of configurations. Allowing non-privileged access to the web server system files makes it more likely that an attacker can cause a Denial of Service (DoS) by stopping the web server, add more functionality to the web server to allow later access or help with a DoS, or to gain access to certificates and keys used for trust relationships. Privileged users are users that act in the role of system administrator, web administrator, or some other role used for web administration. In an environment where non-privileged users are capable of accessing content and scripts, the web server, to include hosted applications, could become compromised and unstable.

Checks: C-47355r1_chk

Review the web server documentation and configuration to determine which files are web server system files. Verify these files have the minimum permission needed for operation of the web server. If the files do not conform to minimum permissions, this is a finding.

Fix: F-45975r1_fix

Configure the web server system files with minimum privileges required for web server operation.

b

Any files used by the web server to store user identifiers and passwords must have proper ownership and permissions that only allow privileged users access.

AC-16 - Medium - CCI-001399 - V-40808 - SV-53051r1_rule

RMF Control

AC-16

Severity

M

CCI

Version

SRG-APP-000006-WSR-000010

Vuln IDs

V-40808

Rule IDs

SV-53051r1_rule

User identifiers and passwords stored by the web server are used to access hosted applications, start and stop services, and to start and stop the web server. The purpose of user identifiers and passwords is to protect data and services from users that do not have access by way of a normal access method. Allowing non-privileged users access to user identifiers and passwords enables a non-privileged user to elevate privileges not authorized by the hosting organization. Protection of files containing user identifiers and passwords must be protected through proper file permissions and ownership. Privileged users are users that act in the role of system administrator, web administrator, or some other role used for web administration.

Checks: C-47357r1_chk

Review the web server documentation and configuration to determine if any user identifiers and passwords are being stored by the web server for application authorization. If user credentials are not being stored, the finding is NA. If user credentials are being stored, verify the files have minimum privileges required for operation. If the files do not conform to minimum permissions, this is a finding.

Fix: F-45977r1_fix

Configure the web server files containing user identifiers and passwords with the minimum privileges required for web server operation.

b

Cookies exchanged between the web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating web server and hosted application.

AC-16 - Medium - CCI-001399 - V-40809 - SV-53052r1_rule

RMF Control

AC-16

Severity

M

CCI

Version

SRG-APP-000006-WSR-000011

Vuln IDs

V-40809

Rule IDs

SV-53052r1_rule

Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. When the cookie parameters are not set properly (i.e., domain and path parameters), cookies can be shared within hosted applications residing on the same web server or to applications hosted on different web servers residing on the same domain.

Checks: C-47358r1_chk

Review the web server documentation and configuration to determine if cookies between the web server and client are accessible by applications or web servers other than the originating pair. If the cookie information is accessible outside the originating pair, this is a finding.

Fix: F-45978r1_fix

Configure the web server to set properties within cookies to disallow the cookie to be accessed by other web servers and applications.

b

Cookies exchanged between the web server and client, such as session cookies, must have the expire attribute set properly.

AC-16 - Medium - CCI-001399 - V-40810 - SV-53053r1_rule

RMF Control

AC-16

Severity

M

CCI

Version

SRG-APP-000006-WSR-000012

Vuln IDs

V-40810

Rule IDs

SV-53053r1_rule

Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connection between the user and the hosted application since HTTP/HTTPS is a stateless protocol. When the cookie does not have an expire date set properly, the cookie information can be resubmitted and accepted by the web server. Unexpired session cookies allow an attacker to gain access through and already authenticated session.

Checks: C-47360r1_chk

Review the web server documentation and configuration to determine if cookies are being expired. If cookies have no expiration date, this is a finding.

Fix: F-45979r1_fix

Configure the web server to set expiration dates on cookies exchanged between the web server and the client.

a

The web server must utilize ports, protocols, and services according to the Ports, Protocols, and Services Management (PPSM) guidelines.

AC-17 - Low - CCI-001436 - V-40818 - SV-53067r1_rule

RMF Control

AC-17

Severity

L

CCI

CCI-001436

Version

SRG-APP-000020-WSR-000013

Vuln IDs

V-40818

Rule IDs

SV-53067r1_rule

Ports, protocols, and services utilized by the web server must comply with the DoD ports, protocols, and services management (PPSM) guidelines. The guidelines specify what ports, protocols, and services are acceptable to use and what protocols and services should be running on which ports. Non-compliance with the PPSM guidelines can result in a compromise of enclave boundary protections.

Checks: C-47373r1_chk

Review the web server documentation to determine if HTTP and HTTPS are used in accordance with the Internet Assigned Numbers Authority (IANA) well known ports (e.g., 80 and 443) or those ports and services as registered and approved for use by the DoD PPSM. If HTTP and HTTPS are not being used in accordance with IANA, this is a finding.

Fix: F-45993r1_fix

Ensure the website enforces the use of IANA well-known ports for HTTP and HTTPS.

b

The web server must use cryptography to protect the integrity of remote sessions.

AC-17 - Medium - CCI-001453 - V-40819 - SV-53068r1_rule

RMF Control

AC-17

Severity

M

CCI

CCI-001453

Version

SRG-APP-000015-WSR-000014

Vuln IDs

V-40819

Rule IDs

SV-53068r1_rule

Data exchanged between the user and the web server can range from static display data to credentials used to log into the hosted application. Even when data appears to be static, the non-displayed logic in a web page may expose business logic or trusted system relationships. The integrity of all the data being exchanged between the user and web server must always be trusted. To ensure this integrity and trust, encryption methods should be used to protect the complete communication session.

Checks: C-47375r1_chk

Review the web server documentation and configuration to ensure the web server is configured to use cryptography to protect the integrity of remote access sessions. If the web server is not configured to use cryptography to protect the integrity of remote access sessions, this is a finding.

Fix: F-45994r1_fix

Configure the web server to utilize encryption during remote access sessions.

a

The web server must provide automated mechanisms for user account management.

AC-2 - Low - CCI-000015 - V-40821 - SV-53071r1_rule

RMF Control

AC-2

Severity

L

CCI

CCI-000015

Version

SRG-APP-000023-WSR-000015

Vuln IDs

V-40821

Rule IDs

SV-53071r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. Examples of features are user creation, modification, and deletion to include logging of these events. The scripting of these events must also be available to aid in the quick and easy management of a large number of users. The web server must have an automated mechanism to manage user accounts. The automated mechanism can be comprised of differing technologies that, when placed together, contain an overall automated mechanism. Using automated account management techniques ensures that accounts that need attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated. By employing a user management process requiring administrators to manually address account management functions adds risk of potential oversight.

Checks: C-47377r1_chk

Review the web server documentation and configuration to see if the web server is performing user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted applications, the web server must offer an automated facility to manage user accounts. If there is no automated facility to manage user accounts, this is a finding.

Fix: F-45997r1_fix

Configure the web server to use an automated mechanism for user management.

b

The web server must provide a mechanism to automatically terminate accounts designated as temporary accounts after a defined time period.

AC-2 - Medium - CCI-000016 - V-40822 - SV-53073r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-000016

Version

SRG-APP-000024-WSR-000016

Vuln IDs

V-40822

Rule IDs

SV-53073r1_rule

Temporary application accounts are used for many purposes. A major use is in the event of a vendor support visit where a support representative requires a temporary unique account in order to perform diagnostic testing or conduct some other support related activity. These accounts become a risk when the temporary account remains active after the need for the account has ended. To address this issue, the web server must have a mechanism in place to automatically terminate accounts designated as temporary after a defined amount of time. Terminating the accounts automatically reduces the risk of the accounts being misused, hijacked, or data compromised.

Checks: C-47379r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management for the hosted application, the web server must automatically terminate accounts designated as temporary after a defined amount of time. If the web server does not automatically terminate temporary user accounts after a defined time period, this is a finding.

Fix: F-45999r1_fix

Configure the web server to automatically terminate accounts designated as temporary after a defined amount of time.

b

The web server must automatically disable accounts after a 35-day period of account inactivity.

AC-2 - Medium - CCI-000017 - V-40823 - SV-53074r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-000017

Version

SRG-APP-000025-WSR-000017

Vuln IDs

V-40823

Rule IDs

SV-53074r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. Inactive user accounts become a risk to the web server and hosted applications over time. An inactive user is incapable of realizing the user account has become altered, improperly accessed, or compromised. The web server must be capable of monitoring user accounts for organization-defined periods of inactivity and disable the accounts. Having a process to automatically disable inactive accounts reduces the risk that accounts will be misused, hijacked, or compromised.

Checks: C-47380r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must have an automated mechanism to disable accounts that are inactive for 35 days or more. If the web server does not have a facility to monitor accounts and disable them after inactivity, this is a finding.

Fix: F-46000r1_fix

Configure the web server to use an automated mechanism to disable inactive accounts after a 35-day period of inactivity.

b

The web server must automatically audit account creation.

AC-2 - Medium - CCI-000018 - V-40824 - SV-53075r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-000018

Version

SRG-APP-000026-WSR-000018

Vuln IDs

V-40824

Rule IDs

SV-53075r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. Logging of user creation events is an essential feature to assist in the tracking or alarming of possible account creation by unauthorized users. An unauthorized user may be a non-privileged user or an attacker who is trying to circumvent normal account creation processes. When the event is not logged, the creation of the user account may go unnoticed and become a persistent threat to the system.

Checks: C-47381r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must automatically log the creation of user accounts. If the web server does not automatically log account creation, this is a finding.

Fix: F-46001r1_fix

Configure the web server to automatically log the creation of user accounts.

b

The web server must monitor for unusual usage of accounts.

AC-2 - Medium - CCI-001356 - V-40827 - SV-53078r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001356

Version

SRG-APP-000030-WSR-000019

Vuln IDs

V-40827

Rule IDs

SV-53078r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. Logging account usage allows for the tracking and alarming when usage occurs at atypical times. An account that begins to be used after hours or on weekends may signal that the account has been compromised. Knowing that an account may be compromised allows for further investigation and reduces the risk of the account being continually used undetected. The data logged can also be used later for forensic purposes. While the web server is undertaking the task of user management and logging of events, the monitoring of atypical usage is not an intrinsic function of a web server. By providing a standardized formatted logged event, the atypical account usage can be discovered by an enterprise tool used by the organization to discover such events.

Checks: C-47384r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must log account usage and provide the logged events to an enterprise tool used to discover account atypical use. If the web server does not log event usage or provide logs to an enterprise tool that monitors for atypical account usage, this is a finding.

Fix: F-46004r1_fix

Configure the web server to log account usage in a standardized format and forward to an enterprise tool for atypical account usage evaluation.

b

The web server must automatically audit account modification.

AC-2 - Medium - CCI-001403 - V-40828 - SV-53079r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001403

Version

SRG-APP-000027-WSR-000020

Vuln IDs

V-40828

Rule IDs

SV-53079r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. Examples of features are user creation, modification, and deletion to include logging of these events. Account modification may arise for many valid reasons, such as to reset passwords or to modify privileges. An account that is inappropriately modified may signal that the account has been compromised to allow persistent access to the hosted application or the web server. Automatically auditing account modification is one way to help mitigate this risk and to create data for later forensic investigation.

Checks: C-47385r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must log account modification and provide the logged event. If the web server does not log account modification, this is a finding.

Fix: F-46005r1_fix

Configure the web server to automatically log the modification of user accounts.

b

The web server must automatically audit account-disabling actions and notify appropriate individuals.

AC-2 - Medium - CCI-001404 - V-40829 - SV-53080r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001404

Version

SRG-APP-000028-WSR-000021

Vuln IDs

V-40829

Rule IDs

SV-53080r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. Examples of features are user creation, modification, and deletion to include logging of these events. The disabling of an account might be a valid modification to a user account. Such an instance would be when an account has been inactive. When an account is disabled by an attacker or inadvertently by an administrator, a denial of access occurs since the user is no longer able to access the application. To limit the effects of an account being disabled inappropriately and to aid in the forensic data used for any investigation, the modification of the account must be automatically audited and the appropriate individuals must be notified.

Checks: C-47386r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must log events that disable user accounts and notify appropriate individuals. If the web server does not log an account being disabled and notify appropriate individuals, this is a finding.

Fix: F-46006r1_fix

Configure the web server to automatically log the disabling of user accounts and to notify appropriate individuals.

b

The web server must automatically audit account termination and notify appropriate individuals.

AC-2 - Medium - CCI-001405 - V-40830 - SV-53082r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001405

Version

SRG-APP-000029-WSR-000022

Vuln IDs

V-40830

Rule IDs

SV-53082r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. Examples of features are user creation, modification, and deletion to include logging of these events. The scripting of these events must also be available to aid in the quick and easy management of a large number of users. The termination of an account might be a valid modification to a user account. When an account is terminated by an attacker or inadvertently by an administrator, a denial of access occurs since the user is no longer able to access the application. To limit the effects of an account being terminated inappropriately and to aid in the forensic data used for any investigation, the termination of the account must be automatically audited and the appropriate individuals must be notified.

Checks: C-47388r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must log events that terminate user accounts and notify appropriate individuals. If the web server does not log account termination and notify appropriate individuals, this is a finding.

Fix: F-46008r1_fix

Configure the web server to automatically log the termination of user accounts and notify appropriate individuals.

b

The web server must provide a mechanism to automatically terminate accounts designated as emergency accounts after a defined time period.

AC-2 - Medium - CCI-001682 - V-40831 - SV-53083r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001682

Version

SRG-APP-000234-WSR-000023

Vuln IDs

V-40831

Rule IDs

SV-53083r1_rule

Emergency application accounts are used for many purposes. A major use is during an unforeseen operational event or in the event of a vendor support visit. These accounts become a risk when the emergency account remains active after the need for the account has ended. To address this issue, the web server must have a mechanism in place to automatically terminate accounts designated as an emergency account after a defined amount of time. Terminating the accounts automatically reduces the risk of the accounts being misused, hijacked, or data compromised.

Checks: C-47389r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management for the hosted application, the web server must automatically terminate accounts designated as emergency accounts after a defined amount of time. If the web server does not automatically terminate emergency user accounts, this is a finding.

Fix: F-46009r1_fix

Configure the web server to automatically terminate accounts designated as emergency accounts.

b

The web server must notify appropriate individuals when accounts are created.

AC-2 - Medium - CCI-001683 - V-40832 - SV-53084r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001683

Version

SRG-APP-000291-WSR-000024

Vuln IDs

V-40832

Rule IDs

SV-53084r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. An example is notifying appropriate individuals when an account is created, modified, or deleted. The creation of accounts is a normal occurrence during the task of user management. A method used quite often by an attacker after gaining initial access to a system is to create a persistent method of re-establishing their access. One way to accomplish this is for the attacker to simply create a new account. Having the web server notify appropriate individuals when an account is created reduces the risk of an account being created and used by an attacker.

Checks: C-47390r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must notify appropriate individuals when accounts are created. If the web server does not notify appropriate individuals on account creation, this is a finding.

Fix: F-46010r1_fix

Configure the web server to notify appropriate individuals on account creation.

b

The web server must notify appropriate individuals when accounts are modified.

AC-2 - Medium - CCI-001684 - V-40833 - SV-53086r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001684

Version

SRG-APP-000292-WSR-000025

Vuln IDs

V-40833

Rule IDs

SV-53086r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. An example is notifying appropriate individuals when an account is created, modified, or deleted. Modification of accounts happens routinely during the task of user management. For an attacker, after an account has been created for persistent access, the attacker will modify the account to elevate the account's privileges so that greater access to the application is achieved. Having the web server notify appropriate individuals when an account is modified reduces the risk of an account being given greater privileges by an attacker.

Checks: C-47392r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must notify appropriate individuals when accounts are modified. If the web server does not notify appropriate individuals on account modification, this is a finding.

Fix: F-46012r1_fix

Configure the web server to notify appropriate individuals on account modification.

b

The web server must notify appropriate individuals when account-disabling actions are taken.

AC-2 - Medium - CCI-001685 - V-40834 - SV-53087r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001685

Version

SRG-APP-000293-WSR-000026

Vuln IDs

V-40834

Rule IDs

SV-53087r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. An example is notifying appropriate individuals when an account is created, modified, or deleted. The disabling of an account might be a valid modification to a user account. Such an instance would be when an account has been inactive. When an account is disabled by an attacker or inadvertently by an administrator, a denial of access occurs since the user is no longer able to access the application. To limit the effects of an account being disabled inappropriately, appropriate individuals must be notified.

Checks: C-47393r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must notify appropriate individuals when a user account is disabled. If the web server does not notify appropriate individuals when a user account is disabled, this is a finding.

Fix: F-46013r1_fix

Configure the web server to automatically notify appropriate individuals when user accounts are disabled.

b

The web server must notify appropriate individuals when accounts are terminated.

AC-2 - Medium - CCI-001686 - V-40835 - SV-53088r1_rule

RMF Control

AC-2

Severity

M

CCI

CCI-001686

Version

SRG-APP-000294-WSR-000027

Vuln IDs

V-40835

Rule IDs

SV-53088r1_rule

Applications hosted by the web server may have users that need to be authenticated. User authentication can take place by calls to a backend that manages users or user authentication can be done by the web server. When done by the web server, other user management functionality must be available. An example is notifying appropriate individuals when an account is created, modified, or deleted. The termination of an account might be a valid modification to a user account. When an account is terminated by an attacker or inadvertently by an administrator, a denial of access occurs since the user is no longer able to access the application. To limit the effects of an account being terminated inappropriately, appropriate individuals must be notified.

Checks: C-47394r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted application, the web server must notify appropriate individuals when a user account is terminated. If the web server does not notify appropriate individuals when a user account is terminated, this is a finding.

Fix: F-46014r1_fix

Configure the web server to automatically notify appropriate individuals on the termination of user accounts.

a

A separation of duties for individuals involved in the management of the web server must be documented and implemented.

AC-5 - Low - CCI-000037 - V-40873 - SV-53205r1_rule

RMF Control

AC-5

Severity

L

CCI

CCI-000037

Version

SRG-APP-000062-WSR-000028

Vuln IDs

V-40873

Rule IDs

SV-53205r1_rule

The web server must support the separation of duties for individuals involved in web server management. Separating duties e.g., administrators, auditors, web authors, allows for better auditing and tracking of changes made to the web server and hosted applications. Files associated with the operation of the web server and applications can also be segregated to only allow access to the files by individuals that need access to accomplish their duties. Having the individuals documented, along with the roles each individual is assigned, enables the quick recovery of the system and accounts if the system needed to be recovered or recreated.

Checks: C-47511r1_chk

Review the web server documentation and the deployed configuration to determine the accounts used to accomplish administrative and operational duties for the web server. Verify the accounts are separated by the different roles that are needed to accomplish the administrative and operational tasks. Also, verify the accounts and roles are documented. If separate accounts are not used to perform administrative and operational tasks for the web server and the accounts and roles are not documented, this is a finding.

Fix: F-46131r1_fix

Set up and document accounts and roles that are used to perform defined administrative and operational tasks.

b

Non-privileged accounts on the hosting system must only access web server security-relevant information through a distinct administrative account.

AC-6 - Medium - CCI-000040 - V-40874 - SV-53206r1_rule

RMF Control

AC-6

Severity

M

CCI

CCI-000040

Version

SRG-APP-000063-WSR-000029

Vuln IDs

V-40874

Rule IDs

SV-53206r1_rule

By separating web server security functions from non-privileged users, roles can be developed that can then be used to administer the web server. Forcing users to change from a non-privileged account to a privileged account when operating on the web server or on security-relevant information, forces users to only operate as a web server administrator when necessary. Operating in this manor allows for better auditing of changes, better forensic information, and limits accidental changes to the web server.

Checks: C-47512r1_chk

Review the web server documentation and configuration to determine if accounts used for administrative duties of the web server are separated from non-privileged accounts. If non-privileged accounts can access web server security-relevant information, this is a finding.

Fix: F-46132r1_fix

Set up accounts and roles that can only be used to perform web server security-relevant tasks.

c

Accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

AC-6 - High - CCI-000040 - V-40876 - SV-53208r1_rule

RMF Control

AC-6

Severity

H

CCI

CCI-000040

Version

SRG-APP-000063-WSR-000030

Vuln IDs

V-40876

Rule IDs

SV-53208r1_rule

As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. The resources to which these accounts have access must also be closely monitored and controlled. Only the system administrator needs access to all the system's capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files.

Checks: C-47514r1_chk

Review the web server documentation and configuration to determine what accounts are available on the server hosting the web server. If accounts are available with access to functions, directories, or files not needed for the role of the account, this is a finding.

Fix: F-46134r1_fix

Limit the functions, directories, and files that are accessible by each account and role.

c

Anonymous accounts to the web server application directories must be prohibited.

AC-6 - High - CCI-000040 - V-40877 - SV-53209r1_rule

RMF Control

AC-6

Severity

H

CCI

CCI-000040

Version

SRG-APP-000063-WSR-000031

Vuln IDs

V-40877

Rule IDs

SV-53209r1_rule

In order to properly monitor the changes to the web server and the hosted applications, auditing must be enabled. Along with auditing being enabled, each record must properly contain the changes made and by whom. Allowing anonymous users the capability to change the web server or the hosted application will not generate proper audit information that can then be used for forensic reporting in the case of a security issue. Allowing anonymous users to make changes will also grant change capabilities to anybody without forcing a user to authenticate before the changes can be made.

Checks: C-47515r1_chk

Review the web server documentation and configuration to determine if anonymous users can make changes to the web server or any applications hosted by the web server. If anonymous users can make changes, this is a finding.

Fix: F-46135r1_fix

Configure the web server to not allow anonymous users to change the web server or any hosted applications.

b

The web server must limit the number of failed login attempts within a defined time period.

AC-7 - Medium - CCI-000044 - V-41588 - SV-54165r1_rule

RMF Control

AC-7

Severity

M

CCI

CCI-000044

Version

SRG-APP-000065-WSR-000038

Vuln IDs

V-41588

Rule IDs

SV-54165r1_rule

Anytime an authentication method is exposed allowing login to an application, there is a risk that attempts will be made to obtain unauthorized access. By limiting the number of failed login attempts that occur within a particular time period, the risk of unauthorized system access by means of user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account once the number of failed attempts has been exceeded.

Checks: C-48017r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management for the hosted application, the web server must limit the number of failed login attempts during a specified time period by locking or disabling the account. If the web server does not limit the number of failed logins during a defined time period, this is a finding.

Fix: F-47047r1_fix

Configure the web server to limit the number of failed logins during a specified time period.

b

The web server must lock an account after a specified number of failed logins.

AC-7 - Medium - CCI-000047 - V-41589 - SV-54166r1_rule

RMF Control

AC-7

Severity

M

CCI

CCI-000047

Version

SRG-APP-000067-WSR-000039

Vuln IDs

V-41589

Rule IDs

SV-54166r1_rule

Anytime an authentication method is exposed allowing login to an application, there is a risk that attempts will be made to obtain unauthorized access. To defeat these attempts, organizations define the number of times a user account may consecutively fail a login attempt. The organization also defines the period of time in which these consecutive failed attempts may occur. By limiting the number of failed login attempts that occur within a particular time period, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account once the number of failed attempts has been exceeded.

Checks: C-48018r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management for the hosted application, the web server must lock or disable an account after a specified number of failed logins. If the web server does not lock or disable an account after a specified number of failed logins, this is a finding.

Fix: F-47048r1_fix

Configure the web server to lock an account after a specified number of failed logins.

b

The web server must enforce a defined time period during which the number of consecutive invalid access attempts by a user is counted.

AC-7 - Medium - CCI-001452 - V-41590 - SV-54167r1_rule

RMF Control

AC-7

Severity

M

CCI

CCI-001452

Version

SRG-APP-000066-WSR-000040

Vuln IDs

V-41590

Rule IDs

SV-54167r1_rule

Anytime an authentication method is exposed allowing login to an application, there is a risk that attempts will be made to obtain unauthorized access. To aid in defeating these attempts, organizations define the number of times that a user account may consecutively fail a login attempt. The organization also defines the period of time in which these consecutive failed attempts may occur. By limiting the number of failed login attempts, the risk of unauthorized system access via automated user password guessing, otherwise known as brute forcing, is reduced. Best practice requires a time period be applied in which the number of failed attempts are counted (Example: 5 failed attempts within 5 minutes). Limits are imposed by locking the account.

Checks: C-48019r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management for the hosted application, the web server must enforce a time period during which the number of consecutive invalid access attempts are counted. If the web server does not allow definition of a time period during which the number of consecutive invalid access attempts are counted, this is a finding.

Fix: F-47049r1_fix

Configure the web server to only count failed consecutive access attempts during a defined time period.

a

The web server must record the date and time of the last successful logon for each user.

AC-9 - Low - CCI-000052 - V-41594 - SV-54171r1_rule

RMF Control

AC-9

Severity

L

CCI

CCI-000052

Version

SRG-APP-000075-WSR-000041

Vuln IDs

V-41594

Rule IDs

SV-54171r1_rule

Users need to be aware of activity that occurs regarding their application account. Providing users with information regarding the date and time of their last successful login allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators. The web server, when performing user management functionality, must store the last successful logon date and time, providing the information to any hosted application for display.

Checks: C-48023r1_chk

Review the web server documentation and configuration to determine if the web server is also performing hosted application user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management for the hosted application, the web server must record each user's date and time of the last successful logon. If the last successful logon is not recorded, this is a finding.

Fix: F-47053r1_fix

Configure the web server to record the last successful logon date and time for each user.

a

Web server configurations, certificates, system files, and any other files deemed important must be protected against an individual falsely denying having performed a particular action.

AU-10 - Low - CCI-000166 - V-41599 - SV-54176r1_rule

RMF Control

AU-10

Severity

L

CCI

CCI-000166

Version

SRG-APP-000080-WSR-000046

Vuln IDs

V-41599

Rule IDs

SV-54176r1_rule

Changes to the web server software or components can change how the web server and hosted applications function. A minor change to the configuration of the web server can quickly cause a denial of service (DoS) for all users or open a major security flaw. Being able to trace these changes to the user who made the change and potentially rollback to a stable environment can be a major risk analysis factor. Non-repudiation is the concept of ensuring that an individual cannot repudiate, or refute, the validity of an action. By enforcing non-repudiation type measures, actions taken by administrators of the web server can be tracked and traced to individuals. Measures, such as user accounts, roles, signing of files, version control software, auditing, and logging are just a few measures that can be deployed to force accountability of user actions.

Checks: C-48028r1_chk

Review the web server documentation and configuration to determine if the web server forces the signing of documents, such as configurations, certificates, and hosted application files before the changes are implemented. If the web server cannot enforce the signing of files, determine if some other external tool is used to force the signing of files before becoming part of the production web server. If changes can be made without signing the files, this is a finding.

Fix: F-47058r1_fix

Configure the web server to enforce signing of changes before the changes become part of the running web server configuration.

b

The web server must be configurable to generate audit records for defined events.

AU-12 - Medium - CCI-000169 - V-41600 - SV-54177r1_rule

RMF Control

AU-12

Severity

M

CCI

CCI-000169

Version

SRG-APP-000089-WSR-000047

Vuln IDs

V-41600

Rule IDs

SV-54177r1_rule

Audit records can be generated from various components within the web server (e.g., httpd, plugins to external backends, etc.). From a web server perspective, certain specific web server functionalities may need to be audited as well. During normal operation, the amount of audit data may be less than that needed during an investigation or when debugging an issue. Limiting the amount of data can be done by changing the amount of data per event or not generating an event for every action. To limit or expand the amount of audit data, the web server must be capable of setting a log level to control what type of information and the degree to which the web server logs data.

Checks: C-48029r1_chk

Review the web server documentation and deployed web server configuration to determine if the system generates audit records for definable events. Perform functionality testing and examine log data to ensure defined events are logged. If the system cannot perform this function, this is a finding.

Fix: F-47059r2_fix

Configure the web server to audit at the defined event level.

b

The web server must generate audit records for the DoD-selected list of auditable events.

AU-12 - Medium - CCI-000172 - V-41602 - SV-54179r1_rule

RMF Control

AU-12

Severity

M

CCI

CCI-000172

Version

SRG-APP-000091-WSR-000048

Vuln IDs

V-41602

Rule IDs

SV-54179r1_rule

Audit records can be generated from various components within the web server (e.g., httpd, plugins to external backends, etc.). From a web server perspective, certain specific web server functionalities may be audited as well. The web server must allow the definition of what events are to be audited. As conditions change, the number and types of events to be audited may change and the web server must be able to facilitate these changes. The DoD selected list of events is typically a subset of the list of all events for which the system is capable of generating audit records (e.g., auditable events, timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked). The events selected for auditing are selected due to their assistance in intrusion detection and forensic analysis. Failure to capture these events increases the likelihood that an adversary could breach the system without detection.

Checks: C-48031r1_chk

Review the web server documentation and the deployed system configuration to determine if the DoD-required auditable events are recorded. Required events include system startup and shutdown, successful and unsuccessful application deployment attempts, program execution, and integrity validation failures. Verify a reasonable subset of these events is captured in practice by examining the audit logs. If the audit logs do not include DoD-required auditable events, this is a finding.

Fix: F-47061r1_fix

Configure the web server to generate audit records for the DoD-required auditable events.

b

The web server must generate audit records from all components, extensions, or plug-ins being utilized by the web server into an audit trail that is time-correlated to within a defined level of tolerance.

AU-12 - Medium - CCI-000174 - V-41603 - SV-54180r1_rule

RMF Control

AU-12

Severity

M

CCI

CCI-000174

Version

SRG-APP-000086-WSR-000049

Vuln IDs

V-41603

Rule IDs

SV-54180r1_rule

Audit generation and audit records can be generated from various components within the web server. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records (e.g., auditable events, timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked). The events occurring must be time-correlated in order to conduct accurate forensic analysis. In addition, the correlation must meet a certain tolerance criteria. For instance, DoD may define that the timestamps of different audited events must not differ by any amount greater than ten seconds. It is also acceptable for the web server to utilize an external auditing tool that provides this capability.

Checks: C-48032r1_chk

Review the web server audit feature configuration to determine if the web server can compile audit records from multiple components within the server into a system-wide (logical or physical) audit trail that is time-correlated to within an organization-defined level of tolerance. If the web server does not meet this requirement, or cannot be configured to utilize an external tool that provides this capability, this is a finding.

Fix: F-47062r1_fix

Configure the web server to compile audit records from multiple components within the server into a system-wide (logical or physical) audit trail that is time correlated or configure the web server to utilize an external auditing tool designed to meet this requirement.

b

The web server must capture, record, and log all content related to a user session.

AU-14 - Medium - CCI-001462 - V-41609 - SV-54186r1_rule

RMF Control

AU-14

Severity

M

CCI

CCI-001462

Version

SRG-APP-000093-WSR-000053

Vuln IDs

V-41609

Rule IDs

SV-54186r1_rule

A user session to a web server is in the context of a user accessing a hosted application that extends to any plugins/modules and services that may execute on behalf of the user. The web server must be capable of enabling a setting for troubleshooting, debugging, or forensic gathering purposes which will log all user session information related to the hosted application session.

Checks: C-48038r1_chk

Review the web server documentation and deployed configuration to determine if the web server captures and logs all content related to a user session. Request a user access the hosted applications and verify the complete session is logged. If any of the session is excluded from the log, this is a finding.

Fix: F-47068r1_fix

Configure the web server to capture and log all content related to a user session.

a

The web server must provide the capability to remotely view all content related to an established user session in real time.

AU-14 - Low - CCI-001463 - V-41610 - SV-54187r1_rule

RMF Control

AU-14

Severity

L

CCI

CCI-001463

Version

SRG-APP-000094-WSR-000054

Vuln IDs

V-41610

Rule IDs

SV-54187r1_rule

While a great deal of effort is made to secure applications to prevent unauthorized access, in certain instances there can be valid requirements to view all content related to a particular user's application session in real time as it occurs. These instances are reserved for monitoring or investigative purposes supported through policy and are officially sanctioned. Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. The web server must support valid monitoring requirement capabilities performed in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. This includes the capability to remotely view all content related to an established user session in real time.

Checks: C-48039r1_chk

Review the web server documentation and deployed configuration to determine if the web server provides a capability to remotely view all content related to an established user session in real time. If the web server does not offer this capability, review the configuration along with the domain topology to determine if an external device is in place to offer this capability. If there is no capability to remotely view all content related to a user's session, this is a finding.

Fix: F-47069r1_fix

Configure the web server to allow the viewing of an established user session in real time. If the web server does not offer this capability, install and configure an external device that will provide the capability to view established user session data in real time.

b

The web server must produce audit records containing sufficient information to establish what type of events occurred.

AU-3 - Medium - CCI-000130 - V-41612 - SV-54189r1_rule

RMF Control

AU-3

Severity

M

CCI

CCI-000130

Version

SRG-APP-000095-WSR-000056

Vuln IDs

V-41612

Rule IDs

SV-54189r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the correct type of event that occurred is important during forensic analysis. The correct determination of the event and when it occurred is important in relation to other events that happened at that same time. Without sufficient information establishing what type of audit event occurred, investigation into the cause of event is severely hindered. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, timestamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, file names involved, access control, or flow control rules invoked.

Checks: C-48041r1_chk

Review the web server documentation and deployed configuration to determine if the web server contains sufficient information to establish what type of event occurred. Request a user access the hosted applications and verify sufficient information is recorded. If sufficient information is not logged, this is a finding.

Fix: F-47071r1_fix

Configure the web server to record more information with each event so that the type of event can be determined.

b

The web server must produce audit records containing sufficient information to establish when (date and time) events occurred.

AU-3 - Medium - CCI-000131 - V-41613 - SV-54190r1_rule

RMF Control

AU-3

Severity

M

CCI

CCI-000131

Version

SRG-APP-000096-WSR-000057

Vuln IDs

V-41613

Rule IDs

SV-54190r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the correct order of the events that occurred is important during forensic analysis. Events that appear harmless by themselves might be flagged as a potential threat when properly viewed in sequence. By also establishing the event date and time, an event can be properly viewed with an enterprise tool to fully see a possible threat in its entirety. Without sufficient information establishing when the audit event occurred, investigation into the cause of event is severely hindered. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, timestamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, file names involved, access control, or flow control rules invoked.

Checks: C-48042r1_chk

Review the web server documentation and deployment configuration to determine if the web server is configured to generate a date and time for each audited event. Request a user access the hosted application and generate auditable events and then review the audit logs to determine if the date and time are included in the log event data. If the date and time are not included, this is a finding.

Fix: F-47072r1_fix

Configure the web server to log date and time with the event.

b

The web server must produce audit records containing sufficient information to establish where within the web server the events occurred.

AU-3 - Medium - CCI-000132 - V-41614 - SV-54191r1_rule

RMF Control

AU-3

Severity

M

CCI

CCI-000132

Version

SRG-APP-000097-WSR-000058

Vuln IDs

V-41614

Rule IDs

SV-54191r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the correct location within the web server the events occurred is important during forensic analysis. By correctly determining the web service, plugin, or module will add information to the overall reconstruction of the audited event. For example, an event that occurred during communication to a cgi module might be handled differently than an event that occurred during a communication session to a user. Without sufficient information establishing where the audit event occurred within the web server, investigation into the cause of event is severely hindered. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, timestamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, file names involved, access control, or flow control rules invoked.

Checks: C-48043r1_chk

Review the web server documentation and deployment configuration to determine if the web server is configured to generate sufficient information to resolve where within the web server the audit event occurred. Request a user access the hosted application and generate auditable events and then review the audit logs to determine if the location within the web server of the event can be established. If it cannot be determined where the event occurred, this is a finding.

Fix: F-47073r1_fix

Configure the web server to generate enough information to determine where within the web server the log event occurred.

b

The web server must produce audit records containing sufficient information to establish the sources of events.

AU-3 - Medium - CCI-000133 - V-41615 - SV-54192r1_rule

RMF Control

AU-3

Severity

M

CCI

CCI-000133

Version

SRG-APP-000098-WSR-000059

Vuln IDs

V-41615

Rule IDs

SV-54192r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the correct source of the events is important during forensic analysis. By correctly determining the source will add information to the overall reconstruction of the auditable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise. Without sufficient information establishing the source of the audited event, investigation into the cause of event is severely hindered. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, timestamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, file names involved, access control, or flow control rules invoked.

Checks: C-48044r1_chk

Review the web server documentation and deployment configuration to determine if the web server is configured to generate sufficient information to resolve the source of the audit event. Request a user access the hosted application and generate auditable events and then review the audit logs to determine if the source of the event can be established. If the source of the event cannot be determined, this is a finding.

Fix: F-47074r1_fix

Configure the web server to generate the source of each auditable event.

b

A web server, behind a load balancer or proxy server, must produce audit records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.

AU-3 - Medium - CCI-000133 - V-41616 - SV-54193r1_rule

RMF Control

AU-3

Severity

M

CCI

CCI-000133

Version

SRG-APP-000098-WSR-000060

Vuln IDs

V-41616

Rule IDs

SV-54193r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the correct source of the events is important during forensic analysis. By correctly determining the source of events will add information to the overall reconstruction of the auditable event. By determining the source of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the source occurred in other areas within the enterprise. A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every auditable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each auditable event the client source of the event.

Checks: C-48045r1_chk

Review the deployment configuration to determine if the web server is sitting behind a proxy server. If the web server is not sitting behind a proxy server, this finding is NA. If the web server is behind a proxy server, review the documentation and deployment configuration to determine if the web server is configured to generate sufficient information to resolve the source of the audit event and not the proxy server. Request a user access the hosted application through the proxy server and generate auditable events and then review the audit logs to determine if the source of the event can be established. If the source of the event cannot be determined, this is a finding.

Fix: F-47075r1_fix

Configure the web server to generate the client source, not the load balancer or proxy server, of each auditable event.

b

The web server must produce audit records that contain sufficient information to establish the outcome (success or failure) of events.

AU-3 - Medium - CCI-000134 - V-41617 - SV-54194r1_rule

RMF Control

AU-3

Severity

M

CCI

CCI-000134

Version

SRG-APP-000099-WSR-000061

Vuln IDs

V-41617

Rule IDs

SV-54194r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Ascertaining the success or failure of an event is important during forensic analysis. By correctly determining the outcome will add information to the overall reconstruction of the auditable event. By determining the success or failure of the event correctly, analysis of the enterprise can be undertaken to determine if events tied to the event occurred in other areas within the enterprise. Without sufficient information establishing the success or failure of the audited event, investigation into the cause of event is severely hindered. The success and failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, timestamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, file names involved, access control, or flow control rules invoked.

Checks: C-48046r1_chk

Review the web server documentation and deployment configuration to determine if the web server is configured to generate the outcome of the audit event. Request a user access the hosted application and generate auditable events and then review the audit logs to determine if the outcome of the event can be established. If the outcome of the event cannot be determined, this is a finding.

Fix: F-47076r1_fix

Configure the web server to generate the outcome, success or failure, as part of each auditable event.

a

The web server must include DoD-defined additional, detailed information in the audit records for audit events identified by type, location, or subject.

AU-3 - Low - CCI-000135 - V-41618 - SV-54195r1_rule

RMF Control

AU-3

Severity

L

CCI

CCI-000135

Version

SRG-APP-000101-WSR-000062

Vuln IDs

V-41618

Rule IDs

SV-54195r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. In some instances, DoD may require customized application-related events to be logged or more detailed information in each audit record. The web server must be capable to handle the customization of the audit events to handle these instances.

Checks: C-48047r1_chk

Review the web server documentation and deployment configuration to determine if the web server is configured to generate DoD-defined additional information for each auditable event. Request a user access the hosted application and generate auditable events and then review the audit logs to determine if the additional information is generated. If the DoD-defined additional information is not present, this is a finding.

Fix: F-47077r1_fix

Configure the web server to generate the additional DoD-defined information for each auditable event.

a

The web server must not impede the ability to write specified audit record content to an audit log server.

AU-3 - Low - CCI-000136 - V-41619 - SV-54196r1_rule

RMF Control

AU-3

Severity

L

CCI

CCI-000136

Version

SRG-APP-000102-WSR-000063

Vuln IDs

V-41619

Rule IDs

SV-54196r1_rule

Writing events to a centralized management audit system offers many benefits to the enterprise over having dispersed audit logs. Centralized management of audit records and logs provides for efficiency in maintenance and management of records, enterprise analysis of events, and backup and archiving of event records enterprise wide. The web server and related components are required to be capable of writing logs to centralized audit log servers.

Checks: C-48048r1_chk

Review the web server documentation and deployment configuration to determine if the web server can write audit data to, or if audit data can be transferred to, a separate audit server. Request a user access the hosted application and generate auditable events and verify the audit data is written to a separate audit server. If audit logs cannot be directly written or transferred on request or on a periodic schedule to an audit log server, this is a finding.

Fix: F-47078r1_fix

Configure the web server to directly write or transfer the audit logs to a remote audit log server.

b

The web server must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with an event.

AU-3 - Medium - CCI-001487 - V-41620 - SV-54197r1_rule

RMF Control

AU-3

Severity

M

CCI

CCI-001487

Version

SRG-APP-000100-WSR-000064

Vuln IDs

V-41620

Rule IDs

SV-54197r1_rule

Web server auditing capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of the events cannot be determined. Determining user accounts, processes running on behalf of the user, and running process identifiers also enable a better understanding of the overall event. User tool identification is also helpful to determine if events are related to overall user access or specific client tools. Audit record content that may be necessary to satisfy the requirement of this control, includes: timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.

Checks: C-48049r1_chk

Review the web server documentation and deployment configuration to determine if the web server can generate audit data containing the user/subject identity. Request a user access the hosted application and generate auditable events and verify the events contain the user/subject or process identity. If the identity is not part of the audit record, this is a finding.

Fix: F-47079r1_fix

Configure the web server to include the user/subject identity as part of each audit record.

b

The web server must use a logging mechanism that is configured to provide a warning when allocated audit record storage volume reaches a defined percentage of maximum audit record storage capacity.

AU-5 - Medium - CCI-000143 - V-41625 - SV-54202r1_rule

RMF Control

AU-5

Severity

M

CCI

CCI-000143

Version

SRG-APP-000103-WSR-000065

Vuln IDs

V-41625

Rule IDs

SV-54202r1_rule

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Audit processing failures include: software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded. If audit log capacity were to be exceeded then events subsequently occurring will not be recorded. Organizations shall define a maximum allowable percentage of storage capacity serving as an alarming threshold (e.g., application has exceeded 80% of log storage capacity allocated) at which time the application or the logging mechanism the application utilizes will provide a warning to the appropriate personnel. This requirement can be met by configuring the web server to utilize a dedicated audit tool that meets this requirement.

Checks: C-48054r1_chk

Review the web server documentation and deployment configuration settings to determine if the web server audit system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity. If designated alerts are not sent or the web server is not configured to use a dedicated audit tool that meets this requirement, this is a finding.

Fix: F-47084r1_fix

Configure the web server to provide a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.

b

The web server must use a logging mechanism that is configured to provide a real-time alert when organization-defined audit failure events occur.

AU-5 - Medium - CCI-000144 - V-41626 - SV-54203r1_rule

RMF Control

AU-5

Severity

M

CCI

CCI-000144

Version

SRG-APP-000104-WSR-000166

Vuln IDs

V-41626

Rule IDs

SV-54203r1_rule

Reviewing audit data allows an investigator to recreate the path of an attacker and to capture forensic data for later use. Audit data is also essential to system administrators in their daily administrative duties on the hosted system or within the hosted applications. If the audit system begins to fail, audit events will not be recorded. Organizations shall define audit failure events, at which time the application or the logging mechanism the application utilizes will provide a warning to the appropriate personnel.

Checks: C-48055r1_chk

Review the web server documentation and deployment configuration settings to determine if the web server audit system provides a real-time alert when organization-defined audit failures occur. If designated alerts are not sent or the web server is not configured to use a dedicated audit tool that meets this requirement, this is a finding.

Fix: F-47085r1_fix

Configure the web server to provide a real-time alert when organization-defined audit failures occur.

b

The web server must use the internal system clock to generate timestamps for audit records.

AU-8 - Medium - CCI-000159 - V-41668 - SV-54245r1_rule

RMF Control

AU-8

Severity

M

CCI

CCI-000159

Version

SRG-APP-000116-WSR-000066

Vuln IDs

V-41668

Rule IDs

SV-54245r1_rule

Without the use of an approved and synchronized time source, configured on the system, events cannot be accurately correlated and analyzed to determine what is transpiring within the web server. If an event has been triggered on the network, and the web server is not configured with the correct date and time, the event may be seen as insignificant, when in reality the events are related and may have a larger impact across the network. Synchronization of system clocks is needed in order to correctly correlate the timing of events that occur across multiple systems. Determining the correct time a particular event occurred on a system, via timestamps, is critical when conducting forensic analysis and investigating system events. Timestamps generated by the web server shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.

Checks: C-48065r1_chk

Review the web server documentation and deployment configuration to determine if the internal system clock is used for date and timestamps. If this is not feasible, an alternative workaround is to take an action that generates an entry in the audit log and then immediately query the operating system for the current time. A reasonable match between the two times will suffice as evidence that the system is using the internal clock for date and timestamps. If the web server does not use the internal system clock to generate timestamps, this is a finding.

Fix: F-47127r1_fix

Configure the web server to use internal system clocks to generate date and timestamps for audit records.

b

The web server must synchronize with internal information system clocks which, in turn, are synchronized on a DoD frequency with a DoD authoritative time source.

AU-8 - Medium - CCI-000160 - V-41669 - SV-54246r1_rule

RMF Control

AU-8

Severity

M

CCI

CCI-000160

Version

SRG-APP-000117-WSR-000067

Vuln IDs

V-41669

Rule IDs

SV-54246r1_rule

Determining the correct time a particular web server event occurred is critical when conducting forensic analysis and investigating system events. To investigate events domain wide, synchronization of system clocks is needed. To meet the requirement, an organization will define a time source as authoritative and a frequency to which each system will synchronize its internal clock will be set. The web server must defer accurate timekeeping services to the operating system upon which the web server is installed. An example is utilizing the NTP protocol to synchronize with centralized NTP servers. Timestamps generated by the information system shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.

Checks: C-48066r1_chk

Review the web server documentation and deployment configuration to determine if the web server defers to the operating system for accurate timekeeping. If the web server provides its own timekeeping service, this is a finding.

Fix: F-47128r1_fix

Configure the web server to utilize the timekeeping services of the host OS.

b

Web server log files must only be accessible by privileged users.

AU-9 - Medium - CCI-000162 - V-41670 - SV-54247r1_rule

RMF Control

AU-9

Severity

M

CCI

CCI-000162

Version

SRG-APP-000118-WSR-000068

Vuln IDs

V-41670

Rule IDs

SV-54247r1_rule

Audit data is essential in the investigation of events. If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult if not impossible to achieve. In addition, access to audit records provides information an attacker could potentially use to their advantage with each event record potentially containing communication ports, protocols, services, trust relationships, user names, etc. The web server must protect the audit data from unauthorized read, write, copy, etc. This can be done by the web server if the web server is also doing the auditing function. The web server may also use an external audit system. In either case, the audit logs must be protected from access by non-privileged users.

Checks: C-48067r1_chk

Review the web server documentation and deployed configuration settings to determine if the web server audit features protect audit information from unauthorized access. Review file system settings to verify the log files have secure file permissions. If the web server log files are not protected from unauthorized access, this is a finding.

Fix: F-47129r1_fix

Configure the web server log files so unauthorized access of audit information is not possible.

b

The audit information from the web server must be protected from unauthorized modification.

AU-9 - Medium - CCI-000163 - V-41671 - SV-54248r1_rule

RMF Control

AU-9

Severity

M

CCI

CCI-000163

Version

SRG-APP-000119-WSR-000069

Vuln IDs

V-41671

Rule IDs

SV-54248r1_rule

Audit data is essential in the investigation of events. The accuracy of the information is always pertinent. Information that is not accurate does not help in the revealing of potential security risks and may hinder the early discovery of a system compromise. One of the first steps an attacker will undertake is the modification or deletion of audit records to cover his tracks and prolong discovery. The web server must protect the audit data from unauthorized modification. This can be done by the web server if the web server is also doing the auditing function. The web server may also use an external audit system. In either case, the audit logs must be protected from modification by non-privileged users.

Checks: C-48068r1_chk

Review the web server documentation and deployed configuration settings to determine if the web server audit features protect audit information from unauthorized modification. Review file system settings to verify the log files have secure file permissions. If the web server log files are not protected from unauthorized modification, this is a finding.

Fix: F-47130r1_fix

Configure the web server log files so unauthorized modification of audit information is not possible.

b

The audit information from the web server must be protected from unauthorized deletion.

AU-9 - Medium - CCI-000164 - V-41672 - SV-54249r1_rule

RMF Control

AU-9

Severity

M

CCI

CCI-000164

Version

SRG-APP-000120-WSR-000070

Vuln IDs

V-41672

Rule IDs

SV-54249r1_rule

Audit data is essential in the investigation of events. The accuracy of the information is always pertinent. Information that is not accurate does not help in the revealing of potential security risks and may hinder the early discovery of a system compromise. One of the first steps an attacker will undertake is the modification or deletion of audit records to cover his tracks and prolong discovery. The web server must protect the audit data from unauthorized deletion. This can be done by the web server if the web server is also doing the auditing function. The web server may also use an external audit system. In either case, the audit logs must be protected from deletion by non-privileged users.

Checks: C-48069r1_chk

Review the web server documentation and deployed configuration settings to determine if the web server audit features protect audit information from unauthorized deletion. Review file system settings to verify the log files have secure file permissions. If the web server log files are not protected from unauthorized deletion, this is a finding.

Fix: F-47131r1_fix

Configure the web server log files so unauthorized deletion of audit information is not possible.

b

The web server application, libraries, and configuration files must only be accessible to privileged users.

CM-5 - Medium - CCI-000345 - V-41681 - SV-54258r1_rule

RMF Control

CM-5

Severity

M

CCI

CCI-000345

Version

SRG-APP-000128-WSR-000072

Vuln IDs

V-41681

Rule IDs

SV-54258r1_rule

A web server can be modified through parameter modification, patch installation, upgrades to the web server or modules, and security parameter changes. With each of these changes, there is the potential for an adverse effect such as a DoS, web server instability, or hosted application instability. To limit changes to the web server and limit exposure to any adverse effects from the changes, files such as the web server application files, libraries, and configuration files must have permissions and ownership set properly to only allow privileged users access.

Checks: C-48078r1_chk

Review the web server documentation and configuration to determine if the web server provides unique account roles specifically for the purposes of segmenting the responsibilities for managing the web server. Log into the hosting server using a web server role with limited permissions (e.g., Auditor, Developer, etc.) and verify the account is not able to perform configuration changes that are not related to that role. If roles are not defined with limited permissions and restrictions, this is a finding.

Fix: F-47140r1_fix

Define roles and responsibilities to be used when managing the web server. Configure the hosting system to utilize specific roles that restrict access related to web server system and configuration changes.

a

Expansion modules must be fully reviewed, tested, and signed before they can exist on a production web server.

CM-5 - Low - CCI-000352 - V-41684 - SV-54261r1_rule

RMF Control

CM-5

Severity

L

CCI

CCI-000352

Version

SRG-APP-000131-WSR-000073

Vuln IDs

V-41684

Rule IDs

SV-54261r1_rule

In the case of a production web server, areas for content development and testing will not exist, as this type of content is only permissible on a development website. The process of developing on a functional production website entails a degree of trial and error and repeated testing. This process is often accomplished in an environment where debugging, sequencing, and formatting of content are the main goals. The opportunity for a malicious user to obtain files that reveal business logic and login schemes is high in this situation. The existence of such immature content on a web server represents a significant security risk that is totally avoidable. The web server must enforce, internally or through an external utility, the signing of modules before they are implemented into a production environment. By signing modules, the author guarantees that the module has been reviewed and tested before production implementation.

Checks: C-48081r1_chk

Review the web server documentation and configuration to determine if web server modules are fully tested before implementation in the production environment. Review the web server for modules identified as test, debug, or backup and that cannot be reached through the hosted application. Review the web server to see if the web server or an external utility is in use to enforce the signing of modules before they are put into a production environment. If development and testing is taking place on the production web server or modules are put into production without being signed, this is a finding.

Fix: F-47143r1_fix

Configure the web server to enforce, internally or through an external utility, the signing of modules before implementation into the production environment.

b

The web server must only contain services and functions necessary for operation.

CM-7 - Medium - CCI-000381 - V-41693 - SV-54270r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000075

Vuln IDs

V-41693

Rule IDs

SV-54270r1_rule

A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too insecure to run on a production DoD system. The web server must provide the capability to disable, uninstall, or deactivate functionality and services that are deemed to be non-essential to the web server mission or can adversely impact server performance.

Checks: C-48090r1_chk

Review the web server documentation and deployed configuration to determine if web server features, services, and processes are installed that are not needed for hosted application deployment. If excessive features, services, and processes are installed, this is a finding.

Fix: F-47152r1_fix

Uninstall or deactivate features, services, and processes not needed by the web server for operation.

b

The web server must not be a proxy server.

CM-7 - Medium - CCI-000381 - V-41694 - SV-54271r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000076

Vuln IDs

V-41694

Rule IDs

SV-54271r1_rule

A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack making the attack anonymous.

Checks: C-48091r1_chk

Review the web server documentation and deployed configuration to determine if the web server is also a proxy server. If the web server is also acting as a proxy server, this is a finding.

Fix: F-47153r1_fix

Uninstall any proxy services, modules, and libraries that are used by the web server to act as a proxy server. Verify all configuration changes are made to ensure the web server is no longer acting as a proxy server in any manner.

c

The web server must provide install options to exclude the installation of documentation, sample code, example applications, and tutorials.

CM-7 - High - CCI-000381 - V-41695 - SV-54272r1_rule

RMF Control

CM-7

Severity

H

CCI

Version

SRG-APP-000141-WSR-000077

Vuln IDs

V-41695

Rule IDs

SV-54272r1_rule

Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server because this type of code has not been evaluated and approved. A production web server must only contain components that are operationally necessary (e.g., compiled code, scripts, web-content, etc.). Any documentation, sample code, example applications, and tutorials must be removed from a production web server. To ensure the documentation and code are not installed or uninstalled completely, the web server must offer an option as part of the installation process to exclude these packages or to uninstall the packages if necessary.

Checks: C-48092r1_chk

Review the web server documentation and deployment configuration to determine if the web server contains documentation, sample code, example applications, or tutorials. Verify the web server install process also offers an option to exclude these elements from installation and provides a uninstall option for their removal. If web server documentation, sample code, example applications, or tutorials are installed or the web server install process does not offer an option to exclude these elements from installation, this is a finding.

Fix: F-47154r1_fix

Use the web server uninstall facility or manually remove any documentation, sample code, example applications, and tutorials.

b

Web server accounts not utilized by installed features (i.e., tools, utilities, specific services, etc.) must not be created and must be deleted when the web server feature is uninstalled.

CM-7 - Medium - CCI-000381 - V-41696 - SV-54273r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000078

Vuln IDs

V-41696

Rule IDs

SV-54273r1_rule

When accounts used for web server features such as documentation, sample code, example applications, tutorials, utilities, and services are created even though the feature is not installed, become an exploitable threat to a web server. These accounts become inactive, are not monitored through regular use, and passwords for the accounts are not created or updated. An attacker, through very little effort, can use these accounts to gain access to the web server and begin investigating ways to elevate the account privileges. The accounts used for web server features not installed must not be created and must be deleted when these features are uninstalled.

Checks: C-48093r1_chk

Review the web server documentation to determine the user accounts created when particular features are installed. Verify the deployed configuration to determine which features are installed with the web server. If any accounts exist that are not used by the installed features, this is a finding.

Fix: F-47155r1_fix

Use the web server uninstall facility or manually remove the user accounts not used by the installed web server features.

b

All accounts installed with the web server software and tools must have passwords assigned and default passwords changed.

CM-7 - Medium - CCI-000381 - V-41697 - SV-54274r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000079

Vuln IDs

V-41697

Rule IDs

SV-54274r1_rule

During installation of the web server software, accounts are created for the web server to operate properly. The accounts installed will have either no password installed or a default password, which will be known and documented by the vendor and the user community. The first things an attacker will try when presented with a login screen are the default user identifiers with default passwords. Installed applications may also install accounts with no password making the login even easier. Once the web server is installed, the passwords for any created accounts should be changed and documented. The new passwords must meet the requirements for all passwords, i.e., upper/lower characters, numbers, special characters, time until change, reuse policy, etc.

Checks: C-48094r1_chk

Review the web server documentation and deployment configuration to determine what accounts were installed by the web server installation process. Verify the passwords for these accounts have been set and/or changed from the default passwords. If these accounts still have no password or default passwords, this is a finding.

Fix: F-47156r1_fix

Set passwords for accounts containing no passwords and change the passwords for accounts which still have default passwords.

a

The web server must provide install options to exclude installation of utility programs, services, plugins, and modules not necessary for operation.

CM-7 - Low - CCI-000381 - V-41698 - SV-54275r1_rule

RMF Control

CM-7

Severity

L

CCI

Version

SRG-APP-000141-WSR-000080

Vuln IDs

V-41698

Rule IDs

SV-54275r1_rule

Just as running unneeded services and protocols is a danger to the web server at the lower levels of the OSI model, running unneeded utilities and programs is also a danger at the application layer of the OSI model. Office suites, development tools, and graphical editors are examples of such programs that are troublesome. Individual productivity tools have no legitimate place or use on an enterprise, production web server and they are also prone to their own security risks. The web server installation process must provide options allowing the installer to choose which utility programs, services and modules are to be installed or removed. By having a process for installation and removal, the web server is guaranteed to be in a more stable and secure state than if these services and programs were installed and removed manually.

Checks: C-48095r1_chk

Review the web server documentation and deployment configuration to determine which web server utilities, services, and modules are installed. Verify these options are essential to the operation of the web server. Also, confirm the web server install process offers an option to exclude these utilities, services, and module from installation that are not needed for operation and that there is a uninstall option for their removal. If there are more utilities, services, or modules installed than are needed for the operation of the web server or the web server does not provide an install facility to customize installation, this is a finding.

Fix: F-47157r1_fix

Use the web server uninstall facility or manually remove any utility programs, services, or modules not needed by the web server for operation.

b

The web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.

CM-7 - Medium - CCI-000381 - V-41699 - SV-54276r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000081

Vuln IDs

V-41699

Rule IDs

SV-54276r1_rule

Controlling what a user of a hosted application can access is part of the security posture of the web server. Anytime a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user, with too much access, can view information that is not needed for the user's job role or the user could use the function in an unintentional manner. A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. A shell is a program that serves as the basic interface between the user and the operating system and so hosted application users must not have access to these programs. Shell programs may execute shell escapes and can then perform unauthorized activities that could damage the security posture of the web server.

Checks: C-48096r1_chk

Review the web server documentation and deployment configuration to determine if the OS shell is accessible by any MIME types that are enabled. If a user to the web server can invoke OS shell programs, this is a finding.

Fix: F-47158r1_fix

Configure the web server to disable all MIME types that invoke OS shell programs.

b

The web server must allow the mappings to unused and vulnerable scripts to be removed.

CM-7 - Medium - CCI-000381 - V-41700 - SV-54277r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000082

Vuln IDs

V-41700

Rule IDs

SV-54277r1_rule

Scripts allow server side processing on behalf of the hosted application user or as processes needed in the implementation of hosted applications. By removing scripts not needed for application operation or deemed vulnerable help to secure the web server. To ensure scripts are not added to the web server and run maliciously, those script mappings that are not needed or used by the web server for hosted application operation must be disabled.

Checks: C-48097r1_chk

Review the web server documentation and deployment configuration to determine what script mappings are enabled. Review the scripts used by the web server and the hosted applications. If there are script mappings enabled that are not used by the web server or hosted applications for operation, this is a finding.

Fix: F-47159r1_fix

Disable script mappings that are not needed for web server and hosted application operation.

b

The web server must have resource mappings set to disable the serving of certain file types.

CM-7 - Medium - CCI-000381 - V-41701 - SV-54278r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000083

Vuln IDs

V-41701

Rule IDs

SV-54278r1_rule

Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and which file types are not to be delivered to a client. By not specifying which files can and which files cannot be served to a user, the web server could deliver to a user web server configuration files, log files, password files, etc. The web server must only allow hosted application file types to be served to a user and all other types must be disabled.

Checks: C-48098r1_chk

Review the web server documentation and deployment configuration to determine what types of files are being used for the hosted applications. If the web server is not configured to disallow other file types, especially those associated with logs, configuration files, passwords, etc., this is a finding.

Fix: F-47160r1_fix

Configure the web server to only serve file types to the user that are needed by the hosted applications. All other file types must be disabled.

b

Web Distributed Authoring (WebDAV) must be disabled.

CM-7 - Medium - CCI-000381 - V-41702 - SV-54279r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000085

Vuln IDs

V-41702

Rule IDs

SV-54279r1_rule

A web server can be installed with functionality that just by its nature, is not secure. Web Distributed Authoring (WebDAV) is an extension to the HTTP protocol that when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used, and has serious security concerns as it may allow clients to modify unauthorized files on the web server.

Checks: C-48099r1_chk

Review the web server documentation and deployment configuration to determine if Web Distributed Authoring (WebDAV) is enabled. If WebDAV is enabled, this is a finding.

Fix: F-47161r1_fix

Configure the web server to disable Web Distributed Authoring.

b

The web server must protect system resources and privileged operations from hosted applications.

CM-7 - Medium - CCI-000381 - V-41703 - SV-54280r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000086

Vuln IDs

V-41703

Rule IDs

SV-54280r1_rule

A web server may host one too many applications. Each application will need certain system resources and privileged operations to operate correctly. The web server must be configured to contain and control the applications and protect the system resources and privileged operations from those not needed by the application for operation. Limiting the application will confine the potential harm a compromised application could cause to a system.

Checks: C-48100r1_chk

Review the web server documentation and configuration to determine the access to server resources given to hosted applications. If hosted applications have access to more system resources than needed for operation, this is a finding.

Fix: F-47162r1_fix

Configure the privileges given to hosted applications to the minimum required for application operation.

b

Users and scripts running on behalf of users must be contained to the document root or home directory tree of the web server.

CM-7 - Medium - CCI-000381 - V-41704 - SV-54281r1_rule

RMF Control

CM-7

Severity

M

CCI

Version

SRG-APP-000141-WSR-000087

Vuln IDs

V-41704

Rule IDs

SV-54281r1_rule

A web server is designed to deliver content and execute scripts or applications on the request of a client or user. Containing user requests to files in the directory tree of the hosted web application and limiting the execution of scripts and applications guarantees that the user is not accessing information protected outside the application's realm. The web server must also prohibit users from jumping outside the hosted application directory tree through access to the user's home directory, symbolic links or shortcuts, or through search paths for missing files.

Checks: C-48101r1_chk

Review the web server documentation and configuration to determine where the document root or home directory for each application hosted by the web server is located. Verify that users of the web server applications, and any scripts running on the user's behalf, are contained to the root or home directory tree. If users of the web server applications, and any scripts running on the user's behalf, are not contained to the root or home directory tree, this is a finding.

Fix: F-47163r1_fix

Configure the web server to contain users and scripts to the home or root directory of each hosted application.

b

The web server must prohibit or restrict the use of non-secure ports, protocols, modules, and/or services in accordance with organizationally defined requirements.

CM-7 - Medium - CCI-000382 - V-41705 - SV-54282r1_rule

RMF Control

CM-7

Severity

M

CCI

CCI-000382

Version

SRG-APP-000142-WSR-000088

Vuln IDs

V-41705

Rule IDs

SV-54282r1_rule

Web servers provide numerous processes, features, and functionalities that utilize TCP/IP ports. Some of these processes may be deemed unnecessary or too insecure to run on a production system. The web server must provide the capability to disable or deactivate network-related services that are deemed to be non-essential to the server mission, are too insecure, or are prohibited by DoD ports and protocols.

Checks: C-48102r1_chk

Review the web server documentation and deployment configuration to determine which ports and protocols are enabled. Verify that the ports and protocols being used are not prohibited and are necessary for the operation of the web server and the hosted applications. If any of the ports or protocols are prohibited or not necessary for web server operation, this is a finding.

Fix: F-47164r1_fix

Configure the web server to disable any ports or protocols that are prohibited by the DoD or are not necessary for web server operation.

b

The web server must be configured to use a specified IP address and port.

CM-7 - Medium - CCI-000382 - V-41706 - SV-54283r1_rule

RMF Control

CM-7

Severity

M

CCI

CCI-000382

Version

SRG-APP-000142-WSR-000089

Vuln IDs

V-41706

Rule IDs

SV-54283r1_rule

The web server must be configured to listen on a specified IP address and port. Without specifying an IP address and port for the web server to utilize, the web server will listen on all IP addresses available to the hosting server. If the web server has multiple IP addresses, i.e., a management IP address, the web server will also accept connections on the management IP address. Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.

Checks: C-48103r1_chk

Review the web server documentation and deployment configuration to determine whether the web server is configured to listen on a specified IP address and port. Request a client user try to access the web server on any other available IP addresses on the hosting hardware. If an IP address is not configured on the web server or a client can reach the web server on other IP addresses assigned to the hosting hardware, this is a finding.

Fix: F-47165r1_fix

Configure the web server to only listen on a specified IP address and port.

a

The web server software, hosted application software, and licenses must be part of a system backup.

CP-9 - Low - CCI-000537 - V-41711 - SV-54288r1_rule

RMF Control

CP-9

Severity

L

CCI

CCI-000537

Version

SRG-APP-000146-WSR-000090

Vuln IDs

V-41711

Rule IDs

SV-54288r1_rule

The web server software, hosted applications, and licenses needed for operation are essential for the operation of the web server and hosted applications. In the event of a disaster or failure, having a backup of these files will enable the re-creation of a stable production environment more easily and quickly than the re-creation of the production web server. Examples of the files to be included in a backup are the web server software, hosted application software, and licenses.

Checks: C-48108r1_chk

Review the web server documentation to determine where files that should be backed up are located. Request the SA show the process for the backup of the web server and determine whether the files are part of the backup. If the files determined to be essential are not part of a regular backup, this is a finding.

Fix: F-47170r1_fix

Configure the web server essential files to be part of a scheduled backup process.

a

The web server must not impede DoD requirements to conduct backups of system-level information contained on the web server.

CP-9 - Low - CCI-000537 - V-41712 - SV-54289r1_rule

RMF Control

CP-9

Severity

L

CCI

CCI-000537

Version

SRG-APP-000146-WSR-000091

Vuln IDs

V-41712

Rule IDs

SV-54289r1_rule

Having a regularly scheduled backup of the web server and hosted applications makes recovery quicker in the event of a hardware failure or a natural disaster. The web server must not impede or hinder the backup process. Examples of impeding or hindering the backup process include locking essential files during web server operation or using excessive resources that would not allow the backup process to run successfully.

Checks: C-48109r1_chk

Verify that the web server is part of a backup process and that no special actions must be taken to complete a backup, such as stopping the web server, stopping services, or making copies of files. If special actions are needed in order to completely back up the web server, this is a finding.

Fix: F-47171r1_fix

Configure the web server to support a complete system and software backup.

a

The web server configuration files, user password files, keystore, keys, and certificates must be part of a system backup.

CP-9 - Low - CCI-000539 - V-41713 - SV-54290r1_rule

RMF Control

CP-9

Severity

L

CCI

CCI-000539

Version

SRG-APP-000147-WSR-000092

Vuln IDs

V-41713

Rule IDs

SV-54290r1_rule

The web server contains several files that are changed once the web server software is installed to enable the web server to operate correctly in the hosting environment. The information contained in the configuration files, along with the certificates, are considered to be security-related documents. In the event of a disaster or failure, having a backup of these files will enable the re-creation of a stable production environment more easily and quickly than the re-creation of the production web server. Examples of the files to be included in a backup are configuration files, password files, keystores, keys, and certificates.

Checks: C-48110r1_chk

Review the web server documentation to determine where web server configuration files, user password files, keystore, keys, and certificates are located. Request the SA show the process for the backup of the web server and determine whether these files are part of the backup. If the configuration files, user password files, keystore, keys, and certificates are not part of a regular backup, this is a finding.

Fix: F-47172r1_fix

Configure the scheduled backup process to include the web server configuration files, user password files, keystore, keys, and certificates.

b

The web server must use secure token authentication for network access to non-privileged accounts.

IA-2 - Medium - CCI-000766 - V-41716 - SV-54293r1_rule

RMF Control

IA-2

Severity

M

CCI

CCI-000766

Version

SRG-APP-000150-WSR-000093

Vuln IDs

V-41716

Rule IDs

SV-54293r1_rule

Multifactor authentication is the act of validating a user by using two or more elements to achieve the validation. Such elements can be something the user knows, something the user has, or something the user is. A web server, when used to authenticate users to a hosted application, must use multifactor authentication as part of the authentication process.

Checks: C-48113r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted applications, the web server must use multifactor authentication as part of the user authentication process. If multifactor authentication is not being used, this is a finding.

Fix: F-47175r1_fix

Configure the web server to use multifactor authentication when validating users.

b

The web server must support organizational requirements to disable user accounts after an organization-defined time period of inactivity.

IA-4 - Medium - CCI-000795 - V-41728 - SV-54305r1_rule

RMF Control

IA-4

Severity

M

CCI

CCI-000795

Version

SRG-APP-000163-WSR-000094

Vuln IDs

V-41728

Rule IDs

SV-54305r1_rule

Users are the first line of defense within an application. Active users notice system and data changes and are the first to notify system administrators of these changes. Inactive users pose a risk to a web server and the hosted applications by not noticing unauthorized access to their user accounts. The web server, when used to authenticate users, must also be configurable to disable inactive user accounts after a definable time period.

Checks: C-48125r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted applications, the web server must disable user accounts after a definable period of inactivity. If the web server is not configured to disable inactive accounts, this is a finding.

Fix: F-47187r1_fix

Configure the web server to disable user accounts after a defined period of inactivity.

b

The web server must perform RFC 5280-compliant certification path processing.

IA-5 - Medium - CCI-000185 - V-41730 - SV-54307r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000185

Version

SRG-APP-000175-WSR-000095

Vuln IDs

V-41730

Rule IDs

SV-54307r1_rule

When there is a chain of trust, usually the top entity to be trusted becomes the trust anchor; it can be, for example, a Certification Authority (CA). A certification path starts with the subject certificate and proceeds through a number of intermediate certificates up to a trusted root certificate, typically issued by a trusted CA. Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Status information for certification paths includes certificate revocation lists or online certificate status protocol responses.

Checks: C-48127r1_chk

Review the web server documentation and deployed configuration to determine whether the web server provides PKI functionality that validates certificates by constructing a certification path with status information to an accepted trust anchor. If PKI is not being used, this is NA. If the web server is using PKI, but it does not perform this requirement, this is a finding.

Fix: F-47189r1_fix

Configure the web server to validate certificates using a trusted certificate path with status information to an accepted trust anchor.

b

When using PKI-based authentication, access to the web server private key must be restricted to only privileged accounts

IA-5 - Medium - CCI-000186 - V-41731 - SV-54308r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000186

Version

SRG-APP-000176-WSR-000096

Vuln IDs

V-41731

Rule IDs

SV-54308r1_rule

Protection of the private key is essential to preserve the authentication and non-repudiation gained through PKI. By gaining access to the private key and knowing the public key, an attacker can digitally sign documents, pretend to be an authorized user or server, or encrypt/decrypt the SSL traffic between a client and the web server.

Checks: C-48128r1_chk

Review the web server documentation and deployed configuration to determine whether the web server contains a private key and where the private key is stored. If the web server does not have a private key, this is NA. If the private key is not protected and is accessible by non-privileged accounts, this is a finding.

Fix: F-47190r1_fix

Configure the web server to protect the private key allowing only access by privileged accounts.

b

The web server must ensure that PKI-based authentication maps the authenticated identity to the user account.

IA-5 - Medium - CCI-000187 - V-41732 - SV-54309r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000187

Version

SRG-APP-000177-WSR-000098

Vuln IDs

V-41732

Rule IDs

SV-54309r1_rule

When a web server performs PKI-based authentication, the web server must be able to map a unique identifier on the token to the list of users maintained by the web server. By mapping a unique identifier from the token to a web server user, the web server can then accurately determine access rights and generate accurate audit events. If the web server is unable to map to a user, the web server is only validating the token, and not hosted application access.

Checks: C-48129r1_chk

Review the web server documentation and deployed configuration to determine whether the web server is performing user validation through PKI-based authentication. If the web server is not performing user management or is not configured to use PKI-based authentication, this is NA. If the web server is only performing PKI-based authentication, and not mapping the token to a user, this is a finding.

Fix: F-47191r1_fix

Configure the web server to map the PKI-authenticated identity to an authorized user.

b

The web server must enforce password complexity by the number of uppercase characters used.

IA-5 - Medium - CCI-000192 - V-41733 - SV-54310r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000192

Version

SRG-APP-000166-WSR-000099

Vuln IDs

V-41733

Rule IDs

SV-54310r1_rule

The complexity of user passwords is the first line of defense between an attacker and the hosted applications on a web server. Short passwords or dictionary words used as passwords are easily cracked by an attacker. In order to hinder or lengthen the time and resources needed to crack a password, certain password attributes must be employed. One of these attributes defined by the DoD is the number of uppercase characters required in a password. The web server must enforce the use of passwords that meet or exceed the DoD requirement for the number of uppercase characters.

Checks: C-48130r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted applications, the web server must also enforce DoD requirements for the number of uppercase letters in a password. If the number of required uppercase password characters is not according to the DoD requirement, this is a finding.

Fix: F-47192r1_fix

Configure the web server to require the DoD-defined number of uppercase characters in user passwords.

b

The web server must enforce password complexity by the number of lowercase characters used.

IA-5 - Medium - CCI-000193 - V-41734 - SV-54311r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000193

Version

SRG-APP-000167-WSR-000100

Vuln IDs

V-41734

Rule IDs

SV-54311r1_rule

The complexity of user passwords is the first line of defense between an attacker and the hosted applications on a web server. Short passwords or dictionary words used as passwords are easily cracked by an attacker. In order to hinder or lengthen the time and resources needed to crack a password, certain password attributes must be employed. One of these attributes defined by the DoD is the number of lowercase characters required in a password. The web server must enforce the use of passwords that meet or exceed the DoD requirement for the number of lowercase characters.

Checks: C-48131r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted applications, the web server must also enforce DoD requirements for the number of lowercase letters in a password. If the number of required lowercase password characters is not according to the DoD requirement, this is a finding.

Fix: F-47193r1_fix

Configure the web server to require the DoD-defined number of lowercase characters in user passwords.

b

The web server must enforce password complexity by the number of numeric characters used.

IA-5 - Medium - CCI-000194 - V-41735 - SV-54312r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000194

Version

SRG-APP-000168-WSR-000101

Vuln IDs

V-41735

Rule IDs

SV-54312r1_rule

The complexity of user passwords is the first line of defense between an attacker and the hosted applications on a web server. Short passwords or dictionary words used as passwords are easily cracked by an attacker. In order to hinder or lengthen the time and resources needed to crack a password, certain password attributes must be employed. One of these attributes defined by the DoD is the number of numeric characters required in a password. The web server must enforce the use of passwords that meet or exceed the DoD requirement for the number of numeric characters.

Checks: C-48132r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted applications, the web server must also enforce DoD requirements for the number of numeric characters in a password. If the number of required numeric password characters is not according to the DoD requirement, this is a finding.

Fix: F-47194r1_fix

Configure the web server to require the DoD-defined number of numeric characters in user passwords.

b

The web server must enforce the number of characters that get changed when passwords are changed.

IA-5 - Medium - CCI-000195 - V-41736 - SV-54313r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000195

Version

SRG-APP-000170-WSR-000102

Vuln IDs

V-41736

Rule IDs

SV-54313r1_rule

When a password has been compromised, having the user only change a character or two from the old password greatly reduces the time and resources an attacker needs to reveal the new password. In order to force the attacker to guess a new password that is considerably different from the old password, a significant number of characters must be changed from the old password. The web server must force a user to change a DoD-defined number of characters in new passwords and not rely on the user to remember a best practice in password creation.

Checks: C-48133r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. If the web server is the user authenticator and manager, verify that the number of characters that need to be changed to generate a valid new password is set to that defined by the DoD. If the number of characters needed to be changed in a password does not meet the DoD requirement, this is a finding.

Fix: F-47195r1_fix

Configure the web server to force a user to change a DoD-defined number of characters when creating a new password.

b

The web server must enforce organizational requirements to enforce password encryption for storage.

IA-5 - Medium - CCI-000196 - V-41737 - SV-54314r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000196

Version

SRG-APP-000171-WSR-000103

Vuln IDs

V-41737

Rule IDs

SV-54314r1_rule

Data used to authenticate, especially passwords, needs to be protected at all times, and encryption is the standard method for protecting authentication data during storage. Authentication data stored in plain text becomes easily readable to an attacker or non-privileged user, undermining any security measures in place using the authentication data. The potential risk then becomes unauthorized users accessing hosted applications, elevation of privileges through users using accounts other than those given to them, and abuse of trust relationships between the web server/hosted applications and external systems. The encryption of authentication data eliminates non-privileged users from accidently discovering the data, and the discovery by an attacker is prolonged and reduced due to the time and resources needed to decrypt the data.

Checks: C-48134r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. If the web server is the user authenticator and manager, verify that the passwords are stored in an encrypted format. If the passwords are not stored encrypted, this is a finding.

Fix: F-47196r1_fix

Configure the web server to encrypt passwords when stored.

b

The web server must encrypt passwords during transmission.

IA-5 - Medium - CCI-000197 - V-41738 - SV-54315r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000197

Version

SRG-APP-000172-WSR-000104

Vuln IDs

V-41738

Rule IDs

SV-54315r1_rule

Data used to authenticate, especially passwords, needs to be protected at all times, and encryption is the standard method for protecting authentication data during transmission. Data used to authenticate can be passed to and from the web server for many reasons. Examples include data passed from a user to the web server through a HTTPS connection for authentication, the web server authenticating to a backend database for data retrieval and posting, and the web server authenticating to a clustered web server manager for an update.

Checks: C-48135r1_chk

Review the web server documentation and deployed configuration to determine whether authentication data is being passed to or from the web server. If the transmission of the authentication data is not encrypted, this is a finding.

Fix: F-47197r1_fix

Configure the web server to encrypt the transmission authentication data.

b

The web server must enforce password minimum lifetime restrictions.

IA-5 - Medium - CCI-000198 - V-41739 - SV-54316r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000198

Version

SRG-APP-000173-WSR-000105

Vuln IDs

V-41739

Rule IDs

SV-54316r1_rule

Password minimum lifetime limits the amount of time between password changes. By limiting the minimum time between password changes, the web server is capable of prohibiting the user from changing their password immediately and continually in order to defeat an organization's password reuse policy, allowing the user to quickly get back to reusing their old password.

Checks: C-48136r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. If the web server is the user authenticator and manager, verify that a password minimum lifetime setting is in place. If there is no password minimum lifetime in place, this is a finding.

Fix: F-47198r1_fix

Configure the web server to enforce a password minimum lifetime.

b

The web server must enforce password maximum lifetime restrictions.

IA-5 - Medium - CCI-000199 - V-41740 - SV-54317r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000199

Version

SRG-APP-000174-WSR-000106

Vuln IDs

V-41740

Rule IDs

SV-54317r1_rule

Passwords, no matter how complex, can eventually be cracked. To make the discovery of passwords more difficult, users must be forced to periodically change their password. By setting a maximum lifetime, the maximum period of time a user's password may be in effect before the user is forced to change it, the web server limits the risk of password discovery through brute force over time. Forcing users to change their passwords also limits the lifetime of an undiscovered password compromise. While the attacker will have access to the hosted application during the time the password is compromised, the user will eventually be forced to change the password, forcing the attacker to once again discover a newly created password.

Checks: C-48137r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. If the web server is the user authenticator and manager, verify that a password maximum lifetime setting is in place. If there is no password maximum lifetime in place, this is a finding.

Fix: F-47199r1_fix

Configure the web server to enforce a password maximum lifetime.

b

The web server must support DoD requirements to prohibit password reuse for the organization-defined number of generations.

IA-5 - Medium - CCI-000200 - V-41741 - SV-54318r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000200

Version

SRG-APP-000165-WSR-000107

Vuln IDs

V-41741

Rule IDs

SV-54318r1_rule

An element of the overall policy of making passwords complex is enforcing a password reuse policy. Allowing users to reuse passwords is synonymous with having no password change policy in place. Users, out of laziness, will continue to use the same password indefinitely, even when forced to change their password, without a reuse policy. An attacker, who has compromised a password, will continue to have access even when the password is changed if the user changes back to the old password. To prevent the password change policy from being ignored, the web server must enforce a password reuse or history policy.

Checks: C-48138r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. If the web server is the user authenticator and manager, verify that a password reuse setting is in place. If there is no password reuse setting in place, this is a finding.

Fix: F-47200r1_fix

Configure the web server to enforce password reuse.

b

The web server must support DoD requirements to enforce minimum password length.

IA-5 - Medium - CCI-000205 - V-41742 - SV-54319r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-000205

Version

SRG-APP-000164-WSR-000108

Vuln IDs

V-41742

Rule IDs

SV-54319r1_rule

Password complexity significantly increases the longer a password is. The time and resources exponentially increase as the password increases in length. Shorter passwords limit themselves to the lower number of possible combinations that need to be tested before the password is compromised. To prevent users from implementing short and non-complex passwords, the web server must enforce a minimum password length.

Checks: C-48139r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. If the web server is the user authenticator and manager, verify that a password minimum length setting is in place. If there is no password minimum length setting in place, this is a finding.

Fix: F-47201r1_fix

Configure the web server to enforce a password minimum length.

b

The web server must support DoD requirements to enforce password complexity by the number of special characters used.

IA-5 - Medium - CCI-001619 - V-41743 - SV-54320r1_rule

RMF Control

IA-5

Severity

M

CCI

CCI-001619

Version

SRG-APP-000169-WSR-000109

Vuln IDs

V-41743

Rule IDs

SV-54320r1_rule

The complexity of user passwords is the first line of defense between an attacker and the hosted applications on a web server. Short passwords or dictionary words used as passwords are easily cracked by an attacker. In order to hinder or lengthen the time and resources needed to crack a password, certain password attributes must be employed. One of these attributes defined by the DoD is the number of special characters required in the password. The web server must enforce the use of passwords that meet or exceed the DoD requirement for the number of special characters.

Checks: C-48140r1_chk

Review the web server documentation and configuration to determine whether the web server is performing user management. If the web server is not being used for user management, this is NA. When the web server is also performing user management functionality for the hosted applications, the web server must also enforce DoD requirements for the number of special characters in a password. If the number of special characters in the password does not meet the DoD requirement, this is a finding.

Fix: F-47202r1_fix

Configure the web server to require the DoD-defined number of special characters in user passwords.

b

The web server must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.

IA-7 - Medium - CCI-000803 - V-41745 - SV-54322r1_rule

RMF Control

IA-7

Severity

M

CCI

CCI-000803

Version

SRG-APP-000179-WSR-000110

Vuln IDs

V-41745

Rule IDs

SV-54322r1_rule

Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified, and cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. FIPS 140-2 is the current standard for validating cryptographic modules and NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules. The web server must provide FIPS-compliant encryption modules when storing encrypted data and configuration settings.

Checks: C-48142r1_chk

Review web server documentation and deployed configuration to determine whether the encryption modules utilized for storage of data are FIPS 140-2 compliant. Reference the following NIST site to identify validated encryption modules: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm If the encryption modules used for storage of data are not FIPS 140-2 validated, this is a finding.

Fix: F-47204r1_fix

Configure the web server to utilize FIPS 140-2 approved encryption modules when the web server is storing data.

b

The web server must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

IA-7 - Medium - CCI-000803 - V-41746 - SV-54323r1_rule

RMF Control

IA-7

Severity

M

CCI

CCI-000803

Version

SRG-APP-000179-WSR-000111

Vuln IDs

V-41746

Rule IDs

SV-54323r1_rule

Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified, and cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised due to weak algorithms. FIPS 140-2 is the current standard for validating cryptographic modules and NSA Type-X (where X=1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules. The web server must provide FIPS-compliant encryption modules when authenticating users and processes.

Checks: C-48143r1_chk

Review web server documentation and deployed configuration to determine whether the encryption modules utilized for authentication are FIPS 140-2 compliant. Reference the following NIST site to identify validated encryption modules: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm If the encryption modules used for authentication are not FIPS 140-2 validated, this is a finding.

Fix: F-47205r1_fix

Configure the web server to utilize FIPS 140-2 approved encryption modules when authenticating users and processes.

b

The web server must encrypt user identifiers and passwords.

MP-4 - Medium - CCI-001019 - V-41765 - SV-54342r1_rule

RMF Control

MP-4

Severity

M

CCI

CCI-001019

Version

SRG-APP-000188-WSR-000113

Vuln IDs

V-41765

Rule IDs

SV-54342r1_rule

When data is written to digital media such as hard drives, mobile computers, external/removable hard drives, personal digital assistants, flash/thumb drives, etc., there is risk of data loss and data compromise. User identities and passwords stored on the hard drive of the hosting hardware must be encrypted to protect the data from easily being discovered and used by an unauthorized user to access the hosted applications. The cryptographic libraries and functionality used to store and retrieve the user identifiers and passwords must be part of the web server.

Checks: C-48153r1_chk

Review the web server documentation and deployed configuration to determine whether the web server is authorizing and managing users. If the web server is not authorizing and managing users, this is NA. If the web server is the user authenticator and manager, verify that stored user identifiers and passwords are being encrypted by the web server. If the user information is not being encrypted when stored, this is a finding.

Fix: F-47224r1_fix

Configure the web server to encrypt the user identifiers and passwords when storing them on digital media.

b

The web server must terminate the network connection associated with a communications session at the end of the session or after a DoD-defined time period of inactivity.

SC-10 - Medium - CCI-001133 - V-41768 - SV-54345r1_rule

RMF Control

SC-10

Severity

M

CCI

CCI-001133

Version

SRG-APP-000190-WSR-000114

Vuln IDs

V-41768

Rule IDs

SV-54345r1_rule

Communications sessions that remain open for extended periods of time, even when unused, become potential targets for an adversary to hijack. The session can then be used to gain access to the web server, hosted applications, network resources, and other networks to which it is attached. Terminating sessions when an application is closed or after a certain period of inactivity is a method for mitigating the risk of this vulnerability. The web server must provide a mechanism for terminating a session by closing the hosted application or when connections time out.

Checks: C-48156r1_chk

Review the web server documentation and deployed configuration to verify the system terminates network connections on hosted application close or after an organization-defined time period of inactivity. If communications are not terminated on hosted application close or after an organization-defined time period of inactivity, this is a finding.

Fix: F-47227r1_fix

Configure the web server to terminate network connections on hosted application close or after the organization-defined time period of inactivity.

b

The web server must implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.

SC-13 - Medium - CCI-001144 - V-41774 - SV-54351r1_rule

RMF Control

SC-13

Severity

M

CCI

CCI-001144

Version

SRG-APP-000196-WSR-000118

Vuln IDs

V-41774

Rule IDs

SV-54351r1_rule

Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. NSA has developed Type 1 algorithms for protecting classified information. The Committee on National Security Systems (CNSS) National Information Assurance Glossary (CNSS Instruction No. 4009) defines Type 1 products as: "Cryptographic equipment, assembly or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed. Developed using established NSA business processes and containing NSA-approved algorithms are used to protect systems requiring the most stringent protection mechanisms." Although persons may have a security clearance, they may not have a "need to know" and are required to be separated from the information in question. The application server must employ NSA-approved cryptography to protect classified information from those individuals who have no "need to know" or when encryption of compartmentalized data is required by data classification.

Checks: C-48162r1_chk

Review policy documents to identify classified data that is compartmentalized and requires cryptographic protection. Review the web server documentation and deployed configuration to identify the encryption modules utilized to protect the compartmentalized data. If the encryption modules used to protect the compartmentalized data are not compliant with the data, this is a finding.

Fix: F-47233r1_fix

Configure the web server to utilize cryptography when protecting classified compartmentalized data.

b

A web server hosting publicly available information and applications must be physically and logically isolated.

SC-14 - Medium - CCI-001149 - V-41777 - SV-54354r1_rule

RMF Control

SC-14

Severity

M

CCI

Version

SRG-APP-000201-WSR-000121

Vuln IDs

V-41777

Rule IDs

SV-54354r1_rule

To minimize exposure of private assets to unnecessary risk by attackers, public web servers must be isolated from internal systems. Public web servers are by nature more vulnerable to attack from publicly based sources, such as the public Internet. Once compromised, a public web server could be used as a base for further attack on private resources, unless additional layers of protection are implemented. Public web servers must be located in a DMZ environment with carefully controlled access. Failure to isolate resources in this way increases the risk that private assets are exposed to attacks from public sources.

Checks: C-48165r1_chk

Review the web server deployed configuration to determine whether the web server is displaying publicly hosted information. Also, determine whether the web server is separated physically and logically from private assets. If the web server is not isolated from private assets, this is a finding.

Fix: F-47236r1_fix

Physically and logically isolate the web server from private assets.

b

Public display of web server architecture and settings must be minimized.

SC-14 - Medium - CCI-001149 - V-41778 - SV-54355r1_rule

RMF Control

SC-14

Severity

M

CCI

Version

SRG-APP-000201-WSR-000122

Vuln IDs

V-41778

Rule IDs

SV-54355r1_rule

An attacker will begin his attack by looking for possible vulnerabilities in a web server. The easiest way to find these vulnerabilities is to blueprint or profile the web server. A lot of information can be found in the banner page of the web server. The banner page will often display what the web server is, the version of the web server, what plugins and modules are installed along with their version, and what compile options were used to build the web server. Using this information, an attacker can pinpoint an attack that will have a high possibility of working against the web server without needing to make much noise on the network by randomly trying attacks. By minimizing the information displayed or by modifying the banner to disguise the web server, the attacker must guess at what attacks might work, thereby delaying a successful attack and also causing the attacker to risk being discovered.

Checks: C-48166r1_chk

Review the web server documentation and deployed configuration to determine whether the web server banner can be minimized or customized. If the web server is not configured to minimize the banner or the banner is not customized, this is a finding.

Fix: F-47237r1_fix

Configure the web server to minimize the information given in the banner, or customize the banner to disguise the web server.

b

A web server hosting controlled access information and applications must be on a separate access-controlled subnet.

SC-14 - Medium - CCI-001149 - V-41779 - SV-54356r1_rule

RMF Control

SC-14

Severity

M

CCI

Version

SRG-APP-000201-WSR-000123

Vuln IDs

V-41779

Rule IDs

SV-54356r1_rule

Web servers which host applications that deliver controlled access data must be protected from outside threats in addition to insider threats. An insider threat may be accidental or intentional but, in either case, can cause a disruption in service of the web server. To protect the web server from these threats, it must be located on a separate controlled access subnet and must not be a part of the public DMZ that houses public web servers. It also cannot be located inside the enclave as part of the local general population LAN.

Checks: C-48167r1_chk

Verify the site's network diagram and visually check the web server to ensure that the web server is located on a separate controlled access subnet and is not a part of the public DMZ that houses web servers for public use. In addition, the web server needs to be isolated via a controlled access mechanism from the local general population LAN. If the web server is not isolated, this is a finding.

Fix: F-47238r1_fix

Locate the web server so that it is isolated and protected from public use.

b

A web server hosting controlled access information and applications must not respond to public search engines.

SC-14 - Medium - CCI-001149 - V-41780 - SV-54357r1_rule

RMF Control

SC-14

Severity

M

CCI

Version

SRG-APP-000201-WSR-000124

Vuln IDs

V-41780

Rule IDs

SV-54357r1_rule

Search engines are constantly at work on the Internet. Search engines are augmented by agents, often referred to as spiders or bots, which endeavor to capture and catalog web site content. In turn, these search engines make the content they obtain and catalog available to any public web user. Such information in the public domain defeats the purpose of a protected web server, provides information to those not authorized access to the web site, and could provide clues to the web server's architecture.

Checks: C-48168r1_chk

Review the web server documentation and deployed configuration to determine whether the web server is configured to not respond to public search engines. If the web server will respond to public search engines, this is a finding.

Fix: F-47239r1_fix

Configure the web server to not respond to public search engines.

a

The web server must have indexing services turned off or limited to the web content directory.

SC-14 - Low - CCI-001149 - V-41781 - SV-54358r1_rule

RMF Control

SC-14

Severity

L

CCI

Version

SRG-APP-000201-WSR-000125

Vuln IDs

V-41781

Rule IDs

SV-54358r1_rule

The indexing service can be used to facilitate a search function for web sites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.

Checks: C-48169r1_chk

Review the web server documentation and deployed configuration to determine whether indexing is being used and on which directories. If indexing is enabled and not limited to the content directory, this is a finding.

Fix: F-47240r1_fix

Configure the web server to either disable indexing or limit indexing to only the content directory.

b

Session ID storage must be protected from non-privileged users.

SC-14 - Medium - CCI-001149 - V-41782 - SV-54359r1_rule

RMF Control

SC-14

Severity

M

CCI

Version

SRG-APP-000201-WSR-000126

Vuln IDs

V-41782

Rule IDs

SV-54359r1_rule

Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a session identifier (ID) for each client session when the session is initiated. The session ID allows the web server to track a user session and, in many cases, the user if the user previously logged into a hosted application. Session hijacking is the exploitation of a valid computer session to gain unauthorized access to information or services on a computer through the session ID. Since the session ID is stored on the web server, the session ID must be protected from non-privileged users who could use the session ID to hijack an already authorized session. Session IDs, along with user names, account numbers, etc., are stored using a variety of techniques including, but not limited to, local memory, flat files, and databases. These files must be protected through proper file permissions and file ownership.

Checks: C-48170r1_chk

Review the web server documentation and deployed configuration to determine whether session IDs are protected from non-privileged users. If session IDs are not protected, this is a finding.

Fix: F-47241r1_fix

Configure the web server to protect session IDs from non-privileged users.

b

The web server must follow the DOD and NSS certificate policies to obtain public key certificates.

SC-17 - Medium - CCI-001159 - V-41786 - SV-54363r1_rule

RMF Control

SC-17

Severity

M

CCI

CCI-001159

Version

SRG-APP-000205-WSR-000165

Vuln IDs

V-41786

Rule IDs

SV-54363r1_rule

To secure a communication channel between the web server and clients successfully, the web server must follow DoD and NSS certificate policies to obtain public key certificates. If the web server does not follow these policies, an attacker could substitute a false public key, or the attacker's key, for the client, allowing the attacker to unencrypt the secure channel.

Checks: C-48174r1_chk

Review the web server documentation and deployed configuration to determine if the web server is following DoD and NSS certificate policies to obtain public keys. If the web server is not following the DoD and NSS policies, this is a finding.

Fix: F-47245r1_fix

Configure the web server to follow the DoD and NSS certificate policies to obtain public key certificates.

b

The web server must separate the hosted applications from hosted web server management functionality.

SC-2 - Medium - CCI-001082 - V-41794 - SV-54371r1_rule

RMF Control

SC-2

Severity

M

CCI

CCI-001082

Version

SRG-APP-000211-WSR-000129

Vuln IDs

V-41794

Rule IDs

SV-54371r1_rule

The separation of user functionality from web server management can be accomplished by moving management functions to a separate IP address or port. To further separate the management functions, separate authentication methods and certificates should be used. By moving the management functionality, the possibility of accidental discovery of the management functions by non-privileged users during hosted application use is minimized.

Checks: C-48182r1_chk

Review the web server documentation and deployed configuration to determine whether hosted application functionality is separated from web server management functions. If the functions are not separated, this is a finding.

Fix: F-47253r1_fix

Configure the web server to separate the hosted applications from web server management functionality.

b

The web server must prevent presentation of management-related functionality to non-privileged users.

SC-2 - Medium - CCI-001083 - V-41795 - SV-54372r1_rule

RMF Control

SC-2

Severity

M

CCI

CCI-001083

Version

SRG-APP-000212-WSR-000130

Vuln IDs

V-41795

Rule IDs

SV-54372r1_rule

Information regarding the configuration of the web server must be protected from non-privileged users at all times. Web server configuration data can be accidentally leaked through banner grabs, error messages, and web administrator functions. The protection of configuration and management data requires a different method for each of these scenarios. Administrative functionality can easily be moved to a separate IP address or port from that used by the user functionality or hosted applications to separate each of these activities. To further separate the administrative functions, a separate authentication method and certificates can be used. By moving the management functionality, the possibility of accidental discovery of the management functions and configuration data by non-privileged users during hosted application use is minimized. For management functionality that is presented at the OS level, presentation can be controlled through the proper association of roles to users and by properly setting the privileges assigned to management functions.

Checks: C-48183r1_chk

Review the web server documentation and deployed configuration to verify whether management-related functionality is presented to non-privileged users. If the management functionality is presented to non-privileged users, this is a finding.

Fix: F-47254r1_fix

Configure the web server to prevent the presentation of management-related functions to non-privileged users.

b

A web server involved in two-way authentication, such as Mutual SSL Authentication, must ensure the authentication during the entire session.

SC-23 - Medium - CCI-001184 - V-41801 - SV-54378r1_rule

RMF Control

SC-23

Severity

M

CCI

CCI-001184

Version

SRG-APP-000219-WSR-000131

Vuln IDs

V-41801

Rule IDs

SV-54378r1_rule

Mutual SSL Authentication, or two-way authentication, is when two parties authenticate each other. Mutual SSL provides the same functionality as SSL, with the addition of authentication and non-repudiation of the client authentication, using digital signatures. To maintain the non-repudiation, the authentication must be maintained during the entire session.

Checks: C-48189r1_chk

Review the web server documentation and deployed configuration to determine whether two-way authentication is being used. If the web server is not using two-way authentication, this is NA. If two-way authentication is being used, verify that the authentication is maintained during the entire session. If the authentication is not maintained during the entire session, this is a finding.

Fix: F-47260r1_fix

Configure the web server to maintain authentication during the entire session during a two-way authenticated session.

b

The web server must be built to fail to a known safe state for defined types of failures.

SC-24 - Medium - CCI-001190 - V-41811 - SV-54388r1_rule

RMF Control

SC-24

Severity

M

CCI

CCI-001190

Version

SRG-APP-000225-WSR-000140

Vuln IDs

V-41811

Rule IDs

SV-54388r1_rule

Determining a safe state for failure and weighing that against a potential DoS for users depends on what type of application the web server is hosting. For an application presenting publicly available information that is not critical, a safe state for failure might be to shut down for any type of failure; but for an application that presents critical and timely information, a shutdown might not be the best state for all failures. Performing a proper risk analysis of the hosted applications, and configuring the web server according to what actions to take for each failure condition, will provide a known fail safe state for the web server.

Checks: C-48199r1_chk

Review the web server documentation, deployed configuration, and risk analysis documentation to determine whether the web server will fail to known states for defined failures. If the web server will not fail to known states for defined failures, this is a finding.

Fix: F-47270r1_fix

Configure the web server to fail to the states of operation during defined failures found in the risk analysis.

b

The web server must provide a clustering capability.

SC-24 - Medium - CCI-001190 - V-41812 - SV-54389r1_rule

RMF Control

SC-24

Severity

M

CCI

CCI-001190

Version

SRG-APP-000225-WSR-000141

Vuln IDs

V-41812

Rule IDs

SV-54389r1_rule

The web server may host applications that display information that cannot be disrupted, such as information that is time critical or life threatening. In these cases, a web server that shuts down or ceases to be accessible when there is a failure is not acceptable. In these types of cases, clustering of web servers is used. Clustering of multiple web servers is a common approach to providing fail safe application availability. To assure application availability, the web server must provide clustering or some form of failover functionality.

Checks: C-48200r1_chk

Review the web server documentation, deployed configuration, and risk analysis documentation to ensure the web server is configured to provide clustering functionality. If the web server is not configured to provide clustering or some form of failover functionality, this is a finding.

Fix: F-47271r1_fix

Configure the web server to provide application failover, or participate in a web cluster which provides failover.

b

The web server must display a default web page, not a directory listing, when a requested web page cannot be found.

SC-24 - Medium - CCI-001190 - V-41813 - SV-54390r1_rule

RMF Control

SC-24

Severity

M

CCI

CCI-001190

Version

SRG-APP-000225-WSR-000142

Vuln IDs

V-41813

Rule IDs

SV-54390r1_rule

The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an index.html file is a significant factor to accomplish this end. Enumeration techniques, such as URL parameter manipulation, rely upon being able to obtain information about the web server's directory structure by locating directories without default pages. In the scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.

Checks: C-48201r1_chk

Review the web server documentation and deployed configuration to locate all the web document directories. Verify that each web document directory contains a default web page. If a document directory does not contain a default web page, this is a finding.

Fix: F-47272r1_fix

Place a default web page in every web document directory.

b

Information at rest such as keys, passwords, and certificates needed for web server operation must be encrypted using a DoD-accepted algorithm to protect the confidentiality and integrity of the information.

SC-28 - Medium - CCI-001199 - V-41815 - SV-54392r1_rule

RMF Control

SC-28

Severity

M

CCI

CCI-001199

Version

SRG-APP-000231-WSR-000144

Vuln IDs

V-41815

Rule IDs

SV-54392r1_rule

Data at rest is inactive data which is stored physically in any digital form (e.g., databases, data warehouses, spreadsheets, archives, tapes, off-site backups, mobile devices, etc.). Data at rest includes, but is not limited to, archived data, data which is not accessed or changed frequently, files stored on hard drives, USB thumb drives, files stored on backup tape and disks, and files stored off-site or on a storage area network. While data at rest can reside in many places, data at rest for a web server is data on the hosting system storage devices. Data stored as a backup on tape or stored off-site is no longer under the protection measures covered by the web server. There are several pieces of data that the web server uses during operation. Keys, certificates, and passwords are examples. The web server must use an accepted encryption method, such as SHA1, to protect the confidentiality and integrity of the information.

Checks: C-48203r1_chk

Review the web server documentation and deployed configuration to locate where potential data at rest is stored. Verify that the data is encrypted using a DoD-accepted algorithm to protect the confidentiality and integrity of the information. If the data is not encrypted using a DoD-accepted algorithm, this is a finding.

Fix: F-47274r1_fix

Use a DoD-accepted algorithm to encrypt data at rest to protect the information's confidentiality and integrity.

b

The web server document directory must be in a separate partition from the web servers system files.

SC-3 - Medium - CCI-001084 - V-41821 - SV-54398r1_rule

RMF Control

SC-3

Severity

M

CCI

CCI-001084

Version

SRG-APP-000233-WSR-000146

Vuln IDs

V-41821

Rule IDs

SV-54398r1_rule

A web server is used to deliver content on the request of a client. The content delivered to a client must be controlled, allowing only hosted application files to be accesses and delivered. To allow a client access to system files of any type is a major security risk that is entirely avoidable. Obtaining such access is the goal of directory traversal and URL manipulation vulnerabilities. To facilitate such access by misconfiguring the web document (home) directory is a serious error. In addition, having the path on the same drive as the system folder compounds potential attacks such as drive space exhaustion.

Checks: C-48209r1_chk

Review the web server documentation and deployed configuration to determine where the document directory is located for each hosted application. If the document directory is not separated from the web server's system files, this is a finding.

Fix: F-47280r1_fix

Configure the web server to separate the document directories from the web server system files.

b

The web server must be protected from being stopped by a non-privileged user.

SC-5 - Medium - CCI-001092 - V-41831 - SV-54408r1_rule

RMF Control

SC-5

Severity

M

CCI

CCI-001092

Version

SRG-APP-000245-WSR-000147

Vuln IDs

V-41831

Rule IDs

SV-54408r1_rule

An attacker has at least two reasons to stop a web server. The first is to cause a DoS, and the second is to put in place changes the attacker made to the web server configuration. To prohibit an attacker from stopping the web server, the process ID (pid) of the web server and the utilities used to start/stop the web server must be protected from access by non-privileged users. By knowing the pid and having access to the web server utilities, a non-privileged user has a greater capability of stopping the server, whether intentionally or unintentionally.

Checks: C-48219r1_chk

Review the web server documentation and deployed configuration to determine where the process ID is stored and which utilities are used to start/stop the web server. Determine whether the process ID and the utilities are protected from non-privileged users. If they are not protected, this is a finding.

Fix: F-47290r1_fix

Configure the web server to protect the process ID and the utilities used for starting/stopping the web server from non-privileged users.

b

The web server must be tuned to handle the operational requirements of the hosted application.

SC-5 - Medium - CCI-001092 - V-41832 - SV-54409r1_rule

RMF Control

SC-5

Severity

M

CCI

CCI-001092

Version

SRG-APP-000245-WSR-000148

Vuln IDs

V-41832

Rule IDs

SV-54409r1_rule

A Denial of Server (DoS) can occur when the web server is so overwhelmed that it can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.

Checks: C-48220r1_chk

Review the web server documentation and deployed configuration to determine what parameters are set to tune the web server. Review the hosted applications along with risk analysis documents to determine the expected user traffic. If the web server has not been tuned to avoid a DoS, this is a finding.

Fix: F-47291r1_fix

Analyze the expected user traffic for the hosted applications. Tune the web server to avoid a DoS condition under normal user traffic to the hosted applications.

b

The web server must have security protections in place in the event of a boundary protection device failure.

SC-7 - Medium - CCI-001126 - V-41845 - SV-54422r1_rule

RMF Control

SC-7

Severity

M

CCI

CCI-001126

Version

SRG-APP-000254-WSR-000150

Vuln IDs

V-41845

Rule IDs

SV-54422r1_rule

A web server will often have several boundary protection devices securing the web server from external access and attack. In the event that these boundary devices fail or become compromised, the web server must also have in place settings, such as black and white lists, that allow the web server to continue operation in a safe and secure setting. While these settings might not be the optimal protection for the web server, the protections will allow the web server to operate for a short period of time, keeping data and applications secure, until the boundary devices can be brought back online.

Checks: C-48233r1_chk

Review the web server documentation and deployed configuration to determine the settings needed to add a layer of security should a boundary protection device fail. If the web server does not have any settings in place to secure the web server in the event of a boundary protection device failure, this is a finding.

Fix: F-47304r1_fix

Configure the web server with settings that will protect the web server environment should a boundary protection device fail.

b

The web server must employ cryptographic mechanisms (TLS/SSL) preventing the unauthorized disclosure of information during transmission.

SC-9 - Medium - CCI-001131 - V-41846 - SV-54423r1_rule

RMF Control

SC-9

Severity

M

CCI

Version

SRG-APP-000264-WSR-000151

Vuln IDs

V-41846

Rule IDs

SV-54423r1_rule

Preventing the disclosure of transmitted information requires that the web server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS). Transmission of data can take place between the web server and a large number of devices/applications external to the web server. Examples are a web client used by a user, a backend database, an audit server, or other web servers in a web cluster. If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information.

Checks: C-48234r1_chk

Review the web server documentation and deployed configuration to determine whether the transmission of data between the web server and external devices is encrypted. If the web server does not encrypt the transmission, this is a finding.

Fix: F-47305r1_fix

Configure the web server to encrypt the transmission of data between the web server and external devices.

b

Session IDs must be sent to the client using SSL/TLS.

SC-9 - Medium - CCI-001131 - V-41847 - SV-54424r1_rule

RMF Control

SC-9

Severity

M

CCI

Version

SRG-APP-000264-WSR-000152

Vuln IDs

V-41847

Rule IDs

SV-54424r1_rule

The HTTP protocol is a stateless protocol. To maintain a session, a session identifier is used. The session identifier is a piece of data that is used to identify a session and a user. If the session identifier is compromised by an attacker, the session can be hijacked. By encrypting the session identifier, the identifier becomes more difficult for an attacker to hijack, decrypt, and use before the session has expired.

Checks: C-48235r1_chk

Review the web server documentation and deployed configuration to determine whether the session identifier is being sent to the client encrypted. If the web server does not encrypt the session identifier, this is a finding.

Fix: F-47306r1_fix

Configure the web server to encrypt the session identifier for transmission to the client.

b

Cookies, such as session cookies, sent to the client using SSL/TLS must not be encrypted and compressed.

SC-9 - Medium - CCI-001131 - V-41848 - SV-54425r1_rule

RMF Control

SC-9

Severity

M

CCI

Version

SRG-APP-000264-WSR-000153

Vuln IDs

V-41848

Rule IDs

SV-54425r1_rule

A cookie is used when a web server needs to share data with the client's browser. The data is often used to remember the client when the client returns to the hosted application at a later date. A session cookie is a special type of cookie used to remember the client during the session. The cookie will contain the session identifier (ID) and may contain authentication data to the hosted application. To protect this data from easily being compromised, the cookie can be encrypted. When a cookie is sent encrypted, an attacker must spend a great deal of time and resources to decrypt the cookie. If, along with encryption, the cookie is compressed, the attacker can now use a combination of plaintext injection and inadvertent information leakage through data compression to reduce the time needed to decrypt the cookie. This attack is called Compression Ratio Info-leak Made Easy (CRIME). Cookies shared between the web server and the client must be encrypted, but should not be compressed.

Checks: C-48236r1_chk

Review the web server documentation and deployed configuration to determine whether cookies are being sent to the client encrypted and compressed. If the web server is using encryption and compression to transmit cookies, this is a finding.

Fix: F-47307r1_fix

Configure the web server to turn off cookie compression.

b

Cookies exchanged between the web server and the client, such as session cookies, must have cookie properties set to prohibit client-side scripts from reading the cookie data.

SC-9 - Medium - CCI-001131 - V-41849 - SV-54426r1_rule

RMF Control

SC-9

Severity

M

CCI

Version

SRG-APP-000264-WSR-000154

Vuln IDs

V-41849

Rule IDs

SV-54426r1_rule

A cookie can be read by client-side scripts easily if cookie properties are not set properly. By allowing cookies to be read by the client-side scripts, information such as session identifiers could be compromised and used by an attacker who intercepts the cookie. Setting cookie properties to disallow client-side scripts from reading cookies better protects the information inside the cookie.

Checks: C-48237r1_chk

Review the web server documentation and deployed configuration to determine how to disable client-side scripts from reading cookies. If the web server is not configured to disallow client-side scripts from reading cookies, this is a finding.

Fix: F-47308r1_fix

Configure the web server to disallow client-side scripts the capability of reading cookie information.

b

Cookies exchanged between the web server and the client, such as session cookies, must have cookie properties set to force the encryption of cookies.

SC-9 - Medium - CCI-001131 - V-41850 - SV-54427r1_rule

RMF Control

SC-9

Severity

M

CCI