NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
Demonstrates that vulnerabilities are not purely theoretical
Provides the “realism” necessary to address security issues
Allows for testing of procedures and susceptibility of the human element to social engineering.
9.5 Remotely Administering a Web Server
It is strongly recommended that remote administration and remote updating of content for a Web server
be allowed only after careful consideration of the risks. The most secure configuration is to disallow any
remote administration or content updates. However, that might not be viable for all organizations. The
risk of enabling remote administration or content updates varies considerably depending on the location
of the Web server on the network (see Section 8.1). For a Web server that is located behind a firewall,
remote administration or content updating can be implemented relatively securely from the internal
network, but not without added risk. Remote administration or content updating should generally not be
allowed from a host located outside the organization’s network unless it is performed from an
organization-controlled computer through the organization’s remote access solution, such as a VPN.
If an organization determines that it is necessary to remotely administer or update content on a Web
server, following these steps should ensure that content is implemented in as secure a manner as possible:
Use a strong authentication mechanism (e.g., public/private key pair, two-factor authentication).
Restrict which hosts can be used to remotely administer or update content on the Web server.
• Restrict by authorized users
• Restrict by IP address (not hostname)
• Restrict to hosts on the internal network or those using the organization’s enterprise remote
access solution.
Use secure protocols that can provide encryption of both passwords and data (e.g., SSH, HTTPS); do
not use less secure protocols (e.g., telnet, FTP, NFS, HTTP) unless absolutely required and tunneled
over an encrypted protocol, such as SSH, SSL, or IPsec.
Enforce the concept of least privilege on remote administration and content updating (e.g., attempt to
minimize the access rights for the remote administration/update accounts).
Do not allow remote administration from the Internet through the firewall unless accomplished via
strong mechanisms, such as VPNs.
Change any default accounts or passwords for the remote administration utility or application.
Do not mount any file shares on the internal network from the Web server or vice versa.
9-13