NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
6. Securing Web Content
The two main components of Web security are the security of the underlying server application and OS,
and the security of the actual content. Of these, the security of the content is often overlooked.
Maintaining effective content security itself has two components. The more obvious is not placing any
proprietary, classified, or other sensitive information on a publicly accessible Web server, unless other
steps have been taken to protect the information via user authentication and encryption (see Section 7).
The less obvious component of content security is avoiding compromises caused by the way particular
types of content are processed on a server. As organizations have gotten better at protecting and
hardening their network perimeters, OSs, and Web servers, attackers have increasingly turned to
exploiting vulnerabilities in Web applications and the way information is processed on Web servers.
These application layer attacks exploit the interactive elements of Web sites.
6.1 Publishing Information on Public Web Sites
Too often, little thought is given to the security implications of the content placed on the Web site. Many
organizations do not have a Web publishing process or policy that determines what type of information to
publish openly, what information to publish with restricted access, and what information should be
omitted from any publicly accessible repository. This is troublesome because Web sites are often one of
the first places that malicious entities search for valuable information. For example, attackers often read
the contents of a target organization’s Web site to gather intelligence before any attacks [Scam01]. Also,
attackers can take advantage of content available on a Web site to craft a social engineering attack or to
use individuals’ identifying information in identity theft [FTC06].
Absent compelling reasons, a public Web site should not contain the following information:
Classified records
Internal personnel rules and procedures
Sensitive or proprietary information
Personal information about an organization’s personnel or users 30
• Home addresses and telephone numbers
• Uniquely identifying information, particularly SSNs
• Detailed biographical material (that could be employed for social engineering)
• Staff family members
Telephone numbers, e-mail addresses, 31 or general listings of staff unless necessary to fulfill
organizational requirements
30
31
For Federal agencies, this would include all items covered by the Privacy Act of 1974
(http://www.usdoj.gov/04foia/privstat.htm). This encompasses personally identifiable information (PII), which is
information that can be used to uniquely identify, locate, or contact an individual.
When an email address must be published on a Web site, consider the use of generic email addresses or aliases (e.g.,
webmaster@mydomain.gov as opposed to jane_doe@mydomain.gov). There are two reasons to do this. One, published
6-1