NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
Schedules of organizational principals or their exact location (whether on or off the premises)
Information on the composition or preparation of hazardous materials or toxins 32
Sensitive information relating to homeland security
Investigative records
Financial records (beyond those already publicly available)
Medical records
The organization’s physical and information security procedures
Information about organization’s network and information system infrastructure (e.g., address ranges,
naming conventions, access numbers)
Information that specifies or implies physical security vulnerabilities
Plans, maps, diagrams, aerial photographs, and architectural plans of organizational building,
properties, or installations
Information on disaster recovery or continuity of operations plans except as absolutely required
Details on emergency response procedures, evacuation routes, or organizational personnel responsible
for these issues
Copyrighted material without the written permission of the owner
Privacy or security policies that indicate the types of security measures in place to the degree that they
may be useful to an attacker.
Organizations should not use public Web servers to host sensitive information intended to be accessed
only by internal users. The compromise of a public Web server often leads to the compromise of such
data.
To ensure a consistent approach, an organization should create a formal policy and process for
determining and approving the information to be published on a Web server. In many organizations, this
is the responsibility of the CIO and/or public affairs officer. Such a process should include the following
steps:
Identify information that should be published on the Web
Identify the target audience (Why publish if no audience exists?)
Identify possible negative ramifications of publishing the information
32
email addresses are much more likely to receive spam. Two, personally identifying email addresses can provide useful
information to an attacker (e.g., possible usernames, information for social engineering attempts).
For more guidance on protecting this type of information, see the White House Memorandum dated March 19, 2000, Action
to Safeguard Information Regarding Weapons of Mass Destruction and Other Sensitive Documents Related to Homeland
Security (http://www.usdoj.gov/oip/foiapost/2002foiapost10.htm).
6-2