NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
8.2.4
Load Balancers
Load balancers distribute HTTP requests over multiple Web servers, allowing organizations to increase
the capacity of their Web site by transparently adding additional servers. Load balancers act as virtual
servers, receiving all HTTP requests to the Web site. These requests are forwarded, based on the load
balancer’s policy, to one of the servers that hosts the Web site. The load balancer’s policy attempts to
ensure that each server receives a similar number of requests. Many load balancers are capable of
monitoring the servers and compensating if one of the servers becomes unavailable.
Load balancers are often augmented by caching mechanisms. Many of the HTTP requests an
organization’s Web server receives are identical and return identical HTTP responses. However, when
dynamic content generation is in use, these identical responses need to be regenerated each time the
request is made. To alleviate this requirement and further reduce the load on individual Web servers,
organizations can deploy caching servers.
Like network switches, load balancers are not specifically security appliances, but they are essential tools
for maintaining the availability of a Web site. By ensuring that several individual Web servers are
sharing the load, rather than placing it on a single Web server, the organization is better able to withstand
the high volume of requests used in many DoS attacks. Firewalls, switches, and routers should also be
configured (when possible) to limit the amount of traffic that is passed to the Web servers, which further
reduces the risk of successful DoS attacks.
8.2.5
Reverse Proxies
Reverse proxies are devices that sit between a Web server and the server’s clients. The term “reverse
proxy” is used because the data flow is the reverse of a traditional (forward) proxy. Reverse proxies can
serve as a valuable addition to the security of a Web server. The term reverse proxy is used rather loosely
in the industry and can include some or all of the following functionality:
Encryption accelerators, which off-load the computationally expensive processing required for
initiating SSL/TLS connections
Security gateways, which monitor HTTP traffic to and from the Web server for potential attacks and
take action as necessary, acting in essence as an application level firewall
Content filters, which can monitor traffic to and from the Web server for potentially sensitive or
inappropriate data and take action as necessary
Authentication gateways, which authenticate users via a variety of mechanisms and control access to
URLs hosted on the Web server itself.
Reverse proxies should be considered for any high-risk Web server deployment. While they do add risk
by requiring the deployment of additional hardware and software, the risk is generally outweighed by the
benefits. In addition to the functionality list above, Web proxies are also valuable because they add an
additional layer between a Web server and its less trusted users. Due to their highly specialized nature,
proxies are easier to secure than Web servers. Proxies also further obfuscate a Web server’s
configuration, type, location, and other details that are pertinent to attackers. For example, Web servers
have banners that frequently reveal the Web server type and version, and these banners sometimes cannot
be changed. With a reverse proxy, this is not an issue because the proxy can rewrite the banner before it
is sent to users.
8-12