Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 449Step 8. PortsServices that run on the server use specific ports so that they can serve incomingrequests. Close all unnecessary ports and perform regular audits to detect new portsin the listening state, which could indicate unauthorized access and a securitycompromise.During this step, you:● Restrict Internet-facing ports to TCP 80 and 443.●Encrypt or restrict intranet traffic.Restrict Internet-Facing Ports to TCP 80 and 443Limit inbound traffic to port 80 for HTTP and port 443 for HTTPS (SSL).For outbound (Internet-facing) NICs, use IPSec or TCP filtering. For moreinformation, see “How To: Use IPSec” in the “How To” section of this guide.Encrypt or Restrict Intranet TrafficFor inside (intranet-facing) NICs, if you do not have a secure data center and youhave sensitive information passing between computers, you need to considerwhether to encrypt the traffic and whether to restrict communications between theWeb server and downstream servers (such as an application server or databaseserver). Encrypting network traffic addresses the threat posed by networkeavesdropping. If the risk is deemed sufficiently small you may choose not toencrypt the traffic.The type of encryption used also affects the types of threats that it addresses.For example, SSL is application-level encryption, whereas IPSec is transport layerencryption. As a result, SSL counters the threat of data tampering or informationdisclosure from another process on the same machine, particularly one runningunder a different account in addition to the network eavesdropping threat.Step 9. RegistryThe registry is the repository for many vital server configuration settings. As such,you must ensure that only authorized administrators have access to it. If an attackeris able to edit the registry, he or she can reconfigure and compromise the security ofyour server.During this step, you:● Restrict remote administration of the registry.●Secure the SAM (stand-alone servers only).