+APP.3.2 Web Servers
---+APP.3.2.G1. Loss of Reputation
---+APP.3.2.G2. Web Server Manipulation
---+APP.3.2.G3. Denial of Service (DoS)
---+APP.3.2.G4. Loss of Confidential Data
---+APP.3.2.G5. Violation of Laws or Regulations
---+APP.3.2.G6. Insufficient Troubleshooting
---+APP.3.2.A1 Secure Web Server Configuration (B)
---+APP.3.2.A2 Protection of Web Server Files (B)
---+APP.3.2.A3 Protecting File Uploads and Downloads (B)
---+APP.3.2.A4 Logging of Events (B)
---+APP.3.2.A5 Authentication (B)
---+APP.3.2.A7 Legal Framework Conditions for Websites [Process Owner, Central Administration, Compliance Manager] (B)
---+APP.3.2.A11 Encryption via TLS (B)
---+APP.3.2.A8 Planning the Use of a Web Server (S)
---+APP.3.2.A9 Defining a Web Server Security Policy (S)
---+APP.3.2.A10 Selecting an Appropriate Web Host (S)
---+APP.3.2.A12 Suitable Handling of Errors and Error Messages (S)
---+APP.3.2.A13 Access Control for Web Crawlers (S)
---+APP.3.2.A14 Integrity Checks and Protection Against Malware (S)
---+APP.3.2.A16 Penetration Testing and Auditing (S)
---+APP.3.2.A20 Appointing Contact Persons [Central Administration] (S)
---+APP.3.2.A15 Redundancy (H)
---+APP.3.2.A18 Protection Against Denial-of-Service Attacks (H)

APP.3.2 Web Servers

Introduction

A web server is a key component of any website. It accepts requests from clients and delivers the corresponding content back to them. The data is typically transmitted via the Hypertext Transfer Protocol (HTTP) or HTTP Secure (HTTPS), which is a version encrypted with Transport Layer Security (TLS). Since web servers offer a simple interface between server applications and users, they are also frequently used for internal information and applications in organisations' own networks (intranets).

Web servers are usually available directly on the Internet and are thus exposed to attacks. That is why they must be protected by appropriate security safeguards.

Objective

The aim of this module is to protect web servers and the information they provide and process.

Scoping and Modelling

This module must be applied to all web servers in the information domain in question.

The term “web server” is used for both the software that responds to HTTP requests and the IT systems used to run such software. This module mainly addresses web server software. Security aspects of the IT systems on which web server software is installed are addressed in the corresponding modules of the SYS IT Systems layer (see SYS.1.1 General Server, as well as SYS.1.3 Linux and Unix Servers and SYS.1.2.2 Windows Server 2012).

Recommendations for integrating web servers into network architecture and protecting them with firewalls are included in modules NET.1.1 Network Architecture and Design and NET.3.2 Firewall.

The present module covers fundamental aspects that are important for the provision of web content. It does not address dynamic content provided by web applications or web services. This is dealt with in module APP.3.1 Web Applications and Web Services.

This also applies to web browsers; corresponding requirements are included in module APP.1.2 Web Browsers.

Connections to web servers are usually encrypted. Module CON.1 Crypto Concept describes how cryptographic keys can be managed in a secure manner.

In cases in which web servers are managed by a hosting provider instead of being operated in-house, module OPS.2.1 Outsourcing for Customers must be observed.

Authentication mechanisms are often used for web servers. Additional requirements for these mechanisms can be found in module ORP.4 Identity and Access Management.

Useful Resources

The Federal Office for Information Security has published the following additional documents that may be relevant for the operation of web servers:

  • “Migration auf TLS 1.2 – Handlungsleitfaden” [Migration to TLS 1.2 – BSI Action Guidelines]
  • “Sicheres Webhosting: Handlungsempfehlung für Webhoster” [Secure Web Hosting: Recommendations for Web Hosts]
  • “Sicheres Bereitstellen von Webangeboten (ISi-Webserver)” [Secure Provisioning of Websites (ISi Series for Web Servers)]

In the document “Guidelines on Securing Public Web Servers", the National Institute of Standards and Technology (NIST) also provides advice on web server security.

1. Přehled

APP.3.2.A1 Secure Web Server Configuration (B)

After the IT Operation Department has installed a web server, it MUST perform a secure basic configuration. To that end, it MUST specifically assign the web server process to a user account with minimal rights. The web server MUST also be executed in an encapsulated environment whenever this is supported by the operating system. If this is not possible, each web server SHOULD run on its own physical or virtual server.

The web server service MUST be stripped of all unnecessary write permissions. Modules and functions of the web server that are not required MUST be deactivated.
APP.3.2.A2 Protection of Web Server Files (B)

The IT Operation Department MUST protect all files on the web server (including scripts and configuration files in particular) so that they cannot be read or changed without authorisation.

It MUST be ensured that web applications can only access a defined directory tree (the WWW root directory). The web server MUST be configured to serve only files located within the WWW root directory.

The IT Operation Department MUST disable all unnecessary functions that list directories. Confidential data MUST be protected against unauthorised access. In particular, the IT Operation Department MUST ensure that confidential files are not located in public directories of the web server. The IT Operation Department MUST regularly check whether confidential files have been stored in public directories.
APP.3.2.A3 Protecting File Uploads and Downloads (B)

All files published using the web server MUST be checked in advance for malware. A maximum size for file uploads MUST be specified. Sufficient storage space MUST be reserved for uploads.
APP.3.2.A4 Logging of Events (B)

The web server MUST log at least the following events:

  • successful attempts to access resources
  • failed attempts to access resources due to a lack of authorisations, unavailable resources, or server errors
  • general error messages

The log data SHOULD be analysed regularly.
APP.3.2.A5 Authentication (B)

When clients authenticate themselves to a web server using passwords, these passwords MUST be stored in a way that is cryptographically secured and protected from unauthorised access.
APP.3.2.A7 Legal Framework Conditions for Websites [Process Owner, Central Administration, Compliance Manager] (B)

If web servers publish content or offer services for third parties, the relevant legal framework conditions MUST be observed. The organisation MUST observe the applicable telecommunication, data protection, and copyright laws.
APP.3.2.A11 Encryption via TLS (B)

The web server MUST provide secure encryption via TLS (HTTPS) for all connections that pass through untrusted networks. If it is necessary to use obsolete procedures for compatibility reasons, these SHOULD be limited to as few cases as possible.

If an HTTPS connection is used, all content MUST be delivered via HTTPS. Mixed content MUST NOT be used.
APP.3.2.A8 Planning the Use of a Web Server (S)

The purpose of a web server and the content it provides SHOULD be planned and documented. The documentation SHOULD also describe the information or services included in the web offerings in question, along with the corresponding target groups. Appropriate persons SHOULD be put in charge of technical operations and web content.
APP.3.2.A9 Defining a Web Server Security Policy (S)

A security policy stating the required safeguards and responsibilities SHOULD be drawn up. An approach to obtaining information on current security vulnerabilities SHOULD also be defined. Furthermore, the manner in which security safeguards are to be implemented and the steps to be taken in the event of a security incident SHOULD be defined.
APP.3.2.A10 Selecting an Appropriate Web Host (S)

If an organisation opts to use an external webhosting provider instead of operating its web server itself, the organisation SHOULD pay attention to the following points when selecting a suitable provider:

  • The manner in which the services are to be rendered SHOULD be contractually agreed. Security aspects SHOULD be included in writing in a service level agreement (SLA) as part of the contract.
  • The service provider SHOULD regularly check and service the IT systems used. The service provider SHOULD be obligated to respond promptly in case of technical problems or compromised customer systems.
  • The service provider SHOULD implement basic technical and organisational safeguards to protect its information domain.
APP.3.2.A12 Suitable Handling of Errors and Error Messages (S)

HTTP information and displayed error messages SHOULD not show the product name or the version of the web server used. Error messages SHOULD not reveal details regarding system information or configurations. The IT Operation Department SHOULD ensure that the web server only outputs general error messages that inform the user that an error has occurred. Each error message SHOULD contain a unique characteristic that allows administrators to trace the error. In the case of unexpected errors, it SHOULD be ensured that the web server will not remain in a state where it is vulnerable to attack.
APP.3.2.A13 Access Control for Web Crawlers (S)

Web crawler access SHOULD be regulated in accordance with the robots exclusion standard. Content SHOULD be provided with access protection to safeguard it against web crawlers that do not comply with this standard.
APP.3.2.A14 Integrity Checks and Protection Against Malware (S)

The IT Operation Department SHOULD regularly check the integrity of the configurations of the web server and the files it provides and ensure they have not been modified by attackers. The files intended for publication SHOULD be regularly checked for malware.
APP.3.2.A16 Penetration Testing and Auditing (S)

Web servers SHOULD be checked for security issues at regular intervals. Audits SHOULD also be performed regularly. The results SHOULD be documented transparently, protected adequately, and handled confidentially. Deviations SHOULD be investigated. The results SHOULD be presented to the CISO.
APP.3.2.A20 Appointing Contact Persons [Central Administration] (S)

An organisation that maintains extensive websites SHOULD designate a contact person for them. Processes, procedures, and persons responsible for problems or security incidents SHOULD be specified.

The organisation SHOULD post a contact option on its website that enables external parties to report security issues to the organisation. The organisation SHOULD define processes for handling external security reports.
APP.3.2.A15 Redundancy (H)

Web servers SHOULD be designed to be redundant. The Internet connection of a web server and other IT systems (such as the web application server) SHOULD also be designed with redundancy.
APP.3.2.A18 Protection Against Denial-of-Service Attacks (H)

A web server SHOULD be monitored continuously. Furthermore, safeguards that prevent or at least mitigate DDoS attacks SHOULD be defined and implemented.

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
includes APP.3.2.G1. Loss of Reputation
includes APP.3.2.G2. Web Server Manipulation
includes APP.3.2.G3. Denial of Service (DoS)
includes APP.3.2.G4. Loss of Confidential Data
includes APP.3.2.G5. Violation of Laws or Regulations
includes APP.3.2.G6. Insufficient Troubleshooting