+APP.3.1.A12 Secure Configuration (S)

APP.3.1.A12 Secure Configuration (S)

Web applications and web services SHOULD be configured in such a way that their resources and functions can only be accessed using the secured communication paths specified for this purpose. Access to resources and functions that are not required SHOULD be disabled. If this is not possible, such access SHOULD be restricted as far as possible. The following actions SHOULD be taken when configuring web applications and web services:

  • Disabling unnecessary HTTP methods
  • Configuring character encoding
  • Removing security-related information from error messages and responses
  • Storing configuration files outside of the web root directory
  • Defining thresholds for access attempts

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.31 Incorrect Use or Administration of Devices and Systems