+APP.3.2.A1 Secure Web Server Configuration (B)

APP.3.2.A1 Secure Web Server Configuration (B)

After the IT Operation Department has installed a web server, it MUST perform a secure basic configuration. To that end, it MUST specifically assign the web server process to a user account with minimal rights. The web server MUST also be executed in an encapsulated environment whenever this is supported by the operating system. If this is not possible, each web server SHOULD run on its own physical or virtual server.

The web server service MUST be stripped of all unnecessary write permissions. Modules and functions of the web server that are not required MUST be deactivated.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.46 Loss of Integrity of Sensitive Information