APP.3.2.A2 Protection of Web Server Files (B)
The IT Operation Department MUST protect all files on the web server (including scripts and configuration files in particular) so that they cannot be read or changed without authorisation. It MUST be ensured that web applications can only access a defined directory tree (the WWW root directory). The web server MUST be configured to serve only files located within the WWW root directory. The IT Operation Department MUST disable all unnecessary functions that list directories. Confidential data MUST be protected against unauthorised access. In particular, the IT Operation Department MUST ensure that confidential files are not located in public directories of the web server. The IT Operation Department MUST regularly check whether confidential files have been stored in public directories.
1. Pregled
1.1 Reference
1.2 Utvrđeni zahtjevi
1.3 Povezani propisi
2. Utvrđeni zahtjevi
3. Povezani propisi
Povezani zadaci
|