+APP.3.2.A2 Protection of Web Server Files (B)

APP.3.2.A2 Protection of Web Server Files (B)

The IT Operation Department MUST protect all files on the web server (including scripts and configuration files in particular) so that they cannot be read or changed without authorisation.

It MUST be ensured that web applications can only access a defined directory tree (the WWW root directory). The web server MUST be configured to serve only files located within the WWW root directory.

The IT Operation Department MUST disable all unnecessary functions that list directories. Confidential data MUST be protected against unauthorised access. In particular, the IT Operation Department MUST ensure that confidential files are not located in public directories of the web server. The IT Operation Department MUST regularly check whether confidential files have been stored in public directories.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania

3. Powiązane regulacje

Regulacje

Powiązane zgłoszenia

Powiązania
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.46 Loss of Integrity of Sensitive Information