Web Server Security Requirements Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000172
Group -
The web server must encrypt passwords during transmission.
Data used to authenticate, especially passwords, needs to be protected at all times, and encryption is the standard method for protecting authentication data during transmission. Data used to authe...Rule Medium Severity -
SRG-APP-000175
Group -
The web server must perform RFC 5280-compliant certification path validation.
A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make...Rule Medium Severity -
SRG-APP-000176
Group -
Only authenticated system administrators or the designated PKI Sponsor for the web server must have access to the web servers private key.
The web server's private key is used to prove the identity of the server to clients and securely exchange the shared secret key used to encrypt communications between the web server and clients. B...Rule Medium Severity -
SRG-APP-000179
Group -
The web server must use cryptographic modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance when encrypting stored data.
Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified, and cannot be relied upon to provide confidentiality or integrity, and...Rule High Severity -
SRG-APP-000179
Group -
SRG-APP-000206
Group -
SRG-APP-000211
Group -
Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.
As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. The...Rule Medium Severity -
SRG-APP-000211
Group -
Anonymous user access to the web server application directories must be prohibited.
In order to properly monitor the changes to the web server and the hosted applications, logging must be enabled. Along with logging being enabled, each record must properly contain the changes made...Rule Medium Severity -
SRG-APP-000211
Group -
The web server must separate the hosted applications from hosted web server management functionality.
The separation of user functionality from web server management can be accomplished by moving management functions to a separate IP address or port. To further separate the management functions, s...Rule Medium Severity -
SRG-APP-000220
Group -
The web server must invalidate session identifiers upon hosted application user logout or other session termination.
Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs. Session IDs are tokens...Rule Medium Severity -
SRG-APP-000223
Group -
Cookies exchanged between the web server and client, such as session cookies, must have security settings that disallow cookie access outside the originating web server and hosted application.
Cookies are used to exchange data between the web server and the client. Cookies, such as a session cookie, may contain session information and user credentials used to maintain a persistent connec...Rule Medium Severity -
SRG-APP-000223
Group -
SRG-APP-000224
Group -
The web server must generate a unique session identifier for each session using a FIPS 140-2 approved random number generator.
Communication between a client and the web server is done using the HTTP protocol, but HTTP is a stateless protocol. In order to maintain a connection or session, a web server will generate a sessi...Rule High Severity -
SRG-APP-000224
Group -
SRG-APP-000224
Group -
The web server must generate a session ID long enough that it cannot be guessed through brute force.
Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types of session attacks. By knowing the session ID, an attacker can hijack a user...Rule Medium Severity -
SRG-APP-000224
Group -
The web server must generate a session ID using as much of the character set as possible to reduce the risk of brute force.
Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types of session attacks. By knowing the session ID, an attacker can hijack a user ...Rule Medium Severity -
SRG-APP-000224
Group -
The web server must generate unique session identifiers with definable entropy.
Generating a session identifier (ID) that is not easily guessed through brute force is essential to deter several types of session attacks. By knowing the session ID, an attacker can hijack a user ...Rule Medium Severity -
SRG-APP-000225
Group -
The web server must augment re-creation to a stable and known baseline.
Making certain that the web server has not been updated by an unauthorized user is always a concern. Adding patches, functions, and modules that are untested and not part of the baseline opens the ...Rule Medium Severity -
SRG-APP-000225
Group -
SRG-APP-000225
Group -
The web server must provide a clustering capability.
The web server may host applications that display information that cannot be disrupted, such as information that is time-critical or life-threatening. In these cases, a web server that shuts down o...Rule Medium Severity -
SRG-APP-000231
Group -
Information at rest must be encrypted using a DoD-accepted algorithm to protect the confidentiality and integrity of the information.
Data at rest is inactive data which is stored physically in any digital form (e.g., databases, data warehouses, spreadsheets, archives, tapes, off-site backups, mobile devices, etc.). Data at rest ...Rule Medium Severity -
SRG-APP-000233
Group -
The web server document directory must be in a separate partition from the web servers system files.
A web server is used to deliver content on the request of a client. The content delivered to a client must be controlled, allowing only hosted application files to be accessed and delivered. To all...Rule Medium Severity -
SRG-APP-000246
Group -
The web server must restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.
A web server can limit the ability of the web server being used in a DoS attack through several methods. The methods employed will depend upon the hosted applications and their resource needs for p...Rule Medium Severity -
SRG-APP-000251
Group -
SRG-APP-000266
Group -
SRG-APP-000266
Group -
Warning and error messages displayed to clients must be modified to minimize the identity of the web server, patches, loaded modules, and directory paths.
Information needed by an attacker to begin looking for possible vulnerabilities in a web server includes any information about the web server, backend systems being accessed, and plug-ins or module...Rule Medium Severity -
SRG-APP-000266
Group -
Debugging and trace information used to diagnose the web server must be disabled.
Information needed by an attacker to begin looking for possible vulnerabilities in a web server includes any information about the web server and plug-ins or modules being used. When debugging or t...Rule Medium Severity -
SRG-APP-000295
Group -
The web server must set an absolute session timeout value of eight hours or less.
Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By cl...Rule Medium Severity -
SRG-APP-000295
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.