Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Documents
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
APACHE 2.2 Server for UNIX Security Technical Implementation Guide
WA120
WA120
An XCCDF Group - A logical subset of the XCCDF Benchmark
Details
Profiles
Prose
WA120
1 Rule
<GroupDescription></GroupDescription>
Administrative users and groups that have access rights to the web server must be documented.
Low Severity
<VulnDiscussion>There are typically several individuals and groups that are involved in running a production web server. These accounts must be restricted to only those necessary to maintain web services, review the server’s operation, and the operating system. By minimizing the amount of user and group accounts on a web server the total attack surface of the server is minimized. Additionally, if the required accounts aren’t documented no known standard is created. Without a known standard the ability to identify required accounts is diminished, increasing the opportunity for error when such a standard is needed (i.e. COOP, IR, etc.).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility>System Administrator</Responsibility><Responsibility>Information Assurance Manager</Responsibility><Responsibility>Web Administrator</Responsibility><IAControls></IAControls>