Guidelines on Securing Public Web Servers
should be conducted at least annually. Since both of these testing techniques are applicable to
testing the Web server application as well, they are discussed in greater detail in Section 9.4.
17
4.3 Resources for Operating System Specific Security Procedures
The following Web sites provide detailed information about securing specific operating
systems:
Solaris
Paul D. J. Vandenberg and Susan D. Wyess,
Securing Solaris Servers
(
http://www.usenix.org/sage/sysadmins/solaris/
)
Unix
CERT,
Unix Security Checklist Version 2.0
(
http://www.cert.org/tech_tips/usc20_full.html
)
Windows NT
National Security Agency (NSA),
Guide to Securing Microsoft
Windows NT Networks
(
http://nsa1.www.conxion.com/winnt/guides/wnt 1.pdf
)
Windows 2000
NIST Special Publication 800 43,
Guide to Securing Windows 2000
Professional
(
http://csrc.nist.gov/publications/nistpubs/index.html
)
Windows 2000
NSA,
Guide to Securing Microsoft Windows 2000
(including 2000
Server) (
http://nsa1.www.conxion.com/win2k/index.html
).
4.4 Securing the Web Server Operating System Checklist
Completed
Action
Plan the configuration and deployment of Web server
Identify functions of Web server
Identify information categories that will be stored, processed and
transmitted through the Web server
Identify security requirements of information
Identify how information is published to the Web server
Identify a dedicated host to run Web server
Identify network services that will be provided and supported by the
Web server
Identify users and categories of users of the Web server and
determine privilege for each category of user
Identify user authentication methods for Web server
Choose appropriate operating system for Web server
Minimal exposure to vulnerabilities
Ability to restrict administrative or root level activities to authorized
users only
17
For information on other testing techniques, see NIST Special Publication 800 42,
Guideline on Network Security
Testing
(
http://csrc.nist.gov/publications/nistpubs/index.html
).
25