Guidelines on Securing Public Web Servers

Network protocol used by attack. 

Be updated with new attack signatures frequently (at least on a weekly basis). 

While not providing complete security, IDSs are a critical early warning system that can 

provide the Web administrator with the information necessary to defend the Web server from 

attack.   

8.2.3  Network Switches and Hubs 

Network switches are devices that provide connectivity between two or more hosts located on 

the same network segments.  They are similar to hubs in that they allow communications 

between hosts except that, unlike hubs, switches have more  intelligence  and send 

communications to only those hosts to which the communications are addressed.  Switches 

isolate the communications of hosts on a network segment from each other.  This isolation 

may be beneficial in reducing the impact of a DoS attack on other hosts on the network.   

When switches are employed on a network, it is much more difficult to eavesdrop on 

communications between other hosts on the network segment.  This benefit is extremely 

important when a Web server is on a network segment that is used by other hosts.  For 

example, if a hub is used and the Web server is compromised, an attacker may be able to 

eavesdrop on the communications of other hosts possibly leading to the compromise of those 

hosts or the information they communicate across the network.  E mail servers, are often 

located with the Web servers, and which, in their default configurations, receive unencrypted 

passwords.  In this instance, the compromise of the Web server would lead to the eventual 

compromise of the mail server unless a switch is being used.  A switch would prevent, or at 

least hinder, the attacker from sniffing mail server passwords from the compromised Web 

server.   

Many switches include specific security settings that further enhance the security of the 

network by making it difficult for a malicious entity to  defeat  the switch.  Some examples 

include the ability to minimize the risk of Address Resolution Protocol (ARP) spoofing and 

ARP poisoning attacks.

34

  A switch that has these security capabilities, should be enabled (see 

appropriate vendor documentation).   

34

 ARP poisoning occurs when an attacker successful updates the ARP cache on a target host with a forged ARP 

entry.  This is generally used to redirect network traffic for malicious purposes.     

75