JavaScript isn't enabled in your browser, so this file can't be opened. Enable and reload.

1 of 8

Week 7:�Web Server - Hardening Basics�

SEC 260

2 of 8

Web Server Security and CIA

Remember the goals of information security:

Confidentiality

Integrity

Availability

3 of 8

CIA

Based on what we have covered so far – what web technologies apply to CIA?

4 of 8

Confidentiality: Hardening Topics

Web traffic in transit?

HTTPS

Authentication

Protect resources by requiring authentication
Protect authentication credentials using secure technologies

Least Privilege

Only allow users to access the resources they need
Prevent exposing unnecessary information about the server/application itself

5 of 8

Confidentiality: Hardening Topics (cont…)

File System Protections

Set appropriate permissions on web content, scripts, and configuration files
Prevent “file inclusion” vulnerabilities

Data Store Protections

Prevent unauthorized access methods to databases and other backend data stores (e.g. prevent SQL injection)

Server-Side Script Protections

Prevent script execution when not needed

6 of 8

Integrity: Hardening Topics

Ensuring data doesn’t change:

Using certificates and digital signatures
Preventing Man-in-the-Middle

Prevent File System Changes

Monitor file-system for unauthorized changes (integrity monitoring)
Read-only permissions to web content whenever possible

Server-Side Script Protections

Prevent script execution when not needed

7 of 8

Availability: Hardening Topics

Configuration Settings:

Protect server/service from resource exhaustion (connection limits, timeouts)

Unload unneeded modules/services

Simplify the configuration to the minimal required resources
Reduced complexity can improve reliability of server/service