How to Protect Your Web Server from Attacks

Oct 11, 2007

The National Institute of Standards and Technology has released a new publication that provides detailed tips on how to make web servers more resistant to potential attacks. Called “Guidelines on Securing Public Web Servers,” the publication covers some of the latest threats to web security, while reflecting general changes in web technology that have taken place since the first version of the guide was published 5 years ago.

Web servers are the software programs that make information available over the Internet. They are often the most frequently targeted hosts on a computer network.

Attackers gaining unauthorized access to the server may be able to change information on the site (e.g., defacing a web page), access sensitive personal information, or install malicious software to launch further attacks. Recently emerging threats include “pharming,” in which people attempting to visit a web site are redirected surreptitiously to a malicious site.

How does one thwart these attacks? The guide advocates taking basic steps such as keeping up-to-date on patches (fixes and updates) for web server software and the underlying operating system. Also, the guide recommends configuring the software in as secure a fashion as possible, for example by disabling unnecessary software services and applications, which may themselves have security holes that can provide openings for attacks.

Another key recommendation, especially for large-scale operations, is to consider the proper human-resource requirements for deploying and operating a secure web server, by staffing the appropriate complement of IT experts (such as system and network administrators) all doing their jobs to establish and promote security.

The guide advocates “defense in depth”—installing safeguards at various points of entry into the server, from the router that handles all incoming data traffic to the specific machines that house the server software. In addition, the guide recommends, organizations should monitor log files, create procedures for recovering from attacks, and regularly test the security of their systems.

The guide is designed for federal departments and agencies, but may be applicable to any web server to which the outside world has access. The guide is available free of charge at csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf .

Source: NIST

Explore further: We don't need digital detox, but there is a need to rethink our relationship with technology

Related Stories

Mexico boosts protection of near-extinct porpoise

3 hours ago

Mexico is greatly expanding a protected area of the Gulf of California and boosting navy patrols in an effort to save the vaquita marina, a small porpoise facing imminent extinction.

Court monitor: Apple antitrust cooperation has 'declined'

3 hours ago

Apple Inc.'s cooperation with efforts to improve its compliance with antitrust laws after a federal judge concluded it colluded with electronic book publishers to raise prices five years ago took on an "adversarial tone" ...

SEC questions LA Unified on use of bonds for iPad project

3 hours ago

The Securities and Exchange Commission recently questioned Los Angeles Unified School District officials as part of informal inquiry into whether they properly used bond funds for a beleaguered $1.3 billion project to provide ...

Recommended for you

Data deluge: MLB rolls out Statcast analytics on Tuesday

20 minutes ago

Which outfielder sprints the fastest and runs the longest to snag line drives into the gap? Which shortstop is best at throwing from the grass to nip the runner at first? Which catcher gets the ball to second ...

Germanwings crash could prompt remote override tech review

Apr 15, 2015

The head of Germany's air traffic control agency says the crash of a Germanwings jet in France last month raises the question of whether technology should be put in place allowing authorities on the ground to take control ...

User comments : 0

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.