Title

Web administration tools must be restricted to the web manager and the web manager’s designees. (Cat II impact)

Discussion

All automated information systems are at risk of data loss due to disaster or compromise. Failure to provide adequate protection to the administration tools creates risk of potential theft or damage that may ultimately compromise the mission. Adequate protection ensures that server administration operates with less risk of losses or operations outages. The key web service administrative and configuration tools must be accessible only by the authorized web server administrators. All users granted this authority must be documented and approved by the ISSO. Access to the IIS Manager will be limited to authorized users and administrators.

Check Content

Configuration of the Apache web server is accomplished by editing flat .conf files. Interview the ISSO and ask for the web server’s documented procedures and processes. Verify the documented procedures and processes explicitly document the roles and responsibilities for the web server and web site(s) management. These documented roles will be used to validate access controls for this check. For the purpose of this check, the SA is responsible for the OS platform of the webserver. The web server manager manages the Apache installation and configuration and the web master manages the web site or sites. In some environments, the SA is also the web manager/web master. In such case, the roles should still be documented. Locate the folder in which the Apache installation’s httpd.conf and supporting .conf files are located. Right-click on the folder name and select “Properties”. Select the “Security” tab and review the accounts and assigned permissions. The System Administrator(s), web manager(s) and web master(s), as identified in the organization’s documentation, may have Full Control to the installation folder and sub-folders. Non-documented administrators, non-elevated administrators and users may have Read only permissions to the installation folder and sub-folders. If any accounts other than the documented SA, web manager, or web manager designees have greater than Read permissions to the web administration tool or control files, this is a finding.

Fix Text

Restrict access to the httpd.conf and supporting .conf files to only the documented SA, web manager, or web manager designees.

Additional Identifiers

Rule ID: SV-33072r4_rule

Vulnerability ID: V-2248

Group Title: WG220

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.