Title

A private web server must be located on a separate controlled access subnet. (Cat II impact)

Discussion

Private web servers, which host sites serving controlled access data, must be protected from outside threats in addition to insider threats. Insider threat may be accidental or intentional but, in either case, can cause a disruption in service of the web server. To protect the private web server from these threats, it must be located on a separate controlled access subnet and must not be a part of the public DMZ that houses the public web servers. It also cannot be located inside the enclave as part of the local general population LAN.

Check Content

Perform a check of the site’s network diagram and a visual check of the web server. The private web server must be located on a separate controlled access subnet and not part of the public DMZ that houses the public web servers. In addition, the private web server needs to be isolated via a controlled access mechanism from the local general population LAN. If the web server is not located inside the premise router, switch, or firewall, and is not isolated via a controlled access mechanism from the general population LAN, this is a finding. NOTE: If there is a Network Reviewer available, they should be able to provide much of the information needed to validate this check.

Fix Text

Isolate the private web server from the public DMZ and separate it from the internal general population LAN. This separation must have access control in place to protect the web server from internal threats.

Additional Identifiers

Rule ID: SV-38170r1_rule

Vulnerability ID: V-2243

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.