# Presentation: 014640

## Web Server Security:Protecting Your Pages

- NOAA OAR WebShop 2001
- August 2nd, 2001
- Jeremy Warren

## Overview

- Vulnerabilities
- General Security Solutions
- Network Architecture Security Solutions

## Vulnerabilities

- The Risks
- The Numbers

## Vulnerabilities: The Risks

- Web Servers are often more vulnerable than other systems because they are meant to be accessed.
- Forms, scripts, and dynamic content compound the problem by granting higher levels of access to the system
- Web Servers are a high visibility target

## Vulnerabilities: The Risks (con’t)

- Data interceptions is a seen as a “Network Problem” not necessarily a “Web Server Problem”
- Servers and workstations often have web services running by default
- Wide spread use of Windows and Linux makes them easy targets

## Vulnerabilities: The Numbers

- 54% of all attacks on OAR systems have targeted Web Servers (since 2000)
- 64% of those attacks have been successful (since 2000)
- Note: These figures only include what was officially reported

## General Security Solutions – The Big Three

- 1)	Disable Unused Services & Plug-ins
- 2)	System Patches
- Router Filters & Firewalls

## General Security Solutions – Other Really Good Things To Do

- 4) Security Policies
- 5) Enforce Strong Passwords
- 6) Server Logs
- 7) Preventing Data Interception
- 8) Script Security

## 1) Disable Unused Services & Plug-ins

- Turn off unnecessary web services
- Disable FTP
- Disable server-side includes
- Any other services that are not needed on the web server (ex. tftp, sendmail, gopher, finger, cgi scripts, ODBC drivers, etc..)
- Removed sample files installed by default

## 2) System Patches

- Patch system regularly
- Use automation tools when possible (rpm)
- Use patch version checking tools (_[http://grc.com/pw/patchwork.htm](http://grc.com/pw/patchwork.htm)_)
- Get patches from a secure location (NOAA’s security ftp site)
- Patch both OS and Web Server Software

## 3) Router Filters and Firewalls

- Restrict access to TCP/IP ports (by filtering at the router, using wrappers, etc)
- Use Stateful Firewalls that can filter on both source and destination
- Log server access at the firewall
- 	*(more about logging below)*
- Packet content filtering (advanced firewalls that examine every packet – will significantly impact transfer rates)

## 4) Security Policies

- Increase level of security awareness among users and content providers
- Serve as requirements for procurement of future technical solutions
- Allow for action following violations
- All OAR sites have a Security Plan with rules of behavior for the system

## 5) Enforce Strong Passwords

- DOC Password Policy (_[https://www.csp.noaa.gov](https://www.csp.noaa.gov/)__)_
- Enforce changing passwords every 90 days
- Passwords must have at least 8 characters
- Passwords must always have at least one non-alphanumeric character
- Use a password crack tool to audit user passwords (check with supervisors first!)

## 6) Server Logs

- Keep access logs
- Check logs on a regular basis
- Store logs in a secure place
- Hackers like to delete logs to cover their tracks
- Store log files on a separate server, in hard copy, or burn them to a CD as they are created

## 7) Preventing Data Interception

- Use Secure Sockets Layer (SSL) to encrypt data where necessary
- Free SSL protocols are available (_[http://www.apache-ssl.org/](http://www.apache-ssl.org/)_)
- Use authentication only when necessary
- Only authenticate to the NEMS LDAP when using SSL.

## 8) Script Security

- Never write Shell scripts in CGI!
- Perl and php are generally the best to use
- Use well supported libraries (they allow for higher portability and are generally well patched)
- Use the current version of the interpreter or compiler (they have better security warnings)
**Go to Ann Keane’s presentation tomorrow at 10:45!**

## Network Architecture Security Solutions

- DMZ’s (De-Militarize Zones)
- Development Servers
- Site Mirroring

## DMZ’s - Method

- Basic Design
- Design your network with a firewall between your systems and the outside world ( more restrictive filter set)
- Add a second firewall level outside of your existing firewall (less restrictive filter set)
- The area between the two firewalls is your DMZ
- Put your external web servers in the DMZ

## DMZ’s - Benefits

- Protects your systems with a more restrictive filter set without inhibiting access to your Web Server
- Protects your Web Server with a less restrictive filter set (which is better than leaving it in the open)
- Protects your Network should your Web Server be broken into

## Development Servers

- Extension of the DMZ idea
- Method
- Put a Development Server on the interior network
- Users only update the Development Server
- The Development Server replicates its changes to the external Web Server on a regular basis
- The Development Server decreases the impact of hacks on the Web Server (it doesn’t prevent them)

## Site Mirroring

- Duplicate production site on multiple servers
- Method
- Can be done simply through DNS
- Can also be done with a load balancer to increase performance of the site
- If one server gets hacked then it can be shut down without impacting the web site

## Wrap Up

- Vulnerabilities
- More than half of all attacks are on Web Servers because they are high risk, high visibility targets
- We can protect our systems through:

- Network Architecture Solutions
- DMZ’s
- Development Servers
- Site Mirroring

- General Security Principles
- Patching
- Disabling Services
- Installing firewalls

## Additional Information

- NOAA Security Page – _[https://www.csp.noaa.gov](https://www.csp.noaa.gov/)_
- WWW Security FAQ – _[http://www.w3.org/Security/faq/wwwsf.html](http://www.w3.org/Security/faq/wwwsf.html)_
- Apache Security Tips – _[http://httpd.apache.org/docs/misc/security_tips.html](http://httpd.apache.org/docs/misc/security_tips.html)_