Guidelines on Securing Public Web Servers

3.  Planning and Management of Web Servers 

The most critical aspect of deploying a secure Web server is careful planning prior to 

installation, configuration, and deployment.  Careful planning will ensure that the Web server 

is as secure as possible and in compliance with all relative organizational policies.  Many Web 

server security and performance problems can be traced back to a lack of planning or 

management controls.  The importance of management controls is difficult to overstate.  In 

many organizations, the information technology support structure is highly fragmented.  This 

fragmentation often leads to inconsistencies, which then lead to security vulnerabilities and 

other issues.   

3.1  Planning for a Web Server Deployment 

As it is much more difficult to address security once deployment and implementation have 

occurred, security should be considered from the initial planning stage.  Organizations are 

more likely to make decisions about configuring computers appropriately and consistently 

when they develop and use a detailed, well designed deployment plan.  Developing such a 

plan enables organizations to make informed tradeoff decisions between usability and 

performance, and risk.  A deployment plan allows an organization to maintain a secure 

configuration and aids in identifying security vulnerabilities, which often manifest themselves 

as deviations from the plan. 

Organizations planning for the development of a Web server should consider the following 

steps [CERT00a]: 

Identify the purpose(s) of the Web server. 

What information categories will be stored on the Web server?  

What information categories will be processed on or transmitted through the Web 

server?  

What are the security requirements for this information? 

Is any information retrieved from or stored on another host (e.g., backend 

database, mail server)? 

What are the security requirements for any other hosts involved (e.g., backend 

database, mail server, proxy servers)?  

What other service(s) are provided by the Web server (a Web server should run 

only on a dedicated host)? 

What are the security requirements for these additional services? 

Identify the network services that will be provided on the Web server, such as those 

supplied through the following protocols: 

HTTP 

9