A public OHS installation, if hosted on the NIPRNet, must be isolated in an accredited DoD DMZ Extension.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-64657	OH12-1X-000209	SV-79147r1_rule		Medium

Description
To minimize exposure of private assets to unnecessary risk by attackers, public web servers must be isolated from internal systems. Public web servers are by nature more vulnerable to attack from publically based sources, such as the public Internet. Once compromised, a public web server might be used as a base for further attack on private resources, unless additional layers of protection are implemented. Public web servers must be located in a DoD DMZ Extension, if hosted on the NIPRNet, with carefully controlled access. Failure to isolate resources in this way increase risk that private assets are exposed to attacks from public sources.

Description

To minimize exposure of private assets to unnecessary risk by attackers, public web servers must be isolated from internal systems. Public web servers are by nature more vulnerable to attack from publically based sources, such as the public Internet. Once compromised, a public web server might be used as a base for further attack on private resources, unless additional layers of protection are implemented. Public web servers must be located in a DoD DMZ Extension, if hosted on the NIPRNet, with carefully controlled access. Failure to isolate resources in this way increase risk that private assets are exposed to attacks from public sources.

STIG	Date
Oracle HTTP Server 12.1.3 Security Technical Implementation Guide	2019-01-04

Details

Check Text ( C-65399r1_chk )
1. As required, confirm with the OHS Administrator that OHS is installed in a DMZ and isolated from internal systems. 2. If not, this is a finding.

Fix Text (F-70587r1_fix)
1. Relocate the OHS server to be in a DMZ, isolated from internal systems. 2. Confirm that the OHS server only has connections to supporting Application and Database Servers.