A private web server will be located on a separate controlled access subnet.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2243	WA070	SV-2243r4_rule	EBPW-1	Medium

Description
Private web servers, which host sites that serve controlled access data, must be protected from outside threats in addition to insider threats. Insider threat may be accidental or intentional but, in either case, can cause a disruption in service of the web server. To protect the private web server from these threats, it must be located on a separate controlled access subnet and must not be a part of the public DMZ that houses the public web servers. It also cannot be located inside the enclave as part of the local general population LAN.

Description

Private web servers, which host sites that serve controlled access data, must be protected from outside threats in addition to insider threats. Insider threat may be accidental or intentional but, in either case, can cause a disruption in service of the web server. To protect the private web server from these threats, it must be located on a separate controlled access subnet and must not be a part of the public DMZ that houses the public web servers. It also cannot be located inside the enclave as part of the local general population LAN.

STIG	Date
Web Server STIG	2010-10-07

Details

Check Text ( C-30021r1_chk )
This check verifies, through a discussion with the IAO/SA/Web Manager, a check of the site’s network diagram and a visual check of the web server, that the private web server is located on a separate controlled access subnet and is not a part of the public DMZ that houses the public web servers. In addition, the private web server needs to be isolated via a controlled access mechanism from the local general population LAN. NOTE: If there is a Network Reviewer available, he/she should be able to provide much of the information needed to validate this check. Proposed Questions: What devices (i.e., router, switch, or firewall) lie between the web server and Internet connectivity? Is the private web server on a separate subnet? Is the private web server on a LAN with servers and workstations dedicated to functions not intended for public access? If the web server is not located inside the premise router, switch, or firewall and is not isolated via a controlled access mechanism from the general population LAN, this is a finding.

Check Text ( C-30021r1_chk )

This check verifies, through a discussion with the IAO/SA/Web Manager, a check of the site’s network diagram and a visual check of the web server, that the private web server is located on a separate controlled access subnet and is not a part of the public DMZ that houses the public web servers. In addition, the private web server needs to be isolated via a controlled access mechanism from the local general population LAN.

NOTE: If there is a Network Reviewer available, he/she should be able to provide much of the information needed to validate this check.

Proposed Questions:

What devices (i.e., router, switch, or firewall) lie between the web server and Internet connectivity?
Is the private web server on a separate subnet?
Is the private web server on a LAN with servers and workstations dedicated to functions not intended for public access?

If the web server is not located inside the premise router, switch, or firewall and is not isolated via a controlled access mechanism from the general population LAN, this is a finding.

Fix Text (F-26864r1_fix)
Isolate the private web server from the public DMZ and separate it from the internal general population LAN. This separation must have access control in place to protect the web server from internal threats.