34,333
edits
Changes
→Application Hardening
== Application Hardening ==
All applications and services installed on network based host systems must be included in the security hardening process to ensure that they do not provide a weak link in the security defenses. A number of common operating system based services are installed installed by default and need to be reviewed.
== Web Servers ==
Probably the most common service found on the internet today, web servers are responsible for serving web pages to web browsers.
For non-public sites, authentication methods should be put in place and for sites that are only to be accessible by internal users, an intranet approach should be used so that external access is prevented by a firewall. For the purposes of secure web based transactions Secure Sockets Layer (SSL) communication should be implemented.
Web server logs should be reviewed routinuly for suspicious activity. Any attempts to access unusual URLs on the web server typically indicate an attempt to exploit problems in outdated or unpatched web servers.
As with all software, steps should be taken to ensure that web servers are updated with the latest vendor supplied patches.
== Email Servers ==
The primary steps involved in securing mail servers is to ensure that any unneeded configuration options of the mail server software are disabled and that all the latest vendor supplied updates are applied. Relay prevention options should be activated and authentication must be used to ensure that only authorized users are able to send and receive email messages.
== FTP Servers ==
The purpose of the File Transfer Protocol (FTP) is to allow files to be download from and uploaded to remote servers. Access can be in the form of anonymous FTP and authenticated FTP. Anonymous FTP accounts should be used with caution and monitored regularly. In the case of authenticated FTP it is essential that Secure FTP be used so that logion and password credentials are encrypted, rather than transmitted in plain text.
== DNS Servers ==
Domain Name Servers (DNS) provide the translation of human friendly names for network destination (such a a web site URL) to the IP addresses understood by routers and other network devices. Steps should be taken to ensure DNS software is updated regularly and that all access to servers is authenticated to prevent unauthorized zone transfers. Access to the server may be prevented by blocking port 53, or restricting by limiting access to the DNS to a specified external systems.
