Security Web Servers

•

0 likes•446 views

This document from the National Institute of Standards and Technology provides guidelines for securing public web servers. It was written by Miles Tracy, Wayne Jansen, Karen Scarfone, and Theodore Winograd. The document offers recommendations to help organizations securely configure and manage their public-facing web servers.

Technology Education

Special Publication 800-44
Version 2

Guidelines on Securing Public
Web Servers

Recommendations of the National Institute of
Standards and Technology

Miles Tracy
Wayne Jansen
Karen Scarfone
Theodore Winograd

所謂：知己知彼，才能百戰百勝！本次活動我們將請Allen來分享近期常見的駭客攻擊手法，例如癱瘓伺服器、竊取個資、詐騙金錢等，若知道這些攻擊的手法，相信NPO未來在應對上將更遊刃有餘，歡迎大家踴躍來參加．簡報出處： NPO 要知道的資訊安全 Allen Own https://speakerdeck.com/allenown/npo-yao-zhi-dao-de-zi-xun-an-quan

IoT security-arrow-roadshow #iotconfua

Andy Shutka

Pegasus Spyware - What You Need to Know

Skycure

FINAL PROJECT Dean Kay Dean Kay

Case Study: Samsung's Galaxy S4 smartphone on the Google Android Platform, Kn...

Sal Velasco

Implementation of Wireless Sensor Network in disaster detection and monitoring

Sinthana Sambandam

Secure Data Workflow

OPSWAT

Web Application Securitysudip pudasaini

Securing SCADA

Jeffrey Wang , P.Eng

Securing Web Server IbmAung Khant

Security Engineering ExecutiveAung Khant

Session FixationAung Khant

Security Testing Web AppAung Khant

S Shah Web20Aung Khant

Security Engineeringwith PatternsAung Khant

Nist Sp800 42

jnewlife

Guidelines on Securing Public Web Serverswebhostingguy

NIST Server Hardening Guide SP 800-123

David Sweigert

4 - Keeping your website comfy and secure.pdf

Admin621695

Special Publication 800-114 User’s Guide to Securing External De.docx

rafbolet0

Special Publication 800-114 User’s Guide to Securing External Devices for Telework and Remote Access Recommendations of the National Institute of Standards and Technology Karen Scarfone Murugiah Souppaya User’s Guide to Securing External Devices for Telework and Remote Access Recommendations of the National Institute of Standards and Technology Karen Scarfone Murugiah Souppaya NIST Special Publication 800-114 COMPUTER SECURITY Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 November 2007 U.S. Department of Commerce Carlos M. Gutierrez, Secretary National Institute of Standards and Technology James Turner, Acting Director USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-114 Natl. Inst. Stand. Technol. Spec. Publ. 800-114, 46 pages (Nov. 2007) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. ii USER’S GUIDE TO SECURING EXTERNAL DEVICES FOR TELEWORK AND REMOTE ACCESS Acknowledgements The authors, Karen Scarfone and Murugiah Souppaya of the National Institute of Standards and Technology (NIST), wish to thank their colleagues who reviewed drafts of this document and contributed to its technical content. The authors would like to acknowledge Tim Grance, Rick Kuhn, Elaine Barker, John Connor, Chris Enloe, and Jim St. Pierre of NIST; Derrick Dicoi and Victoria Thompson of Booz Allen Hamilton; and Paul Hoffman of the VPN Consortium for their keen and insightful assistance throughout the development of the document. The authors would also like to express their thanks to all the security experts that provided c.

nist

dhimazt

What's hot

A Guide to 802.11 WiFi Security by US-CERT

David Sweigert

20150616 NPO要知道的駭客攻擊手法

Net Tuesday Taiwan

IoT security-arrow-roadshow #iotconfua

Andy Shutka

Pegasus Spyware - What You Need to Know

Skycure

FINAL PROJECT Dean Kay Dean Kay

Case Study: Samsung's Galaxy S4 smartphone on the Google Android Platform, Kn...

Sal Velasco

Implementation of Wireless Sensor Network in disaster detection and monitoring

Sinthana Sambandam

Secure Data Workflow

OPSWAT

Web Application Securitysudip pudasaini

Securing SCADA

Jeffrey Wang , P.Eng

What's hot (10)

A Guide to 802.11 WiFi Security by US-CERT

20150616 NPO要知道的駭客攻擊手法

IoT security-arrow-roadshow #iotconfua

Pegasus Spyware - What You Need to Know

FINAL PROJECT Dean Kay

Case Study: Samsung's Galaxy S4 smartphone on the Google Android Platform, Kn...

Implementation of Wireless Sensor Network in disaster detection and monitoring

Secure Data Workflow

Web Application Security

Securing SCADA

Viewers also liked

Securing Web Server IbmAung Khant

Security Engineering ExecutiveAung Khant

Session FixationAung Khant

Security Testing Web AppAung Khant

S Shah Web20Aung Khant

Security Engineeringwith PatternsAung Khant

Viewers also liked (6)

Securing Web Server Ibm

Security Engineering Executive

Session Fixation

Security Testing Web App

S Shah Web20

Security Engineeringwith Patterns

Similar to Security Web Servers

Nist Sp800 42

jnewlife

Guidelines on Securing Public Web Serverswebhostingguy

NIST Server Hardening Guide SP 800-123

David Sweigert

4 - Keeping your website comfy and secure.pdf

Admin621695

Special Publication 800-114 User’s Guide to Securing External De.docx

rafbolet0

nist

dhimazt

Nist.sp.800 124r1Global Business Professor

3 - Firewall Guidlines.pdf

Admin621695

Sp800 63 v1-0_2Hai Nguyen

Secure Web Servers Protecting Web Sites That Are Accessed By ...webhostingguy

Guide to intrusion detectionMarc Manthey

NIST Malware Attack Prevention SP 800-83

David Sweigert

Guide scada and_industrial_control_systems_security

Deepakraj Sahu

Guidelines for Smart Grid Cybersecurity Strategy, Architecture & High Level R...

Dr Dev Kambhampati

Draft NIST 7628 on CyberSecurity

GovLoop

Sp800 92Hai Nguyen

NIST Cybersecurity Event Recovery Guide 800-184

David Sweigert

Implementing ID Governance in Complex Environments-HyTrust & CA Technologies HyTrust

NIST WiFi Security SP 800-97

David Sweigert

Similar to Security Web Servers (20)

Nist Sp800 42

Guidelines on Securing Public Web Servers

NIST Server Hardening Guide SP 800-123

4 - Keeping your website comfy and secure.pdf

Special Publication 800-114 User’s Guide to Securing External De.docx

nist

Nist.sp.800 124r1

3 - Firewall Guidlines.pdf

Sp800 63 v1-0_2

Secure Web Servers Protecting Web Sites That Are Accessed By ...

Guide to intrusion detection

NIST Malware Attack Prevention SP 800-83

Guide scada and_industrial_control_systems_security

Guidelines for Smart Grid Cybersecurity Strategy, Architecture & High Level R...

Draft NIST 7628 on CyberSecurity

Sp800 92

NIST Cybersecurity Event Recovery Guide 800-184

Implementing ID Governance in Complex Environments-HyTrust & CA Technologies

NIST WiFi Security SP 800-97

Recently uploaded

Microsoft - Power Platform_G.Aspiotis.pdf

Uni Systems S.M.S.A.

By Design, not by Accident - Agile Venture Bolzano 2024

Pierluigi Pugliese

PCI PIN Basics Webinar from the Controlcase Team

ControlCase

RESUME BUILDER APPLICATION Project for students

KAMESHS29

GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024

Neo4j

How to Get CNIC Information System with Paksim Ga.pptx

danishmna97

Secstrike : Reverse Engineering & Pwnable tools for CTF.pptx

nkrafacyberclub

GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...

Neo4j

Sudheer Mechineni, Head of Application Frameworks, Standard Chartered Bank Discover how Standard Chartered Bank harnessed the power of Neo4j to transform complex data access challenges into a dynamic, scalable graph database solution. This keynote will cover their journey from initial adoption to deploying a fully automated, enterprise-grade causal cluster, highlighting key strategies for modelling organisational changes and ensuring robust disaster recovery. Learn how these innovations have not only enhanced Standard Chartered Bank’s data infrastructure but also positioned them as pioneers in the banking sector’s adoption of graph technology.

Introduction to CHERI technology - Cybersecurity

mikeeftimakis1

Epistemic Interaction - tuning interfaces to provide information for AI support

Alan Dix

Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024 https://alandix.com/academic/papers/synergy2024-epistemic/ As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

Uni Systems Copilot event_05062024_C.Vlachos.pdf

Uni Systems S.M.S.A.

UiPath Test Automation using UiPath Test Suite series, part 6

DianaGray10

Welcome to UiPath Test Automation using UiPath Test Suite series part 6. In this session, we will cover Test Automation with generative AI and Open AI. UiPath Test Automation with generative AI and Open AI webinar offers an in-depth exploration of leveraging cutting-edge technologies for test automation within the UiPath platform. Attendees will delve into the integration of generative AI, a test automation solution, with Open AI advanced natural language processing capabilities. Throughout the session, participants will discover how this synergy empowers testers to automate repetitive tasks, enhance testing accuracy, and expedite the software testing life cycle. Topics covered include the seamless integration process, practical use cases, and the benefits of harnessing AI-driven automation for UiPath testing initiatives. By attending this webinar, testers, and automation professionals can gain valuable insights into harnessing the power of AI to optimize their test automation workflows within the UiPath ecosystem, ultimately driving efficiency and quality in software development processes. What will you get from this session? 1. Insights into integrating generative AI. 2. Understanding how this integration enhances test automation within the UiPath platform 3. Practical demonstrations 4. Exploration of real-world use cases illustrating the benefits of AI-driven test automation for UiPath Topics covered: What is generative AI Test Automation with generative AI and Open AI. UiPath integration with generative AI Speaker: Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP

Climate Impact of Software Testing at Nordic Testing Days

Kari Kakkonen

My slides at Nordic Testing Days 6.6.2024 Climate impact / sustainability of software testing discussed on the talk. ICT and testing must carry their part of global responsibility to help with the climat warming. We can minimize the carbon footprint but we can also have a carbon handprint, a positive impact on the climate. Quality characteristics can be added with sustainability, and then measured continuously. Test environments can be used less, and in smaller scale and on demand. Test techniques can be used in optimizing or minimizing number of tests. Test automation can be used to speed up testing.

UiPath Test Automation using UiPath Test Suite series, part 5

DianaGray10

The Art of the Pitch: WordPress Relationships and Sales

Laura Byrne

Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes? All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.

Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...

James Anderson

Mind map of terminologies used in context of Generative AI

Kumud Singh

Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI

Vladimir Iglovikov, Ph.D.

Presented by Vladimir Iglovikov: - https://www.linkedin.com/in/iglovikov/ - https://x.com/viglovikov - https://www.instagram.com/ternaus/ This presentation delves into the journey of Albumentations.ai, a highly successful open-source library for data augmentation. Created out of a necessity for superior performance in Kaggle competitions, Albumentations has grown to become a widely used tool among data scientists and machine learning practitioners. This case study covers various aspects, including: People: The contributors and community that have supported Albumentations. Metrics: The success indicators such as downloads, daily active users, GitHub stars, and financial contributions. Challenges: The hurdles in monetizing open-source projects and measuring user engagement. Development Practices: Best practices for creating, maintaining, and scaling open-source libraries, including code hygiene, CI/CD, and fast iteration. Community Building: Strategies for making adoption easy, iterating quickly, and fostering a vibrant, engaged community. Marketing: Both online and offline marketing tactics, focusing on real, impactful interactions and collaborations. Mental Health: Maintaining balance and not feeling pressured by user demands. Key insights include the importance of automation, making the adoption process seamless, and leveraging offline interactions for marketing. The presentation also emphasizes the need for continuous small improvements and building a friendly, inclusive community that contributes to the project's growth. Vladimir Iglovikov brings his extensive experience as a Kaggle Grandmaster, ex-Staff ML Engineer at Lyft, sharing valuable lessons and practical advice for anyone looking to enhance the adoption of their open-source projects. Explore more about Albumentations and join the community at: GitHub: https://github.com/albumentations-team/albumentations Website: https://albumentations.ai/ LinkedIn: https://www.linkedin.com/company/100504475 Twitter: https://x.com/albumentations

Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!

SOFTTECHHUB

As the digital landscape continually evolves, operating systems play a critical role in shaping user experiences and productivity. The launch of Nitrux Linux 3.5.0 marks a significant milestone, offering a robust alternative to traditional systems such as Windows 11. This article delves into the essence of Nitrux Linux 3.5.0, exploring its unique features, advantages, and how it stands as a compelling choice for both casual users and tech enthusiasts.

Recently uploaded (20)

Microsoft - Power Platform_G.Aspiotis.pdf

By Design, not by Accident - Agile Venture Bolzano 2024

PCI PIN Basics Webinar from the Controlcase Team

RESUME BUILDER APPLICATION Project for students

GraphSummit Singapore | Neo4j Product Vision & Roadmap - Q2 2024

How to Get CNIC Information System with Paksim Ga.pptx

Secstrike : Reverse Engineering & Pwnable tools for CTF.pptx

GraphSummit Singapore | Graphing Success: Revolutionising Organisational Stru...

Introduction to CHERI technology - Cybersecurity

Epistemic Interaction - tuning interfaces to provide information for AI support

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

Uni Systems Copilot event_05062024_C.Vlachos.pdf

UiPath Test Automation using UiPath Test Suite series, part 6

Climate Impact of Software Testing at Nordic Testing Days

UiPath Test Automation using UiPath Test Suite series, part 5

The Art of the Pitch: WordPress Relationships and Sales

Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...

Mind map of terminologies used in context of Generative AI

Enchancing adoption of Open Source Libraries. A case study on Albumentations.AI

Goodbye Windows 11: Make Way for Nitrux Linux 3.5.0!