STIGQter: STIG Summary: APACHE 2.2 Site for UNIX Security Technical Implementation Guide Version: 1 Release: 11 Benchmark Date: 25 Jan 2019:

Only web sites that have been fully reviewed and tested must exist on a production web server.

DISA Rule

SV-32830r2_rule

Vulnerability Number

V-2254

Group Title

WG260

Rule Version

WG260 A22

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

The presences of portions of the web site that proclaim Under Construction or Under Development are clear indications that a production web server is being used for development. The web administrator will ensure that all pages that are in development are not installed on a production web server.

Check Contents

Query the ISSO, the SA, and the web administrator to find out if development web sites are being housed on production web servers.

Proposed Questions:
Do you have development sites on your production web server?
What is your process to get development web sites / content posted to the production server?
Do you use under construction notices on production web pages?

The reviewer can also do a manual check or perform a navigation of the web site via a browser could be used to confirm the information provided from interviewing the web staff. Graphics or texts which proclaim Under Construction or Under Development are frequently used to mark folders or directories in that status.

If Under Construction or Under Development web content is discovered on the production web server, this is a finding.

Vulnerability Number

V-2254

Documentable

False

Rule Version

WG260 A22

Severity Override Guidance

Query the ISSO, the SA, and the web administrator to find out if development web sites are being housed on production web servers.

Proposed Questions:
Do you have development sites on your production web server?
What is your process to get development web sites / content posted to the production server?
Do you use under construction notices on production web pages?

The reviewer can also do a manual check or perform a navigation of the web site via a browser could be used to confirm the information provided from interviewing the web staff. Graphics or texts which proclaim Under Construction or Under Development are frequently used to mark folders or directories in that status.

If Under Construction or Under Development web content is discovered on the production web server, this is a finding.

Check Content Reference

M

Responsibility

Web Administrator

Target Key

161

Comments