STIGQter STIGQter: STIG Summary: APACHE 2.2 Server for Windows Security Technical Implementation Guide Version: 1 Release: 13 Benchmark Date: 25 Jan 2019:

A private web server must be located on a separate controlled access subnet.

DISA Rule

SV-33013r2_rule

Vulnerability Number

V-2243

Group Title

WA070

Rule Version

WA070 W22

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Isolate the private web server from the public DMZ and separate it from the internal general population LAN. This separation must have access control in place to protect the web server from internal threats.

Check Contents

This check verifies that the private web server is located on a separate controlled access subnet and is not a part of the public DMZ that houses the public web servers. In addition, the private web server needs to be isolated via a controlled access mechanism from the local general population LAN.

Interview the ISSO and confirm with the SA, the Web Manager, or the individual in an equivalent role. Ask for the web server’s documented procedures and processes.

Verify the documented procedures and processes include verbiage and a diagram clearly showing what devices (router, switch, firewall) lie between the private web server and the Internet, showing the private web server’s location on a separate subnet dedicated to functions not intended for public access.

If the documented procedures and processes do include verbiage and/or do not include a diagram clearly showing what devices (router, switch, firewall) lie between the private web server and the Internet, showing the private web server’s location on a separate subnet dedicated to functions not intended for public access, this is a finding.

Vulnerability Number

V-2243

Documentable

False

Rule Version

WA070 W22

Severity Override Guidance

This check verifies that the private web server is located on a separate controlled access subnet and is not a part of the public DMZ that houses the public web servers. In addition, the private web server needs to be isolated via a controlled access mechanism from the local general population LAN.

Interview the ISSO and confirm with the SA, the Web Manager, or the individual in an equivalent role. Ask for the web server’s documented procedures and processes.

Verify the documented procedures and processes include verbiage and a diagram clearly showing what devices (router, switch, firewall) lie between the private web server and the Internet, showing the private web server’s location on a separate subnet dedicated to functions not intended for public access.

If the documented procedures and processes do include verbiage and/or do not include a diagram clearly showing what devices (router, switch, firewall) lie between the private web server and the Internet, showing the private web server’s location on a separate subnet dedicated to functions not intended for public access, this is a finding.

Check Content Reference

M

Responsibility

System Administrator

Target Key

158

Comments