Master Checklists

Auditing Web Servers

Checklist for Auditing Web Servers

1. qVerify that the web server is running on a dedicated system and not in conjunction with other critical applications.

2. qVerify that the web server is fully patched and updated with the latest approved code.

3. qDetermine if the web server should be running additional tools to aid in the protection of the web server.

4. qVerify that unnecessary services or modules are disabled. Running services and modules should be running with least privileged accounts.

5. qVerify that only appropriate protocols and ports are allowed to access the web server.

6. qVerify that accounts allowing access to the web server are managed appropriately and hardened with strong passwords.

7. qEnsure that appropriate controls exist for files, directories, and virtual directories.

8. qEnsure that the web server has appropriate logging enabled and secured.

9. qEnsure that script extensions are mapped appropriately.

10. qVerify that unnecessary or unused ISAPI filters are removed from the server.

11. qVerify the validity and use of any server certificates in use.

Auditing Web Applications

Checklist for Auditing Web Applications

1. qVerify that all input is validated prior to use by the web server.

2. qVerify that proper authorization controls are enforced.

3. qBroken authentication and session management

4. qReview the website for cross-site scripting vulnerabilities.

5. qVerify that the server is updated with all known patches for buffer overflows.

6. qEnsure that the web application is protected against injection attacks.

7. qEvaluate the use of proper error handling.

8. qEnsure that secure storage mechanisms are used correctly and appropriately.

9. qDetermine the use of adequate controls to prevent denial of service.

10. qReview controls surrounding maintaining a secure configuration.