CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.5  Security Baselines            9  3.5.3  Application Hardening

3.5.3.1  Updates 1 2 3 4 3.5.3.3  Email Servers

Web servers are often a company’s primary interface with the outside world, since a company’s web site is generally accessible to anyone, with no authorization required.

Web servers accept HTTP requests on port 80, and HTTPS requests on port 443. You can change these port numbers, if you wish, but understand that unless your site visitors know the alternate port number at which your site lives, they won’t find it.

When looking at hardening your web server, you actually need to look at a variety of tasks (in addition to hardening the machine on which the server software is running). In the early 1990’s, a web server consisted of just the server software itself and a bunch of static pages displayed upon request. Time marched on, and now web servers typically include some sort of application server to process pages whose content is dynamically created, such as JSP or ASP pages. So, hardening a web server includes:

• Hardening the web server software
  
  
• Hardening any “third party” server-side applications it uses
  
  
• Hardening any applications you’ve written for it

3.5.3.1  Updates 1 2 3 4 3.5.3.3  Email Servers