INFORMATION SECURITY AND THE WORLD WIDE WEB (WWW) The Internet provides access to an ever-expanding storehouse of electronic information via the World Wide Web. Many people use the Web to browse, explore, and search for information. Organizations find the Web invaluable in providing information about their services and products. Web technology has been successful in linking homes, businesses, and governments together, and new applications involving connection to the Internet are appearing daily. This bulletin on the World Wide Web and security contains information from a draft report, Internet Security Policy: A Technical Guide (http://csrc.nist.gov/isptg/) which NIST plans to publish this year. Trusted Information Systems, Inc., was a contributor to the draft guide, including the material in this bulletin and in our November 1997 bulletin on Electronic Mail. The Internet The Internet is a network of networks, providing the infrastructure for communication and sharing of information. The Internet makes possible a number of services including e-mail, file transfer, login from remote systems, interactive conferences, news groups, and access to the World Wide Web. The World Wide Web (known as "WWW," "Web," or "W3") is the universe of Internet- accessible information. The World Wide Web began as a networked information project at CERN, the European Laboratory for Particle Physics. The Web has a body of software and a set of protocols and conventions which are used to traverse and find information over the Internet. Users can browse through information without being concerned about where the information is actually stored. Web clients, also called Web browsers, enable a user to navigate through information by pointing and clicking. Web servers deliver HTML (HyperText Markup Language) and other media to browsers through the HyperText Transfer Protocol (HTTP). The browsers interpret, format, and present the documents to users. The end result is a multimedia view of the Internet. The Web: Threats and Vulnerabilities Computer systems are at risk when a threat takes advantage of a vulnerability and causes harm. A threat is any circumstance or event with the potential to cause harm to an organization through the disclosure, modification, or destruction of information, or by the denial of services. Organizations have different levels of sensitivity to risk, and they should develop and adopt security policies that reflect their particular sensitivities. Vulnerabilities stemming from the use of the World Wide Web are associated with browser software and server software. While browser software can introduce vulnerabilities to an organization, these vulnerabilities are generally less severe than the threat posed by servers. A number of risks related to the use of WWW browsers to search for and retrieve information over the Internet exist. Web browsing programs are very complicated and are getting more complicated all the time. The more complicated a program is, the less secure it generally is. Flaws may then be exploited by network-based attacks. Web pages often include forms. As with e-mail, data sent from a Web browser to a Web server may pass through many interconnecting computers and networks before reaching its final destination. Users should be aware that the privacy of personal or valuable information sent using a Web page entry cannot be assured. Web servers are vulnerable to threats, especially to malicious threats. Web servers can be attacked directly, or they can be used as jumping off points to attack an organization's internal networks. Organizations should examine the underlying operating system of their Web server, the Web server software, server scripts and other software for vulnerabilities. Many organizations now support an external Web site describing their products and services. For security reasons, these servers are usually posted outside the organization's firewall. The offerings of Web sites range from simple notices to carefully developed and designed marketing vehicles. Organizations may spend a considerable amount of money and effort in developing a Web site that is informational, easily accessible to users, and creates the right company logo or style. This effort is focused on making the Web site a component of the organization's image and reputation. The public Web site can be subject to vandalism and break-ins, as documented by many well-publicized incidents over the past few years. These attackers exploited weaknesses in the base operating systems on which the Web servers ran, and broke into the sites with apparent ease. Attackers modified information, and, in some instances, added pornographic material. In one case, attackers inserted hateful language. Public embarrassment to the organization may have been the only consequence in these cases. Had the attackers modified statements of services or falsified prices, the consequences might have been more severe. Web sites that are inside the organization's firewall are often used for posting company information to employees. Information such as birthdays, organizational calendars, and phone directories are often posted. Internal Web sites are also used for internal information on the status of projects. Although internal Web sites do not carry the same visibility as external pages, they should be managed with system-specific guidance and procedures. The project leader generally takes on this responsibility. Security Policies Security policies provide the foundation for implementing security controls to reduce vulnerabilities and reduce risks. The cost of security controls that are adopted should be appropriate for the risks involved. For Web users, organizational security policies should clearly state the terms and conditions for the use of the Web, and should assign roles and responsibilities for carrying out the policies. Managers should assign specific responsibilities for the creation, management, and maintenance of an organization's external Web site. The assignment of roles helps to implement organizational policies. In smaller organizations, there may be only a Web site engineer or Webmaster who reports to a senior manager. In larger organizations, Web site responsibilities may be spread across several different groups and managers. In general, managers are responsible for identifying and implementing new business opportunities using the Web. The Web site manager oversees the overall strategy of the Web site including coordinating content preparation, distribution, and budget monitoring. The technical staff or the Webmaster is responsible for Web site development, connection, intranet, e-mail, and firewall security. Programmers and graphic artists are responsible for the installation, design, coding, debugging, and documentation of the Web site. The following guidelines give some examples (not an exhaustive list) that organizations might use to start thinking about policies to protect their Web sites. These policies are divided into situations involving low, medium, and high sensitivities to risks that could result from the use of the Web. User, manager and technical staff member responsibilities are identified where appropriate. Example Policy Statements for Browsing Low-Risk Situations User Software for browsing the Internet is provided to employees primarily for business use. Any personal use must not interfere with normal business activities, must not involve solicitation, must not be associated with any for-profit outside business activity, and must not embarrass the company. Internet users are prohibited from transmitting or downloading material that is obscene, pornographic, threatening, or racially or sexually harassing. Users of the WWW are reminded that Web browsers leave "footprints" providing a trail of all site visits. Manager Approved sources for licensed WWW software will be made available to users. Technical A local repository of useful WWW browsers, helper applications, and plug-ins will be maintained and made available for internal use. Medium-Risk Situations User Software for browsing the World Wide Web is provided to employees for business use only. Only technical staff may download files over the WWW. Manager All software used to access the WWW must be approved by the Network Manager and must incorporate all vendor-provided security patches. Technical Any files downloaded over the WWW shall be scanned for viruses, using approved virus detection software. Due to the non-secure state of the technology, all WWW browsers shall disable the use of Java, JavaScript, and ActiveX. Only company-approved versions of browser software may be used or downloaded. Non-approved versions may contain viruses or other bugs. All Web browsers shall be configured to use the firewall HTTP proxy. When using a form, ensure that the SSL or Secure Sockets layer or other such mechanism is configured to encrypt the message as it is sent from the user's browser to the Web server. High-Risk Situations User Users may browse the Internet using approved software for the sole purpose of their research or job function. No sites known to contain offensive material may be visited. Any user suspected of misuse may have all transactions and material logged for further action. URLs of offensive sites must be forwarded to the organization's Web security contact. Manager An organization-wide list of forbidden sites will be maintained. WWW software will be configured so that those sites cannot be accessed. Internet sites containing offensive material will be immediately blocked by network administrators. Contractors must follow this policy after explicit written authorization is given for access to the Internet. Technical All sites visited are logged. Web browsers shall be configured with the following rules: They will only access the Internet through the firewall HTTP proxy. They will scan every file downloaded for viruses or other malign content. Only ActiveX controls signed by the organization may be downloaded. Only Java signed by the organization may be downloaded. Only JavaScript signed by the organization may be downloaded. Example Policy Statements for Web Servers Low-Risk Situations User No offensive or harassing material may be made available via the organization's Web sites. No personal commercial advertising may be made available via the organization's Web sites. Manager Managers and users are permitted to have a Web site. The personal material on or accessible from the Web site is to be minimal. No offensive or harassing material may be made available via the organization's Web sites. No organization confidential material will be made available. Technical A local archive of Web server software and authoring tools will be maintained and made available for internal use. Medium-Risk Situations User Users are not permitted to install or run Web servers. Web pages must follow existing approval procedures regarding company documents, reports, memos, marketing information, etc. Manager Managers and users are permitted to have Web pages for a business-related project or function. Technical The Web server and any data to be accessed by the general public must be located external to the organization's firewall. Web servers shall be configured so users cannot install CGI scripts. All network applications other than HTTP should be disabled (e.g., SMTP, ftp). Information servers shall be located on a screened subnet to isolate itself from other systems on the site. This reduces the chance that an information server could be compromised and then used to attack these systems. If using a Web administrative tool, access is restricted to only authorized systems (via IP address, rather than hostname). Default passwords must always be changed. High-Risk Situations User Users are forbidden to download, install, or run Web server software. Network traffic will be monitored for unapproved Web servers, and operators of those servers will be subject to disciplinary action. Manager The Chief Information Officer (CIO) must approve the operation of any other Web server to be connected to the Internet in writing. All content on the organization's WWW servers connected to the Internet must be approved by and installed by the WebMaster. No confidential material may be made available on the Web site. Information placed on the Web site is subject to the same Privacy Act restrictions as when releasing non-electronic information. Accordingly, before information is placed on the Internet, it must be reviewed and approved for release in the same manner as other official memos, reports, or other official non-electronic information. Copyrights must be protected and permission obtained before placing copyrighted information on the Web site. Public affairs offices or legal authorities should be contacted for advice and assistance. All publicly accessible Web sites must be thoroughly tested to ensure all links work as designed and are not "under construction" when the site is opened to the public. Under construction areas are not to appear on publicly accessible Web sites. Technical Remote control of the Web server (i.e., from other than the console) is not allowed. All administrator operations (e.g., security changes) shall be done from the console. Supervisor-level logon shall not be done at any device other than the console. The Web server software, and the software of the underlying operating system, shall contain all manufacturer-recommended patches for the version in use. Incoming HTTP traffic will be scanned, and connections to unapproved Web sites will be reported. Restricting user access to addresses ending in .GOV or .COM provides a minimal level of protection for information not cleared for release to the public. A separate server or partition may be used to separate restricted use information (internal information or internal Web site) from information released to the public. All Web sites may be monitored as part of the organization's network administration function. Any user suspected of misuse may have all their transactions logged for possible disciplinary action. On UNIX systems, Web servers shall not be run as root. The implementation and use of CGI scripts shall be monitored and controlled. CGI scripts shall not accept unchecked input. Any programs that run externally with arguments should not contain metacharacters. The developer is responsible for devising the proper regular expression to scan for shell metacharacters and shall strip out special characters before passing external input to the server software or the underlying operating system. All WWW servers connected to the Internet will have a firewall between the Web server and internal company networks. Any internal WWW servers supporting critical company applications must be protected by internal firewalls. Sensitive, confidential, and private information should never be stored on an external WWW server.