documentation_complete: true


title: 'A public web server, if hosted on the NIPRNet, must be isolated in an accredited DoD DMZ extension'

description: |-
    To minimize exposure of private assets to unnecessary risk by attackers,
    public web servers must be isolated from internal systems.

    Logically relocate public web servers to be isolated from internal
    systems. In addition, ensure the public web server does not have
    trusted connections with assets outside the confines of the
    demilitarizez done (DMZ) other than application and/or database servers
    that are a part of the same system as the web server.

rationale: |-
    Public web servers are by nature more vulnerabile to attack from publicly
    based sources, such as the public Internet. Once compromised, a public
    server might be used as a base for further attack on private resources,
    unless additional layers of protection are implemented. Public web servers
    must be located in a DoD DMZ Extension, if hosted on the NIPRNet, with
    carefully controlled access. Failure to isolate resources in this way
    increase risk that private assets are exposed to attacks from public
    sources. An improperly located public web server is a potential
    threat to the entire network.

severity: medium


ocil_clause: 'the web server is not isolated in an accredited DoD DMZ Extension'

ocil: |-
    Interview the SA or web administrator to see where the public web server
    is logically located in the data center. Review the site network diagram
    to see how the web server is connected to the LAN. Visually check the web
    server hardware connections to see if it conforms to the site network
    diagram.
