HOSTING SEVER SECURITY REQUIREMENTS: The web hosting site/server should meet these minimum environmental requirements. These should be common practice for most web site hosting vendors. • Ensure an anti-virus solution is deployed and active. • Ensure logging is enabled for all logins and services (i.e. SFTP, SSH, etc.). • Ensure all remote console functions are managed through secured VPN services. • Perform regular security scans with a tool similar to Nessus to assure no security deficiencies exist. • Ensure directory transversal has been disabled in the web service configuration. • Confirm web statistics are only viewable to those requiring the information. • Verify that directory indexing is turned off. • Provide for data backup, testing and annual disaster recovery testing. • Ensure that all test and development software code has been removed from the production server. • Maintain latest security patches for operating system, application frameworks, and other utilized services. (Systems that do not have critical patches made within 30 days are removed from the TAMU network per TAMU IT Policy.) • Ensure that all remote RDP sessions are two-factor enabled. WEB APPLICATION SECURITY REQUIREMENTS: The following requirements apply to the web application or software. • Verify that all authentications for web forms use encrypted protocols and auto-fill is turned off (i.e. a site SSL certificate should be installed and functional). • Verify that form field validation is implemented to prevent buffer overflows. • All user account passwords should be stored as encrypted data. • Unsuccessful login attempts to the web application should be logged and accounts locked out upon 6 unsuccessful login attempts within a 15 minute period. • A method for end users to reset or change passwords should be provided (i.e. a self-service account password management functionality). • Provide high level documentation of the framework and overall configuration for the web application environment (i.e. Application framework and version, database/version, etc.).
