1. Home
  2. Security Hardening
  3. DISA STIG Apache Site 2.2 Unix V1R11 Middleware
  4. WG237 A22 – Remote authors or content providers must have all files scanned for viruses and malicious code before uploading files to the Document Root directory.
Searching...

WG237 A22 – Remote authors or content providers must have all files scanned for viruses and malicious code before uploading files to the Document Root directory.

Details

Remote web authors should not be able to upload files to the Document Root directory structure without virus checking and checking for malicious or mobile code. A remote web user, whose agency has a Memorandum of Agreement (MOA) with the hosting agency and has submitted a DoD form 2875 (System Authorization Access Request (SAAR)) or an equivalent document, will be allowed to post files to a temporary location on the server. All posted files to this temporary location will be scanned for viruses and content checked for malicious or mobile code. Only files free of viruses and malicious or mobile code will be posted to the appropriate DocumentRoot directory.

Solution

Install anti-virus software on the system and set it to automatically scan new files that are introduced to the web server.

Supportive Information

The following resource is also helpful.

This security hardening control applies to the following category of controls within NIST 800-53: System and Information Integrity.This control applies to the following type of system Unix.

References

Source

Updated on July 16, 2022
Was this article helpful?
Yes No

Related Articles