Classified web servers will be afforded physical security commensurate with the classification of its content.

Part of WA155

SV-14165r3_rule Classified web servers will be afforded physical security commensurate with the classification of its content.

Vulnerability discussion

When data of a classified nature is migrated to a web server, fundamental principles applicable to the safeguarding of classified material must be followed. A classified web server needs to be afforded physical security commensurate with the classification of its content to ensure the protection of the data it houses.

Check content

Interview the ISSO, the SA, the web administrator, or developers as necessary to determine if a classified web server is afforded physical security commensurate with the classification of its content (i.e., is located in a vault or a room approved for classified storage at the highest classification processed on that system). Ask what the classification of the web server is. Based on the classification, evaluate the location of the web server to determine if it is approved for storage of that classification level. If there is a traditional reviewer available, work with him/her to address specific conditions or questions. If the web server is not appropriately physically protected based on its classification, this is a finding.

Fix text

Relocate the web server to a location appropriate to classified devices.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.