Top 10 IT security actions: No. 9 Isolate web-facing applications - ITSM.10.099

1 IT security risk management: An overview

1.1 Top 10 IT security actions

This document provides guidance on isolating web-facing applications by using virtualization technology. Isolating these applications reduces your organization’s exposure to common cyber threats that impact web-facing applications and that could compromise your networks, systems, and IT assets. This guidance is based on the advice in ITSM.10.189^{Footnote 1} and the security controls listed in Annex 3A of ITSG 33^{Footnote 2}.

Our top 10 recommended IT security actions, which are listed in Figure 1 below and ITSM.10.189^{Footnote 1}, are based on our analysis of trends in cyber security threat activities and the impact of those threat activities on Internet connected networks. By implementing all 10 of the actions, you can address many of your organization’s IT security vulnerabilities.

Cyber security threats can have varying impacts based on your organization’s business and technical environment. To ensure your organization’s security needs are appropriately met, review your current security and risk management activities.

Figure 1: Top 10 IT security actions - No. 9 isolate web-facing applications

Long description - Top 10 IT security actions - No. 9 isolate web-facing applications

Figure 1 provides a list of the top 10 IT security actions. Item number 9, “Isolate web-facing applications”, is highlighted as it is the security action that applies to this publication. Figure 1 includes the following 10 items in the list:

1. Consolidate, monitor, and defend internet gateways
2. Patch operating systems and applications
3. Enforce the management of administrative privilages
4. Harden operating systems and applications
5. Segment and separate information
6. Provide tailored training
7. Protect information at the enterprise level
8. Apply protection at the host level
9. Isolate web-facing applications
10. Implement application allow lists

1.2 Relationship to the IT security risk management process

Our top 10 security actions are taken from the security controls listed in Annex 3A of ITSG-33^{Footnote 2}. ITSG 33^{Footnote 2} describes the roles, responsibilities, and activities that help organizations manage their IT security risks and includes a catalogue of security controls (standardized security requirements to protect the confidentiality, integrity, and availability of IT assets). These security controls are divided into the following three classes, which are further divided into several families (or groupings) of related security controls:

• Technical security controls: Security controls that are implemented and executed by information systems primarily through security mechanisms contained in hardware, software, and firmware components.
• Operational security controls: Information system security controls that are primarily implemented and executed by people and typically supported using technology, such as supporting software.
• Management security controls: Security controls that focus on the management of IT security and IT security risks.

As illustrated in Figure 2, this document includes actions that fall under the Access Control (AC) and the System Communication Protection (SC) control families. This document addresses the following controls:

• AC 6 Least privilege
• SC 32 Information system partitioning

See Annex A of this document for more information on controls AC 6 and SC 32.

Figure 2: Applicable security control classes and families described in ITSG-33 applications

Long description - Applicable security control classes and families described in ITSG-33

As depicted in Figure 2 with highlighted text, this publication focuses on technical, operational, and management security controls. It includes some of the actions that fall under the Access Control and System and Communication Protection control families.

The full list of classes of security controls and their related control families or groupings is also presented in Figure 2, as follows:

Technical security controls

• Access control
• Audit and accountability
• Identification and authentication
• System and communications protection

Operational security controls

• Awareness and training
• Configuration management
• Contingency planning
• Incident response
• Maintenance
• Media protection
• Physical and Environmental Protection
• Personnel Security
• System and Information Integrity

Management security controls

• Security assessment and authorization
• Planning
• Risk assessment
• System and services acquisition

You can use the security controls discussed in this document and in Annex 3A of ITSG 33^{Footnote 2} as a foundation when determining how best to manage your organization’s cyber security risks and protect its networks, systems, and IT assets. However, keep in mind that implementing these controls is only one part of the IT security risk management process.

ITSG 33^{Footnote 2} describes a process based on two levels of risk management activities: organization level activities and information system level activities. These two levels of activities will help your organization identify its security needs for both the entire organization and its information systems. Once you understand your security needs at each level, you can identify which security controls your organization needs to implement and maintain based on your accepted level of risk.

Note: The security controls and best practices in this document are not described in depth. As with any IT solution, your organization is responsible for reviewing its business and security requirements to determine how best to tailor your approach to security.

2 Threats to web-facing applications

This section provides an overview of the common threats to web-facing applications. Isolating all web-facing applications is one of the essential actions that you can take to reduce your organization’s exposure to cyber threats.

A web facing application is any program that can be accessed over a network connection and uses web technology and browsers to perform tasks over the Internet, such as email, word processors, file conversion, e commerce, calendars, or IoT devices. Web applications are convenient and cost effective. Data can be stored on-premise, in the cloud, or in a hybrid environment, which makes the information accessible when needed. Web-facing applications can be used to improve business processes and support remote work. Generally, web applications are easy to install and maintain because patches and updates can be rolled out remotely to devices.

However, when applications are developed, security is often an afterthought. If security measures are not built into applications, they can be vulnerable to unauthorized access, data leaks, and other security issues. Code flaws and defects can also leave applications vulnerable to attacks, such as cross site scripting (XSS) and structured query language (SQL) injection attacks.

2.1 Understand the common threats

Cyber threat actors look for ways to modify application parameters and execute unauthorized or malicious functionalities on applications. By exploiting application vulnerabilities, a threat actor can gain unauthorized access to sensitive information like personal or business information that is processed by and stored on web facing applications. Attacks on web facing applications can result in information exposure, identity theft, compromise of the application itself or other organizational systems, or denial of service.

Table 1 lists some examples of common threats to web-facing applications, including the method of attack and the potential impact the attack could have on your organization and on users of the application. The data in Table 1 is derived from the Open Web Application Security Project (OWASP) Top 10 Web Application Security Risks³. Note that this list of threats is not exhaustive.

3 Security controls for web-facing applications

This section introduces actions that your organization can take when isolating web facing applications. These actions are based on security controls, SC 32 Information System Partitioning and AC-6 Least Privilege. For more information on these controls, see annexes A.1 and A.2 in this document.

Although the security controls described below are a good start to protecting your organization, you should also consider taking the following actions:

• scan and test applications for vulnerabilities
• update and patch applications as soon as updates and patches are available
• implement an application allow list
• implement web application firewalls
  • There are two different types of application firewalls: network-based application firewalls and host-based application firewalls. Both provide a barrier which protects local system resources from being accessed from the outside.

3.1 Information system partitioning (SC-32)

Your organization should isolate web facing applications so that they reside in separate domains or environments to reduce the risk of backend networks and information systems being compromised. Isolated applications are restricted or prohibited from accessing the network or communicating with other information system components. If an isolated application is infected with malware or compromised, the exploit will be contained and will not be able to spread beyond the isolated environment, known as a sandbox, to infect other hosts and systems.

Segmenting your networks into security zones enables you to isolate web-facing applications and protect your organization’s systems and data. Segmentation reduces your organization’s exposure to threats that could exploit publicly known vulnerabilities and compromise your networks, systems, and IT assets.

Network segmentation refers to a networking technique that divides a network into smaller, distinct sub-networks (sub-nets), enabling organizations to compartmentalize and deliver unique security controls and services to each sub-net. Network security zones are logical groupings based on the underlying implementation of network segmentation. The unique security controls protecting a zone are defined within the zone interface point (ZIP).

A ZIP is a system that controls the flow of information between two zones. The differentiation between zones is called the boundary. The boundary contains ZIPs which are the only connecting points between zones. All data communication between zones must be through a ZIP which exclusively connects these two zones and creates a distinct communication path.

A cloud ZIP is used to describe the controlled interface connecting two zones. In a cloud environment, there are other logical segmentation mechanisms which may not necessarily meet all the security function requirements of a ZIP, but they can have a role in network zoning.

Cloud resources are deployed within these specific zones. In a traditional network environment it would be expected to find a ZIP at the boundary of the zone. Within a cloud environment, a ZIP can be situated at the boundary of a zone, or it can be within a zone associated with specific cloud resource network interfaces, such as a virtual machine (VM) or host.

3.1.1 Virtualization

A common way to isolate web-facing applications is through virtualization. Desktop virtualization is a software-based technology used to create software versions of IT systems and services that are traditionally implemented in separate physical hardware. These software versions, or virtual instances, can dramatically increase efficiency and decrease costs. You can use hardware to its full capacity by distributing its capabilities among many different services.

Desktop virtualization separates the logical desktop from the physical device. The user interacts with the host computer by using another desktop or mobile device that is connected to your organization’s network. With regards to applications, you can use virtual desktops to have centralized control over which applications user can access on their workstations.

Using virtualization technology, you can encapsulate an application so that it is separate from other programs or from the operating system (OS) on which it is running. Although the application still executes and runs as intended, it is not installed on the host.

3.1.1.1 Virtual machine (VM)

With virtualization, you can run your applications on fewer physical servers. Applications and software run virtually on a simulated computer system called a VM. A VM is the emulated equivalent of a computer system that runs on top of another system. By using a VM, you can run applications in isolated environments. You could also use a container, which is an isolated process but is not a full, independent machine. When using a container, applications can run in isolated user spaces like a VM. However, unlike VMs, each container shares the same underlying host OS and sits on top of a physical server.

The VM has all the features of a computer server, without needing the physical hardware attached and is supported by a hypervisor.

3.1.1.2 Hypervisor

The hypervisor is software that delivers the necessary computing resources, like storage or memory, to multiple VMs, enabling them to run virtually.

There are two types of hypervisors: bare-metal and hosted. A bare metal hypervisor runs directly on physical hardware, while a hosted hypervisor runs as an application on a host OS.

3.1.1.3 Hardware servers

A single hardware server may support multiple VMs. Without virtualization, idle applications have resources such as processing power or RAM, storage that are unused. With virtualization, hardware servers can be used at full capacity to offer the hypervisor all the resources necessary to support the VMs.

Figure 3: Virtualized environment lifecycle

Long description - Virtualized environment

The diagram visualizes a virtual architecture system. The diagram starts with three boxes labelled as applications, which is sitting on top of three boxes labelled as operating systems. These boxes are sitting on top of a larger box labelled as the virtualization layer (hypervisor), which is sitting on top of another larger box labelled as hardware (physical server). The diagram presents how applications reside in operating systems, which reside in the hypervisor, which all reside in the hardware. The base of the diagram states virtual architecture to signify this diagram being the key components for a virtual architecture.

3.2 Apply the principle of least privilege (AC 6)

Your organization should implement the principle of least privilege. Essentially this means you grant a user only the set of privileges that are required to perform authorized tasks. This principle limits the damage that can result from accidental, incorrect, or unauthorized use of an application.

When deploying an application, you should ensure that users only have the level of access that is needed for the application to function. Administrative functions should be restricted to only those who require that level of privilege. You may want to consider creating additional processes, roles, and information system accounts as necessary to maintain least privilege. You should also use the principle of least privilege when allowing remote access to your devices.

In cloud-native environments, a strong security posture is linked to robust identity and access management (IAM). The cloud management zone (MZ) IAM service requires organizations to implement role-based access control (RBAC) to control permissions for users and resources. RBAC should be structured to enforce least privileged access. The cloud MZ is a dedicated and isolated administration network available to network administrators for configuring and monitoring network infrastructures.

Using separate processing domains enables you to allocate user privileges more specifically. For example, you can use virtualization techniques to allow a user to have additional privileges when using a virtual machine and limited privileges when using other environments.

Summary

One of our top 10 recommended IT security actions is to isolate web-facing applications. To do this effectively, we recommend using virtualization to create a separate environment on which applications can run and implementing least privilege for all application users. The guidance in this document is based on security controls AC 6 and SC 32, which are detailed in Annex A of this document.

Isolating web facing applications prevents malware from spreading to other hosts and systems. However, isolating your organization’s web facing applications is just one aspect of improving cyber security. To best protect your organization again cyber threats, you should review and implement all the actions recommended in ITSM.10.189 Top 10 IT Security Actions to Protect Internet Connected Networks and Information^{Footnote 1}.

For more information on application security, see ITSM.10.095 Top 10 IT Security Actions: No. 10 Implement Application Allow Lists^{Footnote 4} which provides guidance on creating a list of applications that are authorized to run on your organizations systems. An application allow list is an effective way to prevent unauthorized and malicious programs from executing on organizational systems. As an additional layer of security, your organization should patch and update your OS and applications frequently. For more information on patching, see ITSM.10.096 Top 10 IT Security Actions: No. 2 Patch Operating Systems and Applications^{Footnote 5} which includes best practices for managing updates and patches for your OS and applications.

4 Supporting content