Web security controls
Control : HTTP-6640
Anti Denial of Service (DoS) module and protects against brute force attempts. This control is advised for systems running a webserver and those in particular which are available from public networks.
Control : HTTP-6641
Module to protect against SlowLoris attack, especially useful for webservers which are available from public networks.
Control : HTTP-6642
Module against spammers, useful for webservers which are available from public networks.
Control : HTTP-6643
Module for webservers to act as a web application firewall.
Control : HTTP-6710
To protect the privacy of users, including sniffing of sensitive data on networks, enable SSL/TLS in nginx.
Control : HTTP-6712
For auditing purposes logging should be properly configured in nginx. Missing log files or disabled entries might result in losing valuable data for analytics and accounting.
Control : HTTP-6714
This test searches for the presence of error logs.