Skip to content

Web security controls

Control : HTTP-6640

Anti Denial of Service (DoS) module and protects against brute force attempts. This control is advised for systems running a webserver and those in particular which are available from public networks.

Control : HTTP-6641

Module to protect against SlowLoris attack, especially useful for webservers which are available from public networks.

Control : HTTP-6642

Module against spammers, useful for webservers which are available from public networks.

Control : HTTP-6643

Module for webservers to act as a web application firewall.

Control : HTTP-6710

To protect the privacy of users, including sniffing of sensitive data on networks, enable SSL/TLS in nginx.

Control : HTTP-6712

For auditing purposes logging should be properly configured in nginx. Missing log files or disabled entries might result in losing valuable data for analytics and accounting.

Control : HTTP-6714

This test searches for the presence of error logs.