Security Management for the World Wide Web - High-Performance Web Databases: Design, Development, and Deployment - page 745

WWW server compromise be suspected. A site could potentially discover
the degree of data exposure though these logs.
These are some of the major areas where auditing can be put in place to
monitor the WWW environment while enhancing its overall security. It is
important to note that the potential placement of audits encompasses the
entire distributed computing infrastructure environment, not just the new
WWW server itself. In fact, there are some schools of thought that consider
the more reliable audits to be those that are somewhat distanced from the
target server, thus reducing the potential threat of compromise to the audit
logs themselves. In general, the important point is to look at the big picture
when designing the security controls and a supporting audit solution.
WWW/Internet Audit Considerations
After your distributed Internet, intranet, and WWW security policies are
firmly established, distributed security architectures are updated to ac-
commodate this new environment. When planning for audit, and security
control mechanisms are designed and implemented, you should plan how
you will implement the audit environment — not only which audit facilities
to use to collect and centralize the audit function, but how much and what
type of information to capture, how to filter and review the audit data and
logs, and what actions to take on the violations or anomalies identified.
Additional consideration should be given to secure storage and access to
the audit data. Other considerations include:
• Timely resolution of violations.
• Disk space storage availability.
• Increased staffing and administration.
• In-house developed programming.
• Ability to alarm and monitor in real time.
WWW SECURITY FLAWS
As with all new and emerging technology, many initial releases come
with some deficiency. But this has been of critical importance when that
deficiency can impact the access or corruption of a whole corporation or
enterprise's display to the world. This can be the case with Web implemen-
tations utilizing the most current releases which have been found to con-
tain some impacting code deficiencies, though up to this point most of
these deficiencies have been identified before any major damage has been
done. This underlines the need to maintain a strong link or connection with
industry organizations that announce code shortcomings that impact a
sites Web implementation. A couple of the leading organizations are CERT,
the Computer Emergency Response Team, and CIAC, Computer Incident
Advisory Capability.