Defacement Risks
A hosted web site could be "defaced" making use of known vulnerabilities of the hosting web services by a third party with the intention of propagating political messages, harming the corporate image or to state that the corporate security has been compromised.
Viruses in the past have made use of known vulnerabilities to achieve this - therefore the defacement of a web site is not only a risk related to a third party intentionally attacking the corporate web services but could also be the random result of an automated process through the infection of a large number of computers on the internet with a virus.
Web Services Abuse Risk
The defacement of a web site does not have to take place on the starting page of a complex web structure. Although this is most likely the case, there have also been incidents known in which only parts of the web structure had been compromised. It may take a very long time before the owner of the content becomes aware of this change.
As it is becoming harder to exchange illegal copies of software and multimedia files such as videos and music files, it may be desirable to abuse existing web sites in order to host a platform for this type of file exchange. In this case, the original web site remains unchanged and a directory structure is added into the web site that contains the files for the exchange. Recently this type of abuse has become more popular in the context of terrorist information exchange.
How the FactotumNOW Web Checking Engine Manages Hosting Risks
FactotumNOW Web Checking Engine includes means for publication of content, regular content inspection and administrator notification. Also, the software allows an organization to implement a centralized monitoring of web content and a centralization of web publishing tasks. All monitoring is done remotely from a single dedicated server that may be running at a separate location behind additional security measures. Additionally, this server may become the corporate gateway to web content updates since it can be positioned closer to the content creators for more convenience. The upload process then happens transparently in the background. If desired, the engine will submit content update notifications by email.
Separation of server management and content management
A major step towards controlling these risks is to separate server and content management tasks and reflect this also in user rights. To achieve this, the FactotumNOW Web Checking Engine can become the location for posting content. The replication engine then automatically publishes content to the hosting servers.
The hosted content could then become inaccessible through file shares since the FactotumNOW Web Checking Engine does not rely on file shares for the publication process. Instead, the FactotumNOW Web Checking Engine runs as an agent on the web server and automatically manages the content from there. Publishing users could then authenticate against the publishing server with their own network credentials since it should be hosted in the same domain as the user accounts. A direct user access to the server for modification or publication of content can then be denied.
Separation of web servers from the user account domain
In order to protect web servers from internal virus outbreaks, it is necessary to host these servers in a separate domain structure – whenever this is possible. With this separation in place, a virus that depends on network shares to propagate would not have the same amount of rights when targeting the web servers. Even when running with administrative rights in the user account domain, the virus would still be executing its code in a separate domain context, which would not grant it rights to the web servers by default. Normally, even an average user account still has a number of basic rights to web servers in the same domain – like the enumeration of shares.
User proximity to master copy of web site
Using the FactotumNOW Web Checking Engine, you can maintain a full copy of your web site on a file server in the corporate production network. Users can update areas through file shares and you can manage user access conveniently through share and file permissions. FactotumNOW Web Checking Engine detects changes to the master site and replicates them to the actual web servers transparently. This is beneficial specifically for networks, where the web servers are located in a DMZ, potentially even at another site and content providers spend too much time trying to upload their changes. It becomes even more valuable in scenarios where organizations are hosting their site on several web servers that may be geographically distributed across the world. Then, the FactotumNOW Web Checking Engine not only ensures, that your content is uploaded to all sites but also remains consistent across all sites and locations.
