The purpose of this document is to assist organizations in understanding the fundamental activities performed as part of securing and maintaining the security of servers that provide services over network communications as a main function. Hosts that incidentally provide one or a few services for maintenance or accessibility purposes, such as a remote access service for remote troubleshooting, are not considered servers in this document. The types of servers this publication addresses include outward-facing publicly accessible servers, such as web and email services, and a wide range of inward-facing servers. This document discusses the need to secure servers and provides recommendations for selecting, implementing, and maintaining the necessary security controls.
This document addresses common servers that use general operating systems (OS) such as Unix, Linux, and Windows. Many of the recommendations in this document may also be applicable to servers that use specialized OSs or run on proprietary appliances, but other recommendations will not be implementable or may have unintended consequences, so such servers are considered outside the scope of this document. Other types of servers outside the scope of this document are virtual servers and highly specialized servers, particularly security infrastructure devices (e.g., firewalls, intrusion detection systems), which have unusual configurations and security needs.
Other NIST documents, such as Special Publication (SP) 800-45 Version 2, Guidelines on Electronic Mail Security and SP 800-44 Version 2, Guidelines on Securing Public Web Servers, provide recommendations for particular types of servers. The recommendations in this document are intended as a foundation for other server-related documents and do not override more specific recommendations made in such documents.
This document addresses common servers that use general operating systems (OS) such as Unix, Linux, and Windows. Many of the recommendations in this document may also be applicable to servers that use specialized OSs or run on proprietary appliances, but other recommendations will not be implementable or may have unintended consequences, so such servers are considered outside the scope of this document. Other types of servers outside the scope of this document are virtual servers and highly specialized servers, particularly security infrastructure devices (e.g., firewalls, intrusion detection systems), which have unusual configurations and security needs.
Other NIST documents, such as Special Publication (SP) 800-45 Version 2, Guidelines on Electronic Mail Security and SP 800-44 Version 2, Guidelines on Securing Public Web Servers, provide recommendations for particular types of servers. The recommendations in this document are intended as a foundation for other server-related documents and do not override more specific recommendations made in such documents.
