Rule: ELB Application Load Balancers Should Drop HTTP Headers
This rule focuses on ensuring ELB application load balancers drop HTTP headers to enhance security.
| Rule | ELB application load balancers should be drop HTTP headers |
| Framework | NIST Cybersecurity Framework (CSF) v1.1 |
| Severity | ✔ High |
Description:
ELB application load balancers play a crucial role in distributing incoming traffic across multiple resources, such as web servers, to ensure optimal performance and availability. However, to comply with the NIST Cybersecurity Framework (CSF) v1, it is necessary to drop certain HTTP headers to minimize potential security risks.
Policy/Rules:
The policy requires ELB application load balancers to drop specific HTTP headers that might expose sensitive information or introduce vulnerabilities. These headers should not be forwarded to the backend resources.
Troubleshooting Steps (if any):
If there are any issues, follow the troubleshooting steps mentioned below:
- 1.Ensure that the ELB application load balancer is properly configured and associated with the desired target resources.
- 2.Check if the requested HTTP headers are not reaching the backend servers.
- 3.Confirm that the correct ELB configuration rules have been implemented.
- 4.If unsure, consult AWS documentation or seek expert assistance.
Necessary Codes (if any):
There are no specific codes for this rule. The rule requires the appropriate configuration for the ELB application load balancer.
Remediation Steps:
To comply with the policy of dropping HTTP headers as per the NIST Cybersecurity Framework (CSF) v1, follow these steps:
- 1.Log in to the AWS Management Console.
- 2.Navigate to the EC2 Dashboard.
- 3.In the navigation pane, click on "Load Balancers" under the "LOAD BALANCING" section.
- 4.Choose the ELB application load balancer for which you want to configure header dropping.
- 5.Go to the "Listeners" tab.
- 6.Select the appropriate listener and click on "View/edit rules" in the "Actions" column.
- 7.In the rules editor, identify the rule responsible for forwarding traffic to the backend.
- 8.To drop a specific HTTP header:
- Select the rule condition that corresponds to the header you want to drop.
- Click on the rule action dropdown menu and choose "Drop" or "No actions".
- 9.Repeat step 8 for each HTTP header that needs to be dropped.
- 10.Click on "Save" to apply the changes.
CLI Commands (if required):
There are no specific CLI commands required for this policy. The remediation steps can be performed easily through the AWS Management Console.