Assessing the NGINX Server's Configuration Security Based on CIS Benchmarks
Issued Date
2025-01-01
Resource Type
Scopus ID
2-s2.0-105032724655
Journal Title
Icsec 2025 29th International Computer Science and Engineering Conference 2025
Start Page
459
End Page
464
Rights Holder(s)
SCOPUS
Bibliographic Citation
Icsec 2025 29th International Computer Science and Engineering Conference 2025 (2025) , 459-464
Suggested Citation
Lekcharuthas G., Khurat A., Choetkiertikul M., Ragkhitwetsagul C. Assessing the NGINX Server's Configuration Security Based on CIS Benchmarks. Icsec 2025 29th International Computer Science and Engineering Conference 2025 (2025) , 459-464. 464. doi:10.1109/ICSEC67360.2025.11298035 Retrieved from: https://repository.li.mahidol.ac.th/handle/123456789/115802
Title
Assessing the NGINX Server's Configuration Security Based on CIS Benchmarks
Author's Affiliation
Corresponding Author(s)
Other Contributor(s)
Abstract
Websites and applications commonly rely on web server software such as NGINX to handle server-side tasks. Administrators often copy configuration files of these servers from online sources (e.g., GitHub) and adapt them, but these files can be misconfigured and introduce security vulnerabilities. This paper presents an automated tool that assesses NGINX configuration files against the CIS Benchmark for NGINX by the Center for Internet Security (CIS). We categorized benchmark recommendations applicable to configuration files, implemented the tool, and evaluated it on 23 popular NGINXbased GitHub repositories. On average, only about 4.01% of scannable recommendations were implemented; configurations for logging and encryption were absent from defaults. These findings raise concerns for developers adopting such files without thorough review. Our evaluation shows that the tool can be used to identify insecure or missing configurations in online-sourced configurations and promotes best practices of having secure configurations for a stronger security posture.