Abstract A Web server is a wonderful business communication channel — it relays information cheaply, conveniently and, in theory, to almost everyone. Traditionally, in my experience at least, the Web is not an area auditors have taken particularly seriously: until recently, it has not been used to transact business, but simply to publicize the organization. Most companies run their Web applications on a firewall interface or interfaces outside the internal network, so the audit, more concerned with the core business applications, could rely on the firewall to protect against hackers, and treat the Web server as, at worst, a bastion host.