Which practice aligns with Requirement A.1.1 for shared hosting environments?

• A. Run application processes using the entity's unique user ID
• B. Use a shared web server user ID for all entities
• C. Allow CGI scripts to run under a global root user
• D. Disable per-entity user IDs to reduce complexity

Answer: (A)

In a shared hosting environment, isolating each customer by giving their processes and files distinct ownership is essential. Running application processes under the entity’s unique user ID creates a clear boundary: each customer’s data and runtime environment are owned and accessible only by that customer’s IDs, controlled by the system’s file permissions. This prevents one tenant from inadvertently or maliciously accessing another tenant’s data and keeps privilege levels confined to what the individual entity should have.

Using a single shared web server user for all tenants would blur those boundaries, letting processes and files be accessible across customers. Allowing CGI scripts to run as a global root user would grant full system privileges to scripts, creating a catastrophic security risk. Disabling per-entity user IDs removes the isolation and undermines the basic access controls that keep different customers from interfering with or accessing each other’s data.

So, the practice of running application processes using the entity’s unique user ID best aligns with the requirement for proper isolation in shared hosting.