Quick tips for improving security in Internet Information Services (IIS)

If you work in a Windows shop and your company has a Web presence, chances are you are working with Microsoft Internet Iinformation Services (IIS). Security problems with IIS are well documented. When working with IIS, there are some important security issues to keep in mind. In this security tip, I take a look at a handful of quick but effective security improvements for IIS.

1. Log for any and all activity of the IUSR account outside of the Web and FTP roots. If activity for this account is detected on files or resources not designated as publicly accessible, this indicates that your system has been compromised.

2. Keep your root CA certifications on your Web server up to date. Regularly prune the list of untrustworthy CAs and add in new CAs that are trustworthy. Make sure your system is properly obtaining the CRL from your trusted CAs.

3. Disable or remove all native default IIS applications. These are stored in the IISSamples, IISHelp and MSADC folders. In most cases, you can simply delete these folders in their entirety. But be sure to create a backup just in case you need to restore them.

4. Remove the IISADMPWD Virtual Directory, especially if you are not using IIS's remote administrative features. The contents of this folder are popular targets for numerous Web based attacks and exploits.

5. Disable or remove unneeded COM components. Removing any unused and unneeded service will reduce the overall number of vulnerabilities of any system. As the number of vulnerabilities discovered for IIS increase, keeping your risk exposure to a minimum is even more important.

6. Disable parent paths (i.e. ".."). Parent paths allow the use of the double period command to move from a child to a parent folder while browsing directories. The parent path command can be included in URLs to access parent folder contents. Parent paths are disabled through a Web sites Properties dialog box by selecting the Home Directory tab, clicking the Configuration button, selecting the App Options tab, then clearing the Enable parent paths checkbox. This setting must be made individually on each separate Web site. ...
   
   To continue reading for free, register below or login

   Requires Membership to View

   To gain access to this and all member only content, please provide the following information:

   Email Address:
   
   
   

   By joining SearchWindowsServer.com you agree to receive email updates from the TechTarget network of sites, including updates on new content, magazine or event notifications, new site launches and market research surveys. Please verify all information and selections above. You may unsubscribe at any time from one or more of the services you have selected by editing your profile or unsubscribing via email.
   
   TechTarget cares about your privacy. Read our Privacy Policy
   To read more you must become a member of SearchWindowsServer.com

   As an existing member of the TechTarget network please activate your SearchWindowsServer.com account 

   By joining SearchWindowsServer.com you agree to receive email updates from the TechTarget network of sites, including updates on new content, magazine or event notifications, new site launches and market research surveys. Please verify all information and selections above. You may unsubscribe at any time from one or more of the services you have selected by editing your profile or unsubscribing via email.
   
   TechTarget cares about your privacy. Read our Privacy Policy
   
   
   

   Digg This!     StumbleUpon     Del.icio.us

   
   
   
   

   RELATED CONTENT Microsoft Internet Information Services (IIS) Small changes go a long way with IIS 7.5 IIS gets patched, SQL Server not so much Internet Information Services (IIS) sees big changes in Windows Server 2008 How to keep IIS logs from filling up your server hard drives A first look at Internet Information Services 7.0 Free security tools that can improve IIS security New IIS 7 security adds value to Windows Server 2008 How can I prevent Internet access with Windows SBS? When and how to use worker process recycling with IIS Windows Process Activation Service in IIS 7.0 Microsoft Windows Network Security Are security concerns over cloud computing unfounded? Balancing Windows security with reasonable password policies Windows AppLocker in R2: Turning conventional security wisdom on its head Using software restriction policies in Windows IIS gets patched, SQL Server not so much Windows Server Security Guide Free Windows security tools every admin must have Common causes of Windows server security vulnerabilities Cutting the cost of Windows identity and access management Group Policy Object modeling simplifies network security Web Management Small changes go a long way with IIS 7.5 Internet Information Services (IIS) sees big changes in Windows Server 2008 How to keep IIS logs from filling up your server hard drives A first look at Internet Information Services 7.0 When and how to use worker process recycling with IIS Fix app problems stemming from Firefox as default browser Control users' Internet access Raise Web server performance in Windows Server 2003 Remotely administer IIS with HTML tool INDEX.DAT tool helps admins see what users browsed in IE

   RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary IIS  (SearchWindowsServer.com)

   RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

   
   
   

About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.