A handful of quick tips for improving IIS security

If you work in a Windows shop and your company has a Web presence, chances are you are working with IIS. Security problems with IIS are well documented. When working with IIS, there are some important security issues to keep in mind. In this security tip, I take a look at a handful of quick but effective security improvements for IIS.

  1. Log for any and all activity of the IUSR account outside of the Web and FTP roots. If activity for this account is detected on files or resources not designated as publicly accessible, this indicates that your system has been compromised.


  2. Keep your root CA certifications on your Web server up to date. Regularly prune the list of untrustworthy CAs and add in new CAs that are trustworthy. Make sure your system is properly obtaining the CRL from your trusted CAs.


  3. Disable or remove all native default IIS applications. These are stored in the IISSamples, IISHelp and MSADC folders. In most cases, you can simply delete these folders in their entirety. But be sure to create a backup just in case you need to restore them.


  4. Remove the IISADMPWD Virtual Directory, especially if you are not using IIS's remote administrative features. The contents of this folder are popular targets for numerous Web based attacks and exploits.


Requires Free Membership to View

  1. Disable or remove unneeded COM components. Removing any unused and unneeded service will reduce the overall number of vulnerabilities of any system. As the number of vulnerabilities discovered for IIS increase, keeping your risk exposure to a minimum is even more important.


  2. Disable parent paths (i.e. ".."). Parent paths allow the use of the double period command to move from a child to a parent folder while browsing directories. The parent path command can be included in URLs to access parent folder contents. Parent paths are disabled through a Web sites Properties dialog box by selecting the Home Directory tab, clicking the Configuration button, selecting the App Options tab, then clearing the Enable parent paths checkbox. This setting must be made individually on each separate Web site.

About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.

This was first published in October 2002

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.