Quick tips for improving security in Internet Information Services (IIS)

If you work in a Windows shop and your company has a Web presence, chances are you are working with Microsoft Internet Iinformation Services (IIS). Security problems with IIS are well documented. When working with IIS, there are some important security issues to keep in mind. In this security tip, I take a look at a handful of quick but effective security improvements for IIS.

1. Log for any and all activity of the IUSR account outside of the Web and FTP roots. If activity for this account is detected on files or resources not designated as publicly accessible, this indicates that your system has been compromised.

2. Keep your root CA certifications on your Web server up to date. Regularly prune the list of untrustworthy CAs and add in new CAs that are trustworthy. Make sure your system is properly obtaining the CRL from your trusted CAs.

3. Disable or remove all native default IIS applications. These are stored in the IISSamples, IISHelp and MSADC folders. In most cases, you can simply delete these folders in their entirety. But be sure to create a backup just in case you need to restore them.

4. Remove the IISADMPWD Virtual Directory, especially if you are not using IIS's remote administrative features. The contents of this folder are popular targets for numerous Web based attacks and exploits.

5. Disable or remove unneeded COM components. Removing any unused and unneeded service will reduce the overall number of vulnerabilities of any system. As the number of vulnerabilities discovered for IIS increase, keeping your risk exposure to a minimum is even more important.

6. Disable parent paths (i.e. ".."). Parent paths allow the use of the double period command to move from a child to a parent folder while browsing directories. The parent path command can be included in URLs to access parent folder contents. Parent paths are disabled through a Web sites Properties dialog box by selecting the Home Directory tab, clicking the Configuration button, selecting the App Options tab, then clearing the Enable parent paths checkbox. This setting must be made individually on each separate Web site. ...
   
   To continue reading for free, register below or login

   Requires Membership to View

   To gain access to this and all member only content, please provide the following information:

   Email Address:
   
   
   

   By joining SearchEnterpriseDesktop.com you agree to receive email updates from the TechTarget network of sites, including updates on new content, magazine or event notifications, new site launches and market research surveys. Please verify all information and selections above. You may unsubscribe at any time from one or more of the services you have selected by editing your profile or unsubscribing via email.
   
   TechTarget cares about your privacy. Read our Privacy Policy
   To read more you must become a member of SearchEnterpriseDesktop.com

   As an existing member of the TechTarget network please activate your SearchEnterpriseDesktop.com account 

   By joining SearchEnterpriseDesktop.com you agree to receive email updates from the TechTarget network of sites, including updates on new content, magazine or event notifications, new site launches and market research surveys. Please verify all information and selections above. You may unsubscribe at any time from one or more of the services you have selected by editing your profile or unsubscribing via email.
   
   TechTarget cares about your privacy. Read our Privacy Policy
   
   
   

   Digg This!     StumbleUpon     Del.icio.us

   
   
   
   

   RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

   
   
   

About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.