Designing Iis Security Baselines

By Author: unknownmem
Total Articles: 128
Comment this article

Securing IIS involves a combination of developing security for Microsoft 70-620(http://www.mcts-70-620.com)
and using US specific knowledge and controls. Windows Server 2003 hardening baselines were introduced in Chapter 8. This lesson focuses on designing security for IIS. This lesson goes beyond the simple IIS incremental template mentioned previously and provides specific baselines for IIS services.
Do not enable services that were disabled to conform to the recommendations evalu-ated in Chapter 8 or because of other considerations. Evaluate additional enabled services to see whether they can be disabled as well. Some services that should be evaluated include the following:
The server update process should be reviewed for Web servers. You can choose a different path for Internet servers than for intranet servers. All Web servers should be updated; however, you might want to develop an update process that is specific to MCTS exam(http://www.mcts-70-620.com)
Web servers. Critical Web servers might be running specialized software and hardware, which can result in issues with updates.
A higher ...
... degree of testing might be necessary. In addition, unexpected downtime because of some problem with an update might have a higher cost than if the
same specialized software or hardware were located on a less critical server. For these reasons, consider disabling the automatic update services, but do design an update process.
The Background Intelligent Transfer Service (BITS) is used to provide background file transfers. It is used when automatic updates are enabled. If auto-
matic updating is disabled, this service should be disabled as well.
This service is used to allow Administrators and Backup Operators remote access to the registry. In a high security server, such as an Internet server, disable this service and provide alternative remote management methods, or require administration from the console.
Do not install terminal services in application mode. If terminal services is required for administration, it is available in administrative mode.
You do not want ordinary users to be able to obtain free Microsoft IT certification test questions(http://www.examshots.com/vendor/Microsoft-1.html)
terminal services access to the Web server.