Tweaking Optimizing Windows.pdf - GEGeek

To configure security zone settings:
- On the Tools menu of Internet Explorer, click Internet Options, and then click the Security tab.
- Click a security zone to select it and view its current settings.
- Change the following settings as necessary:
- Security Level. To change the security level for the selected zone to High, Medium, Medium-low, or Low, move the slider. The onscreen
description for each level can help you decide which level to select.
Sites. To add or remove Web sites from the zone, click the Sites button, and then click the Add or Remove button to customize your
list of sites for the selected zone.
Custom Level. For more precise control of your security settings, click the Custom Level button, and then select the options you
want. For more detailed instructions, please see Setting up Security Zones.
63. Be Paranoid
Don't panic, but be paranoid all the time. Take every security concern or oddball alert seriously.
SECURING INTERNET INFORMATION SERVER (IIS)
1. Get these tools
MS IIS lockdown tool
Microsoft has released a new security tool that makes it simple to secure an IIS 4.0 or 5.0 web server. The tool, known as the IIS
Lockdown Tool, allows web servers to quickly and easily be put into the right configuration - in which the server provides all of the
services the administrator wants to provide, and no others. Customers can use this tool to instantly protect their systems against
security threats that target web servers.
The tool offers two operating modes. The default is Express Lockdown which, with a single mouse click, configures the server in a
highly secure way that is appropriate for most basic web servers. For administrators who want to pick and choose the technologies
that will be enabled on the server, the tool offers an Advanced Lockdown mode. A comprehensive help system provides information
and recommendations for selecting the best configuration, and an undo facility allows the most recent lockdown to be reversed.
Wondering whether it’s worth the time to use the tool? Consider this: a web server configured using the Express Lockdown would be
completely protected against Code Red and virtually all known security vulnerabilities affecting IIS 4.0 and 5.0 - even without the
patches for these vulnerabilities. I do, of course, recommend that all customers, even those running locked-down servers, continue
to stay current on all security patches, but this vividly illustrates the value of the tool.
http://search.microsoft.com/
Urlscan Security Tool
Urlscan is a powerful security tool that works in conjunction with the IIS Lockdown Tool to give IIS Web site administrators the
ability to turn off unneeded features and restrict the kind of HTTP requests that the server will process. By blocking specific HTTP
requests, the Urlscan security tool prevents potentially harmful requests from reaching the server and causing damage.
www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/tools/urlscan.asp
2. Set appropriate ACLs on virtual directories
Although this procedure is somewhat application-dependent, some rules of thumb apply:
File Type
CGI (.exe, .dll, .cmd, .pl)
Script files (.asp)
Include files (.inc, .shtm, .shtml)
Access Control Lists
Everyone (X)
Administrators (Full Control)
System (Full Control)
Everyone (X)
Administrators (Full Control)
System (Full Control)
Everyone (X)
Administrators (Full Control)
System (Full Control)
Static content (.txt, .gif, .jpg, .html)
Everyone (R)
Administrators (Full Control)
System (Full Control)
3. Recommended default ACLs by file type
Rather than setting ACLs on each file, you are better off creating new directories for each file type, setting ACLs on the directory,
and allowing the ACLs to inherit to the files. For example, a directory structure might look like this:
C:\inetpub\wwwroot\myserver\static (.html)
C:\inetpub\wwwroot\myserver\include (.inc)
C:\inetpub\wwwroot\myserver\script (.asp)
C:\inetpub\wwwroot\myserver\executable (.dll)
C:\inetpub\wwwroot\myserver\images (.gif, .jpeg)
Also, be aware that two directories need special attention: