Improving Web Application Security: Threats and - CGISecurity

Contents xxxiiiSummary ............................................................................................................... 642Additional Resource ................................................................................................ 642Chapter 22Deployment Review 643In This Chapter ....................................................................................................... 643Overview ................................................................................................................ 643Web Server Configuration ........................................................................................ 644Patches and Updates .......................................................................................... 645Services............................................................................................................. 645Protocols............................................................................................................ 646Accounts............................................................................................................ 647Files and Directories ........................................................................................... 648Shares............................................................................................................... 649Ports.................................................................................................................. 649Registry ............................................................................................................. 651Auditing and Logging ........................................................................................... 651IIS Configuration ..................................................................................................... 652IISLockdown ....................................................................................................... 652URLScan ............................................................................................................ 652Sites and Virtual Directories ................................................................................ 653ISAPI Filters........................................................................................................ 655IIS Metabase...................................................................................................... 656Server Certificates .............................................................................................. 656Machine.Config....................................................................................................... 657.............................................................................................................. 657................................................................................................... 657 .................................................................................................... 657 ............................................................................................................ 658.................................................................................................. 658 ................................................................................................ 658........................................................................................................... 660 .................................................................................................. 660.................................................................................................... 661 .............................................................................................................. 661 .................................................................................................. 662 .................................................................................................. 662................................................................................................. 663Web Services ......................................................................................................... 663Enterprise Services................................................................................................. 664Accounts............................................................................................................ 665Files and Directories ........................................................................................... 665Authentication .................................................................................................... 666Authorization ...................................................................................................... 667Remote Serviced Components ............................................................................. 668