Improving Web Application Security: Threats and - CGISecurity

16Securing Your Web ServerIn This Chapter●●●●OverviewA proven methodology to secure Web serversAn explanation of the most common Web server security threatsSteps to secure your serverA reference table that illustrates a secure Web serverA secure Web server provides a protected foundation for hosting your Webapplications, and Web server configuration plays a critical role in your Webapplication’s security. Badly configured virtual directories, a common mistake, canlead to unauthorized access. A forgotten share can provide a convenient back door,while an overlooked port can be an attacker’s front door. Neglected user accountscan permit an attacker to slip by your defenses unnoticed.What makes a Web server secure? Part of the challenge of securing your Web serveris recognizing your goal. As soon as you know what a secure Web server is, you canlearn how to apply the configuration settings to create one. This chapter provides asystematic, repeatable approach that you can use to successfully configure a secureWeb server.The chapter begins by reviewing the most common threats that affect Web servers.It then uses this perspective to create a methodology. The chapter then puts themethodology into practice, and takes a step-by-step approach that shows you how toimprove your Web server’s security. While the basic methodology is reusable acrosstechnologies, the chapter focuses on securing a Web server running the MicrosoftWindows 2000 operating system and hosting the Microsoft .NET Framework.