Improving Web Application Security: Threats and - CGISecurity

422 Part IV: Securing Your Network, Host, and ApplicationHow to Use This ChapterThis chapter provides a methodology and the steps required to secure your Webserver. You can adapt the methodology for your own situation. The steps are modularand demonstrate how you can put the methodology in practice. You can use theseprocedures on existing Web servers or on new ones.To gain the most from this chapter:● Read Chapter 2, “Threats and Countermeasures.” This will give you a broaderunderstanding of potential threats to Web applications.● Use the Snapshot. The section “Snapshot of a Secure Web Server” lists andexplains the attributes of a secure Web server. It reflects input from a variety ofsources including customers, industry experts, and internal Microsoftdevelopment and support teams. Use the snapshot table as a reference whenconfiguring your server.● Use the Checklist. “Checklist: Securing Your Web Server” in the “Checklist”section of this guide provides a printable job aid for quick reference. Use the taskbasedchecklist to quickly evaluate the scope of the required steps and to help youwork through the individual steps.● Use the “How To” Section. The “How To” section in this guide includes thefollowing instructional articles:● “How To: Use URLScan”● “How To: Use Microsoft Baseline Security Analyzer”● “How To: Use IISLockdown”Threats and CountermeasuresThe fact that an attacker can strike remotely makes a Web server an appealing target.Understanding threats to your Web server and being able to identify appropriatecountermeasures permits you to anticipate many attacks and thwart the evergrowingnumbers of attackers.The main threats to a Web server are:● Profiling● Denial of service● Unauthorized access● Arbitrary code execution● Elevation of privileges● Viruses, worms, and Trojan horses