Improving Web Application Security: Threats and - CGISecurity

426 Part IV: Securing Your Network, Host, and ApplicationViruses, Worms, and Trojan HorsesMalicious code comes in several varieties, including:● Viruses. Programs that are designed to perform malicious acts and causedisruption to an operating system or applications.● Worms. Programs that are self-replicating and self-sustaining.●Trojan horses. Programs that appear to be useful but that actually do damage.In many cases, malicious code is unnoticed until it consumes system resources andslows down or halts the execution of other programs. For example, the Code Redworm was one of the most notorious to afflict IIS, and it relied upon a buffer overflowvulnerability in an ISAPI filter.VulnerabilitiesCommon vulnerabilities that make you susceptible to viruses, worms, and Trojanhorses include:● Unpatched servers● Running unnecessary services● Unnecessary ISAPI filters and extensionsCountermeasuresCountermeasures include the prompt application of the latest software patches,disabling unused functionality such as unused ISAPI filters and extensions, andrunning processes with least privileged accounts to reduce the scope of damage inthe event of a compromise.Methodology for Securing Your Web ServerTo secure a Web server, you must apply many configuration settings to reduce theserver’s vulnerability to attack. So, how do you know where to start, and when doyou know that you are done? The best approach is to organize the precautions youmust take and the settings you must configure, into categories. Using categoriesallows you to systematically walk through the securing process from top to bottom orpick a particular category and complete specific steps.