Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 427Configuration CategoriesThe security methodology in this chapter has been organized into the categoriesshown in Figure 16.2..NETMachine.configweb.configIISSites and v-dirsMetabaseOperating SystemSharesServicesAcountsAuditing andLoggingFiles andDirectoriesRegistryPatches and UpdatesNetworkProtocolsPortsFigure 16.2Web server configuration categoriesThe rationale behind the categories is as follows:●●Patches and UpdatesMany security threats are caused by vulnerabilities that are widely published andwell known. In many cases, when a new vulnerability is discovered, the code toexploit it is posted on Internet bulletin boards within hours of the first successfulattack. If you do not patch and update your server, you provide opportunities forattackers and malicious code. Patching and updating your server software is acritical first step towards securing your Web server.ServicesServices are prime vulnerability points for attackers who can exploit the privilegesand capabilities of a service to access the local Web server or other downstreamservers. If a service is not necessary for your Web server’s operation, do not run iton your server. If the service is necessary, secure it and maintain it. Considermonitoring any service to ensure availability. If your service software is not secure,but you need the service, try to find a secure alternative.