Improving Web Application Security: Threats and - CGISecurity

432 Part IV: Securing Your Network, Host, and ApplicationInstallation RecommendationsBy default, the Windows 2000 Server setup installs IIS. However, therecommendation is that you do not install IIS as part of the operating systeminstallation but install it later, after you have updated and patched the base operatingsystem. After you install IIS, you must reapply IIS patches and harden the IISconfiguration to ensure that it is fully secured. Only then is it safe to connect theserver to the network.IIS Installation RecommendationsIf you are installing and configuring a new Web server, follow the procedure outlinedbelow. To build a new Web server1. Install Windows 2000 Server, but do not install IIS as part of the operating systeminstallation.2. Apply the latest service packs and patches to the operating system. (If you areconfiguring more than one server, see “Including Service Packs with a BaseInstallation,” later in this section.)3. Install IIS separately by using Add/Remove Programs in the Control Panel.If you do not need the following services, do not install them when you install IIS:● File Transfer Protocol (FTP) Server● Microsoft FrontPage® 2000 Server Extensions●●●●Internet Service Manager (HTML)NNTP ServiceSMTP ServiceVisual InterDev RAD Remote Deployment SupportNote By installing IIS on a fully patched and updated operating system, you can prevent attacksthat take advantage of known vulnerabilities (such as NIMDA) that have now been patched..NET Framework Installation RecommendationsDo not install the .NET Framework Software Development Kit (SDK) on a productionserver. The SDK contains utilities that the server does not require. If an attacker gainsaccess to your server, the attacker can use some of these tools to assist other attacks.Instead, install the redistributable package, which you can obtain from the“Downloads” link at the .NET Framework site on Microsoft.com athttp://www.microsoft.com/net/.