Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 435For more information on using MBSA, see “How To: Use Microsoft Baseline SecurityAnalyzer” in the “How To” section of this guide.Update the .NET FrameworkAt the time of this writing (May 2003), MBSA cannot detect .NET Framework updatesand patches. Therefore, you must manually detect .NET Framework updates. To manually update .NET Framework version 1.01. Determine which .NET Framework service pack is installed on your Web server.To do this, see Microsoft Knowledge Base article 318785, “INFO: DeterminingWhether Service Packs Are Installed on .NET Framework.”2. Compare the installed version of the .NET Framework to the current service pack.To do this, use the .NET Framework versions listed in Microsoft Knowledge Basearticle 318836, “INFO: How to Obtain the Latest .NET Framework Service Pack.”Step 2. IISLockdownThe IISLockdown tool helps you to automate certain security steps. IISLockdowngreatly reduces the vulnerability of a Windows 2000 Web server. It allows you to picka specific type of server role, and then use custom templates to improve security forthat particular server. The templates either disable or secure various features. Inaddition, IISLockdown installs the URLScan ISAPI filter. URLScan allows Web siteadministrators to restrict the kind of HTTP requests that the server can process, basedon a set of rules that the administrator controls. By blocking specific HTTP requests,the URLScan filter prevents potentially harmful requests from reaching the serverand causing damage.During this step, you:● Install and run IISLockdown.●.Install and configure URLScan.Install and Run IISLockdownIISLockdown is available as an Internet download from the Microsoft Web site athttp://download.microsoft.com/download/iis50/Utility/2.1/NT45XP/EN-US/iislockd.exe.Save IISlockd.exe in a local folder. IISlockd.exe is the IISLockdown wizard and not aninstallation program. You can reverse any changes made by IISLockdown by runningIISlockd.exe a second time.