Improving Web Application Security: Threats and - CGISecurity

438 Part IV: Securing Your Network, Host, and ApplicationYou configure URLScan using settings in the .ini file %windir%\system32\inetsrv\urlscan\urlscan.ini.In addition to blocking malicious requests, you can use URLScan to defend yourserver against denial of service attacks before the requests reach ASP.NET. To do this,set limits in the MaxAllowedContentLength, MaxUrl, and MaxQueryStringarguments in the URLScan.ini file. For more information, see “How To: UseURLScan” in the “How To” section of this guide.Reversing URLScan ChangesThere is no automatic operation to remove URLScan. If you have problems withURLScan, you can either remove it from IIS or you can analyze the problem bylogging requests that are rejected. To do this, use the option RejectResponseUrl=/~*in the URLScan .ini file.For more information about how to remove ISAPI filters, see “Step 13. ISAPI Filters,”later in this chapter.More InformationSee the following articles for more information about the URLScan tool:● For information on running URLScan, see “How To: Use URLScan” in the“How To” section of this guide.● For information about URLScan configuration and the URLScan.ini file settings,see Microsoft Knowledge Base article 326444, “How To: Configure the URLScanTool.”Step 3. ServicesServices that do not authenticate clients, services that use insecure protocols, orservices that run with too much privilege are risks. If you do not need them, do notrun them. By disabling unnecessary services you quickly and easily reduce the attacksurface .You also reduce your overhead in terms of maintenance (patches, serviceaccounts, and so on.)If you run a service, make sure that it is secure and maintained. To do so, run theservice using a least privilege account, and keep the service current by applyingpatches.During this step, you:● Disable unnecessary services.●●Disable FTP, SMTP, and NNTP unless you require them.Disable the ASP.NET State service unless you require it.