Improving Web Application Security: Threats and - CGISecurity

440 Part IV: Securing Your Network, Host, and ApplicationDisable the ASP.NET State Service Unless You Require ItThe .NET Framework installs the ASP.NET State service (aspnet_state.exe) to manageout-of-process user session state for ASP.NET Web applications and Web services. Bydefault, this service is configured for manual startup and runs as the least privilegedlocal ASPNET account. If none of your applications store state by using this service,disable it. For more information on securing ASP.NET session state, see the “SessionState” section in Chapter 19, “Securing Your ASP.NET Application and WebServices.”Step 4. ProtocolsBy preventing the use of unnecessary protocols, you reduce the potential for attack.The .NET Framework provides granular control of protocols through settings in theMachine.config file. For example, you can control whether your Web Services can useHTTP GET, POST or SOAP. For more information about configuring protocols inMachine.config, see “Step 16. Machine.config.”During this step, you:● Disable or secure WebDav.●●Harden the TCP/IP stack.Disable NetBIOS and SMB.Disable or Secure WebDAVIIS supports the WebDAV protocol, which is a standard extension to HTTP 1.1 forcollaborative content publication. Disable this protocol on production servers if it isnot used.Note IISLockdown provides an option to remove support for WebDAV.WebDAV is preferable to FTP from a security perspective, but you need to secureWebDAV. For more information, see Microsoft Knowledge Base article 323470, “HowTo: Create a Secure WebDAV Publishing Directory.”If you do not need WebDAV, see Microsoft Knowledge Base article 241520, “How To:Disable WebDAV for IIS 5.0.”Harden the TCP/IP StackWindows 2000 supports the granular control of many parameters that configure itsTCP/IP implementation. Some of the default settings are configured to provideserver availability and other specific features.