Improving Web Application Security: Threats and - CGISecurity

446 Part IV: Securing Your Network, Host, and ApplicationStep 6. Files and DirectoriesInstall Windows 2000 on partitions formatted with the NTFS file system so that youbenefit from NTFS permissions to restrict access. Use strong access controls to protectsensitive files and directories. In most situations, an approach that allows access tospecific accounts is more effective than one that denies access to specific accounts. Setaccess at the directory level whenever possible. As files are added to the folder theyinherit permissions from the folder, so you need to take no further action.During this step, you:● Restrict the Everyone group.●●●Restrict the anonymous Web account(s).Secure or remove tools, utilities, and SDKs.Remove sample files.Restrict the Everyone GroupThe default NTFS permissions for Windows 2000 grant members of the Everyonegroup full control access to a number of key locations, including the root directory,\inetpub, and \inetpub\scripts.First grant FULL CONTROL to the Administrator account to the root (\), thenremove access rights for the Everyone group from the following directories.● Root (\)●●●System directory (\WINNT\system32)Framework tools directory (\WINNT\Microsoft.NET\Framework\{version})Web site root directory and all content directories (the default is \inetpub\*)Restrict Access to the IIS Anonymous AccountThe anonymous account is well known. Attackers target this well known account toperform malicious actions. To secure the anonymous account:● Deny write access to Web content directories.Make sure that it is not possible for this account to write to content directories, forexample, to deface Web sites.● Restrict access to System tools.In particular, restrict access to command-line tools located in \WINNT\System32.