Improving Web Application Security: Threats and - CGISecurity

448 Part IV: Securing Your Network, Host, and ApplicationStep 7. SharesRemove any unused shares and harden the NTFS permissions on any essentialshares. By default all users have full control on newly created file shares. Hardenthese default permissions to ensure that only authorized users can access filesexposed by the share. In addition to explicit share permissions, use NTFS ACLs forfiles and folders exposed by the share.During this step, you:● Remove unnecessary shares.●Restrict access to required shares.Remove Unnecessary SharesRemove all unnecessary shares. To review shares and associated permissions, run theComputer Management MMC snap-in, and select Shares from Shared Folders asshown in Figure 16.3.Figure 16.3Computer Management MMC snap-in SharesRestrict Access to Required SharesRemove the Everyone group and grant specific permissions instead. Everyone is usedwhen you do not have restrictions on who should have access to the share.Additional ConsiderationsIf you do not allow remote administration of your server, remove unusedadministrative shares, for example C$ and Admin$.Note Some applications may require administrative shares. Examples include Microsoft SystemsManagement Server (SMS) and Microsoft Operations Manager (MOM). For more information, seeMicrosoft Knowledge Base article 318751, “How To: Remove Administrative Shares inWindows 2000 or Windows NT 4.0.”