Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 451Step 10. Auditing and LoggingAuditing does not prevent system attacks, although it is an important aid inidentifying intruders and attacks in progress, and can assist you in diagnosing attackfootprints. Enable a minimum level of auditing on your Web server and use NTFSpermissions to protect the log files so that an attacker cannot cover his tracks bydeleting or updating the log files in any way. Use IIS W3C Extended Log File FormatAuditing.During this step, you:● Log all failed Logon attempts.●●●●Log all failed actions across the file system.Relocate and secure the IIS log files.Archive log files for offline analysis.Audit access to the Metabase.bin file.Log All Failed Logon AttemptsYou must log failed logon attempts to be able to detect and trace suspicious behavior. To audit failed logon attempts1. Start the Local Security Policy tool from the Administrative Tools program group.2. Expand Local Policies and then select Audit Policy3. Double-click Audit account logon events.4. Click Failure and then OK.Logon failures are recorded as events in the Windows security event log. Thefollowing event IDs are suspicious:● 531. This means an attempt was made to log on using a disabled account.●529. This means an attempt was made to log on using an unknown user account orusing a valid user account but with an invalid password. An unexpected increasein the number of these audit events might indicate an attempt to guess passwords.Log All Failed Actions Across the File SystemUse NTFS auditing on the file system to detect potentially malicious attempts. This isa two-step process. To enable logging1. Start the Local Security Policy tool from the Administrative Tools program group.2. Expand Local Policies and then select Audit Policy3. Double-click Audit object access.4. Click Failure and then click OK.