Improving Web Application Security: Threats and - CGISecurity

466 Part IV: Securing Your Network, Host, and ApplicationSnapshot of a Secure Web ServerA snapshot view that shows the attributes of a secure Web server allows you toquickly and easily compare settings with your own Web server. The settings shown inTable 16.4 are based on Web servers that host Web sites that have proven to be veryresilient to attack and demonstrate sound security practices. By following theproceeding steps you can generate an identically configured server, with regard tosecurity.Table 16.4 Snapshot of a Secure Web ServerComponentCharacteristicsPatches and Updates Latest service packs and patches are applied for Windows, IIS, and the.NET Framework.ServicesUnnecessary services are disabled.NNTP, SMTP, and FTP are disabled unless you require them.WebDAV is disabled or secured if used.Service accounts run with least privilege.ASP.NET Session State service is disabled if not required.ProtocolsThe NetBIOS and SMB protocols are not enabled on the server.The TCP stack has been hardened.AccountsUnused accounts are removed.Guest account is disabled.The default administrator account is renamed and has a strong password.Default anonymous account (IUSR_Machine) is disabled.Custom anonymous account is used for anonymous access.Strong password policies are enforced.Remote logons are restricted.Null sessions (anonymous logons) are disabled.Approval if required for account delegation.Shared accounts are not used.Membership of local administrators group is restricted (ideally to twomembers).Administrators are required to log on interactively (or a secure remoteadministration solution is implemented).