Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 473Use a secure VPN connection between the client and the server or an IPSec tunnel forenhanced security. This approach provides mutual authentication and the RDPpayload is encrypted.Copying Files over RDPTerminal Services does not provide built-in support for file transfer. However, youcan install the File Copy utility from the Windows 2000 Server Resource Kit to addfile transfer functionality to the clipboard redirection feature in Terminal Services.For more information about the utility and installation instructions see MicrosoftKnowledge Base article 244732, “How To: Install the File Copy Tool Included withthe Windows 2000 Resource Kit.”Simplifying and Automating SecurityThis chapter has shown you how to manually configure security settings for anASP.NET Web server. The manual process helps you to understand the configurationbut can be time consuming Use the following resources to help automate the stepspresented in this chapter:● For information on how to automate IISLockdown, see Microsoft Knowledge Basearticle 310725 “How To: Run the IIS Lockdown Wizard Unattended in IIS.”● You can create and deploy security policies using security templates. For moreinformation, see the following Microsoft Knowledge Base articles:● 313434, “How To: Define Security Templates in the Security Templates Snap-inin Windows 2000.”● 309689, “How To: Apply Predefined Security Templates in Windows 2000.”● 321679, “How To: Manage Security Templates in Windows 2000 Server.”● For detailed guidance about customizing and automating security templates, seethe Microsoft patterns & practices, Microsoft Solution for Securing Windows 2000Server, at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/prodtech/windows/secwin2k/default.asp.The Microsoft Solution for Securing Windows 2000 Server addresses the mostcommon server roles, including domain controllers, DNS servers, DHCP servers,IIS Web servers, and File and Print servers. The approach used in this guide allowsyou to take a default Windows 2000 installation and then create a secure server,the precise configuration of which varies depending upon its role. Administratorscan then consciously weaken security to satisfy the needs of their particularenvironment. The guide provides a foundation of baseline securityrecommendations that covers services, accounts, group policies, and so on,that you can use as a starting point for the common types of server roles.