Improving Web Application Security: Threats and - CGISecurity

644 Part V: Assessing Your SecurityWeb ServerApplication ServerDatabase Server.NETFrameworkIISWebServicesEnterpriseServicesRemotingShares Auditing and Logging Registry PortsFiles and Directories Accounts Protocols ServicesSQLServerWindows2000Patches and UpdatesRouters Firewalls SwitchesNetworkFigure 22.1Core elements of a deployment reviewWeb Server ConfigurationThe goal for this phase of the review is to identify vulnerabilities in theconfiguration of the base operating system on your Web server. This does not includeIIS configuration, which is dealt with separately. For further background informationabout the issues raised by the review questions in this section, see Chapter 16,“Securing Your Web Server.”To help focus and structure the review process, the review questions have beendivided into the following configuration categories:● Patches and updates● Services● Protocols● Accounts● Files and directories● Shares● Ports● Registry● Auditing and logging