Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 645Patches and UpdatesVerify that your server is updated with the latest service packs and software patches.You need to separately check operating system components and the .NETFramework. Review the following questions:● Have you run MBSA?Make sure you have run the MBSA tool to identify common Windows and IISvulnerabilities, and to identify missing service packs and patches.Respond to the MBSA output by fixing identified vulnerabilities and by installingthe latest patches and updates. For more information, see “Step 1. Patches andUpdates” in Chapter 16, “Securing Your Web Server.”● Have you installed .NET Framework updates?To determine the current version of the .NET Framework, see MicrosoftKnowledge Base article 318785, “INFO: Determining Whether Service PacksAre Installed on .NET Framework.” Then compare the installed version ofthe .NET Framework against the current service pack. To do this, use the.NET Framework versions listed in article 318836, “INFO: How to Obtainthe Latest .NET Framework Service Pack.”ServicesMake sure that only the services that you require are enabled. Check that all othersare disabled to reduce your server’s attack profile. To see which services are runningand enabled, use the Services and Applications Microsoft Management Console(MMC) snap-in available from Computer Management. To disable a service, makesure it is stopped and set its startup type to manual.Review the following questions to verify your services configuration:● Do you run unnecessary services?Review each service that is running by using the Services snap-in and confirm thateach service is required. Identify why it is required and which solutions rely on it.Make sure all unnecessary services are disabled.● Have you disabled the Telnet service?Telnet is often used for remote IIS administration. However, it is an insecureprotocol susceptible to many attacks. Check that the Telnet service is disabled.For a more secure administration solution, use Terminal Services.