Improving Web Application Security: Threats and - CGISecurity

646 Part V: Assessing Your Security●Have you disabled FTP, SMTP, and NNTP services?These services are not secure protocols and have known vulnerabilities. If you donot need them, disable them. If you use them, find secure alternatives. Theseservices are listed in the Services MMC snap-in as FTP Publishing Service, SimpleMail Transport Protocol (SMTP) and Network News Transport Protocol (NNTP).Note IISLockdown disables these services.●Do you use the ASP.NET session state service?To see whether your applications use this service, review the element in your application’s Web.config file. If Web.config does not containthis element, check its setting in Machine.config. You use the session stateservice on your Web server if the mode attribute is set to “StateServer” and thestateConnectionString points to the local machine, for example with a localhostaddress as shown below:If you do not use the service on the Web server, disable it. It is listed as “ASP.NETState Service” in the Services MMC snap-in.For more information on how to secure ASP.NET session state, refer to “SessionState” in Chapter 19, “Securing Your ASP.NET Application and Web Services.”ProtocolsReview which protocols are enabled on your server and make sure that nounnecessary protocol is enabled. Use the following questions to help review protocolson your server:● Do you use WebDAV?If you use the Web Distributed Authoring and Versioning protocol (WebDAV)to publish content then make sure it is secure. If you do not use it, disable theprotocol.For information on how to secure WebDAV, see Microsoft Knowledge Base article323470, “How To: Create a Secure WebDAV Publishing Directory.” For informationabout disabling WebDAV, see article 241520, “How To Disable WebDAV forIIS 5.0.”