Improving Web Application Security: Threats and - CGISecurity

648 Part V: Assessing Your Security●●●Do you use strong password policies?Use the Local Security Policy tool to review password policy. For informationabout the recommended password policy, see “Step 5. Accounts” in Chapter 16,“Securing Your Web Server.”Do you restrict remote logons?Check the user rights assignments within the Local Security Policy tool to ensurethat the Everyone group is not granted the “Access this computer from thenetwork” user right.Have you disabled null sessions?Check that null sessions are disabled to prevent anonymous (unauthenticated)sessions from being created with your server. To check this, run Regedt32.exe andconfirm that the RestrictAnonymous key is set to 1 as shown below.HKLM\System\CurrentControlSet\Control\LSA\RestrictAnonymous=1Files and DirectoriesThe following review questions enable you to verify that you have used NTFSpermissions appropriately to lock down accounts such as the anonymous Web useraccount.● Is IIS installed on an NTFS volume?This allows you to use NTFS to configure ACLs on resources to restrict access.Do not build a server that uses FAT partitions.● Have you restricted the Everyone group?Use Windows Explorer to ensure that the Everyone group does not have accessto the following directories:● Root (:\)● System directory (\WINNT\system32)● Framework tools directory (\WINNT\Microsoft.NET\Framework\{version})●●Web site root directory and all content directories (default is \inetpub\*)Have you restricted the anonymous Web user account?Make sure that the anonymous Internet user account does not have the ability towrite to Web content directories. Use Windows Explorer to view the ACL on eachcontent directory. Also check the ACL on the %windir%\system32 directory tomake sure that it cannot access system tools and utilities.Note If you ran IISLockdown, the Web Anonymous Users group and the Web Applications groupcan be used to restrict access. By default, the Web Anonymous Users group contains the IUSRaccount and the Web Applications group contains Internet Web Application Manager (IWAM). Froman administrative perspective, restricting access to a group is preferred to individual accountrestriction.