Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 649●●Have you secured or removed utilities and SDKs?Verify that you have no utilities or software development kits (SDKs) on yourserver. Make sure that neither Visual Studio.NET nor any .NET Framework SDKsare installed. Also make sure that you have restricted access with NTFSpermissions to powerful system tools such as At.exe, Cmd.exe, Net.exe,Pathping.exe, Regedit.exe, Regedt32.exe, Runonce.exe, Runas.exe, Telnet.exe, andTracert.exe. Finally, make sure that no debugging tools are installed on the server.IISLockdown automatically restricts access to system tools by the WebAnonymous Users group and the Web Applications group.Have you removed unused DSNs?Verify that all unused data source names (DSNs) have been removed from theserver because they can contain clear text database connection details.SharesReview the following questions to ensure that your server is not unnecessarilyexposed by the presence of file shares:● What shares are available on your server?To review shares and associated permissions, run the Computer ManagementMMC snap-in and select Shares beneath Shared Folders. Check that all the sharesare required. Remove any unnecessary shares.● Can the Everyone group access shares?Verify that the Everyone group is not granted access to your shares unlessintended, and that specific permissions are configured instead.● Have you removed the administration shares?If you do not allow remote administration of your server, then check that theadministration shares, for example, C$ and IPC$ have been removed.PortsReview the ports that are active on your server to make sure that no unnecessaryports are available. To verify which ports are listening, run the following netstatcommand.netstat -n -a