Improving Web Application Security: Threats and - CGISecurity

652 Part V: Assessing Your SecurityIIS ConfigurationBy reviewing and improving the security of IIS configuration settings, you are ineffect reducing the attack surface of your Web server. For more information about thereview points covered in this section, see Chapter 16, “Securing Your Web Server.”The review questions in this section have been organized by the followingconfiguration categories.● IISLockdown● URLScan● Sites and virtual directories● ISAPI filters● IIS Metabase● Server certificatesIISLockdownThe IISLockdown tool identifies and turns off features to reduce the IIS attack surfacearea. To see if it has been run on your server, check for the following report generatedby IISLockdown:\WINNT\system32\inetsrv\oblt-rep.logFor more information about IISLockdown, see “How To: Use IISLockdown” in the“How To” section of this guide.URLScanURLScan is an ISAPI filter that is installed with IISLockdown. It helps preventpotentially harmful requests from reaching the server and causing damage. Checkthat it is installed and that it is configured appropriately. To see if URLScan is installed1. Start Internet Information Services.2. Right-click your server (not Web site) and then click Properties.3. Click the Edit button next to Master Properties.4. Click the ISAPI Filters tab and see if URLScan is listed.To check the URLScan configuration, use Notepad to edit the following URLScanconfiguration file.%WINDIR%\System32\Inetsrv\URLscan\Urlscan.ini