Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 653For more information about URLScan, see “How To: Use URLScan” in the “How To”section of this guide.Sites and Virtual DirectoriesThe review questions in this section relate to the specific configuration of your Websites and the virtual directories of your applications. In this section, you review thefollowing categories:● Web site location● Script mappings● Anonymous Internet user accounts● Auditing and logging● Web permissions●●●●IP address and domain name restrictionsAuthenticationParent path settingMicrosoft FrontPage Server extensionsWeb Site LocationCheck that your Web site root directory is installed on a non-system volume. Byrelocating your Web site root to a non-system volume, you prevent attackers whouse directory traversal attacks from accessing the system tools and executables suchas Cmd.exe.Script MappingsCheck that you have mapped all unnecessary file extensions to the 404.dll, which isinstalled when you run IISLockdown. To review script mappings1. Start Internet Information Manager.2. Right-click your Web site and click Properties.3. Click the Home Directory tab and then click the Configuration button within theApplication Settings group.Anonymous Internet User AccountsVerify that your application is configured to use a non-default anonymous Internetuser account. If you have multiple Web applications on your server, check that eachapplication is configured to use a separate anonymous account. This allows you toconfigure permissions and to track activity on a per Web application basis.