Improving Web Application Security: Threats and - CGISecurity

654 Part V: Assessing Your SecurityAuditing and LoggingCheck that you have configured IIS auditing to help detect attacks in progress and todiagnose attack footprints. The following review questions help identifyvulnerabilities in IIS auditing:● Are log files located on a separate non-system volume?Right click your Web site in IIS and click the Web Site tab. Click the Propertiesbutton to check the log file location. Check that the log files are located in a nondefaultlocation using a non-default name, preferably on a non-system volume.● Do you restrict access to the log files?Use Windows Explorer to view the ACL on the log files directory. Check thatthe ACL grants Administrators and System full control but grants access to noother user.Web PermissionsReview the default Web permissions configured for your Web site and for eachvirtual directory. Check that the following conditions are met:● Include directories restrict Read permissions.● Virtual directories for which anonymous access is allowed are configured torestrict Write and Execute permissions.● Write permissions and script source access permissions are only granted to contentfolders that allow content authoring. Also check that folders that allow contentauthoring require authentication and Secure Sockets Layer (SSL) encryption.IP Address and Domain Name RestrictionsDo you use IP and domain name restrictions to restrict access to your Web server?If so, have you considered the risks of IP spoofing?AuthenticationCheck the authentication settings for your Web sites and virtual directories. Ensurethat anonymous access is only supported for publicly accessible areas of your site.If you are selecting multiple authentication options, thoroughly test the effects andauthentication-precedence on your application.If Basic authentication is selected, check that SSL is used across the site to protectcredentials.