Improving Web Application Security: Threats and - CGISecurity

766 Improving Web Application Security: Threats and Countermeasures●●IISLockdown. The IISLockdown tool reduces your computer’s attack surface byhardening default IIS and Windows configuration settings and by removingunnecessary IIS extensions. IISLockown also installs the “404.dll” ISAPI filter,which is used to report “404 File Not Found” messages when disabled extensionsare requested.You can download the IISLockdown tool from http://download.microsoft.com/download/iis50/Utility/2.1/NT45XP/EN-US/iislockd.exe.URLScan. URLScan is an ISAPI filter that rejects or allows HTTP requests basedon a configurable set of rules. It is integrated with IISLockdown, although you canalso download it separately. It comes with customizable templates for eachsupported server role.To install URLScan without IISLockdown, see Microsoft Knowledge Basearticle 307608, “INFO: Availability of URLScan Version 2.5 Security Tool,”at http://support.microsoft.com/default.aspx?scid=kb;en-us;307608, in theMicrosoft Knowledge Base.Steps to Secure Your Developer WorkstationTo secure your developer workstation, perform the following tasks:●●●●●●Run using a least privileged accountPatch and updateSecure IISSecure SQL Server and MSDEEvaluate your configuration categoriesStay secureRun Using a Least-Privileged AccountYou should develop applications using a non administrator account. Doing so isimportant primarily to limit the exposure of the logged on user and to help you todesign more secure software. For example, if you design, develop, and test anapplication while you are interactively logged in as an administrator, you are muchmore likely to end up with software that requires administrative privileges to run.You should not generally log on using the local administrator account. The accountthat you use on a daily basis should not be a member of the local Administratorsgroup. Sometimes you might still need an account that has administrative privileges— for example, when you install software or edit the registry. Because the defaultlocal administrator account is well known, however, and it is the target of manyattacks, create a non-standard administrator account and use this only when it isrequired.