Improving Web Application Security: Threats and - CGISecurity

770 Improving Web Application Security: Threats and CountermeasuresAutomatic Updates scans and installs updates for the following operating systems(including the .NET Framework and IIS where applicable):● Microsoft Windows 2000 Professional● Microsoft Windows 2000 Server● Microsoft Windows XP ProfessionalIn addition to using Automatic Updates, use MBSA to detect missing updates forSQL Server, MSDE and MDAC.Secure IISYou often need to run IIS locally for Web development. If you run IIS, secure it.IISLockdown and URLScan significantly reduce your Web server’s attack profile.IISLockdown points unused or forbidden script mappings to 404.dll and helps secureaccess to system directories and system tools. URLScan blocks known dangerousrequests.Although IISLockdown improves IIS security, if you choose the wrong installationoptions or do not modify the URLScan configuration file, URLScan.ini, you couldencounter the following issues:● You cannot create new ASP.NET Web applications. NTFS file system permissionsare configured to strengthen default access to Web locations. This may prevent thelogged on user from creating new ASP.NET Web applications.● Cannot debug existing ASP.NET Web applications. URLScan blocks the DEBUGverb, which is used when you debug ASP.NET Web applications.The following steps show you how to improve IIS security on your developmentworkstation and avoid the issues listed above:● Install and run IISLockdown● Configure URLScan● Restrict access to the local Web serverInstall and Run IISLockdown To install and run IISLockdown1. Run the IISLockdown installation program (Iislockd.exe) fromhttp://download.microsoft.com/download/iis50/Utility/2.1/NT45XP/EN-US/iislockd.exe.Note If you run Iislockd.exe a second time, it removes all changes based on the log file\WINNT\System32\Inetsrv\oblt-log.log.