Securing IIS Server Checklists

Abstract

This paper addresses the common IIS web server security specification in the form of a checklist that aids the web master or penetration tester to implement a secure web server infrastructure swiftly.

It is mandatory for a web application to be duly foolproof from vicious attacks for preventing damage that could be in any form indeed. Security professionals and penetration testers are typically part of a web project to ensure the website protection from various attacks by detecting loopholes that might be exploited later. But such critical task is typically not followed in a proper manner and web applications become live into the production environment with inherent vulnerabilities, or even without complying with security guidelines. That is because developers and organizations are often in a hurry to launch the software into the production environment due to various unnamed pressures. Unfortunately, there is not a single tool available that can claim the comprehensive security of an application because attacks could come in any form, in fact the its horizon is so extensive that, it is beyond the assumption. So such summarized checklist snapshots proved to be a truly savior for hardening or to improve our deployment workstation security precipitously.

Virtual Directory

Machine Configuration File

Secure Communication

Logging and Audit