A handful of quick tips for improving IIS security

If you work in a Windows shop and your company has a Web presence, chances are you are working with Microsoft Internet Iinformation Services (IIS). Security problems with IIS are well documented. When working with IIS, there are some important security issues to keep in mind. In this security tip, I take a look at a handful of quick but effective security improvements for IIS.

1. Log for any and all activity of the IUSR account outside of the Web and FTP roots. If activity for this account is detected on files or resources not designated as publicly accessible, this indicates that your system has been compromised.

2. Keep your root CA certifications on your Web server up to date. Regularly prune the list of untrustworthy CAs and add in new CAs that are trustworthy. Make sure your system is properly obtaining the CRL from your trusted CAs.

3. Disable or remove all native default IIS applications. These are stored in the IISSamples, IISHelp and MSADC folders. In most cases, you can simply delete these folders in their entirety. But be sure to create a backup just in case you need to restore them.

4. Remove the IISADMPWD Virtual Directory, especially if you are not using IIS's remote administrative features. The contents of this folder are popular targets for numerous Web based attacks and exploits.

5. Disable or remove unneeded COM components. Removing any unused and unneeded service will reduce the overall number of vulnerabilities of any system. As the number of vulnerabilities discovered for IIS increase, keeping your risk exposure to a minimum is even more important.

6. Disable parent paths (i.e. ".."). Parent paths allow the use of the double period command to move from a child to a parent folder while browsing directories. The parent path command can be included in URLs to access parent folder contents. Parent paths are disabled through a Web sites Properties dialog box by selecting the Home Directory tab, clicking the Configuration button, selecting the App Options tab, then clearing the Enable parent paths checkbox. This setting must be made individually on each separate Web site.

About the author
James Michael Stewart is a researcher and writer for Lanwrights, Inc.