Five simple and effective measures to enhance IIS security

This article is from: People's Network

Web services are the most vulnerable to attacks on any network. Maybe you are using the most popular Web server, Microsoft's Network Information Server (IIS ). Although the recently released IIS 6.0 has enhanced security, it is not omnipotent. You can take five simple measures to make your IIS 6.0 more secure.

Only enable IIS components related to business needs

One of the changes to IIS 6.0 is that IIS only enables indispensable static Web services by default. Keep this configuration in mind and only enable the services you actually need.

Strictly restrict the access permissions assigned to the IUSR_systemname account

Many applications running on the server call the IUSR (Internet user) account to represent Unauthorized network users interacting with the system. This actually limits the account's permissions required to perform operations on the server.

Update security patches in real time with Automatic Updates

Although the new version has significant security improvements over the previous version, if the history replays (as often as Microsoft does ), release version 6.0 will soon have one or more patches for security reasons. Enable automatic upgrade to ensure that you receive the patch as soon as possible.

Quick Failure Protection

The most notable feature of the new version is that you can enable the Rapid-Fail Protection function. This will protect your server from security incidents and performance. It is usually caused by a process that fails too many times in a short period of time, such as a fault or malicious attack. When this happens, the Network Management Service closes the application pool to prevent further failures and make the application unavailable until the Administrator processes the application.

Strict restrictions on Remote Management

It is great to manage servers anywhere, but make sure that only authorized users can. You should require all remote administrators to use static IP addresses for logon, And the logon is limited to the predefined security IP addresses. You should also use strong certification.

This is not a complete list of measures you should take. These five simple methods can immediately improve the security of the IIS server. Visit the Microsoft IIs Security Center to learn more about IIS security.