How to make your IIS server more secure

We all know that Web services are the most vulnerable to attacks on any network. Maybe you are using the most popular Web server, Microsoft's Network Information Server (IIS server ). Although the recently released IIS Server 6.0 has enhanced security, it is not omnipotent. You can take five simple measures to make your IIS Server 6.0 more secure.

Use only components related to the business requirements of the IIS server

One of the changes in IIS Server 6.0 is that the IIS server only uses the indispensable static Web page service by default. Keep this configuration in mind and only enable the services you actually need.

Strictly restrict the access permissions assigned to the IUSR_systemname account

Many applications running on the server call the IUSR (Internet user) account to represent Unauthorized network users interacting with the system. This actually limits the account's permissions required to perform operations on the server.

IIS server uses automatic upgrade to update security patches in real time

Although the new version has significant security improvements over the previous version, if the history replays (as often as Microsoft does ), release version 6.0 will soon have one or more patches for security reasons. Enable automatic upgrade to ensure that you receive the patch as soon as possible.

IIS server quick Failure Protection

The most notable feature of the new version is that you can enable the Rapid-Fail Protection function. This will protect your server from security incidents and performance. It is usually caused by a process that fails too many times in a short period of time, such as a fault or malicious attack. When this happens, the Network Management Service closes the application pool to prevent further failures and make the application unavailable until the Administrator processes the application.

Strict restrictions on Remote Management

It is great to manage servers anywhere, but make sure that only authorized users can. You should require all remote administrators to use static IP addresses for logon, And the logon is limited to the predefined security IP addresses. You should also use strong certification.

These five simple methods can immediately improve the security of the IIS server.