Designing IIS Security (IIS – Internet Information Service) Lecture 12 1

Reduce Surface of Attacks Windows 2008 Server can be harden by enabling only needed IIS components and services. Default options of IIS can be used Or select / Enable only services and components that needed. Enabling only needed services will reduce risks in Windows 2008 Server.

Reduce Surface of Attacks (cont.) 1) Automatic updates services Choice of different path for Internet servers Critical Web servers with specialized software and hardware Issues with updates Update downtime can have a higher cost Therefore A higher degree of testing might be necessary Disabling automatic update services & developing an a specific update process

Reduce Surface of Attacks (cont.) 2) Access to Files and Folders 2.1 Address File system location Install Web Server in a dedicated disk separate from OS Prevents directory traversal attacks Top-level folder with all subfolders of Web sites and applications One subfolder for each Web site and Web application

Reduce Surface of Attacks (cont.) 2.2 Address use of access control lists (ACLs) on files, folders, and registry keys Ensure anonymous accounts have authorized and controlled access to the Web sites of the Web server. If multiple Web sites, ensure that users accessing one site cannot access another site. Ensure Windows accounts & groups have authorized and controlled access on Web pages of the Web server

Controlling Access to Web Servers, Web Sites, Applications, and Server Resources Restrict Access from Specific IP Addresses or Domain Names Block specific domain names and IP addresses. Or allow only specific domains and IP addresses. Restrict access to intranet sites to computers on internal network Better to restrict by range of IP addresses Avoid DNS reverse lookup when access request is received which reduces performance

Controlling Access to Web Servers, Web Sites, Applications, and Server Resources (cont.) 2. Use Web Site Permissions Read: Default permission required to view the content and properties of directories and files. Can be removed for scripted content Web site Write: Allows visitors to change the content and properties of directories and files Directory Browsing: Allows users to view file lists

Controlling Access to Web Servers, Web Sites, Applications, and Server Resources (cont.) Use Web Site Permissions Log Visits: Places a log entry for each visit to the Web site Index This Resource: Indexing service will index the resources ⇨ search on resource Script Source Access: Permits access to source files Execute: 3 levels of access: None: No scripts or executables can run on the server Scripts Only: scripts can run Scripts And Executables: scripts & executables can run

Protecting Data in Transit Data exchanged between the Web server and clients. Examples: logon credentials, user identities, credit card numbers Data exchanged between the Web server and any other servers Example: data between IIS and database servers

Protecting Data in Transit (cont.) Three technologies to protect data in transit 1) Secure Sockets Layer (or TLS) 2) IPSec 3) Virtual Private Networks (VPNs)

Protecting Data in Transit (cont.) SSL : Secure Sockets Layer Support for client/Web server communication Used in e-commerce application and remote e-mail access Support for communications between SQL Server and IIS Between IIS and ISA (Internet Security and Acceleration Server) Provides server authentication & data encryption between client/server. SSL can tunnel from the client directly to the IIS server or can send data to the ISA server that will be passed to the IIS server

Protecting Data in Transit (cont.) 2) IPSec Can protect communications between IIS and other servers communicating with IIS Can protect communications between the administrative workstation and the IIS server. Data transferred using IPSec ensures data confidentiality. Can block unauthorized communication Eliminate attacks based on other protocols Use of IPSec blocking policy By port: example: block access through 3389 terminal services By type of access from specific servers

Pictures taken from reference [1]

Protecting Data in Transit (cont.) 3) VPN – Virtual Private Network VPN can be used to protect Remote administrative sessions Content management sessions Client access to highly sensitive Web servers

Picture taken from reference [1]

Designing a Secure Content Management Strategy After deployment, Web site must be updated Updating and managing content in a secure way and granted only to authorized users Content can be moved to Web server Examples: file transfer, Microsoft FrontPage publishing Authentication, authorization and data protection Content can be directly modified on Web server Authentication, authorization

Monitoring and Maintenance Strategies for IIS Backing-up of IIS server Applying service packs and security patches Auditing the Web server Monitoring modifications and deletions of content via Systems Access Control Lists (SACLs) Reviewing security policies

Monitoring and Maintenance Strategies for IIS (cont.) Preventing intrusion via IDS and designing response strategy to intrusion alert. Configuring the logs: type of logs, types of Web access depending on security level, performance (log size) and cost (log analysis) Designing secure remote administration

Reference Designing Security for a Microsoft Windows Server 2008 Network, Roberta Bragg, Microsoft Press