Advertisement
Help Keep Boards Alive. Support us by going ad free today. See here: https://subscriptions.boards.ie/.
If we do not hit our goal we will be forced to close the site.

Current status: https://keepboardsalive.com/

Annual subs are best for most impact. If you are still undecided on going Ad Free - you can also donate using the Paypal Donate option. All contribution helps. Thank you.
https://www.boards.ie/group/1878-subscribers-forum

Private Group for paid up members of Boards.ie. Join the club.
Hi all, please see this major site announcement: https://www.boards.ie/discussion/2058427594/boards-ie-2026

How do you protect your MS / IIS web server... !?

  • 15-12-2014 08:40PM
    #1
    rolion
    Closed Accounts Posts: 3,233 ✭✭✭


    Hello,

    I have a MS Server 2008 & 2012 that I am using to host my clients web sites.
    Is a physical boxes somewhere in a data centre.

    How do you protect the server(s) ,the IIS and / or the websites against the threads that are out there !?
    Are you using a hardware or software firewall ?
    Any antivirus installed on the servers ?

    Thanks.


Comments

  • #2
    Aswerty
    Registered Users, Registered Users 2 Posts: 586 ✭✭✭Aswerty


    Not a system admin but have worked on a few MS Server 2008 production machines. In one place we had a hardware firewall which was managed by our service provider, in another we just used the inbuilt software firewall. The software approach is so finicky, really not a real option in a production environment. The software firewall also means the production machine gets hit with all the malicious requests, with the hardware your machines are nicely isolated from this.

    I can't really remember what we had for AV, I think one place had McAfee in use.

    As a developer I used asafaweb.com for doing some basic configuration analysis for web applications.

    We also removed default accounts on the servers and databases and put high entropy passwords on the active accounts. We also encrypted passwords (e.g. database password) in the web application config files.

    We used a VPN for remotely accessing the servers, via RDP, so that we didn't have to keep ports open for creating an incoming connection.

    OWASP is a great security resource, though I'm far less familiar with their best practices than I should be. I'm sure I'm only scratching the surface of what needs to be done. I'd hope some better experienced folks can chip in.


Advertisement