Summary

Chapter 12 covered how to secure one of the most frequently attacked applications on the Internet. It detailed how to harden the network environment, physical location, hardware, operating system, IIS, and applications. Most of the effort is spent hardening the operating system and IIS. If done appropriately and verified, the steps will result in a strongly hardened IIS server that is impervious to easy exploitation.

The author was involved in a hacking contest at www.hackiis6.com (no longer an active domain), where the steps in this chapter were used to harden an IIS 6 static web site. Hackers from around the world were then invited to attempt to exploit the site for a chance to win an Xbox game console. After more than three weeks, the site didn't even come close to being hacked. While the contest may not have proved that IIS is unhackable, it did demonstrate that when appropriately configured, it can be made relatively secure against easy attack. Chapter 13 will cover file and folder encryption using the Encrypting File System.