Step Summary

IIS is secure by default out of the box, but web servers are a combination of components (i.e., network environment, hardware, software, OS, and applications). Making sure that IIS and its running applications are secure means checking and verifying a lot of components beyond IIS. Here are the summarized steps that need to be performed to strongly harden an IIS server:

1. Configure network/perimeter security.

2. Ensure physical security.

3. Install updated hardware drivers.

4. Install the operating system.

5. Configure the host firewall.

6. Configure Remote Admin.

7. Install IIS.

8. Install patches.

9. Harden the operating system.

10. Configure and tighten IIS.

11. Secure web site(s).

12. Configure logging.

13. Clean and test.

14. Install and tighten applications.

15. Conduct penetration tests.

16. Deploy.

17. Monitor log files.

Now we'll cover each of those steps in detail.