Checklist: Securing IIS

Check off each IIS or Windows Server 2003 security feature or concept once you have become familiar with its operation, use, and configuration.

• NTFS standard permissions

• NTFS special permissions

• Effective permissions

• Shared folder permissions

• Web permissions

• Security principals

• Built-in special identities

• Service accounts

• IUSR_computername

• IWAM_computername

• IIS_WPG

• Anonymous access

• Basic Authentication

• Digest Authentication

• Windows Integrated Authentication

• .NET Passport Authentication

• FTP site security

• IP address and domain name restrictions

• Four-step IIS security model

• Web Service Extensions (WSE)

• Execute permissions

• Application pool identity

• Network Service account

• Local System account

• Parent paths

• ASP security

• Secure Sockets Layer (SSL)

• Server certificates