IIS insecurity

[Karl1]

I need to install IIS locally to do some testing. Machine is win2k + running norton personal firewall. After installing iis what will I need to do to ensure that it is secure ? (other than downloading latest patches / updates)

 

[ScotsPine]

make sure

make sure

you run iislockdown...

 

[DimPrawn]

Re: make sure

Re: make sure

Also, urlscan is quite useful.

It blocks 'funny' urls, i.e. ones that try fancy unicode in the url or access to system directories. Combined with lockdown and latest patches, makes IIS 1000x more secure.

 

[AEuropean]

maybe you chuck a personal firewall on and lock down who can connect to it?