The result of this configuration strategy is a high level of security with minimal administrative effort.Describe the security architecture of IIS, including built-in accounts.Įnable remote management features for IIS web servers.Ĭonfigure IIS Manager users, permissions, and feature delegation for distributed administration. Administrators can then override settings for specific web applications by using whatever method is dictated by business or technical requirements. In general, settings placed on higher-level objects (such as a website) apply automatically to all the lower-level objects (such as multiple web applications). Figure 6-1 shows how objects, such as the web server, websites, web applications, and other items, are arranged into nested parent–child relationships. In general, applying permissions at higher levels in the hierarchy simplifies administration. For example, you can apply security-related settings at the server level, for specific websites, for specific web applications, or directly on virtual directories, physical files, and folders. IIS simplifies security management through a hierarchical arrangement that helps organize settings and content. Security settings can often be difficult and complicated to manage, and this complexity reduces security because many systems administrators find it challenging to set up the appropriate permissions. In addition, if one layer of security is incorrectly configured or is compromised, other security settings can help restrict or prevent unauthorized access. These security mechanisms work together to ensure that only authorized users have access to the system. Security options include authentication, authorization, file system permissions, and other settings that provide multiple barriers to access. This technique involves a multilayered security approach. NET Framework), you can reduce potential unauthorized access to the system by disabling that feature.Īnother major strategy related to web server security is defense in depth. If certain web applications do not require a particular technology (for example, support for the Microsoft. One of the primary ways to secure a server is by reducing its attack surface. The primary goal for systems administrators who are responsible for managing access to Web Services is to minimize the potential for unauthorized access to and misuse of applications or data.
These topics are covered in Chapter 5, "Installing and Configuring Web Applications". The ability to create and manage websites and web applications. If you have created additional websites or web applications in previous exercises, you may leave them configured on this server. Installed the Web Server (IIS) server role on by using the default installation options for this server role. To complete the lessons in this chapter, you should have: Lesson 2: Controlling Access to Web Services
#Windows server 2008 security checklist how to
You also learn how to increase security through server certificates and IP address restrictions.Ĭonfigure Web site authentication and permissions. In Lesson 2, "Controlling Access to Web Services," you learn about ways in which you use authentication and authorization. You learn how to configure permissions for remote management and how to increase the security of the server by disabling or removing unneeded features and options. Lesson 1, "Configuring IIS Security", focuses on securing access to Internet Information Services 7 (IIS 7) and the content it contains.
#Windows server 2008 security checklist windows
In this chapter, you learn how to configure security for a Windows Server 2008 R2 web server. Security is an important concern in all areas of IT, but it’s especially important for information and applications that are readily accessible to large numbers of users.
From a systems administration standpoint, one of the main goals for managing web servers is to maintain a high standard of security.
0 kommentar(er)
