When you are deploying a new web server box what are the standard things you install on it and do to set it up?
What things do you do to ensure the box is locked down and not going to get compromised?
- Apply security patches, etc
- Run the Microsfot Baseline Security Analyzer (MBSA)
- Disable weak encryption algorithms - Scott, also see David Christiansen's article and the serversniff.com site
- Harden TCP/IP stack - K. Brian Kelley
- White list traffic with an IPSEC policy
- All NetBIOS is removed or disabled
- Put web server in a workgroup (not allowed to be on a domain)
- Use a DMZ