Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any Security software recommendation for Windows Server 2003 as a Web Application/Website server?

Or any particular settings I should adjust before making a website to be Live.

share|improve this question
up vote 1 down vote accepted

A few recommendations:

(1) Secure the base operating system, relational database, application server and HTTP server

(2) If possible, use 2008 instead of 2003

(3) Consider posting a diagram of your network here, with IP addresses removed, but describing ports, protocols, management interfaces and trust relationships so we may review it.

(4) Check out the OWASP site and learn more about how to build a secure web application, scan it for vulnerabilities, and standard errors programmers make

(5) Get a web application scanner and review your code. If you are using compiled languages, you can do some static analysis too.

(6) When moving code from (A) development, to (B) staging, to (C) production, I previously used different servers for each. This also enabled reviews of each site, prior to moving it to another stag.

share|improve this answer

If you are serious about it, you can use the CIS benchmarks to get your system to a known state:

Server 2003. IIS, & MySQL

Also, you could look into a web application firewall (Like ModSecurity)--Check out the following SF questions on WAF:

Hope this helps!


share|improve this answer

You should look at the security baselines in the server 2003 security compliance management toolkit. Chapters 8 and 9 talk about IIS/web server security. Also readn and implement the IIS6 security best practices. I'm not to sure about anything from CIS. Lastly develop an upgrade plan to get to server 2008. Many of the improvements were around security.

share|improve this answer

Although, it hasn't been maintained I would recommend Core Force security system:

It'll take some setting up, but it has a lot of features that SHOULD be in Windows by default (like a decent firewall).

share|improve this answer
-1 for bad advice. Installing a security software suite that hasn't been maintained for over 2 years, on a production server, is really bad advice. Not to mention that the last release (Jan 2008!) was to fix vulnerabilities. – Josh Brower Feb 1 '10 at 3:54
This is a very fallacious argument, a new version of synergy ( ) hasn't officially been released for over 2 years. Yet it has 1,892,569 downloads and it works just fine. If you know a better security software please share. – Nathan Adams Feb 1 '10 at 4:00
Please don't take it personally. I am trying to point out that installing software that is, for all intents and purposes, end of life, is not the best idea for a production server. This is because you do not get the benefits of compatibility & security updates to the program, which you want for a stable production environment. Using synergy was a bad example: There is a project ( that is updating synergy, because they did not want to use a program that is not being maintained. Finally, I have shared my answer to the question--Look at the other answer. – Josh Brower Feb 1 '10 at 4:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.