I have a dedicated server windows server 2016, IIS, Sql server 2018 enterprise edition with MS SQL Server databases. I use this server to host my dotnet core applications I manage this server via remote desktop. The hosted websites have a SSl certificate installed over the server. I want to know what are the best practices I should apply to guarantee the full security for my server totally and my hosted web applications and its connected SQL database specifically. Also I want to know if there is any trusted tools that can measure the security level of my server , my web applications and SQL databases

Thanks in advance

  • Keep all programs that are remotely accessible via the internet up to date. Also, log everything. Do some research on common vulnerabilities specific to your OS or software versions. – Ecstasy Feb 4 at 14:15
  • Does it sit behind any type of firewall (hardware or software) ? – Smock Feb 4 at 14:23
  • @Smock no it is not – albier naguib Feb 4 at 14:36
  • That would be recommended, but otherwise, gotta make sure all except the required ports are locked down! There should be an in-built firewall on Server 2016 - which should block most thing by default, but MSTSC/RDP is probably open to all IPs. You'd need to do some research on how to limit ports like that to specific IP addresses (your own) etc. – Smock Feb 4 at 14:42
  1. Research common vulnerabilities in the OS you are using
  2. Use a port/vulnerability scanner to check what ports host services (you should drop all incoming traffic on ports that do not host services)
  3. Use a comprehensive scanner on your open ports to check software version (you want to keep all packages that are exposed to the internet up-to-date and research common vulnerabilities in these open software)
  4. Make sure that you don't have any compilers installed on your system. If an attacker manages to get a remote shell on your machine, they can compile privilege escalation exploits using compilers. (protects against local privilege escalation exploits)
  5. NEVER use default passwords
  6. Whitelist your IP Address services such as SQL and SSH and deny all other addresses (not always required)
  7. Log EVERYTHING you possibly can
  8. Check logs often
  9. If the server is for a website, I would recommend using a CDN

Again, make sure ALL packages are up to date! New exploits for remote access are created and/or patched often!

lynis is a good vulnerability scanner, but not sure if there is a windows release.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.