Setting up IIS 8.5 - Security practices

Question

This is the first time I'm setting up an IIS installation and i want to make sure to provide maximum security. Some questions were popping into my mind while setting up:

Note that this server hosts external websites which have about 50 Users simultaneously and about 1000 Users a day, but also internal websites which are only for internal purposes (internal means in this case, websites that users of our company use outside the network, but no customers use these sites)

Application Pool Identities:

I've read that it is the best security practice to use the built-in account ApplicationPoolIdentity for Application Pool Identities. My question here is, if I can use this buit-in account for each Application Pool I have because I will deploy Wep Application Isolation - means I will set up a different AppPool for every Web Application I have. Isn't this a contradiction to use the same account on every AppPool even though I deploy different Apppools for each Web App?

Server Hardening:

I want to install as few features and services as possible, to harden the server as much as possible. Is there a way to check if features that I installed are used, or if it doesn't need those at all? (yeah, I know. a bit of a noob question)

Authentification:

Is anonymous authentification required for websites that have external visitors? websites like www.mycompany.com which need to be accessible by everyone? I haven't found a way yet to disable anonymous authentification but make the website still accessible for everyone.

General Networking Question:

I always thought best practice for IIS is to put the Server into DMZ because If the Server got hacked, the Intruder wouldn't be able to access all other Servers which are in our domain-network. Since there are new authification methods like Digestauthentification which need to communicate with a Domain Controller and also the server itself needs to be in a domain for this, I was asking myself if it was better to put the Server in the domain network and secure the access to it with other security measures (proxy etc.) or is DMZ still the best security practice?

Thank you in advance for every input.

Answer 1

1. Application Pool Identities

Use seperate accounts for each application - each application pool results in a seperate w3wp process which runs in the assigned user context. Having stuff like files and other resources (like database authentications) you can increase the security due utilization of the default operating system, filesystem and other security subsystems (like kerberos).

Obviously the assigned accounts should only have as less access to your host as possible (never use high privileagued accounts for websites unless absolutely required by the application [which should really not be the case]).

If possible, i strongly recommend to seperate the servers hosting your public facing website(s) and your internal stuff. Public reachable servers should also be placed in a seperate network segment.

2. Server hardening

Your primary attack surface is IIS (i assume you've a firewall in front of the server) - hardening by disabling services is required to prevent local attacks. Local means in that case your local network (network related services) as well as your own operating system and even your local hardware (like cachebleed does).

So, yes - disable services you don't need. Don't disable services that protect you. You may find some resources on the web about this.

To prevent bad guys from launching custom applications that may finally comprise more parts of your server i advice to make use of software restrictions policies:

• Your application pools are using weak accounts (like a user on a workstation) and cannot install / modify applications on paths that are considered as "application paths"
• Restrict software that is executed to these paths

This leads to a mutual exclution and prevents some simple attacks like opening up a shell and download the actual application that finally opens the doors onto your server.

When using SSL/TLS i advice to harden the server here as well. A good tool for this job is IISCrypto and SslLabs for verifications. Having some spare time you could dig into using NGINX as a reverse proxy that offers some additional advantages regarding transport security.

3. Authentication

Anonymous authentication is more ore less "no authentication". So it's ok.

4. Network segmentation

I've seen many networks applying the concept of a DMZ by putting a whole bunch of servers there and opening doors to the primary network to support backend connectivity for the services provided from the servers hosted in the DMZ.

This leads to the conclusion that you've a network segmentation that doesn't offer any benefit.

Therefore: Yep, DMZ absolutely. But don't put everything in there and don't open doors you don't need. If you've too many unrelated services in the same DMZ, consider creating a seperated zones that seperate the provided service into service groups that are related to each other and have dependencies.

Answer 2

IIS best security practice is an entire discipline and you could spend months reading and learning. And you're certainly asking the correct questions.

I would wax long about each of your specific topics and make explanations, but I'd just be repeating information that's already well documented.

In short, if you wish to follow best practice configuration with IIS, follow the CIS II8 Benchmarks. EVERYTHING you need to know and configure is here. https://benchmarks.cisecurity.org/tools2/iis/CIS_Microsoft_IIS_8_Benchmark_v1.4.0.pdf