1

Is there any Security software recommendation for Windows Server 2003 as a Web Application/Website server?

Or any particular settings I should adjust before making a website to be Live.

Improve this question

4 Answers 4

Reset to default
1

A few recommendations:

(1) Secure the base operating system, relational database, application server and HTTP server http://iase.disa.mil/stigs/stig/index.html

(2) If possible, use 2008 instead of 2003

(3) Consider posting a diagram of your network here, with IP addresses removed, but describing ports, protocols, management interfaces and trust relationships so we may review it.

(4) Check out the OWASP site and learn more about how to build a secure web application, scan it for vulnerabilities, and standard errors programmers make http://www.owasp.org/

(5) Get a web application scanner and review your code. If you are using compiled languages, you can do some static analysis too.

(6) When moving code from (A) development, to (B) staging, to (C) production, I previously used different servers for each. This also enabled reviews of each site, prior to moving it to another stag.

Improve this answer
0

If you are serious about it, you can use the CIS benchmarks to get your system to a known state:

Server 2003. IIS, & MySQL

Also, you could look into a web application firewall (Like ModSecurity)--Check out the following SF questions on WAF:

Application firewalls on IIS

Open Source XML Firewalls?

Hope this helps!

Josh

Improve this answer
0

You should look at the security baselines in the server 2003 security compliance management toolkit. Chapters 8 and 9 talk about IIS/web server security. Also readn and implement the IIS6 security best practices. I'm not to sure about anything from CIS. Lastly develop an upgrade plan to get to server 2008. Many of the improvements were around security.

Improve this answer
-2

Although, it hasn't been maintained I would recommend Core Force security system:
http://force.coresecurity.com/

It'll take some setting up, but it has a lot of features that SHOULD be in Windows by default (like a decent firewall).

Improve this answer
3
  • -1 for bad advice. Installing a security software suite that hasn't been maintained for over 2 years, on a production server, is really bad advice. Not to mention that the last release (Jan 2008!) was to fix vulnerabilities.
    – Josh Brower
    Feb 1, 2010 at 3:54
  • This is a very fallacious argument, a new version of synergy ( synergy2.sourceforge.net ) hasn't officially been released for over 2 years. Yet it has 1,892,569 downloads and it works just fine. If you know a better security software please share.
    – Natalie Adams
    Feb 1, 2010 at 4:00
  • Please don't take it personally. I am trying to point out that installing software that is, for all intents and purposes, end of life, is not the best idea for a production server. This is because you do not get the benefits of compatibility & security updates to the program, which you want for a stable production environment. Using synergy was a bad example: There is a project (tinyurl.com/d27j8t) that is updating synergy, because they did not want to use a program that is not being maintained. Finally, I have shared my answer to the question--Look at the other answer.
    – Josh Brower
    Feb 1, 2010 at 4:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .