Tuesday, January 13, 2009

SANs published a list of the top 25 reasons systems are hacked. Evidently, a consortium of people participate in this list including Microsoft. The list is a whose who of problems that continually plauge systems and range from improper coding, to improper permissions, to running processes in privledged accounts.

It is a solid list and I would recommend that you inspect it for anything you aren't already looking for:

http://www.sans.org/top25errors/#s4

IIS | IIS 7 | Reference | Security
Tuesday, January 13, 2009 11:38:03 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Monday, January 12, 2009
Mai Lan posted an article on the details of what to expect in R2
 
The most interesting thing is that several of the most useful "out of band" downloads that you add on the server, FTP, Dav, and Admin Pack specifically are now considered part of the server distribution. I haven't validated this, but this probably means they are part of the installation options on the server with equivalent optional component, automated installation options.
 
This is very good news on two fronts. Often, companies forbid the use of  "out of band" additions to IIS even if it's from Microsoft as they may not be fully supported and there's a stigma that if the code is not part of the core platform, then it shouldn't be trusted. This means that the IIS team is making a statement that this code is production quality for server - which is a big deal, as it is tested a gillion ways before release. My guess is that we can expect to see more of this - code released out of band by the IIS team, becomes incorporated into the core product. The second part is that updates to the code will occur automatically through windows update.
 
Speaking of core produce. Core server will acquire the ability to run asp.net! YES! To be honest, I was always a bit backed off core server as an IIS engine, although it makes a great ISAPI delivery vehicle, since it didn't have .NET capabilities (meaning no integrated pipeline). Adding .NET to core opens a lot of doors to have smaller footprint .NET servers that you manage with Powershell and of course, to make that vision real...
 
R2 comes with an IIS powershell provider.
 
Yeah! Looking forward to this...
 
 
 
-brett
 
IIS | IIS 7 | ITPro | Microsoft  | News
Monday, January 12, 2009 5:11:18 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com
Tuesday, January 06, 2009

Wanted to postback to this article by Wade on the IIS team.

He summarizes this issue really well - in particular that topics lose focus due to a the many posts and lack of the ability to see information chronologically sorted in searching.

http://blogs.iis.net/wadeh/archive/2008/12/18/how-iis-can-help-with-sql-injection.aspx

Keep in mind that as he points out early on, request filtering for SQL inhections is a band-aid. Your appliciations should be written so they do not allow passing of invalid or risky strings to the server.

Thanks!

-brett

 

 

IIS | IIS 7 | Reference | Security
Tuesday, January 06, 2009 6:00:16 PM (GMT Standard Time, UTC+00:00)  #    Comments [0]  |  kick it on DotNetKicks.com

Theme design by Jelle Druyts