Details

A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that also proxy requests into an otherwise protected network is a common attack, making the attack anonymous.

Solution

Open the IIS 10.0 Manager.

Under the ‘Connections’ pane on the left side of the management console, select the IIS 10.0 web server.

Under the IIS installed features, ‘Application Request Routing Cache’ is present, double-click the icon to open the feature.

From the right ‘Actions’ pane, under ‘Proxy’, select ‘Server Proxy Settings…’.

In the ‘Application Request Routing’ settings window, remove the check from the ‘Enable proxy’ check box.

Click ‘Apply’ in the ‘Actions’ pane.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y20M10_STIG.ziphttps://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y20M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-7a.
• CAT|II
• CCI|CCI-000381
• Rule-ID|SV-218794r561041_rule
• STIG-ID|IIST-SV-000119
• STIG-Legacy|SV-109227
• STIG-Legacy|V-100123
• Vuln-ID|V-218794

Source

• Tenable.com/audits