Details

This check verifies the key web server system configuration files are owned by the SA or Web Manager controlled account. These same files which control the configuration of the web server, and thus its behavior, must also be accessible by the account which runs the web service. If these files are altered by a malicious user, the web server would no longer be under the control of its managers and owners; properties in the web server configuration could be altered to compromise the entire server platform.

Solution

Set file permissions on the web server systems files to meet minimum file permissions requirements.

Supportive Information

The following resource is also helpful.

• http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control, Audit and Accountability, Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|AC-6(7)(b)
• 800-53|AU-9(4)
• 800-53|CM-6b.
• CAT|II
• CSCv6|3.1
• Rule-ID|SV-31321r1_rule
• STIG-ID|WG300_IIS6
• Vuln-ID|V-2259

Source

• Tenable.com/audits