IIST-SI-000201 – The IIS 10.0 website session state must be enabled.
Details When the session information is stored on the client, the session ID, along with the user authorization and identity...
- Home
- Security Hardening
- DISA IIS 10.0 Site V2R1
DISA IIS 10.0 Site V2R1
IIST-SI-000202 – The IIS 10.0 website session state cookie settings must be configured to Use Cookies mode.
Details When the session information is stored on the client, the session ID, along with the user authorization and identity...IIST-SI-000203 – A private IIS 10.0 website must only accept Secure Socket Layer (SSL) connections.
Details Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information...IIST-SI-000204 – A public IIS 10.0 website must only accept Secure Socket Layer (SSL) connections when authentication is required.
Details Transport Layer Security (TLS) encryption is a required security setting for a private web server. Encryption of private information...IIST-SI-000214 – The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled – csh
Details Controlling what a user of a hosted application can access is part of the security posture of the web...IIST-SI-000214 – The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled – dll
Details Controlling what a user of a hosted application can access is part of the security posture of the web...IIST-SI-000214 – The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled – exe
Details Controlling what a user of a hosted application can access is part of the security posture of the web...IIST-SI-000215 – Mappings to unused and vulnerable scripts on the IIS 10.0 website must be removed.
Details IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution...IIST-SI-000216 – The IIS 10.0 website must have resource mappings set to disable the serving of certain file types.
Details IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution...IIST-SI-000206 – Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.
Details Internet Information Services (IIS) on Windows Server 2012 provides basic logging capabilities. However, because IIS takes some time to...