IIST-SI-000217 – The IIS 10.0 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.
Details A web server can be installed with functionality that by its nature is not secure. Web Distributed Authoring (WebDAV)...
- Home
- Security Hardening
- DISA IIS 10.0 Site V2R1
DISA IIS 10.0 Site V2R1
IIST-SI-000208 – An IIS 10.0 website behind a load balancer or proxy server must produce log records containing the source client IP, and destination information.
Details Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of...IIST-SI-000219 – Each IIS 10.0 website must be assigned a default host header.
Details The web server must be configured to listen on a specified IP address and port. Without specifying an IP...IIST-SI-000209 – The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events – Connection
Details Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of...IIST-SI-000220 – A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.
Details A DoD private website must use PKI as an authentication mechanism for web users. Information systems residing behind web...IIST-SI-000209 – The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events – Warning
Details Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of...IIST-SI-000221 – Anonymous IIS 10.0 website access accounts must be restricted – Anonymous username
Details Many of the security problems that occur are not the result of a user gaining access to files or...IIST-SI-000210 – The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event – Custom Authorization
Details Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of...IIST-SI-000210 – The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event – Custom Content-Type
Details Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of...IIST-SI-000210 – The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event – Referer
Details Web server logging capability is critical for accurate forensic analysis. Without sufficient and accurate information, a correct replay of...