| Acknowledgments | p. xvii |
| Introduction | p. xix |
| Exposure, Risk, and Prevention | |
| Web Security Threats | p. 3 |
| Security Incidents | p. 4 |
| Defensive Objectives | p. 7 |
| Hacker Strategies | p. 7 |
| Security Is Interdependent | p. 9 |
| Hacking Methodology | p. 12 |
| Checklist of Threats | p. 17 |
| Defacing, Damage, and Denial | p. 19 |
| The Source of the Problem | p. 20 |
| An Internet Protocol Primer | p. 21 |
| Known Vulnerabilities | p. 25 |
| Opportunistic Scanning | p. 32 |
| Vulnerability Exploits | p. 38 |
| Checklist of Known Vulnerabilities | p. 51 |
| Preparing and Hardening Your Web Server | p. 53 |
| Plan Ahead | p. 54 |
| Secure Installation Requirements | p. 55 |
| Hardening the System | p. 65 |
| Secure Physical, Boot, and Media Settings | p. 88 |
| Installation Planning Checklist | p. 91 |
| Hardening Recommendations Checklist | p. 91 |
| Accounts, Authorization, and Security Policy | p. 93 |
| Applying Security Policy | p. 94 |
| Windows 2000 and IIS Security Concepts | p. 95 |
| Tools for Local Security Management | p. 99 |
| Configuring Web Server Access Control for Windows 2000 | p. 107 |
| Configure IIS Site Attributes and Properties | p. 127 |
| Checklist for Windows 2000 Account Authorization | p. 135 |
| Checklist for IIS Site Properties | p. 136 |
| Security Auditing and Logging | p. 137 |
| Site Monitoring Overview | p. 138 |
| Logging Setup and Maintenance Procedures | p. 143 |
| Auditing | p. 159 |
| Logging and Auditing Checklist | p. 170 |
| Administration | |
| Deployment Issues | p. 175 |
| Recovery Plan | p. 176 |
| Network Layout and Filtering on an Intranet | p. 187 |
| Securing the Network Perimeter | p. 194 |
| Securing Remote Management | p. 197 |
| Deployment Preparation Checklist | p. 201 |
| The Security Management Lifecycle | p. 203 |
| Lifecycle Methodology | p. 204 |
| Vulnerability Assessments and Proactive Monitoring | p. 205 |
| Incident Response | p. 219 |
| Management Lifecycle Checklist | p. 222 |
| Using Encryption | p. 223 |
| The Basics of Encryption | p. 225 |
| Using IIS Secure Communications | p. 231 |
| Checklist for Configuring SSL | p. 244 |
| Third-Party Security Enhancements | p. 245 |
| Firewalls | p. 248 |
| Intrusion Detection Systems | p. 255 |
| Log Analyzers | p. 259 |
| Virus Scanners | p. 260 |
| Security Awareness Training | p. 263 |
| Change Control | p. 264 |
| Performance and Access-Control Hardware | p. 266 |
| Additional Recommended Security Enhancements | p. 270 |
| Checklist | p. 276 |
| Advanced Topics | |
| Securing FTP, NNTP, and Other IIS Services | p. 281 |
| Installing IIS Subcomponents | p. 282 |
| FTP (File Transfer Protocol) Service | p. 283 |
| NNTP (Network News Transport Protocol) Service | p. 293 |
| Microsoft Index Server and the Content Index Service | p. 302 |
| SMTP (Simple Mail Transport Protocol) Service | p. 306 |
| Starting and Stopping Services | p. 313 |
| Windows Media Services | p. 313 |
| Simple TCP/IP Services | p. 315 |
| Checklist | p. 316 |
| Active Content Security | p. 319 |
| Active Content Technologies | p. 320 |
| Common Gateway Interface | p. 321 |
| Folder Structures for Active Content | p. 324 |
| Application Mappings | p. 327 |
| Source Control | p. 330 |
| Validating User Input | p. 333 |
| ISAPI Filters | p. 340 |
| Additional Methods for Securing Access to Web Content | p. 343 |
| Debugging Active Content | p. 347 |
| Code Signing | p. 353 |
| FrontPage Server Extensions | p. 354 |
| Robots and Spiders | p. 362 |
| Checklist | p. 365 |
| Web Privacy | p. 367 |
| What Is Web Privacy? | p. 368 |
| Privacy Principles and Practice | p. 374 |
| Privacy Laws | p. 380 |
| Tools for Building and Implementing Privacy Policies | p. 388 |
| Web Privacy and Liability | p. 396 |
| Web Privacy and E-mail | p. 399 |
| Final Thoughts | p. 404 |
| Checklist | p. 405 |
| Appendixes | |
| Security Resources | p. 409 |
| Security Web Sites | p. 410 |
| Hacker Web Sites | p. 411 |
| Glossary | p. 413 |
| Reference Tables | p. 431 |
| Suggested Directory Permissions for Windows 2000 and IIS | p. 432 |
| Local Security Policy Settings | p. 434 |
| Packet Filtering Protocol Numbers | p. 443 |
| Microsoft IIS Authentication Methods | p. 449 |
| Anonymous Authentication | p. 450 |
| Basic Authentication | p. 450 |
| Integrated Windows Authentication | p. 451 |
| Client Certificate Mapping | p. 451 |
| Index | p. 453 |
| Table of Contents provided by Syndetics. All Rights Reserved. |
