怎样使 IIS更安全.ppt

WEB327怎样使 IIS更安全 胡 雪高级顾问 美国微软公司 顾问咨询部 Microsoft Corporation 日程： 出名的病毒：Code Red (I II) Windows 2000–安全吗? IIS 5.0 基本安全步骤 您的程序 code安全吗? 微软的工具及策略转变 特征： C:\explorer.exe C:\inetpub\scripts\root.exe Extra network traffic or disk activity Windows 2000 – 安全吗? 是的! W 10,000,000 hits, 400 concurrent hackers, 500.000 attacks Winner of eWeek OpenHack challenge 最快的反应速度： Microsoft Security Response Center Blackhat黑客大会没人能攻破 IIS 为什么常听说微软不安全? 微软名气大，容易成为攻击目标。其他操作系统也有相应的安全漏洞。 IIS 功能多，用做应用服务器 Wide attack surface, too many doors soft defaults, most features enabled Security Hotfixes don’t get installed Unicode exploit went public in August 2000 RDS exploit went public in June 1999!!! Code Red 两个星期后才在一个著名大公司出现 IIS 基本安全步骤 减小受攻击面 加固您的IIS服务器文件及账号系统 时刻留意新情况Stay informed 减小受攻击面 如果你没在用… IIS Samples Internet Printing Index Server ISAPI services like Telnet, Terminal Services, FTP, SMTP, NNTP, … WebDAV 加固您的IIS服务器A well-configured server will resist even newly found vulnerabilities Prevent attackers from executing command-line tools cacls %windir%\system32\*.exe /P Administrators:F modifiying your content cacls c:\inetpub\wwwroot\*.* /P Everyone:R cacls c:\inetpub\wwwroot\*.* /E /G Administrators:F Lock down your network with IPSec No FAT! Have your content on a separate partition 时刻留意新情况Security: A Way of Life Remain informed, vigilant and educated! Audit: Eventlog Monitor: IIS Logging Check for new security hot fixes Subscribe to the Security Notification Service Use HFCHECK Query Windows Update Do Backups Use tools to detect intrusions 您的 Code安全吗? All input is bad! Buffer overruns Input validation 缓冲区溢出Buffer Overflow 工作原理 解决方法 strcpy strcat memcpy sprintf memcpy memset gets sscanf read strstr strrev … Cross-site Scripting Again: All input is bad! How Cross-Site Scripting Works 解决方法 Encode output based on input parameters URLEncode HTMLEncode Filter input parameters for special characters % ; ) ( + - Set Data Limits Use ASP.NET data validation controls 输入验证： And