IISW-SV-000100 - The IIS 8.5 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.

CAT|II

CCI|CCI-001453

Rule-ID|SV-91375r1_rule

STIG-ID|IISW-SV-000100

Vuln-ID|V-76679

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Date

800-53|AU-12

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-001462

CCI|CCI-001464

Rule-ID|SV-91377r1_rule

STIG-ID|IISW-SV-000102

Vuln-ID|V-76681

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field IP

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Method

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Query

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Referer

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Status

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Time

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field User

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Format W3C

800-53|AU-3

CSCv6|6.2

IISW-SV-000103 - Both the log file and Event Tracing for Windows (ETW) for the IIS 8.5 web server must be enabled.

CCI|CCI-000139

CCI|CCI-001851

Rule-ID|SV-91379r1_rule

STIG-ID|IISW-SV-000103

Vuln-ID|V-76683

IISW-SV-000109 - An IIS 8.5 web server behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.

Rule-ID|SV-91381r2_rule

STIG-ID|IISW-SV-000109

Vuln-ID|V-76685

IISW-SV-000110 - The IIS 8.5 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 web server events - Connection

CCI|CCI-000134

Rule-ID|SV-91383r3_rule

STIG-ID|IISW-SV-000110

Vuln-ID|V-76687

IISW-SV-000110 - The IIS 8.5 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 web server events - Warning

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Authorization

CCI|CCI-001487

Rule-ID|SV-91385r4_rule

STIG-ID|IISW-SV-000111

Vuln-ID|V-76689

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Content-Type

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom User-Agent

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Referer

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Name

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - UserAgent

IISW-SV-000115 - The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-91391r4_rule

STIG-ID|IISW-SV-000115

Vuln-ID|V-76695

IISW-SV-000116 - The log data and records from the IIS 8.5 web server must be backed up onto a different system or media.

CCI|CCI-001348

Rule-ID|SV-91393r2_rule

STIG-ID|IISW-SV-000116

Vuln-ID|V-76697

IISW-SV-000117 - The IIS 8.5 web server must not perform user management for hosted applications.

CCI|CCI-000381

Rule-ID|SV-91395r1_rule

STIG-ID|IISW-SV-000117

Vuln-ID|V-76699

IISW-SV-000118 - The IIS 8.5 web server must only contain functions necessary for operation.

800-53|CM-7

CSCv6|9.1

Rule-ID|SV-91397r1_rule

STIG-ID|IISW-SV-000118

Vuln-ID|V-76701

IISW-SV-000119 - The IIS 8.5 web server must not be both a website server and a proxy server.

Rule-ID|SV-91399r1_rule

STIG-ID|IISW-SV-000119

Vuln-ID|V-76703

IISW-SV-000120 - All IIS 8.5 web server sample code, example applications, and tutorials must be removed from a production IIS 8.5 server.

CAT|I

Rule-ID|SV-91401r1_rule

STIG-ID|IISW-SV-000120

Vuln-ID|V-76705

IISW-SV-000121 - The accounts created by uninstalled features (i.e., tools, utilities, specific, etc.) must be deleted from the IIS 8.5 server - i.e., tools, utilities, etc. must be deleted from the IIS 8.5 server.

800-53|IA-5

Rule-ID|SV-91403r1_rule

STIG-ID|IISW-SV-000121

Vuln-ID|V-76707

IISW-SV-000123 - The IIS 8.5 web server must be reviewed on a regular basis to remove any Operating System features, utility programs, plug-ins, and modules not necessary for operation.

Rule-ID|SV-91405r1_rule

STIG-ID|IISW-SV-000123

Vuln-ID|V-76709

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - bat

800-53|CM-7(4)

Rule-ID|SV-91407r1_rule

STIG-ID|IISW-SV-000124

Vuln-ID|V-76711

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - com

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - csh

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - dll

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - exe

IISW-SV-000125 - The IIS 8.5 web server must have Web Distributed Authoring and Versioning (WebDAV) disabled.

Rule-ID|SV-91409r1_rule

STIG-ID|IISW-SV-000125

Vuln-ID|V-76713

IISW-SV-000129 - The IIS 8.5 web server must perform RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-91411r3_rule

STIG-ID|IISW-SV-000129

Vuln-ID|V-76715

IISW-SV-000130 - Java software installed on a production IIS 8.5 web server must be limited to .class files and the Java Virtual Machine.

CCI|CCI-001166

Rule-ID|SV-91413r1_rule

STIG-ID|IISW-SV-000130

Vuln-ID|V-76717

IISW-SV-000131 - IIS 8.5 Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

CCI|CCI-001082

Rule-ID|SV-91415r1_rule

STIG-ID|IISW-SV-000131

Vuln-ID|V-76719

IISW-SV-000132 - The IIS 8.5 web server must separate the hosted applications from hosted web server management functionality.

800-53|AC-6(4)

Rule-ID|SV-91417r1_rule

STIG-ID|IISW-SV-000132

Vuln-ID|V-76721

IISW-SV-000134 - The IIS 8.5 web server must use cookies to track session state.

800-53|CM-6

CCI|CCI-001185

CCI|CCI-001664

CSCv6|3.1

Rule-ID|SV-91421r4_rule

STIG-ID|IISW-SV-000134

Vuln-ID|V-76725

IISW-SV-000135 - The IIS 8.5 web server must limit the amount of time a cookie persists - sessionState

Rule-ID|SV-91423r3_rule

STIG-ID|IISW-SV-000135

Vuln-ID|V-76727

IISW-SV-000135 - The IIS 8.5 web server must limit the amount of time a cookie persists - timeout

800-53|SC-23(3)

IISW-SV-000136 - The IIS 8.5 web server must augment re-creation to a stable and known baseline.

CCI|CCI-001190

Rule-ID|SV-91425r1_rule

STIG-ID|IISW-SV-000136

Vuln-ID|V-76729

IISW-SV-000137 - The production IIS 8.5 web server must utilize SHA2 encryption for the Machine Key - Encryption Method

800-53|SC-13

CCI|CCI-001199

Rule-ID|SV-91427r2_rule

STIG-ID|IISW-SV-000137

Vuln-ID|V-76731

IISW-SV-000137 - The production IIS 8.5 web server must utilize SHA2 encryption for the Machine Key - Validation Method

800-53|SC-8(1)

IISW-SV-000138 - Directory Browsing on the IIS 8.5 web server must be disabled.

CCI|CCI-001310

Rule-ID|SV-91429r1_rule

STIG-ID|IISW-SV-000138

Vuln-ID|V-76733

IISW-SV-000139 - The IIS 8.5 web server Indexing must only index web content.

800-53|SI-11

CCI|CCI-001312

Rule-ID|SV-91431r2_rule

STIG-ID|IISW-SV-000139

Vuln-ID|V-76735

IISW-SV-000140 - Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 web server, patches, loaded modules, and directory paths.

Rule-ID|SV-91433r2_rule

STIG-ID|IISW-SV-000140

Vuln-ID|V-76737

IISW-SV-000141 - Remote access to the IIS 8.5 web server must follow access policy or work in conjunction with enterprise tools designed to enforce policy requirements.

CCI|CCI-002314

Rule-ID|SV-91435r1_rule

STIG-ID|IISW-SV-000141

Vuln-ID|V-76739

IISW-SV-000142 - The IIS 8.5 web server must restrict inbound connections from nonsecure zones.

Rule-ID|SV-91437r2_rule

STIG-ID|IISW-SV-000142

Vuln-ID|V-76741

IISW-SV-000143 - The IIS 8.5 web server must provide the capability to immediately disconnect or disable remote access to the hosted applications.

CCI|CCI-002322

Rule-ID|SV-91439r1_rule

STIG-ID|IISW-SV-000143

Vuln-ID|V-76743

IISW-SV-000144 - IIS 8.5 web server system files must conform to minimum file permission requirements.

800-53|AC-6(7)

CCI|CCI-002235

Rule-ID|SV-91441r1_rule

STIG-ID|IISW-SV-000144

Vuln-ID|V-76745

IISW-SV-000145 - The IIS 8.5 web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 web server - Log Path

CCI|CCI-001849

Rule-ID|SV-91443r1_rule

STIG-ID|IISW-SV-000145

Vuln-ID|V-76747

IISW-SV-000145 - The IIS 8.5 web server must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 web server - Schedule

800-53|AU-11

IISW-SV-000147 - Access to web administration tools must be restricted to the web manager and the web managers designees.

Detections

Analytics

DISA IIS 8.5 Server v1r9

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.4 May 4, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Mar 18, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.2 Sep 29, 2020 Functional Update IISW-SV-000159 - The IIS 8.5 web server must have a global authorization rule configured to restrict access. Miscellaneous References updated.
Revision 1.1 Apr 22, 2020 Miscellaneous Metadata updated. References updated.