DISA_IIS_8.5_Web_Server_v2r5.audit from DISA Microsoft IIS 8.5 Server v2r5 STIG

IISW-SV-000100 - The IIS 8.5 web server remote authors or content providers must only use secure encrypted logons and connections to upload web server content.

CAT|II

CCI|CCI-001453

Rule-ID|SV-214399r879520_rule

STIG-ID|IISW-SV-000100

STIG-Legacy|SV-91375

STIG-Legacy|V-76679

Vuln-ID|V-214399

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Date

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-001462

CCI|CCI-001464

Rule-ID|SV-214400r879562_rule

STIG-ID|IISW-SV-000102

STIG-Legacy|SV-91377

STIG-Legacy|V-76681

Vuln-ID|V-214400

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field IP

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Method

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Query

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Referer

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Status

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field Time

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Field User

IISW-SV-000102 - The enhanced logging for the IIS 8.5 web server must be enabled and capture all user and web server events - Format W3C

IISW-SV-000103 - Both the log file and Event Tracing for Windows (ETW) for the IIS 8.5 web server must be enabled.

CCI|CCI-000139

CCI|CCI-001851

Rule-ID|SV-214401r879562_rule

STIG-ID|IISW-SV-000103

STIG-Legacy|SV-91379

STIG-Legacy|V-76683

Vuln-ID|V-214401

IISW-SV-000109 - An IIS 8.5 web server behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.

Rule-ID|SV-214402r879566_rule

STIG-ID|IISW-SV-000109

STIG-Legacy|SV-91381

STIG-Legacy|V-76685

Vuln-ID|V-214402

IISW-SV-000110 - The IIS 8.5 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 web server events - Connection

CCI|CCI-000134

Rule-ID|SV-214403r879567_rule

STIG-ID|IISW-SV-000110

STIG-Legacy|SV-91383

STIG-Legacy|V-76687

Vuln-ID|V-214403

IISW-SV-000110 - The IIS 8.5 web server must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 web server events - Warning

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Authorization

CCI|CCI-001487

Rule-ID|SV-214404r879568_rule

STIG-ID|IISW-SV-000111

STIG-Legacy|SV-91385

STIG-Legacy|V-76689

Vuln-ID|V-214404

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Content-Type

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom User-Agent

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Referer

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Name

IISW-SV-000111 - The IIS 8.5 web server must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - UserAgent

IISW-SV-000115 - The log information from the IIS 8.5 web server must be protected from unauthorized modification or deletion.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-214405r879578_rule

STIG-ID|IISW-SV-000115

STIG-Legacy|SV-91391

STIG-Legacy|V-76695

Vuln-ID|V-214405

IISW-SV-000116 - The log data and records from the IIS 8.5 web server must be backed up onto a different system or media.

CCI|CCI-001348

Rule-ID|SV-214406r879582_rule

STIG-ID|IISW-SV-000116

STIG-Legacy|SV-91393

STIG-Legacy|V-76697

Vuln-ID|V-214406

IISW-SV-000117 - The IIS 8.5 web server must not perform user management for hosted applications.

CCI|CCI-000381

Rule-ID|SV-214407r879587_rule

STIG-ID|IISW-SV-000117

STIG-Legacy|SV-91395

STIG-Legacy|V-76699

Vuln-ID|V-214407

IISW-SV-000118 - The IIS 8.5 web server must only contain functions necessary for operation.

Rule-ID|SV-214408r879587_rule

STIG-ID|IISW-SV-000118

STIG-Legacy|SV-91397

STIG-Legacy|V-76701

Vuln-ID|V-214408

IISW-SV-000119 - The IIS 8.5 web server must not be both a website server and a proxy server.

Rule-ID|SV-214409r879587_rule

STIG-ID|IISW-SV-000119

STIG-Legacy|SV-91399

STIG-Legacy|V-76703

Vuln-ID|V-214409

IISW-SV-000120 - All IIS 8.5 web server sample code, example applications, and tutorials must be removed from a production IIS 8.5 server.

CAT|I

Rule-ID|SV-214410r879587_rule

STIG-ID|IISW-SV-000120

STIG-Legacy|SV-91401

STIG-Legacy|V-76705

Vuln-ID|V-214410

IISW-SV-000121 - The accounts created by uninstalled features (i.e., tools, utilities, specific, etc.) must be deleted from the IIS 8.5 server.

Rule-ID|SV-214411r879587_rule

STIG-ID|IISW-SV-000121

STIG-Legacy|SV-91403

STIG-Legacy|V-76707

Vuln-ID|V-214411

IISW-SV-000123 - The IIS 8.5 web server must be reviewed on a regular basis to remove any Operating System features, utility programs, plug-ins, and modules not necessary for operation.

Rule-ID|SV-214412r879587_rule

STIG-ID|IISW-SV-000123

STIG-Legacy|SV-91405

STIG-Legacy|V-76709

Vuln-ID|V-214412

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - bat

Rule-ID|SV-214413r879587_rule

STIG-ID|IISW-SV-000124

STIG-Legacy|SV-91407

STIG-Legacy|V-76711

Vuln-ID|V-214413

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - com

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - csh

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - dll

IISW-SV-000124 - The IIS 8.5 web server must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - exe

IISW-SV-000125 - The IIS 8.5 web server must have Web Distributed Authoring and Versioning (WebDAV) disabled.

Rule-ID|SV-214414r879587_rule

STIG-ID|IISW-SV-000125

STIG-Legacy|SV-91409

STIG-Legacy|V-76713

Vuln-ID|V-214414

IISW-SV-000129 - The IIS 8.5 web server must perform RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-214415r879612_rule

STIG-ID|IISW-SV-000129

STIG-Legacy|SV-91411

STIG-Legacy|V-76715

Vuln-ID|V-214415

IISW-SV-000130 - Java software installed on a production IIS 8.5 web server must be limited to .class files and the Java Virtual Machine.

CCI|CCI-001166

Rule-ID|SV-214416r879627_rule

STIG-ID|IISW-SV-000130

STIG-Legacy|SV-91413

STIG-Legacy|V-76717

Vuln-ID|V-214416

IISW-SV-000131 - IIS 8.5 Web server accounts accessing the directory tree, the shell, or other operating system functions and utilities must only be administrative accounts.

CCI|CCI-001082

Rule-ID|SV-214417r879631_rule

STIG-ID|IISW-SV-000131

STIG-Legacy|SV-91415

STIG-Legacy|V-76719

Vuln-ID|V-214417

IISW-SV-000132 - The IIS 8.5 web server must separate the hosted applications from hosted web server management functionality.

Rule-ID|SV-214418r879631_rule

STIG-ID|IISW-SV-000132

STIG-Legacy|SV-91417

STIG-Legacy|V-76721

Vuln-ID|V-214418

IISW-SV-000134 - The IIS 8.5 web server must use cookies to track session state.

CCI|CCI-001185

CCI|CCI-001664

Rule-ID|SV-214419r879638_rule

STIG-ID|IISW-SV-000134

STIG-Legacy|SV-91421

STIG-Legacy|V-76725

Vuln-ID|V-214419

IISW-SV-000135 - The IIS 8.5 web server must limit the amount of time a cookie persists - sessionState

Rule-ID|SV-214420r879638_rule

STIG-ID|IISW-SV-000135

STIG-Legacy|SV-91423

STIG-Legacy|V-76727

Vuln-ID|V-214420

IISW-SV-000135 - The IIS 8.5 web server must limit the amount of time a cookie persists - timeout

IISW-SV-000136 - The IIS 8.5 web server must augment re-creation to a stable and known baseline.

CCI|CCI-001190

Rule-ID|SV-214421r879640_rule

STIG-ID|IISW-SV-000136

STIG-Legacy|SV-91425

STIG-Legacy|V-76729

Vuln-ID|V-214421

IISW-SV-000137 - The production IIS 8.5 web server must utilize SHA2 encryption for the Machine Key - Encryption Method

CCI|CCI-001199

Rule-ID|SV-214422r879642_rule

STIG-ID|IISW-SV-000137

STIG-Legacy|SV-91427

STIG-Legacy|V-76731

Vuln-ID|V-214422

IISW-SV-000137 - The production IIS 8.5 web server must utilize SHA2 encryption for the Machine Key - Validation Method

Detections

Analytics

Revision 1.4

Oct 6, 2023

Functional Update