IISW-SI-000201 - The IIS 8.5 website session state must be enabled.

800-53|SC-23(3)

CAT|II

CCI|CCI-000054

Rule-ID|SV-91471r1_rule

STIG-ID|IISW-SI-000201

Vuln-ID|V-76775

IISW-SI-000202 - The IIS 8.5 website session state cookie settings must be configured to Use Cookies mode.

800-53|CM-6

CSCv6|3.1

Rule-ID|SV-91473r3_rule

STIG-ID|IISW-SI-000202

Vuln-ID|V-76777

IISW-SI-000203 - A private IIS 8.5 website must only accept Secure Socket Layer connections.

800-53|SC-13

CCI|CCI-000068

Rule-ID|SV-91475r3_rule

STIG-ID|IISW-SI-000203

Vuln-ID|V-76779

IISW-SI-000204 - A public IIS 8.5 website must only accept Secure Socket Layer connections when authentication is required.

Rule-ID|SV-91477r1_rule

STIG-ID|IISW-SI-000204

Vuln-ID|V-76781

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field Client IP Address

800-53|AU-12

CCI|CCI-001462

CCI|CCI-001464

Rule-ID|SV-91479r1_rule

STIG-ID|IISW-SI-000205

Vuln-ID|V-76783

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field Date

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field Method

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field Protocol Status

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field Referer

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field Time

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field URI Query

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Field User Name

IISW-SI-000205 - The enhanced logging for each IIS 8.5 website must be enabled and capture, record, and log all content related to a user session - Format W3C

800-53|AU-3

CSCv6|6.2

IISW-SI-000206 - Both the log file and Event Tracing for Windows (ETW) for each IIS 8.5 website must be enabled.

CCI|CCI-000139

Rule-ID|SV-91481r1_rule

STIG-ID|IISW-SI-000206

Vuln-ID|V-76785

IISW-SI-000208 - An IIS 8.5 website behind a load balancer or proxy server, must produce log records containing the source client IP and destination information.

CCI|CCI-000133

Rule-ID|SV-91483r3_rule

STIG-ID|IISW-SI-000208

Vuln-ID|V-76787

IISW-SI-000209 - The IIS 8.5 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 website events - Connection

CCI|CCI-000134

Rule-ID|SV-91485r2_rule

STIG-ID|IISW-SI-000209

Vuln-ID|V-76789

IISW-SI-000209 - The IIS 8.5 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 8.5 website events - Warning

IISW-SI-000210 - The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Authorization

CCI|CCI-001487

Rule-ID|SV-91487r3_rule

STIG-ID|IISW-SI-000210

Vuln-ID|V-76791

IISW-SI-000210 - The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Content-Type

IISW-SI-000210 - The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom HTTP_USER_AGENT

IISW-SI-000210 - The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom User-Agent

IISW-SI-000210 - The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Referer

IISW-SI-000210 - The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Agent

IISW-SI-000210 - The IIS 8.5 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Name

IISW-SI-000213 - The log information from the IIS 8.5 website must be protected from unauthorized modification or deletion.

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-91491r4_rule

STIG-ID|IISW-SI-000213

Vuln-ID|V-76795

IISW-SI-000214 - The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - bat

800-53|CM-7(4)

CCI|CCI-000381

Rule-ID|SV-91493r1_rule

STIG-ID|IISW-SI-000214

Vuln-ID|V-76797

IISW-SI-000214 - The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - com

IISW-SI-000214 - The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - csh

IISW-SI-000214 - The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - dll

IISW-SI-000214 - The IIS 8.5 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - exe

IISW-SI-000215 - Mappings to unused and vulnerable scripts on the IIS 8.5 website must be removed.

Rule-ID|SV-91495r2_rule

STIG-ID|IISW-SI-000215

Vuln-ID|V-76799

IISW-SI-000216 - The IIS 8.5 website must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-91497r1_rule

STIG-ID|IISW-SI-000216

Vuln-ID|V-76801

IISW-SI-000217 - The IIS 8.5 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.

800-53|CM-7

Rule-ID|SV-91499r1_rule

STIG-ID|IISW-SI-000217

Vuln-ID|V-76803

IISW-SI-000218 - The production website must configure the Global .NET Trust Level.

800-53|AC-6

Rule-ID|SV-91501r2_rule

STIG-ID|IISW-SI-000218

Vuln-ID|V-76805

IISW-SI-000219 - Each IIS 8.5 website must be assigned a default host header.

CCI|CCI-000382

Rule-ID|SV-91503r3_rule

STIG-ID|IISW-SI-000219

Vuln-ID|V-76807

IISW-SI-000220 - A private websites authentication mechanism must use client certificates to transmit session identifier to assure integrity.

800-53|IA-5(2)

CCI|CCI-000197

CCI|CCI-001188

CCI|CCI-002470

Rule-ID|SV-91505r1_rule

STIG-ID|IISW-SI-000220

Vuln-ID|V-76809

IISW-SI-000221 - Anonymous IIS 8.5 website access accounts must be restricted - Anonymous username

800-53|AC-3

CAT|I

CCI|CCI-001082

Rule-ID|SV-91507r2_rule

STIG-ID|IISW-SI-000221

Vuln-ID|V-76811

IISW-SI-000221 - Anonymous IIS 8.5 website access accounts must be restricted - Local System Groups

IISW-SI-000223 - The IIS 8.5 website must generate unique session identifiers that cannot be reliably reproduced.

Rule-ID|SV-91509r1_rule

STIG-ID|IISW-SI-000223

Vuln-ID|V-76813

IISW-SI-000224 - The IIS 8.5 website document directory must be in a separate partition from the IIS 8.5 websites system files.

CCI|CCI-001084

Rule-ID|SV-91511r1_rule

STIG-ID|IISW-SI-000224

Vuln-ID|V-76815

IISW-SI-000225 - The IIS 8.5 website must be configured to limit the maxURL.

800-53|SI-10

CCI|CCI-001094

Rule-ID|SV-91513r1_rule

STIG-ID|IISW-SI-000225

Vuln-ID|V-76817

IISW-SI-000226 - The IIS 8.5 website must be configured to limit the size of web requests.

Rule-ID|SV-91515r2_rule

STIG-ID|IISW-SI-000226

Vuln-ID|V-76819

IISW-SI-000227 - The IIS 8.5 websites Maximum Query String limit must be configured.

Rule-ID|SV-91517r1_rule

STIG-ID|IISW-SI-000227

Vuln-ID|V-76821

IISW-SI-000228 - Non-ASCII characters in URLs must be prohibited by any IIS 8.5 website.

Rule-ID|SV-91519r1_rule

STIG-ID|IISW-SI-000228

Vuln-ID|V-76823

IISW-SI-000229 - Double encoded URL requests must be prohibited by any IIS 8.5 website.

Rule-ID|SV-91521r1_rule

STIG-ID|IISW-SI-000229

Vuln-ID|V-76825

IISW-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 8.5 website.

Rule-ID|SV-91523r2_rule

STIG-ID|IISW-SI-000230

Vuln-ID|V-76827

IISW-SI-000231 - Directory Browsing on the IIS 8.5 website must be disabled.

CCI|CCI-001310

CSCv6|9.1

Rule-ID|SV-91525r1_rule

STIG-ID|IISW-SI-000231

Vuln-ID|V-76829

IISW-SI-000232 - The IIS 8.5 website must prevent a web content directory from being displayed.

CCI|CCI-001312

Rule-ID|SV-91527r1_rule

STIG-ID|IISW-SI-000232

Vuln-ID|V-76831

IISW-SI-000233 - Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 8.5 website, patches, loaded modules, and directory paths.

800-53|SI-11

Rule-ID|SV-91531r1_rule

STIG-ID|IISW-SI-000233

Vuln-ID|V-76835

IISW-SI-000234 - Debugging and trace information used to diagnose the IIS 8.5 website must be disabled.

Rule-ID|SV-91533r1_rule

STIG-ID|IISW-SI-000234

Vuln-ID|V-76837

IISW-SI-000235 - The Idle Time-out monitor for each IIS 8.5 website must be enabled.

800-53|AC-11

CCI|CCI-002361

CSCv6|16.5

Rule-ID|SV-91535r2_rule

STIG-ID|IISW-SI-000235

Vuln-ID|V-76839

IISW-SI-000236 - The IIS 8.5 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.

800-53|AC-12

Rule-ID|SV-91537r2_rule

STIG-ID|IISW-SI-000236

Vuln-ID|V-76841

IISW-SI-000237 - The IIS 8.5 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.

CCI|CCI-002322

Rule-ID|SV-91539r1_rule

STIG-ID|IISW-SI-000237

Vuln-ID|V-76843

IISW-SI-000238 - The IIS 8.5 website must use a logging mechanism that is configured to allocate log record storage capacity large enough to accommodate the logging requirements of the IIS 8.5 website.

800-53|AU-11

CCI|CCI-001849

Rule-ID|SV-91541r1_rule

STIG-ID|IISW-SI-000238

Vuln-ID|V-76845

IISW-SI-000239 - The IIS 8.5 websites must utilize ports, protocols, and services according to PPSM guidelines.

Detections

Analytics

DISA IIS 8.5 Site v1r9

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.4 May 4, 2021 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Mar 18, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.2 Sep 29, 2020 Miscellaneous References updated.
Revision 1.1 Apr 22, 2020 Miscellaneous Metadata updated. References updated.