3.1 Ensure 'deployment method retail' is set

Information

The <deployment retail> switch is intended for use by production IIS servers. This switch is used to help applications run with the best possible performance and least possible security information leakages by disabling the application's ability to generate trace output on a page, disabling the ability to display detailed error messages to end users, and disabling the debug switch. Often times, switches and options that are developer-focused, such as failed request tracing and debugging, are enabled during active development. It is recommended that the deployment method on any production server be set to retail.

Rationale:

Utilizing the switch specifically intended for production IIS servers will eliminate the risk of vital application and system information leakages that would otherwise occur if tracing or debug were to be left enabled, or customErrors were to be left off.

Solution

Open the machine.config file located in: %systemroot%\\Microsoft.NET\\Framework<bitness (if not the 32 bit)>\\<framework version>\\CONFIG

Add the line <deployment retail='true' /> within the <system.web> section

If systems are 64-bit, do the same for the machine.config located in: %systemroot%\\Microsoft.NET\\Framework<bitness (if not the 32 bit)>\\<framework version>\\CONFIG

See Also

https://workbench.cisecurity.org/benchmarks/14293

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Windows

Control ID: 9ba4d5a9050be43589e20de9aef27acee0c05aa25414b15d37422c08d2a08632