WG195 IIS6 - Anonymous access accounts must be restricted.

Information

Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. In most cases, we can identify several types of users on a web server. These are system SAs, web administrators, auditors, authors, developers, and clients (web users, either anonymous or authenticated). Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.

Solution

Remove the anonymous access account from all privileged accounts and all privileged groups.

See Also

http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(1), CAT|I, Rule-ID|SV-29351r1_rule, STIG-ID|WG195_IIS6, Vuln-ID|V-6537

Plugin: Windows

Control ID: 40d3835ebae78a09d383a9022a6e1d824b00cce4e9e9a5900278cc2a9799227b