WA120 IIS6 - Administrative users and groups with access privilege to the web server must be documented.

Information

There are typically several individuals and groups involved in running a production web site. In most cases, several types of users on a web server can be identified such as SA's, Web Managers, Auditors, Authors, Developers, and the Clients. Nonetheless, only necessary user and administrative accounts will be allowed on the web server. Accounts will be restricted to those who are necessary to maintain web services, review the server's operation and the OS. Owing to the sensitivity of web servers, a detailed record of these accounts must be maintained.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Document the administrative users and groups which have access rights to the web server in the web site SOP or an equivalent document.

See Also

http://iasecontent.disa.mil/stigs/zip/July2015/U_IIS_6-0_V6R16_STIG.zip

Item Details

References: CAT|III, Rule-ID|SV-38171r1_rule, STIG-ID|WA120_IIS6, Vuln-ID|V-2257

Plugin: Windows

Control ID: ada87a92bf9ff2ec4eaa44c555fadf311cc6f58f45fcb4d3ba283618fad8a6bf