Internal corporate, yes. Directly exposed to the internet? I would hope not.
From: Brian Desmond [mailto:[email protected]] Sent: Thursday, October 07, 2010 10:34 AM To: NT System Admin Issues Subject: RE: Need System/Application Security Advice Ermm what you describe (as I understand it) is probably how 75-90 percent of apps run on IIS in a corporate environment. Thanks, Brian Desmond [email protected] c - 312.731.3132 From: Klint Price [mailto:[email protected]] Sent: Thursday, October 07, 2010 7:28 PM To: NT System Admin Issues Subject: Need System/Application Security Advice My off-hour job is consulting for various companies. One such small company puts out a product that I feel needs to be fixed. Company sells two products; ProductA integrates with ProductB which both manage sensitive data and are exposed to the public Internet Windows Forms Authentication is tied to LDAP to authenticate users prior to allowing them into the inner-workings of the system. ProductA and ProductB are configured so that IIS allows a domain account to run the entire website for anonymous users (the equivalent of running an app pool with a domain account). Because the entire site runs under the domain account, there are inherent security risks which Company fails to disclose. I am about to send off an e-mail to the higher ups detailing why this is a bad idea without instructing the customer on the possible security risks, and associated steps to mitigate, let alone re-architect the application to reduce this exposure. Why is it a bad idea to configure a site in this way out-of-the-box, and what articles can you point me to? Any security articles would also be appreciated. At minimum I think the domain user should be removed from the "domain users" group, with additional GPO's applied to lock down the account. What say ye? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected]<mailto:[email protected]> with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
