DISA_IIS_10.0_Web_Site_v2r5.audit from DISA Microsoft IIS 10.0 Site v2r5 STIG

IIST-SI-000201 - The IIS 10.0 website session state must be enabled.

CAT|II

CCI|CCI-000054

Rule-ID|SV-218735r558649_rule

STIG-ID|IIST-SI-000201

STIG-Legacy|SV-109295

STIG-Legacy|V-100191

Vuln-ID|V-218735

IIST-SI-000202 - The IIS 10.0 website session state cookie settings must be configured to Use Cookies mode.

Rule-ID|SV-218736r558649_rule

STIG-ID|IIST-SI-000202

STIG-Legacy|SV-109297

STIG-Legacy|V-100193

Vuln-ID|V-218736

IIST-SI-000203 - A private IIS 10.0 website must only accept Secure Socket Layer (SSL) connections.

CCI|CCI-000068

Rule-ID|SV-218737r558649_rule

STIG-ID|IIST-SI-000203

STIG-Legacy|SV-109299

STIG-Legacy|V-100195

Vuln-ID|V-218737

IIST-SI-000204 - A public IIS 10.0 website must only accept Secure Socket Layer (SSL) connections when authentication is required.

Rule-ID|SV-218738r558649_rule

STIG-ID|IIST-SI-000204

STIG-Legacy|SV-109301

STIG-Legacy|V-100197

Vuln-ID|V-218738

IIST-SI-000206 - Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.

CCI|CCI-000139

CCI|CCI-001464

Rule-ID|SV-218739r558649_rule

STIG-ID|IIST-SI-000206

STIG-Legacy|SV-109303

STIG-Legacy|V-100199

Vuln-ID|V-218739

IIST-SI-000208 - An IIS 10.0 website behind a load balancer or proxy server must produce log records containing the source client IP, and destination information.

CCI|CCI-000133

Rule-ID|SV-218740r558649_rule

STIG-ID|IIST-SI-000208

STIG-Legacy|SV-109305

STIG-Legacy|V-100201

Vuln-ID|V-218740

IIST-SI-000209 - The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events - Connection

CCI|CCI-000134

Rule-ID|SV-218741r558649_rule

STIG-ID|IIST-SI-000209

STIG-Legacy|SV-109307

STIG-Legacy|V-100203

Vuln-ID|V-218741

IIST-SI-000209 - The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events - Warning

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Authorization

CCI|CCI-001487

Rule-ID|SV-218742r558649_rule

STIG-ID|IIST-SI-000210

STIG-Legacy|SV-109309

STIG-Legacy|V-100205

Vuln-ID|V-218742

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Content-Type

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Referer

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Agent

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Name

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - bat

CCI|CCI-000381

Rule-ID|SV-218743r558649_rule

STIG-ID|IIST-SI-000214

STIG-Legacy|SV-109311

STIG-Legacy|V-100207

Vuln-ID|V-218743

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - com

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - csh

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - dll

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - exe

IIST-SI-000215 - Mappings to unused and vulnerable scripts on the IIS 10.0 website must be removed.

Rule-ID|SV-218744r558649_rule

STIG-ID|IIST-SI-000215

STIG-Legacy|SV-109313

STIG-Legacy|V-100209

Vuln-ID|V-218744

IIST-SI-000216 - The IIS 10.0 website must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-218745r558649_rule

STIG-ID|IIST-SI-000216

STIG-Legacy|SV-109315

STIG-Legacy|V-100211

Vuln-ID|V-218745

IIST-SI-000217 - The IIS 10.0 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.

Rule-ID|SV-218746r558649_rule

STIG-ID|IIST-SI-000217

STIG-Legacy|SV-109317

STIG-Legacy|V-100213

Vuln-ID|V-218746

IIST-SI-000219 - Each IIS 10.0 website must be assigned a default host header.

CCI|CCI-000382

Rule-ID|SV-218748r802889_rule

STIG-ID|IIST-SI-000219

STIG-Legacy|SV-109321

STIG-Legacy|V-100217

Vuln-ID|V-218748

IIST-SI-000220 - A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.

CCI|CCI-000197

CCI|CCI-001188

CCI|CCI-002470

Rule-ID|SV-218749r802892_rule

STIG-ID|IIST-SI-000220

STIG-Legacy|SV-109323

STIG-Legacy|V-100219

Vuln-ID|V-218749

IIST-SI-000221 - Anonymous IIS 10.0 website access accounts must be restricted - Anonymous username

CAT|I

CCI|CCI-001082

Rule-ID|SV-218750r810857_rule

STIG-ID|IIST-SI-000221

STIG-Legacy|SV-109325

STIG-Legacy|V-100221

Vuln-ID|V-218750

IIST-SI-000221 - Anonymous IIS 10.0 website access accounts must be restricted - Local System Groups

IIST-SI-000223 - The IIS 10.0 website must generate unique session identifiers that cannot be reliably reproduced.

Rule-ID|SV-218751r558649_rule

STIG-ID|IIST-SI-000223

STIG-Legacy|SV-109327

STIG-Legacy|V-100223

Vuln-ID|V-218751

IIST-SI-000224 - The IIS 10.0 website document directory must be in a separate partition from the IIS 10.0 websites system files.

CCI|CCI-001084

Rule-ID|SV-218752r558649_rule

STIG-ID|IIST-SI-000224

STIG-Legacy|SV-109329

STIG-Legacy|V-100225

Vuln-ID|V-218752

IIST-SI-000225 - The IIS 10.0 website must be configured to limit the maxURL.

CCI|CCI-001094

Rule-ID|SV-218753r558649_rule

STIG-ID|IIST-SI-000225

STIG-Legacy|SV-109331

STIG-Legacy|V-100227

Vuln-ID|V-218753

IIST-SI-000226 - The IIS 10.0 website must be configured to limit the size of web requests.

Rule-ID|SV-218754r558649_rule

STIG-ID|IIST-SI-000226

STIG-Legacy|SV-109333

STIG-Legacy|V-100229

Vuln-ID|V-218754

IIST-SI-000227 - The IIS 10.0 websites Maximum Query String limit must be configured.

Rule-ID|SV-218755r558649_rule

STIG-ID|IIST-SI-000227

STIG-Legacy|SV-109335

STIG-Legacy|V-100231

Vuln-ID|V-218755

IIST-SI-000228 - Non-ASCII characters in URLs must be prohibited by any IIS 10.0 website.

Rule-ID|SV-218756r558649_rule

STIG-ID|IIST-SI-000228

STIG-Legacy|SV-109337

STIG-Legacy|V-100233

Vuln-ID|V-218756

IIST-SI-000229 - Double encoded URL requests must be prohibited by any IIS 10.0 website.

Rule-ID|SV-218757r558649_rule

STIG-ID|IIST-SI-000229

STIG-Legacy|SV-109339

STIG-Legacy|V-100235

Vuln-ID|V-218757

IIST-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.

Rule-ID|SV-218758r695276_rule

STIG-ID|IIST-SI-000230

STIG-Legacy|SV-109341

STIG-Legacy|V-100237

Vuln-ID|V-218758

IIST-SI-000231 - Directory Browsing on the IIS 10.0 website must be disabled.

CCI|CCI-001310

Rule-ID|SV-218759r558649_rule

STIG-ID|IIST-SI-000231

STIG-Legacy|SV-109343

STIG-Legacy|V-100239

Vuln-ID|V-218759

IIST-SI-000233 - Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 website, patches, loaded modules, and directory paths.

CCI|CCI-001312

Rule-ID|SV-218760r558649_rule

STIG-ID|IIST-SI-000233

STIG-Legacy|SV-109345

STIG-Legacy|V-100241

Vuln-ID|V-218760

IIST-SI-000234 - Debugging and trace information used to diagnose the IIS 10.0 website must be disabled.

Rule-ID|SV-218761r558649_rule

STIG-ID|IIST-SI-000234

STIG-Legacy|SV-109347

STIG-Legacy|V-100243

Vuln-ID|V-218761

IIST-SI-000235 - The Idle Time-out monitor for each IIS 10.0 website must be enabled.

CCI|CCI-002361

Rule-ID|SV-218762r766903_rule

STIG-ID|IIST-SI-000235

STIG-Legacy|SV-109349

STIG-Legacy|V-100245

Vuln-ID|V-218762

IIST-SI-000236 - The IIS 10.0 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.

Rule-ID|SV-218763r810858_rule

STIG-ID|IIST-SI-000236

STIG-Legacy|SV-109351

STIG-Legacy|V-100247

Vuln-ID|V-218763

IIST-SI-000237 - The IIS 10.0 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.

CCI|CCI-002322

Detections

Analytics

DISA IIS 10.0 Site v2r5

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Functional Update

Revision 1.1

Functional Update

Revision 1.0

Miscellaneous