DISA_STIG_IIS_10.0_Web_Site_v2r7.audit from DISA Microsoft IIS 10.0 Site v2r7 STIG

IIST-SI-000201 - The IIS 10.0 website session state must be enabled.

CAT|II

CCI|CCI-000054

Rule-ID|SV-218735r558649_rule

STIG-ID|IIST-SI-000201

STIG-Legacy|SV-109295

STIG-Legacy|V-100191

Vuln-ID|V-218735

IIST-SI-000202 - The IIS 10.0 website session state cookie settings must be configured to Use Cookies mode.

Rule-ID|SV-218736r558649_rule

STIG-ID|IIST-SI-000202

STIG-Legacy|SV-109297

STIG-Legacy|V-100193

Vuln-ID|V-218736

IIST-SI-000203 - A private IIS 10.0 website must only accept Secure Socket Layer (SSL) connections.

CCI|CCI-000068

Rule-ID|SV-218737r558649_rule

STIG-ID|IIST-SI-000203

STIG-Legacy|SV-109299

STIG-Legacy|V-100195

Vuln-ID|V-218737

IIST-SI-000204 - A public IIS 10.0 website must only accept Secure Socket Layer (SSL) connections when authentication is required.

Rule-ID|SV-218738r558649_rule

STIG-ID|IIST-SI-000204

STIG-Legacy|SV-109301

STIG-Legacy|V-100197

Vuln-ID|V-218738

IIST-SI-000206 - Both the log file and Event Tracing for Windows (ETW) for each IIS 10.0 website must be enabled.

CCI|CCI-000139

CCI|CCI-001464

Rule-ID|SV-218739r558649_rule

STIG-ID|IIST-SI-000206

STIG-Legacy|SV-109303

STIG-Legacy|V-100199

Vuln-ID|V-218739

IIST-SI-000208 - An IIS 10.0 website behind a load balancer or proxy server must produce log records containing the source client IP, and destination information.

CCI|CCI-000133

Rule-ID|SV-218740r558649_rule

STIG-ID|IIST-SI-000208

STIG-Legacy|SV-109305

STIG-Legacy|V-100201

Vuln-ID|V-218740

IIST-SI-000209 - The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events - Connection

CCI|CCI-000134

Rule-ID|SV-218741r558649_rule

STIG-ID|IIST-SI-000209

STIG-Legacy|SV-109307

STIG-Legacy|V-100203

Vuln-ID|V-218741

IIST-SI-000209 - The IIS 10.0 website must produce log records that contain sufficient information to establish the outcome (success or failure) of IIS 10.0 website events - Warning

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Authorization

CCI|CCI-001487

Rule-ID|SV-218742r558649_rule

STIG-ID|IIST-SI-000210

STIG-Legacy|SV-109309

STIG-Legacy|V-100205

Vuln-ID|V-218742

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Custom Content-Type

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - Referer

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Agent

IIST-SI-000210 - The IIS 10.0 website must produce log records containing sufficient information to establish the identity of any user/subject or process associated with an event - User Name

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - bat

CCI|CCI-000381

Rule-ID|SV-218743r558649_rule

STIG-ID|IIST-SI-000214

STIG-Legacy|SV-109311

STIG-Legacy|V-100207

Vuln-ID|V-218743

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - com

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - csh

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - dll

IIST-SI-000214 - The IIS 10.0 website must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled - exe

IIST-SI-000215 - Mappings to unused and vulnerable scripts on the IIS 10.0 website must be removed.

Rule-ID|SV-218744r558649_rule

STIG-ID|IIST-SI-000215

STIG-Legacy|SV-109313

STIG-Legacy|V-100209

Vuln-ID|V-218744

IIST-SI-000216 - The IIS 10.0 website must have resource mappings set to disable the serving of certain file types.

Rule-ID|SV-218745r558649_rule

STIG-ID|IIST-SI-000216

STIG-Legacy|SV-109315

STIG-Legacy|V-100211

Vuln-ID|V-218745

IIST-SI-000217 - The IIS 10.0 website must have Web Distributed Authoring and Versioning (WebDAV) disabled.

Rule-ID|SV-218746r558649_rule

STIG-ID|IIST-SI-000217

STIG-Legacy|SV-109317

STIG-Legacy|V-100213

Vuln-ID|V-218746

IIST-SI-000219 - Each IIS 10.0 website must be assigned a default host header.

CCI|CCI-000382

Rule-ID|SV-218748r802889_rule

STIG-ID|IIST-SI-000219

STIG-Legacy|SV-109321

STIG-Legacy|V-100217

Vuln-ID|V-218748

IIST-SI-000220 - A private IIS 10.0 website authentication mechanism must use client certificates to transmit session identifier to assure integrity.

CCI|CCI-000197

CCI|CCI-001188

CCI|CCI-002470

Rule-ID|SV-218749r850584_rule

STIG-ID|IIST-SI-000220

STIG-Legacy|SV-109323

STIG-Legacy|V-100219

Vuln-ID|V-218749

IIST-SI-000221 - Anonymous IIS 10.0 website access accounts must be restricted - Anonymous username

CAT|I

CCI|CCI-001082

Rule-ID|SV-218750r810857_rule

STIG-ID|IIST-SI-000221

STIG-Legacy|SV-109325

STIG-Legacy|V-100221

Vuln-ID|V-218750

IIST-SI-000221 - Anonymous IIS 10.0 website access accounts must be restricted - Local System Groups

IIST-SI-000223 - The IIS 10.0 website must generate unique session identifiers that cannot be reliably reproduced.

Rule-ID|SV-218751r558649_rule

STIG-ID|IIST-SI-000223

STIG-Legacy|SV-109327

STIG-Legacy|V-100223

Vuln-ID|V-218751

IIST-SI-000224 - The IIS 10.0 website document directory must be in a separate partition from the IIS 10.0 websites system files.

CCI|CCI-001084

Rule-ID|SV-218752r558649_rule

STIG-ID|IIST-SI-000224

STIG-Legacy|SV-109329

STIG-Legacy|V-100225

Vuln-ID|V-218752

IIST-SI-000225 - The IIS 10.0 website must be configured to limit the maxURL.

CCI|CCI-001094

Rule-ID|SV-218753r558649_rule

STIG-ID|IIST-SI-000225

STIG-Legacy|SV-109331

STIG-Legacy|V-100227

Vuln-ID|V-218753

IIST-SI-000226 - The IIS 10.0 website must be configured to limit the size of web requests.

Rule-ID|SV-218754r558649_rule

STIG-ID|IIST-SI-000226

STIG-Legacy|SV-109333

STIG-Legacy|V-100229

Vuln-ID|V-218754

IIST-SI-000227 - The IIS 10.0 websites Maximum Query String limit must be configured.

Rule-ID|SV-218755r558649_rule

STIG-ID|IIST-SI-000227

STIG-Legacy|SV-109335

STIG-Legacy|V-100231

Vuln-ID|V-218755

IIST-SI-000228 - Non-ASCII characters in URLs must be prohibited by any IIS 10.0 website.

Rule-ID|SV-218756r558649_rule

STIG-ID|IIST-SI-000228

STIG-Legacy|SV-109337

STIG-Legacy|V-100233

Vuln-ID|V-218756

IIST-SI-000229 - Double encoded URL requests must be prohibited by any IIS 10.0 website.

Rule-ID|SV-218757r558649_rule

STIG-ID|IIST-SI-000229

STIG-Legacy|SV-109339

STIG-Legacy|V-100235

Vuln-ID|V-218757

IIST-SI-000230 - Unlisted file extensions in URL requests must be filtered by any IIS 10.0 website.

Rule-ID|SV-218758r863014_rule

STIG-ID|IIST-SI-000230

STIG-Legacy|SV-109341

STIG-Legacy|V-100237

Vuln-ID|V-218758

IIST-SI-000231 - Directory Browsing on the IIS 10.0 website must be disabled.

CCI|CCI-001310

Rule-ID|SV-218759r558649_rule

STIG-ID|IIST-SI-000231

STIG-Legacy|SV-109343

STIG-Legacy|V-100239

Vuln-ID|V-218759

IIST-SI-000233 - Warning and error messages displayed to clients must be modified to minimize the identity of the IIS 10.0 website, patches, loaded modules, and directory paths.

CCI|CCI-001312

Rule-ID|SV-218760r865210_rule

STIG-ID|IIST-SI-000233

STIG-Legacy|SV-109345

STIG-Legacy|V-100241

Vuln-ID|V-218760

IIST-SI-000234 - Debugging and trace information used to diagnose the IIS 10.0 website must be disabled.

Rule-ID|SV-218761r558649_rule

STIG-ID|IIST-SI-000234

STIG-Legacy|SV-109347

STIG-Legacy|V-100243

Vuln-ID|V-218761

IIST-SI-000235 - The Idle Time-out monitor for each IIS 10.0 website must be enabled.

CCI|CCI-002361

Rule-ID|SV-218762r850585_rule

STIG-ID|IIST-SI-000235

STIG-Legacy|SV-109349

STIG-Legacy|V-100245

Vuln-ID|V-218762

IIST-SI-000236 - The IIS 10.0 websites connectionTimeout setting must be explicitly configured to disconnect an idle session.

Rule-ID|SV-218763r850586_rule

STIG-ID|IIST-SI-000236

STIG-Legacy|SV-109351

STIG-Legacy|V-100247

Vuln-ID|V-218763

IIST-SI-000237 - The IIS 10.0 website must provide the capability to immediately disconnect or disable remote access to the hosted applications.

CCI|CCI-002322

Detections

Analytics

Revision 1.3

Jul 24, 2023

Functional Update