3.2 Ensure 'debug' is turned off - Default

Information

Developers often enable the debug mode during active ASP.NET development so that they do not have to continually clear their browsers cache every time they make a change to a resource handler. The problem would arise from this being left 'on' or set to 'true'. Compilation debug output is displayed to the end user, allowing malicious persons to obtain detailed information about applications.

This is a defense in depth recommendation due to the <deployment retail='true' /> in the machine.config configuration file overriding any debug settings.

It is recommended that debugging still be turned off.

Rationale:

Setting <compilation debug> to false ensures that detailed error information does not inadvertently display during live application usage, mitigating the risk of application information leakage falling into unscrupulous hands.

Impact:

Debugging will be disabled.

Solution

To use the UI to make this change:

Open IIS Manager and navigate desired server, site, or application

In Features View, double-click .NET Compilation

On the .NET Compilation page, in the Behavior section, ensure the Debug field is set to False

When finished, click Apply in the Actions pane

Note: The <compilation debug> switch will not be present in the web.config file unless it has been added manually, or has previously been configured using the IIS Manager GUI.

OR

Enter the following command in PowerShell to configure:

Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST/<website name>' -filter 'system.web/compilation' -name 'debug' -value 'False'

Default Value:

The compilation of debug binaries is not enabled by default.

See Also

https://workbench.cisecurity.org/benchmarks/13949

Item Details

Category: SYSTEM AND SERVICES ACQUISITION

References: 800-53|SA-8, CSCv7|18

Plugin: Windows

Control ID: a3afa5eedc7985b72847a8b32070b11c548bc47ba3c0bb8d6152078541142f15