Detections
Analytics

IIST-SI-000221 - Anonymous IIS 10.0 website access accounts must be restricted.

Information

Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data stored on the web server must be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.

Solution

Remove the Anonymous access account from all privileged accounts and all privileged groups.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_10-0_Y26M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-2, CAT|I, CCI|CCI-001082, Rule-ID|SV-218750r1138073_rule, STIG-ID|IIST-SI-000221, STIG-Legacy|SV-109325, STIG-Legacy|V-100221, Vuln-ID|V-218750

Plugin: Windows

Control ID: 5e9c3aa8a186a76c4d92da1044e22ef6b10902e3129e08546809086a891a5799