IIS vulnerability remediation

Products

• Information Centric Analytics

Issue/Introduction

Local security policies might require changes to the following Internet Information Services (IIS) settings:

1. 'host headers' must be required on all Internet-facing websites
2. Advanced IIS logging must be enabled
3. Default IIS web log location must be moved
4. ETW and Physical File logging must be enabled
5. Request Filtering: The maxAllowedContentLength value must be set to <n> bytes or less
6. Request Filtering: Non-ASCII characters must be rejected in URLs under Request Filtering
7. Request Filtering: Request Filtering Configuration Requirements/MaxQueryString
8. Server Headers: server header removed
9. Set log fields for all applications
10. Unlisted File Extensions must not be allowed
11. Web content must be stored on non-system partition

What adverse effects, if any, will these changes have on Information Centric Analytics (ICA)?

Environment

Version : 6.x

Component : Microsoft Internet Information Services (IIS)

Resolution

For any changes to the settings listed in the Introduction of this article, contact Broadcom support for assistance.