Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

IIS 7.0 Site STIG

The IIS 7.0 Site STIG (V1 R19) has 49 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

49STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R19

CurrentPublished Fri Jan 24 2020

Access to the web content and script directories must be restricted.

IIS 7.0 Site STIG

Assessment Title

Rule Text

Description

Discussion Text

Excessive permission for the anonymous web user account is a common fault contributing to the compromise of a web server. If this account is able to upload and execute files on the web server, the organization or owner of the server will no longer have control of the asset.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-2258

Rule

SV-32331r2_rule

Severity

high

Rule Version

WG290 IIS7

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

1. Open the IIS Manager.
2. Click the site name under review.
3. In the Action Pane select Edit Permissions.
4. Select the Security tab.
5. Review the permissions for the accounts. If the IUSR or Everyone Account permission is greater than read, this is a finding.

Implementation Procedure

Fix Text

1. Open the IIS Manager.
2. Click the site name under review.
3. In the Action Pane select Edit Permissions.
4. Select the Security tab.
5. Set the permissions for the accounts IUSR and Everyone to read.

STIG check 28 of 49 in the IIS 7.0 Site STIG checklist

← Previous · V-2254Only web sites that have been fully reviewed and tested will exist on a production web server.Next · V-2260 →A web site must not contain a robots.txt file.