Microsoft IIS 8.5 Site Security Technical Implementation Guide

The Microsoft IIS 8.5 Site Security Technical Implementation Guide (V2 R9) has 49 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

49STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R9

CurrentPublished Wed Oct 25 2023

The IIS 8.5 website must have a unique application pool.

Microsoft IIS 8.5 Site Security Technical Implementation Guide

Assessment Title

Rule Text

The IIS 8.5 website must have a unique application pool.

Description

Discussion Text

Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-214484

Rule

SV-214484r879887_rule

Severity

medium

Rule Version

IISW-SI-000251

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable.

If this IIS 8.5 installation is supporting Microsoft Exchange and not otherwise hosting any content, this requirement is Not Applicable.

Open the IIS 8.5 Manager.

Expand "Sites" from the "Connections" pane. For every Site listed:

Highlight Site name. Click "Basic Settings" and document the name of the Application Pool.

If any Application Pools are being used for more than one website, this is a finding.

Implementation Procedure

Fix Text

Open the IIS 8.5 Manager.

Click the site name under review.

Assign a unique application pool to each website.

STIG check 38 of 49 in the Microsoft IIS 8.5 Site STIG checklist

← Previous · V-214483The IIS 8.5 website must maintain the confidentiality and integrity of information during preparation for transmission and during reception.Next · V-214485 →The maximum number of requests an application pool can process for each IIS 8.5 website must be explicitly set.