Can IIS be kept hackproof?

And strangely enough the answer to both questions has the same roots.

As software gets more complex, its increasingly difficult to keep it safe, and the whole .Net framework is anothe level of complexity.

Add to that a natural antipathy among hackers against Microsoft, and you know that it will be increasingly difficult to secure .Net apps. The collective commmunity of hackers is larger than the number of programmers at Microsoft, and will for various motives, hack into it given enough time.

Thats not to say that you can't prevent most hackers from getting in through dilligence in patching known holes, and careful actitivity monitoring. But most is not all.

You also don't want to try to get back at hackers, unless you can take them to court. Think of them as a community - if you spank one, another will try to spank you, and you will end up with a war that you won't win. Better to spend your energy making your network less tempting, so that the hacker may look for easier prey.

I know this is frustrating. But you need to take a pragmatic approach, unless you are prepared to spend more time and energy than the hackers.

James

The first appears definately no. The second.... well, if you really want to fund a major operation or have the time and strong desire to track people down you often can. Still, doing it half right, as pointed out above, is worse than never starting. Some PI's do this work, but it's expensive and not a sure thing. I recently tracked a bogus seller on e-bay that ripped me off and got them caught but it would have cost way more than the item if all my time was compensated so it was sort of stupid.

It's going to most likely be much harder to find your porn ring. A combination of electronic and good physical detective work is often necessary. Good intuition and hunches get you through the tough bits if you're lucky. Get ready to travel ifyou do go after them, they are likely in another country.

with the majority of people unscrupled enough to hack into systems have a hate on for microsoft, and microsofts programmers known and exploited habit of writing applications with huge holes in it.
the best way to stop hackers is to not use any microsoft product, in conjunction with a good firewall.
today ( for me still ) there were 10 new security holes found in iis. ( 11 if you count the microsoft name drawing hackers )

once I saw that win 2k still has all the win 3.1 code I knew microsoft was not actually repairing any of the problems, just patching over with a quick fix. haven't looked at xp but probably still has win3.1 file manager and emm386.exe as required files.

No computer system will ever be 100% secure, unless turned off. Permanently. Even then, magnets work wonders. Computers and networks are generally made to communicate. Humans program protocols to allow this, and humans are error prone. As long as there are complexities, there will be ways to exploit them.

If you have the time, and the cooperation of ISP's all the way down the line to the little devils' point of demarcation, you COULD catch them, as you would want to get around spoofing and annonymizers. This usually involves involvement from national security forces, and that would mean evidence of serious criminal activity. FBI & CIA have pretty much got their hands full.

You're better off setting up a honey-net, or an IDS (or BOTH!) and just watching closely as they do what they do. Observe and record. THEN once you UNDERSTAND how and where they get in, shut 'em down! Honey-nets are great, as long as you can keep 'em contained and entertained, they aren't busting up your nice little network.

well .NET is not safe yet but lets wait !