Web Development

Ask something
Discussion Locked

Will IIS ever really be secure?

0 helpful
8 replies

by debate

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Tell us whether you think IIS will ever really be secure, as featured in the latest Internet Security Focus e-newsletter. Did you lose trust in IIS because of Code Red or Nimda? If so, what would make you regain faith in the product? What role do you think poor network administration has played in IIS getting a bad reputation?

8 replies

by mvndesign.nm.ru

We have used IIS 2 years, now our decision is migration from w2k/IIS onto UNIX/Apache.

We'll do it because IIS have recommended itself like very unstable.

What about sysadmins? I don't think that our admins have a low experience, but they couldn't find any reasons of sudden stopping IIS.

More over, we had to STOP IIS Admin site, because it a very large black hole in safety. And we have to use additional firewall.

by carock

If you think that's an overstatement, think about this.

How is it possible the richest company in the world with the greatest state-of-the art programming and staff, can create a product with these types of vulnerabilities? Not just once, or evendifferent products, but over and over and over again! These "Root" compromises MUST be there by design.

by chris the computin' goo-roo

No, IIS in any version, is not completely secure. Is other software (Apache?) secure? Not really. In the Builder.com Internet Security Focus newsletter, there is a link to another article titled "Hack Proof Your Web Services" but I don't see anything in there about hack-proofing your web services because in each case, the machine is still connected to the internet. The only true hack proof computer is one that is turned off - regardless of the OS. There ARE differing levels of quality of security (the true QoS???), but distinguishing them by how BAD the other guy is serves no purpose.

by Member 31128369

It is well known in security circles that the only truly secure server has all cables detached and in locked in a secure vault...

On the other hand a good sysadmin who keeps up with security mailing lists, reads server logs religiously and maintains a good firewall in front of the machine can secure any server quite well.

The fact of the matter is that all software has bugs, and only the proper mindset on the part of the development team and company can minimize the risks. Microsoft (BG)came out with a great piece of marketing with their suposed inside memo saying 'security before features'. Unfortunately it has not yet (after how many months?) shown any results... We get MANY security buletins from Microsoft every week, admitedly not ALL about IIS but many are...

Personaly I chose Apache, and suggest it to all of my customers and employers, it is not perfectly secure, but I find it 'secure by design' and the response time for fixes seems faster.

Gary Baribault
MCSE NT4, 2K, CCNP+Security, RHCE

by toddking

I have found that administration is the key.

I manage 1 unix server (which now hosts no web servers), and 6 Windows 2000 (2 lb pairs and two independent server) which host over 100 virtual servers.

In the past 2 years the only exploit that was successful in my environment was against the Unix box which is managed by a contractor.

Our windows systems running IIS 5.0 are managed by my self. Each has had in excess of a year of operational stability. These servers recieve more than 1,000,000 visits a day, and remain secure, not because IIS is or is not a secure product, but because I perform the functions of administrator, and keep the servers secure through diligence and effort.

Anyone who allowed themselves to get Code Red or Nimda, was not paying attention to hot fixes and service packs. Moving to Unix will not make that function better, but worse, as the Unix world is divided on how to apply security. Sure it can be more secure, if the administrator makes it secure, but with out expert administration, no systems are secure.

Todd King

by wesley

We've got to face it, web servers be it IIS or Apache or whatever else we use are only as secure as administrators make it. Every server requires timely upkeep and patching, in addition to routine log checking, etc.
We use IIS and Apache extensively, both have their uses. Now we run only Linux for our servers and have since never been attacked nor have we recieved any worms since that time. However, its not due to the security of the servers themselves, but due to our upkeep.

Administration, no matter what you're using, is key.

by fbuchan

As with all things it truly does come down to administration and management skills. All web servers (and server Operating Systems)have their advantages and disadvantages, and what separates the good and bad really is the human being whose hands manage the configuration.

It does seem that Apache is a better out-of-the-gate default system, but IIS is not inherently any more troubled than any other software -- it is just widely abused. That isn't a defence of MS's laxity either, just a fact of how IIS is sold. The number of times I have reviewed systems in small companies and found IIS installed on professional desktops that don't even require it fascinates me.

Maybe the real question here then is not whether IIS will ever be secure, but whether there will ever be a day when the administrative expertise required to secure any systems will be valued.

by binaryking

Whem MS looss more of the Market becasue of security holes, then they will start put real work on security including IIS.

This discussion is closed to new replies.