According to Web sites that keep track of attacks on computers, only about 20 percent of all Internet Web servers are Microsoft Internet Information Server (IIS) Web servers, but over 60 percent of all the successful attacks on Web servers are against IIS Web servers. Why? Among other things, IIS Web servers' default settings are ill-suited to security needs. Additionally, many security-related flaws have been discovered. The Code Red Worm, which is still attacking Internet IIS servers (including servers at LBNL - see related article), is only one of several designed to exploit vulnerabilities in IIS. The sadmind/PoisonBOx worm, for example, attacked IIS servers all over the Internet (including servers at LBNL) only a few weeks ago.

LBNL's Computer Protection Program provides detailed instructions on how to secure your IIS Web server.

Microsoft's IIS (v. 4.0) Security Checklist is also on the Web.

If you do not have much time to take care of your IIS Web server's security needs, you might want to consider downloading and running SecuredIIS.vbs, a Visual Basic script that eliminates many vulnerabilities in this Web server. You can download this script from the Web.

Take a little while to secure your IIS Web server. By doing so you can prevent defacement of your Web pages, disruption of service, having to rebuild your server, and other problems. For questions send e-mail to eeschultz@lbl.gov.