Strengthening the Security of an IIS 8.5 Web Server

Real-world use case

You're exposing an IIS web server on the Internet: here's how to strengthen its security, version 8.5.

The security of a web server

The security of a web server is often overlooked. Here are some of my IIS hardening methods, for a web server running version 8.5 on Windows Server 2012 R2 Standard.

To start, you need to understand the SSL/TLS protocol and how it works. Personally, here are the tools/methods I use to strengthen a web server:

• Signed certificate: I've only used the Let's Encrypt authority since 2015, with a 3076-bit RSA key (2048-bit is still tolerated until 2030).
• Elliptic-curve Diffie-Hellman key exchange: ECDHE key exchanges should be favored with the following curves: secp256r1, secp384r1, secp521r1, brainpoolP256r1, brainpoolP384r1, or brainpoolP512r1.
• Header restriction: limit REST information disclosure.
• Request logging: for tracking in case of an incident.
• IP address and domain restrictions / Dynamic restrictions (anti-DoS).
• Endpoint Detection and Response (on the Windows server).

Hardening an IIS 8.5 web server

Signed certificate: Let's Encrypt on Windows

1. Download the latest available version of win-acme on your server: link
2. Unzip the archive on the server
3. Run wacs.exe, then: "N", then "1", and choose your IIS site (domain validation via port 80).
4. Your website is then certified by a valid authority.
5. Check the IIS bindings and the certificates used.

Protocols, ciphers, hashes, and key exchange

Download: IIS Crypto

Run the program.

Here's my configuration:

In the Cipher Suites section, here are my preferences:

Confirm your choices and restart the Windows server.

Limiting fingerprinting

In the IIS server, go to: HTTP Response Headers (here's my configuration):

I strongly encourage you to research each directive (e.g., Content-Security-Policy).

More verbose logs

To get more information about the requests received by your sites, go to the Logging tab:

The logs are more verbose and useful in the event of a server issue.

IP address and domain restrictions

In the IP Address and Domain Restrictions tab, I mainly use dynamic restriction:

Endpoint Detection and Response (optional)

Unusual behavior on a web server is often a sign of attack attempts. EDR lets you monitor the machine's behavior. I currently use the Bitdefender EDR solution. For more information: external EDR article.

Once your IIS web server is hardened, you should get the following result on ssllabs.com:

Conclusion