Microsoft Attempts to Secure IIS

billmaly writes: "Yahoo has this article about trying to make IIS more secure. Among steps is to have it install in its most secure state, putting the onus on sysadmins to remove it from that state. It looks like Microsoft may be trying to do the right thing from a security standpoint, at least on paper."

Comments

IIS Secure?

[zarathustra93]

Open the source. Put it up for peer review. Fix the holes. I'm not saying that they should hand out the source for their whole OS, but when they have had as many debacles with one piece of software it might actually help them out quite a bit.

I refuse to install products that require IIS as well. A software provider of ours makes an ultra nice business mining product that can be nicely web enabled. I told them that I would purchase it as soon as they supported a web server that didn't have a new security flaw or bug discovered every week.

Thank god: Microsoft drives forward the industry!

[Sir Spank-o-tron]

Did you catch that:

"``it's incumbent on Microsoft, being in the leadership position we're in, to help drive forward the industry in this area,'' Brian Valentine, senior vice president of the Windows Division at Microsoft, said in an interview."

Now, hopefully Apache and other webservers will start shipping more secure products. Thank you Microsoft for driving forward the industry towards more secure standards.

fun quotes

[ethereal]

``With the virus attacks of late and the numbers of those and how vicious those attacks have been ... it's incumbent on Microsoft, being in the leadership position we're in, to help drive forward the industry in this area,'' Brian Valentine, senior vice president of the Windows Division at Microsoft, said in an interview.

I would think that Microsoft would want to get out of their leadership position in enabling virus attacks and making them so painful, but I guess that's why I'm not President of the Windows Division. I don't think the industry wants to be driven too much further down that path, though - alternate web serving platforms are more like where Microsoft is driving their customers.

``We can't just sit back and think about Microsoft,'' said Valentine, who is leading Microsoft's new security task force.

Well, that will be a first.

Re:it will never be accepted

[Darth RadaR]

It would be interesting if MS does set IIS as "locked down by default". Then we can really find out which MCSEs have a clue and which ones are just good at taking exams.