Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights.

I've seen discussion by some developers who are considering bundling this with their application to make deployment consistent among versions.

If you read the comments section in the link above, the blogger ScottG (and MSFT Corporate VP) mentions that instances of IIS Express will not receive updates via Windows update, but they might be updated when using Microsoft Update.

Since having unexpected and unpatched deployments of IIS Express in the environment of the application end-user can be an attack vector, how does their IT Security organization audit and detect the usage of this product?

share|improve this question
The old version of IIS Express is called Cassini -- en.wikipedia.org/wiki/Cassini_Web_Server – atdre Apr 26 '11 at 17:12
Both IIS Express, and Cassini are different from Hostable Web Core which is a sub component of IIS – makerofthings7 Apr 26 '11 at 19:22
@atdre apparently (havent used it yet...) IIS Express is intended to replace the older Cassini product, but its not just a relabelling... – AviD♦ Apr 26 '11 at 19:52
@makerofthings, for the record note that this really only becomes a real issue when its configured to accept remote requests - which it does not by default. – AviD♦ Apr 26 '11 at 19:54
1  
@nealmcb - Outside of developers using developer tools, Microsoft is recommending that an ISV consider installing IIS Express alongside the application for certain use cases. Some consumers of the ISV application may not notice that this alternate IIS listener is installed or opened. The most concerning is that it may not get patched along with WSUS. – makerofthings7 May 20 '11 at 16:18
show 2 more comments

3 Answers

up vote 3 down vote accepted

Short and easy answer: The same way you audit and detect installation of any other software. You do do this, don't you?

share|improve this answer
up vote 8 down vote

The obvious answer (if we accept your premise) is: routinely port-scan your own machines to see if they are running any unexpected services.

I'm not too sure about the premise that the best way to defend against this risk is to try to detect use of IIS Express. I wonder if you have considered an alternative approach, which is not specific to any particular product:

  • Developers should have full control over their machines, but those machines should be firewalled from the Internet. There should be no open ports that are reachable from the outside Internet, without approval from security staff.

  • There should be separate machines for deploying services to the rest of the world. These machines should be under control of the ops folks, and the ops folks should have procedures governing which services they deploy on those machines. The ops folks will probably require some form of change control, if they're good. These machines can also be firewalled with a firewall policy that matches the expected services running on those machines, as a safety net to catch mistakes.

I think these two steps will take care of the problem.

share|improve this answer
I love your answer, now how do I convince management to do this? – this.josh Jul 2 '11 at 6:53
up vote 1 down vote

Win7 has AppLocker policies which are available via Group Policy. Group Policy, WMI, agentless, and/or Enterprise agent technology can be utilized to accomplish something similar.

In other words, use the Windows Forest/Domain and other technologies to set policies for clients on your network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.