New answers tagged iis
Look here at the OWASP article regarding redirects. Check your PHP code.
My thinking would be to keep it as simple as possible. Use a reverse proxy in your DMZ with ssl termination for encryption. I personally use nginx on Centos but have used HAProxy before and they are both straightforward to set up. Both of them have community and commercial editions. You might be able to find Docker images of nginx or HAProxy. Your app ...
My vote is TMG. This will allow the service to be exposed while still allowing inspection of the traffic before it reaches the internal server. Much like the VPN, it can be configured to require a client side certificate and/or a password for authentication as well as supporting a variety of encryption methods. This will prevent random scanners and ...
You can use TLS with client authentication. The communication is encrypted and both server and client have to prove their authenticity by providing valid certificates. You can install a reverse proxy in front of the existing server to handle encryption.
I would personally use a VPN and make the service accessible from the local network (VPN connections would appear to be local). When using a VPN connection everything is encrypted and you require credentials to use the VPN. These credentials could change on a weekly, monthly basis, etc, etc. Very short answer but it is very black and white.
The following registry file will disable SSLv2 & SSLv3 on most windows implementations. Create a .reg file with the following details and run. Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0] ...
disabling everything "RC4" with IIS Crypto allowed to pass PCI compliance test on Server 2008 / IIS 7.0
Top 50 recent answers are included