I’m currently trying to improve the security at our work. This sounds very broad, but, for example, I’m penetrating our systems and checking whether servers are vulnerable to certain exploits.
As an example, SMTP gave me this telnet result:
220 [redacted] Microsoft ESMTP MAIL Service, Version: 7.5.7601.17514 ready at Mon, 10 Mar 2014 14:15:30 +0100
After a few hours of searching for a solution, I’ve found a way to hide the details about this server, resulting in this result:
220 [redacted] Ouch, sorry.. 404 - version not found.. Mon, 10 Mar 2014 14:15:57 +0100
This seems a lot more secure, as it does not display the version number any more. My question is, did this increase the security of my server? Or doesn’t it actually make much of a difference and should I ignore version numbers as a security vulnerability?
Is there a security benefit in hiding the IIS version number?