As you can see from the tag, I know that security by obscurity is not true security.
So consider a server available to the Internet on port 443 (SSL) of a fixed IP address in the dialup range of a telecommunications provider only. When https'ed, it shows an IIS 8 welcome page. The server can be reached via IP address only, no DNS entry (except the usual
ip-<ip>.customers.provider.com entry that is set for EVERY IP address in the provider's range). The IP address is stored in the mail accounts of Windows Phone, iOS and Android devices, and entered from browsers with Google, Bing, and Yahoo auto-search, thus technically known to Google, Apple, Yahoo and Microsoft, and possibly other third-party application vendors if these can access mail account settings from their applications.
Furthermore it is used for browsing the Internet and writing email, and is stored in many server logs, etc., etc., and especially on the sites where one has to log in, like Stack Exchange, you can see easily that it is a fixed IP address, since the IP address has always been tied to the same username for the last two years.
On that IIS server, OWA and ActiveSync are running. Both are required to access mail from everywhere. These are the applications that I would expect on an IIS server, and try first when I see an IIS welcome page.
Apart from doing Windows/Exchange updates regularly, using hard passwords, introducing all employees to the concepts of phishing and social engineering, and hoping that our email is not interesting enough to justify a fully fledged attack directed at us especially, could it make sense to "secure" the server by changing the page returned on a "naked" HTTPS request to a page indistinguishable (including all headers) from an "It works!" Apache page?
I could use some gooood arguments that a CEO, who came up with that idea in the first place, may understand.
EDIT: No, I don't need to get top management's support for security. The CEO seems to care for security already, or else he would not come up with such ideas for "improvement". I am not a security guy with certificates and all, just a concerned citizen, mainly developer, part-time server administrator. Our company does not have a real security guy; we are four people right now.
Since I do server administration part time, I was asked to change the server. But before I dig down deep for information on how to change the default headers in IIS, I would like to question the whole "project"...