General Procedure of Server Hardening

Below I have listed various resources for Server hardening:

Windows Server 2008 Security Baseline

http://technet.microsoft.com/en-us/library/cc514539.aspx

The Windows Server 2008 Security Baseline is updated for Windows Server 2008 Service Pack 2 (SP2).  This updated product baseline provides:

·         Setting severity ratings, allowing you to quickly sort, prioritize, and apply Microsoft security and compliance recommendations.

·         Consolidated product baselines that eliminate EC and SSLF baseline components, and make viewing, customizing, and implementing your security and compliance baselines easier than ever!

·         New compliance-based settings groups allow quicker and easier compliance reporting and audit preparation, when used with the GRC management solution within System Center.

The Windows Hardening guides have been replaced with the corresponding Security guides.

The security guides for various OS and products are included within the Microsoft Security Compliance Manager http://technet.microsoft.com/en-us/library/cc677002.aspx

You can find each security guide under the “Attachments \Guides” section for each product within the Compliance Manager console.

Other security documents

- Threats and Countermeasures Guide: Security Settings in Windows Server 2003 and Windows XP

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=24696

- Microsoft Baseline Security Analyzer (MBSA)

http://technet.microsoft.com/en-us/security/cc184923

- Threats and Countermeasures Guide: Security Settings in Windows Server 2008 R2 and Windows 7

http://technet.microsoft.com/en-us/library/hh125921(v=ws.10).aspx

- Threats and Countermeasures Guide: Security Settings in Windows Server 2008 and Windows Vista

http://technet.microsoft.com/en-us/library/dd349791(v=WS.10).aspx

- Attack Surface Analyzer (beta)

http://www.microsoft.com/download/en/details.aspx?id=19537

- Microsoft Security Compliance Manager

http://technet.microsoft.com/en-us/library/cc677002.aspx

 

- DoD recommendations on securing various OSs

http://iase.disa.mil/stigs/os/windows/2003.html

SQL

Here is a SQL Hardening guide for Sharepoint Environments:

http://technet.microsoft.com/en-us/library/ff607733.aspx

Microsoft  SQL Server 2008 R2 Best Practices Analyzer

http://www.microsoft.com/download/en/details.aspx?id=15289

IIS:

IIS 6.0 Webserver Hardening:

http://technet.microsoft.com/en-us/library/cc163131.aspx

From what I understand IIS 7 does not have a hardening guide yet…

The following forum has really good information on IIS7 lockdown recommendations:

http://forums.iis.net/t/1127617.aspx

SMS IIS Hardening Checklist.

http://msdn.microsoft.com/en-us/library/cc180049.aspx

IIS7 Security PowerPoint  released by our EMEA team:

http://download.microsoft.com/download/4/1/0/410f1d0c-5f8e-4705-af3b-e01a28c3baf2/4-%20EMEA%20IIS7%20Security.pptx

3rd Party considerations:

Due in part to the patching diligence of most organizations, we've seen these attacks shift from exploiting unpatched Microsoft vulnerabilities to targeting outdated 3rd party products.

 In particular Java VM and Adobe products have been heavily targeted:

- Our Malware Protection Center (MPC) details this in the following write-up:

  http://www.microsoft.com/security/portal/Shared/SWUpdates.aspx

 - Recommend upgrading any outdate Java JRE to the latest Sun Java Version (Latest Version)

  http://java.com/en/download/index.jsp

- You can go to the following site to verify the version of Java on your system

  http://java.com/en/download/installed.jsp

 - Also recommend installing any Adobe updates from

  Adobe X reader (Latest)

  http://get.adobe.com/reader/

-  Adobe Flash Player (Latest)

  http://get.adobe.com/flashplayer/

-  Other Adobe updates

  http://www.adobe.com/downloads/updates/

- Also, Secunia has a patch management tool called Secunia Personal Software Inspector (PSI) that will scan and check for vulnerabilities in a variety 3rd party software.

  Personal version    http://secunia.com/vulnerability_scanning/personal/