文档介绍：IIS Security and Programming Countermeasures
By Jason Coombs (jasonc@)
Introduction
This is a book about how to secure Microsoft Information Services for administrators
and programmers whose work includes a requirement for information security, a
computer industry specialty monly referred to as infosec. In this book the terms
information security and infosec are used interchangeably with the more friendly term
data security. This is not a book about hacking, cracking, and the tools and techniques of
the bad guys, the so-called black hat hackers. This book puter professionals
and infosec specialists how to build secure solutions using IIS. It is your duty to secure
and worked information systems for the benefit of the good guys who are your
end users, clients, or less technical coworkers.
There is nothing you can do that will transform a puter running Microsoft
Windows from its vulnerable condition to an invulnerable one. Every general purpose
puter is inherently vulnerable because it is controlled by software and
is designed to allow new software to be installed or executed arbitrarily. Network
computing based on programmable general puters will never be safe from
an information security perspective. Eliminating the feature of general purpose
programmability from puter and replacing its software with firmware
reduces but does not eliminate vulnerabilities. These are immutable realities of present
puting and, as always, reality represents your biggest challenge. Microsoft is in
business to get as much of your money as possible using whatever means will work at a
given moment and in this respect they know virtually no equal in the software business.
Unfortunately, Microsoft truly does not care about security. You will see why in this book. To
Microsoft, your possession of a microprocessor turns you into a customer, a source of
potential profit. Just as your possession of a pair of eyebal