eEye Digital Security has released SecureIIS Application Firewall to protect IIS servers from hackers. SecureIIS wraps around IIS and works within it, verifying and analyzing incoming and outgoing Web server data for any possible security breaches. It combines features of Intrusion Detection Systems and conventional Network Firewalls all into one. eEye feels they can detect even unknown attacks using their CHAM (Common Hacking Attack Methods) technology.
Microsoft is clearly beginning to respond to the continuing exploits of IIS. They have now released an IIS Lockdown tool that lets you configure an IIS 4.0 or 5.0 web server for secure operation. It provides two modes:
an express mode that is appropriate for most basic web servers
an advanced mode that allows the administrator pick and choose the technologies the server will support
The tool provides an undo feature that allows the effects of the most recent lockdown to be reversed.
