In this article we will focus on some tips you can use in your environment to secure IIS7 servers and the application they’re hosting.

1. The first step you need to take when securing your web server is to harden the OS that hosts it. If you’re using Windows Server 2008 R2, then the server core installation version will give you just what you need – all the functionality, but with the reduced attack surface. If you’re using the regular version of Windows Server, try to install the IIS role with just the features that you currently need. You can always come back and install more features if you need them. Be aware that you’re just making the attack surface larger when you add features that you don’t use.

2. The use of firewalls can really help you in securing your Web server, especially if it’s an Internet-faced one. The firewall can make sure that the server is receiving only valid packets that it has to service. Firewalls serve as a first point of defense for your server when an outside attacker is trying to perform a malicious activity. With the use of Intrusion Prevention Systems (IPS), you can further secure your organization, and the IIS server in particular. If your organization is not large enough to require a specific hardware Firewall device, you can always take advantage of the Windows Server 2008’s integrated Firewall with advanced Security.
Read the full post