The IIS 8.5 web server must be tuned to handle the operational requirements of the hosted application.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-214434	IISW-SV-000151	SV-214434r879806_rule		Medium

Description
A Denial of Service (DoS) can occur when the web server is so overwhelmed that it can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.

STIG	Date
Microsoft IIS 8.5 Server Security Technical Implementation Guide	2023-03-09

Details

Check Text ( C-15644r850603_chk )
If the IIS 8.5 web server is not hosting any applications, this is Not Applicable. If the IIS 8.5 web server is hosting applications, consult with the System Administrator to determine risk analysis performed when application was written and deployed to the IIS 8.5 web server. Obtain documentation on the configuration. Verify, at a minimum, the following tuning settings in the registry. Access the IIS 8.5 web server registry. Verify the following values are present and configured. The required setting depends upon the requirements of the application. Recommended settings are not provided as these settings have to be explicitly configured to show a conscientious tuning has been made. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\ "URIEnableCache" "UriMaxUriBytes" "UriScavengerPeriod" If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" and "UriScavengerPeriod", this is a finding.

Check Text ( C-15644r850603_chk )

If the IIS 8.5 web server is not hosting any applications, this is Not Applicable.

If the IIS 8.5 web server is hosting applications, consult with the System Administrator to determine risk analysis performed when application was written and deployed to the IIS 8.5 web server.

Obtain documentation on the configuration.

Verify, at a minimum, the following tuning settings in the registry.

Access the IIS 8.5 web server registry.

Verify the following values are present and configured. The required setting depends upon the requirements of the application.

Recommended settings are not provided as these settings have to be explicitly configured to show a conscientious tuning has been made.

Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\
"URIEnableCache"
"UriMaxUriBytes"
"UriScavengerPeriod"

If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" and "UriScavengerPeriod", this is a finding.

Fix Text (F-15642r850604_fix)
Access the IIS 8.5 web server registry. Verify the following values are present and configured. The required setting depends upon the requirements of the application. These settings have to be explicitly configured to show a conscientious tuning has been made. Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\ Configure the following registry keys to levels to accommodate the hosted applications. "URIEnableCache" "UriMaxUriBytes" "UriScavengerPeriod"

Fix Text (F-15642r850604_fix)

Access the IIS 8.5 web server registry.

Verify the following values are present and configured. The required setting depends upon the requirements of the application. These settings have to be explicitly configured to show a conscientious tuning has been made.

Navigate to HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\

Configure the following registry keys to levels to accommodate the hosted applications.

"URIEnableCache"
"UriMaxUriBytes"
"UriScavengerPeriod"