IIS Security Hardening for WebReports

WebReports environments should be secured according to your organization's security, compliance, and infrastructure requirements.

This article provides general recommendations for securing an IIS server that hosts WebReports. It is not intended to replace your organization's security policies or Microsoft security guidance.

Important: Security requirements vary by organization. Work with your security, infrastructure, and compliance teams before making changes to IIS, Windows Server, TLS protocols, cipher suites, firewall rules, or authentication settings.

Keep Windows and IIS Updated

Keep the Windows operating system and Internet Information Services (IIS) current with applicable security updates.

Your organization should establish a regular process for:

• Applying Windows security updates.
• Reviewing IIS security updates.
• Updating the ASP.NET Hosting Bundle used by WebReports.
• Reviewing security advisories that affect your deployed Windows Server version.

Remove Unused IIS Features

Only install IIS components that are required by WebReports and your selected authentication method.

Removing unused IIS features reduces the number of services and components exposed on the server.

Review installed IIS role services periodically and disable or remove features that are not required by your environment.

For the IIS components used during WebReports installation, see:

Install Internet Information Services (IIS) for WebReports

Use HTTPS

WebReports should be accessed using HTTPS with a valid SSL/TLS certificate.

The certificate should:

• Be issued by a Certificate Authority (CA) trusted by WebReports users.
• Match the DNS name used to access WebReports.
• Be within its valid date range.
• Use cryptographic settings that comply with your organization's security requirements.

For IIS binding configuration, see:

Configure IIS and Deploy WebReports

Configure TLS According to Your Security Policy

Windows uses the Schannel security provider to manage TLS protocols and cipher suites.

Your security team should determine which protocols and cipher suites are permitted in your environment.

Current Windows Server deployments should use modern TLS protocols and avoid deprecated SSL/TLS versions where application compatibility permits.

Do not apply generic TLS registry changes or third-party hardening scripts without reviewing their effect on:

• WebReports
• VDM integrations
• Browsers and client systems
• APIs and integrations
• Other applications hosted on the same server

Microsoft provides current Windows TLS configuration guidance here:

Transport Layer Security (TLS) Registry Settings

Configure Authentication Appropriately

Enable only the IIS authentication methods required by your WebReports deployment.

If WebReports uses Windows Authentication:

• Enable Windows Authentication for the WebReports site.
• Disable authentication methods that are not required.
• Follow your organization's Active Directory and service-account security policies.

For WebReports authentication configuration, see:

Configure IIS and Deploy WebReports

Review File and Folder Permissions

Grant the WebReports application only the file-system permissions required to operate.

Avoid granting unnecessary permissions to the WebReports application directory or other areas of the server.

For WebReports folder permissions, see:

Configure IIS Folder Permissions for WebReports

Restrict Network Access

Configure firewalls and network security controls to allow only the traffic required by WebReports.

Depending on your environment, this may include restricting:

• Access to the WebReports HTTPS port.
• Database connectivity to authorized WebReports servers.
• Administrative access to trusted networks or systems.
• Access from external networks when WebReports is intended for internal use only.

Firewall requirements should be defined and implemented by your network or security team.

For an overview of WebReports network communication, see:

WebReports Deployment Requirements and Network Architecture

Disable Directory Browsing

Directory browsing should remain disabled unless it is specifically required.

Enabling directory browsing can expose the contents and structure of directories hosted by IIS.

Review the Directory Browsing feature for the WebReports website in IIS Manager and confirm that it is disabled.

Review IIS Request Filtering

IIS Request Filtering can help prevent unwanted requests from reaching hosted applications.

Your security team may configure request filtering policies for:

• File extensions
• HTTP verbs
• URL sequences
• Request size limits
• Other request restrictions

Verify that any restrictions applied to the WebReports website do not interfere with normal WebReports functionality.

Protect Configuration and Credentials

WebReports configuration files may contain information that should not be exposed to unauthorized users.

Ensure that:

• Access to the WebReports application directory is restricted.
• Database accounts follow your organization's password and privilege policies.
• Sensitive credentials are not shared or stored in unsecured locations.
• Connection-string encryption is used when required by your security policy.

For connection-string encryption, see:

Encrypting Your WebReports Connection String in VDM

Monitor the Environment

Regularly review:

• Windows Event Logs
• IIS logs
• WebReports application logs
• Authentication failures
• Firewall and security alerts

Monitoring can help identify configuration problems and unexpected activity.

Additional Microsoft Guidance

For current IIS security recommendations, refer to Microsoft's documentation:

Secure and Harden Internet Information Services

Microsoft's guidance should be used together with your organization's security and compliance requirements.