Microsoft: Web Security Baseline Assessment Feature Now in Public Preview

We are pleased to announce the public preview of the web security baseline assessment feature. You can scan Internet Information Service (IIS) web servers in any environment, including on-premises, Azure, and other cloud platforms monitored by Operations Management Suite (OMS). The feature checks for security vulnerabilities, and provides recommendations on configurations.

The web security baseline assessment helps identify potentially vulnerable web server settings. The three primary sources for the web baseline configurations on web servers are: .NET, ASP.NET, and IIS configuration. IIS configurations are highly customizable, enabling users to override granular settings for sites, and applications running under those sites. The scanner checks the settings at each application or site level, and also at the default root level, and compares these settings to what Microsoft recommends for security. This helps you to identify potentially vulnerable settings, and quickly remediate problems. Similar to the OMS security baseline assessment, the OMS security and audit solution scans web servers running IIS every 24 hours, and shows their security state in the OMS security and audit dashboard.

The web security baseline assessment findings are included in the security baseline assessment dashboard. You can see the servers that were assessed, and the unique rules that failed (along with their severity). You can also drill down into more details by selecting the failed rules.

Read the entire article here, Web security baseline assessment feature now in public preview – Operations Management Suite Blog

via the fine folks at Microsoft.