World Wide Web Publishing Service (W3SVC)ID: oval:org.secpod.oval:def:80631 | Date: (C)2022-06-02 (M)2023-12-13 |
Class: COMPLIANCE | Family: windows |
Provides Web connectivity and administration through the Internet Information Services
Manager.
Note: This service is not installed by default. It is supplied with Windows, but is installed
by enabling an optional Windows feature (Internet Information Services - World Wide Web
Services).
Note #2: An organization may choose to selectively grant exceptions to web developers to
allow IIS (or another web server) on their workstation, in order for them to locally test and
develop web pages. However, the organization should track those machines and ensure the
security controls and mitigations are kept up to date, to reduce risk of compromise
Hosting a website from a workstation is an increased security risk, as the attack surface of
that workstation is then greatly increased. If proper security mitigations are not followed,
the chance of successful attack increases significantly.
Note: This security concern applies to any web server application installed on a
workstation, not just IIS.
Default: Not Installed (Automatic when installed)
Counter Measure:
The recommended state for this setting is Disabled or Not Installed.
Potential Impact:
IIS Web Services will not function
Fix:
(1) GPO: Computer Configuration\Windows Settings\Security Settings\System Services\World Wide Web Publishing Service
(2) REG: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC!Start
Platform: |
Microsoft Windows 10 |