IIS 6.0 + UrlScan != Super Secure IIS

July 22nd, 2007

Recently I was at a client site and was maddened to learn that the client required the use of URLScan with IIS 6.0. Let’s remember IIS 6.0 was mostly re-written with security being the front-runner. That’s right this is not the IIS (i.e. 4.0 or 5.0) of years past that were a cesspool breading ground for vulnerabilities. Now back to my original complaint about URLScan coupled with IIS 6.0. It wasn’t the fact that URLScan was being used that irked me to no end; instead it was the fact the the “InfoSec” team deemed it necessary to use the default configuration. However, I had done my homework and presented the following two links for their InfoSec team to review: IIS 6.0 Makes URLScan Almost Obsolete and UrlScan Security Tool.

I applaud the client as they were definitely security conscious. Although, there’s a balance between security and usability that this site definitely did not comprehend. The main argument from their InfoSec team was the concern over “AllowDotInPath”. After presenting the aforementioned material to their resident security head we were allowed to move forward with commenting out the various items that were unneeded or caused problems. I never received any gratitude for pointing out these issues nor would the security head admit to being incorrect on their stance. I was later told one vendor had to re-write an entire module for their code to work with URLScan, due to the “AllowDotInPath” issue. I recommended that the InfoSec team create a IIS 6.0 only configuration file when using URLScan with IIS 6.0. Otherwise, they’re bound to run into issues further down the line.

Yes, I’m back and I’m pissed.

July 22nd, 2007

Enough said.

Ireland Update

November 13th, 2006

I’m back and the pictures are now up.

Off to Ireland

November 3rd, 2006

Well I’m off to Ireland today, I won’t be back for a while, not that you’ll notice.

The start of a good week…

September 11th, 2006

begins with a massacre of Green and Yellow.

How about some Crank?

September 5th, 2006

Well that was a most excellent labor day weekend. It started with me finally making it home to dear ol’ Madison. Saturday we went to my Aunt and Uncle’s trailer in Elkhorn and no it isn’t that type of trailer. The lake was a little choppy, but a ride in a motorized boat is always a good time (beer not included). We ended that night with some Ian’s pizza and a couple (many) beers at Paul’s Club.

Sunday was a little more interesting at the Taste of Madison. I’d recommend the pulled pork from JAmerica any time. We also went and saw a fantastic movie called Crank. I’d highly recommend this to anyone looking for a kid-NOT-friendly movie that keeps your adult ADD at bay. Follow that up with some Porta Bella’s and some red wine and you have yourself a great weekend.

The “Random” search

September 2nd, 2006

Well after my flight was cancelled and I was waiting in line the next day to finally leave they gave me the “SSSS”. I immediately noticed and fortunately it only took another 10 minutes to make it through security. Ironically enough the questionable person was ahead of me and myself and the individual behind me were picked for “random” screening.

I’m finally back in Madison and there’s really nothing else to be said right now.

Well Houston it’s been fun…

August 31st, 2006

…but I have to go back to the cold dairy farm that is Wisconsin today. I hope you had as much fun as I didn’t. Maybe next time we can go out and see some of the sites. We’ll make sure to hit up the places that actually have somewhat of a populace next time around.

The Flying Saucer

August 30th, 2006

So I ventured out to the Flying Saucer in downtown Houston tonight. Over 100 beers on tap with my favorite, Sierra Nevada, fortunately being one of those. I’d highly recommend this bar if you’re looking for about 20+ girls dressed with hooker boots in skirts. However, the ratio of blondes to non-blondes was 1:20: bummer!

My gramher and spelling is not well

August 29th, 2006

Well in an effort to improve my grammar, spelling, and sentence coherency I’m going to try to blog once a day. I’m sure others will be excited about this as well because I lead such an exciting life here in Wisconsin. I have been teased or ridiculed by friends, co-workers, (ex)girlfriends, and strangers so I figured I’ll start here.

My entry today is simple, people in Texas talk to me in the elevators and it scares me.