...
| Info |
|---|
It is recommended to use a service account for IIS instead of LocalSystem. |
Tilde Short File/Folder Name Disclosure
If IIS accept short filenames, a user may try to break security by testing different file names. Two actions are suggested for this issue.
...
Discard or filter all web requests including a tilde "~" character. The most recommended prevention technique is to apply a filtering rule in the firewall for all ~ (tilde) and Unicode encoded equivalences sent in the URL path to the server. If such a rule cannot be applied, URL rewrite should be used instead.
...
Find the security hardening checklist here: https://
...
signifikant.
...
atlassian.
...