Programs and features not necessary for operations must be removed.

Part of WG130

SV-46363r3_rule Programs and features not necessary for operations must be removed.

Vulnerability discussion

Just as running unneeded services and protocols increase the attack surface of the web server, running unneeded utilities and programs is also an added risk to the web server.

Check content

Review programs installed on the OS. 1. Open Control Panel. 2. Open Programs and Features. 3. The following programs may be installed without any additional documentation: Administration Pack for IIS 7.0 IIS Search Engine Optimization Toolkit Microsoft .NET Framework version 3.5 SP1 or greater Microsoft Web Platform Installer version 3.x or greater Virtual Machine Additions 4. Review the installed programs, if any programs are installed other than those listed above, this is a finding. NOTE: If additional software is needed and has supporting documentation signed by the ISSO, this is not a finding.

Fix text

Remove all unapproved programs and roles from the production web server.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.