IIS 7 7.5 8 Hardening SSL TLS - Windows Server 2008 R2 2012 R2 DISABLE SSL V2/3 POODLE BEAST

One of the first steps you should do when deploying a new public facing web server is hardening your server's SSL/TLS connections. Disabling vulnerable protocols, ciphers, hashes and key exchange algorithms can help mitigate the now more common exploits like the BEAST attack and now POODLE. By default many weaker technologies are enabled, leaving IIS traffic vulnerable and exposed. In this video I show how to harden IIS via the registry or IISCrypto.

For more info and links, check out my blog post:

[PicnicError]

Nice tutorial, helped me in my research.
When substituting one protocol for another to avoid one attack vector; you may be adopting several new and easier to exploit attack vectors.  I hope those that find it will continue to research.

[robwillisinfo]

Thanks! I believe the FIPS 140-2 template is the one you want to use.

[panoramaIl]

Thank you very much, a quick and simple explanation video: how to "fix" your server settings.
Works on windows server 2016, I upgraded from B to A.
I really want A+, But I'll probably have to buy an expensive certificate.

[SutenSeDei]

Great. Thanks a lot. This really simplified the hardening process.

[shaunsmith]

Did you post the microsoft KB article?

[ruggo]

Hi Rob, I'm a new subscriber to your channel, and have an SSL vulnerability for 2.0 and 3.0 on a server 2012 R2 file server, i know that it does not need the cypher codes, but after disabling SSL and enabling TLS 1.2, I'm still getting the SSL vulnerability in my security reports. Any tips? and thank you for your helpful tutorials!

[namerg]

Great Video. I work on healthcare billing organization and i have been asked how to hardening an IIS Web Server if it is exposed to the Internet. I am new to the healthcare industry. So, what about HIPA Compliant template? Thanks for ur help.