If specific HTTP methods are restricted, a web server can be made even more secure
because many of the exploits take advantage of little-used HTTP methods to gain control
of a system. To restrict by a specific HTTP method, perform the following steps while in
the Methods tab:
1. Under Specify the Action Taken for HTTP Methods, use the drop-down box to
specify to Allow Only Specific Methods.
2. Click the Add button.
392 CHAPTER 14 Securing Web (HTTP) Traffic
3. Enter a name for the HTTP method that will be allowed. For example, enter GET (the
method is case-sensitive) and click OK.
4. From the dialog box shown in Figure 14.9, click OK to save the changes.
Customizing Extensions The Extensions tab of the Filtering Rules setting allows only
specific types of message attachments to be displayed, such as .mpg files, .exe files, or any
other ones defined in this rule. It also allows for the reverse, where all attachments except
for specific defined ones are. To accomplish this, choose the option Block Specified
Extensions (Allow All Others).
For additional security, the box on this page can be checked to block ambiguous or illdefined
extensions, which can pose a security risk to an ISA server.
Pages:
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636