WSV332: What's New with IIS 8 Performance, Scalability, and Security Wade A. Hilmo Principal Development Lead Microsoft Corporation Shaun Eagan Senior Program Manager Microsoft Corporation WSV332

Key Takeaways IIS 8 makes it easier to prevent unwanted activity through Dynamic IP Restrictions IIS 8 reduces the attack surface for FTP brute-force/dictionary attacks CPU Throttling can be used to sand- box websites and prevent performance issues Application Initialization enhances your end-users’ website startup perceptions Session Objectives Learn how IIS 8 make it easier to secure your website and host secure sites Understand how IIS 8’s sand-boxing features isolate your websites and improve application responses Discover how IIS 8’s Application Initialization features improve application startup experience

Demo Dynamic IP Restrictions

IIS 8: FTP Logon Attempt Restrictions Dynamically blocks IP addresses that flood the server with failures Prevents script-kiddie and brute-force attacks IIS 7: FTP Static IP Filtering Requires manually discovering and blocking known IP addresses Subject to brute-force attacks and password lockouts

Demo FTP Logon Attempt Restrictions

You manage a server, and you host multiple tenants Badly-written applications from some tenants might consume too many resources Well-written applications from other tenants might be starved for resources

IIS 8: CPU Throttling Limits CPU usage per tenant: Throttling CPU usage Throttling under load Terminating an IIS worker process IIS 7: CPU Throttling Monitors for CPU use that exceeded specific threshold Allows terminating an IIS worker process

Demo CPU Throttling Sand-boxing CPU Usage

Application Initialization is built-in for Windows Server 2012 Application Initialization was released as an out-of-band (OOB) project for IIS 7.5 Application Initialization Application Preload Application Start Mode

Allows the application decide how it will respond to requests received during the warm-up period Each application can define its own behavior IIS marks requests received during warm-up, and allows the application to change the startup experience

Allows an application to be initialized when the worker process starts Server administrator decides which applications should be preloaded New process and recycled process behave differently

Feature existed in IIS 7, but is more useful in IIS 8 Allows pre-starting application pools instead of waiting for a first request

Demo Application Initialization

Key Takeaways IIS 8 makes it easier to prevent unwanted activity through Dynamic IP Restrictions IIS 8 reduces the attack surface for FTP brute-force/dictionary attacks CPU Throttling can be used to sand- box websites and prevent performance issues Application Initialization enhances your users’ website perceptions In this presentation you… Learned how IIS 8 makes it easier to secure your website and host secure sites Understood how to throttle the resources for high CPU usage applications Discovered how IIS 8’s Application Initialization increases website startup experience

WSV332 - What's New with IIS 8: Performance, Scalability, and Security WSV331 - What's New with IIS 8: Open Web Platform for Cloud DEV349 - Internet Information Services (IIS) Express for Web Developers

In-depth technical articles and samples Free advice and assistance in forums Connect with other IIS experts through blogs Download center with IIS solutions

Evaluations Submit your evals online

Q & A Wade A. Hilmo Microsoft Corporation Questions? Shaun Eagan Microsoft Corporation

Connect. Share. Discuss. Learning Microsoft Certification & Training Resources TechNet Resources for IT Professionals Resources for Developers