1. What's New with IIS 8 Performance, Scalability, and Security Robert McMurray Program Manager Microsoft Corporation WSV332

2. Key Takeaways IIS 8 makes it easier to prevent unwanted activity through Dynamic IP Restrictions IIS 8 reduces the attack surface for FTP brute-force/dictionary attacks CPU Throttling can be used to sand- box websites and prevent performance issues Application Initialization enhances your end-users’ website startup perceptions Session Objectives Learn how IIS 8 make it easier to secure your website and host secure sites Understand how IIS 8’s sand-boxing features isolate your websites and improve application responses Discover how IIS 8’s Application Initialization features improve application startup experience

5. Demo Dynamic IP Restrictions

6. IIS 8: FTP Logon Attempt Restrictions Dynamically blocks IP addresses that flood the server with failures Prevents script-kiddie and brute-force attacks IIS 7: FTP Static IP Filtering* Requires manually discovering and blocking known IP addresses Subject to brute-force attacks and password lockouts * Note: You should also implement strong password policies and account lockouts.

7. Demo FTP Logon Attempt Restrictions

9. IIS 8: CPU Throttling Limits CPU usage per tenant: Throttling CPU usage Throttling under load Terminating an IIS worker process IIS 7: CPU Throttling Monitors for CPU use that exceeded specific threshold Allows terminating an IIS worker process

10. You manage a server, and you host multiple tenants Badly-written applications from some tenants might consume too many resources Well-written applications from other tenants might be starved for resources

11. Demo CPU Throttling Sand-boxing CPU Usage

13. Application Initialization is built-in for Windows Server 2012 Application Initialization was released as an out-of-band (OOB) project for IIS 7.5 Application Initialization Application Preload Application Start Mode

14. Allows the application decide how it will respond to requests received during the warm-up period Each application can define its own behavior IIS marks requests received during warm-up, and allows the application to change the startup experience

15. Feature existed in IIS 7, but is more useful in IIS 8 Allows pre-starting application pools instead of waiting for a first request

16. Allows an application to be initialized when the worker process starts Server administrator decides which applications should be preloaded New process and recycled process behave differently

17. Demo Application Initialization

18. Key Takeaways IIS 8 makes it easier to prevent unwanted activity through Dynamic IP Restrictions IIS 8 reduces the attack surface for FTP brute-force/dictionary attacks CPU Throttling can be used to sand- box websites and prevent performance issues Application Initialization enhances your users’ website perceptions In this presentation you… Learned how IIS 8 makes it easier to secure your website and host secure sites Understood how to throttle the resources for high CPU usage applications Discovered how IIS 8’s Application Initialization increases website startup experience

19. WSV332 - What's New with IIS 8: Performance, Scalability, and Security Find Me Later At… the IIS Booth! WSV331 - What's New with IIS 8: Open Web Platform for Cloud DEV349 - Internet Information Services (IIS) Express for Web Developers

20. In-depth technical articles and samples http://learn.iis.net Free advice and assistance in forums http://forums.iis.net Connect with other IIS experts through blogs http://blogs.iis.net Download center with IIS solutions http://www.iis.net/download

21. Q & A Robert McMurray robmcm@microsoft.com Microsoft Corporation Questions?

22. Talk to our Experts at the TLC #TE(sessioncode) DOWNLOAD Windows Server 2012 Release Candidate microsoft.com/windowsserver Hands-On Labs DOWNLOAD Windows Azure Windowsazure.com/ teched

23. Connect. Share. Discuss. http://northamerica.msteched.com Learning Microsoft Certification & Training Resources www.microsoft.com/learning TechNet Resources for IT Professionals http://microsoft.com/technet Resources for Developers http://microsoft.com/msdn

24. Required Slide Complete an evaluation on CommNet and enter to win!

25. Scan the Tag to evaluate this session now on myTechEd Mobile