Advise on IIS security for ASP CMS and File upload

We have developed our own CMS system using ASP VBScript as well as a file management system. We need to have an expert in security on Server 2003/IIS to give us advice as to the best practices to insure the safety of our server and data. We will need someone experienced with a good track record on rentacoder as this is a serious trust issue. Also, we'd like someone who can be flexible and creative with their security approach. We don't want someone who simply says "Buy a $5000 router and never allow file uploading". The work involves the following 1) Check server for obvious security holes 2) Review code for security problems and recommend changes (possibly quote on fixing problems) 3) Explain (or possibly demonstrate) some of the ways hackers gain control of a system 4) Chat (either text or preferrably by phone) with technical people on security practices and Server 2003 settings, and answer questions. The chat would be no longer than 1 hour. ## Deliverables 1) Complete and fully-functional working program(s) in executable form as well as complete source code of all work done. 2) Deliverables must be in ready-to-run condition, as follows (depending on the nature of the deliverables): a) For web sites or other server-side deliverables intended to only ever exist in one place in the Buyer's environment--Deliverables must be installed by the Seller in ready-to-run condition in the Buyer's environment. b) For all others including desktop software or software the buyer intends to distribute: A software installation package that will install the software in ready-to-run condition on the platform(s) specified in this bid request. 3) All deliverables will be considered "work made for hire" under U.S. Copyright law. Buyer will receive exclusive and complete copyrights to all work purchased. (No GPL, GNU, 3rd party components, etc. unless all copyright ramifications are explained AND AGREED TO by the buyer on the site per the coder's Seller Legal Agreement). ## Platform Server 2003 IIS 6.0 ASP VBScript