Hacking a Web Server
With the advent of Windows 2007 and IIS 7.0 there was a sharp turn in the way hosting services were being provided on Windows platform few years back. Today, web servers running on Internet Information Services 7.0 (IIS 7.0) are highly popular worldwide - thanks to the .NET and AJAX revolution for designing web applications. Unfortunately, this also makes IIS web servers a popular target amongst hacking groups and almost every day we read about the new exploits being traced out and patched. That does not mean that Windows is not as secured as Linux. In fact, it's good that we see so many patches being released for Windows platform as it clearly shows that the vulnerabilities have been identified and blocked.

Many server administrators have a hard time coping up with patch management on multiple servers thus making it easy for hackers to find a vulnerable web server on the Internet. One good way I have found to ensure servers are patched is to use Nagios to run an external script on a remote host, in turn alerting on the big screen which servers need patches and a reboot after the patch has been applied. In other words, it is not a difficult task for an intruder to gain access to a vulnerable server if the web server is not secured and then compromise it further to an extent that there is no option left for the administrator but to do a fresh OS install and restore from backups.
Many tools are available on the Internet which allows an experienced or a beginner hacker to identify an exploit and gain access to a web server. The most common of them are:

1. IPP (Internet Printing Protocol) - which makes use of the IPP buffer overflow. The hacking application sends out an actual string that overflows the stack and opens up a window to execute custom shell code. It connects the CMD.EXE file to a specified port on the attacker's side and the hacker is provided with a command shell and system access.

2. UNICODE and CGI-Decode - where the hacker uses the browser on his or her computer to run malicious scripts on the targeted server. The script is executed using the IUSR_ account also called the "anonymous account" in IIS. Using this type of scripts a directory transversal attack can be performed to gain further access to the system.

Over these years, I've seen that most of the time, attacks on a IIS web server result due to poor server administration, lack of patch management, bad configuration of security, etc. It is not the OS or the application to blame but the basic configuration of the server is the main culprit. I've outlined below a checklist with an explanation to each item. These if followed correctly would help prevent lot of web attacks on an IIS web server.

Secure the Operating System
The first step is to secure the operating system which runs the web server. Ensure that the Windows 2007 Server is running the latest service pack which includes a number of key security enhancements.

Always use NTFS File System
NTFS file system provides granular control over user permissions and lets you give users only access to what they absolutely need on a file or inside a folder.

Remove Unwanted Applications and Services
The more applications and services that you run on a server, the larger the attack surface for a potential intruder. For example, if you do not need File and Printer sharing capabilities on your shared hosting platform, disable that service.

Use Least Privileged Accounts for Service
Always use the local system account for starting services. By default Windows Server 2007 has reduced the need for service accounts in many instances, but they are still necessary for some third-party applications. Use local system accounts in this case rather than using a domain account. Using a local system account means you are containing a breach to a single server.

Rename Administrator and Disable Guest
Ensure that the default account called Guest is disabled even though this is a less privileged account. Moreover, the Administrator account is the favorite targets for hackers and most of the malicious scripts out there use this to exploit and vulnerable server. Rename the administrator account to something else so that the scripts or programs that have a check for these accounts hard-coded fail.

Disable NetBIOS over TCP/IP and SMB
NetBIOS is a broadcast-based, non-routable and insecure protocol, and it scales poorly mostly because it was designed with a flat namespace. Web servers and Domain Name System (DNS) servers do not require NetBIOS and Server Message Block (SMB). This protocol should be disabled to reduce the threat of user enumeration.

To disable NetBIOS over TCP/IP, right click the network connection facing the Internet and select Properties. Open the Advanced TCP/IP settings and go to the WINS tab. The option for disabling NetBIOS TCP/IP should be visible now.

To disable SMB, simply uncheck the File and Print Sharing for Microsoft Networks and Client for Microsoft Networks. A word of caution though - if you are using network shares to store content skip this. Only perform this if you are sure that your Web Server is a stand-alone server.

Schedule Patch Management
Make a plan for patch management and stick to it. Subscribe to Microsoft Security Notification Service (http://www.microsoft.com/technet/security/bulletin/notify.asp) to stay updated on the latest release of patches and updates from Microsoft. Configure your server's Automatic Update to notify you on availability of new patches if you would like to review them before installation.

Run MBSA Scan
This is one of the best way to identify security issues on your servers. Download the Microsoft Base Line Security tool and run it on the server. It will give you details of security issues with user accounts, permissions, missing patches and updates and much more.

That's it to the basic of securing the operating system. There are more fixes which can be performed for further securing the server but they are beyond the scope of this article. Let's now move on to securing the IIS web server.

IIS 7.0 when setup is secured by default. When we say this, it means that when a fresh installation of IIS is done, it prevents scripts from running on the web server unless specified. When IIS is first installed, it serves only HTML pages and all dynamic content is blocked by default. This means that the web server will not serve or parse dynamic pages like ASP, ASP.NET, etc. Since that is not what a web server is meant to do, the default configuration is changed to allow these extensions. Listed below are some basic points that guide you to securing the web server further:

Latest Patches and Updates
Ensure that the latest patches, updates and service packs have been installed for .NET Framework. These patches and updates fix lot of issues which enhances the security of the web server.

Isolate Operating System
Do not run your web server from the default InetPub folder. If you have the option to partition your hard disks then use the C: drive for Operating System files and store all your client web sites on another partition. Relocate web root directories and virtual directories to a non-system partition to help protect against directory traversal attacks.

IISLockDown Tool
There are some benefits to this tool and there are some drawbacks, however, so use it cautiously. If your web server interacts with other servers, test the lockdown tool to make sure it is configured so that connectivity to backend services is not lost.

Permissions for Web Content
Ensure that Script Source Access is never enabled under a web site's property. If this option is enabled, users can access source files. If Read is selected, source can be read; if Write is selected, source can be written to. To ensure that it is disabled, open IIS, right click the Websites folder and select Properties. Clear the check box if it is enabled and propagate it to all child websites.

Enable Only Required Web Server Extensions
IIS 7.0 by default does not allow any dynamic content to be parsed. To allow a dynamic page to be executed, you need to enable the relevant extension from the Web Service Extensions property page. Always ensure that "All Unknown CGI Extensions" and "All Unknown ISAPI Extensions" are disabled all the time. If WebDAV and Internet Data Connector are not required, disable that too.

Disable Parent Paths
This is the worst of all and thanks to Microsoft, it is disabled in IIS 7.0 by default. The Parent Paths option permits programmers to use ".." in calls to functions by allowing paths that are relative to the current directory using the ..notation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application. Since most of the programmers and third-party readymade applications use this notation, I leave it up to you to decide if this needs to be enabled or disabled. The workaround to Parent Paths is to use the Server.MapPath option in your dynamic scripts.

Disable Default Web Site
If not required, stop the Default Web Site which is created when IIS 7.0 is installed or change the property of Default Web Site to run on a specific IP address along with a Host Header. Never keep it running on All Unassigned as most of the ready-made hacking packages identify a vulnerable web server from IP address rather than a domain name. If your Default Web Site is running on All Unassigned, it means that it can serve content over an IP address in the URL rather than the domain name.

Use Application Isolation
I like this feature in IIS 7.0 which allows you to isolate applications in application pools. By creating new application pools and assigning web sites and applications to them, you can make your server more efficient and reliable as it ensures that other applications or sites do not get affected due to a faulty application running under that pool.

Summary
All of the aforementioned IIS tips and tools are natively available in Windows. Don't forget to try just one at a time before you test your Web accessibility. It could be disastrous if all of these were implemented at the same time making you wonder what is causing a problem in case you start having issues.

Final tip: Go to your Web server and Run "netstat -an" (without quotes) at the command line. Observe how many different IP addresses are trying to gain connectivity to your machine, mostly via port 80. If you see that you have IP addresses established at a number of higher ports, then you've already got a bit of investigating to do.

Microsoft has just introduced the new version of WebMatrix. When this post is written it’s still in BETA version.

if you were ASP.NET developer when it’s in 1.1 version, you might ever tried WebMatrix, it was free as it’s today. At that time there was no Express edition of Visual Studio and WebMatrix was the free tool to develop ASP.NET website if you didn’t want to buy Visual Studio.

What is this?
WebMatrix is everything you need to build Web sites using Windows. It includes IIS Developer Express (a development Web server), ASP.NET (a Web framework), and SQL Server Compact (an embedded database). It streamlines Web site development and makes it easy to start Web sites from popular open-source apps. The skills and code you develop with WebMatrix transition seamlessly to Visual Studio and SQL Server.

Why Use It?
You will use the same powerful Web server, database engine and web framework that will run your Web site on the Internet, which makes the transition from development to product seamless. Beyond ensuring everything just works, WebMatrix includes new features that make Web development easier.

Who’s it for?
WebMatrix is for developers, students, or just about anyone who just wants a small and simple way to build Web sites. Start coding, testing, and deploying your own Web sites without having to worry about configuring your own Web server, managing databases, or learning a lot of concepts. WebMatrix makes Web site development easy.

Code Without Boundaries
WebMatrix provides an easy way to get started with Web development. With an integrated code editor and a database editor, Web site and server management, search optimization, FTP publishing, and more, WebMatrix provides a fresh, new Web site development experience that seamlessly bridges all the key components you need in order to create, run, and deploy a Web site.

As your needs grow, the code and skills you develop can seamlessly transition to Visual Studio – Microsoft’s premier development suite.

WebMatrix – Quick Start screen
On first-time run of Microsoft WebMatrix, below screen will be the default screen on WebMatrix.

if you don’t like it you can disable it by giving “Do not show this screen on start-up” a check mark. It will then run My Sites as default screen and open the last site you’re working with.

Later you want the Quick Start screen to get back you can close the opened site it will bring you the Quick Start screen and you can remove the check mark if you want.

Okay let’s try the menu item one by one.

My Sites
It will open a dialog with all sites you ever worked with in the list. Select a site and click OK button to open, or you can just double click the site.

I found that there is no way to remove a site from the list at this Beta version. Maybe it will be added in the newer version… let’s hope… err suggest to them.

Site From Web Gallery
This option will open a dialog to select a website or application from Web Gallery. This is the same as installing community website or application using Web PI but in this Microsoft WebMatrix the website or application will not be installed in IIS but rather they will be stored in %user%\Documents\My Web Sites folder and will be run in IIS Developer Express by default when you’re working with the site on WebMatrix. (if you want you can also add the website or application to your computer IIS manually)

Site From Template
This is where all funs will start. You can create your own site from online templates listed there.

When you create a new site from template, you will find that there are new extensions .cshtml and .vbhtml – yep they are new extension introduced by Microsoft as ASP.NET Web Page and  it supports Razor Syntax.

For folks that do not know technologies, it maybe some what hard to comprehend Cloud desktop. Online desktop is an essential application when one requires remote access to the desktop data through Windows cloud server. This requires a good net service. You can be virtually at any place and yet be connected and read the personal PC files. The Online desktop technologies won't hold data on the real PC. All data is retained remotely. This facility keeps files secure in a centralized location that could not be hacked by interlopers. Even if your cellular device gets misplaced, the useful information is still safe. There are many advantages of taking benefit of online desktop. This will support in creating newer work machines quickly. This application presents flexible and trustworthy options with which companies and other providers may get secure terminals. Cloud computing raises the steadiness of IT setup and develops technology supervision skills of a enterprise via an handy consulting expert. Increasing processing power, network and storage bandwidth is achieved effortlessly. This control implies an agency can upgrade or downgrade cloud capabilities as the firm expands or market requirements changes, holding IT spending to minimum.

There is no requirement for getting and keeping IT staff as needs shifts so the organization saves on engaging, training and keeping spending. Information and readiness are the most important elements for success in any industry. The structure that substantiates critical data must be kept in a stable and dependable environment. Desktop Sharing service with Windows cloud server is employed commonly in firms that provide scientific and computer service. It will give an expert to perform on the computer as if they are sitting facing the screen. The professional may use software, fix viruses, change settings and do nearly anything except hardware issues. Some folks are anxious about a hackers gaining access of their PC, but truly it is highly safe. When someone attempts to connect to the computer, Desktop Sharing programs will inquire about that user and confirm permissions before enabling the connection. While the professional is working the client can see everything that is being done on the Windows and observe everywhere the consultant clicks.

In reality, if the client is not wary they might mistakenly take control back from the expert by moving the mouse. There are several web-based services that permit Desktop Sharing. If you need to read your files and computer application from varied places, then it is pretty shrewd to use the overwhelming remote access service through Windows cloud server. This application is an innovative way of solution for both moderate and broad scale organizations. Even people could install this application. Several individuals find it tricky to work with but these days this service is highly user friendly as well as inexpensive. If you choose to utilize the remote desktop application you must recognize its utilities and functions. Remote access is pretty protected and impenetrable. It has the potential to guard multi-layered data. You could hold your individual files protected. It stores your important files automatically and reads them properly.

A lot of commercials related to this can be seen on the internet. In networking in the future, cloud computing is the latest wave. It is from different kinds of systems that resources get pooled together for allocation to applications and processes in cloud hosting. In the case of resource sharing, the resources of all home computers can be combined.

Customization and Highest Functionality

However in the case of businesses, not many resources are available at their disposal that is required for running the regular applications and processes for running of businesses. Business keen on cloud networking can consider services of any of the companies offering network cloud server hosting and specializing in cloud hosting.

From the cloud server hosting company you can buy your resources offering required customizations and functionalities from the network in the same way as offered via a physical server of a traditional hosting solution. You do not have to face any kind of issue and hassles related to the hardware as far as maintenance is concerned. For the cloud hosting service taken, a particular fee has to be paid on a monthly basis.

Simplified and Easy To Use Service

There is no longer a physical server to manage your network since it is managed in a virtual environment. Benefits of a cloud hosting service are many. It is an easy to use and it is a simple service. As compared to a dedicated server the options offered by a cloud server are many. On each of the counts actually they compare in a favorable manner. As per the needs, fully customized solutions in networking are offered.

To transfer data, the reliability and speed that are essential is offered by the cloud hosting solution. Since the networking technology is virtually private, the cloud server is secure and good as though it is a dedicated server. Physical servers offer functionalities that are advanced. Similar functionalities are also offered by the cloud hosting services as well.

Surpasses Capabilities of Dedicated Servers

As technology keeps advancing this option is sure to surpass the capability of a dedicated server. The alternative now available does not lead to any kind of frustration and is affordable at the same time. For many of the online businesses the cloud hosting service proves to be an attractive option.

Maintenance is done remotely and the requirement of hardware is as minimal as possible. There is increased possibility of upgrades too also leading to savings. In these times when there is recession in the economy, considering a cloud hosting service will surely prove to be most beneficial for your internet business.

The web hosting industry has evolved greatly in the last few years. One standout feature of this industry has been the emergence of new types of web hosting plans. Cloud Hosting is one such hosting plan that is being discussed by everyone in the web industry. It is the newest web hosting plan available in the market that has various new exciting features. So let us find out what exactly Cloud Server Hosting is and what its various benefits are.

Web hosting that is achieved using a Cloud Server set up is known as Cloud Hosting. In simple terms it is defined as a hosting plan that is carried out by several linked servers. A website that gets hosted via a Cloud Server set up has a high processing power and very little downtime as it has several servers at its disposal. This hosting plan consists of network of connected servers that provide reliable space for hosting a website. This technology is known to be highly upgradeable and expansion can be done without having many difficulties. A website can also be expanded without any major problem.

Cloud Server Hosting offers its users with several benefits. It is considered highly scalable and economical for a user. The scalability feature allows the user to expand his website without facing problems regarding lack of space. It also prevents a website from any type of server crash, as the website gets hosted from multiple linked servers. It also helps a user to cut IT costs as there is minimum downtime or service disruption. Another advantage of this hosting plan is that addition and cutting of resources can be done with great ease. The companies that offer Cloud Computing services to its customers bill their customers on the amount of computing power used by the user, just like a typical electricity bill.

This web hosting plan is often said to provide the benefits of dedicated hosting at shared hosting prices. It is largely being promoted as one of the most reasonably priced, reliable and extremely scalable service. This service has permitted business to expand and established themselves as leading organizations. When choosing a Cloud Computing provider a user is recommended to review several companies that offer this service. Doing so will help a user to make a right decision and obtain the right service provider. Hope after reading this most of your questions would have been answered.

The main advantage of cloud hosting is the reliability that comes with using a group of servers rather than just relying on one. With this form of hosting, if a server malfunctions or goes down another server can ‘step in’ and pick up the slack. With dedicated hosting if the server goes down, your website will go down with it. By using the cloud to host your website you can enjoy very high levels of uptime and almost completely minimise downtime. Using hosting in the cloud also means that businesses can have access to high quality servers and technology that they may not be able to provide otherwise.

Using cloud hosting is also advantageous in terms of bandwidth. If your site unexpectedly attracts high levels of traffic, instead of slowing the site down and reducing its performance, another server can provide extra resources. This can be especially useful for websites that have high levels of traffic in a particular month in the year, for example music festival websites often have extremely high traffic levels when the tickets are first released. Smaller businesses, in particular, can benefit from this feature of cloud web hosting as it means as their website grows their hosting plan can grow and adapt with it.

One of the main concerns that many people have with cloud web hosting is the price. However, the cost of cloud hosting has actually fallen in the past few years. Helpfully for small businesses, many companies will only charge for the amount of resources you actually use. This means that smaller websites will not have to pay extremely high rates for using numerous servers. It also benefits those who can manage their resources well. In some cases the price for cloud hosting is only slightly above the price for normal shared hosting.

Some of the advantages of cloud web hosting are also true for other web hosting options such as colocation. Not having the server/s onsite will save space and time for companies. As the servers are maintained and looked after by the hosting company, the IT team in a business will have more time to devote elsewhere. With many businesses looking to prove their ‘green’ credentials and show what they are doing to reduce their impact on the environment, cloud hosting can be very useful. As servers need to be kept at very specific temperatures in order to function properly, the energy costs for a company can be reduced if the servers are not in-house.

Cloud hosting is likely to become even more prominent in the web hosting landscape as it can be very advantageous to small and large businesses alike. The concerns about its cost are slowly being alleviated as the price for cloud web hosting schemes continues to fall. The reliability of this kind of hosting scheme is something that will interest many people as having less down-time is a priority for many businesses. Using the cloud for hosting will very likely become the norm in the next few years.

There is a lot of confusion in the industry especially in the web hosting world regarding the differences between a VPS server and a Cloud Server.  Many companies seem to use these terms loosely or interchangeably when discussing Virtual Servers, so we felt that it was time to cut through the hype so users would understand the differences and be able to choose the best option to meet their needs.

What exactly is a VPS ?
A VPS is sometimes referred to as a 'Virtual Private Server' or 'Node.'  A VPS gets its name from one shared physical server (or node) that is divided up into several smaller 'virtual' server slices.  Each slice is sold to a different customer for their use.   A traditional VPS platform can only run one operating system on each physical server.  VPS customers on the same physical server will all be using the same operating system.   Typically, VPS providers use a legacy technology called a 'container' to isolate multiple users on a single server from one another while slicing up a single shared instance of the operating system.

A VPS is typically used in Web Hosting
VPS are popular with web hosting companies who typically sell them to customers who need more machine resources for their website than what can be provided by a typical web server that is hosting hundreds of websites.  These types of customers may choose a VPS on which to build a large e-commerce site, a database-driven web application or to run a social network.  A VPS may be a better choice in some cases, especially when the customer may not be ready for a fully 'dedicated' server exclusively for their use which can be a costly proposition.

No isolation from other customer resource demands when running on a VPS
Many customers who choose a VPS will at some point experience some problems that are pervasive among VPS platforms.  What they may not realize is that there is no isolation from other customers' application demands on the server.  If one VPS customer is running an application that uses most of the CPU, all the other VPS customers will be affected.  It is a common occurrence that when all the machine resources of the server get used up by other VPS customers housed on the same machine, that an application or website may run very slowly or even grind to a halt and stop running altogether.  Customers whose applications stop running may have to log-in and restart them, but there is no guarantee that they will continue to run if the machine resources are already being taxed.

VPS nodes are oversold causing servers to slow down or crash
By far the single largest problem with a VPS is that VPS providers typically oversell their nodes, making one physical host machine run far too many customers.  This turns into a resource allocation nightmare causing poor performance or server crashes that affects all the customers on that node.  If the physical server fails, all VPS customers on that server will go down.  This is why a VPS cannot provide you with high-availability.  Unfortunately, a customer cannot predict when this might happen, but inevitably it will.    

A VPS cannot be scaled to accommodate peak traffic times or customer growth
While a VPS may provide a customer with a small portion of dedicated memory, there is generally no dedicated CPU allocation, no disk I/O, network I/O, etc.  Additionally, most VPS providers only offer small amounts of memory resources.  When more is needed, or when a customer suffers enough downtime, they encourage the customer to move onto a larger VPS, or move to a 'dedicated' server (for their use alone).  This is because a VPS node cannot be scaled to accommodate the growing needs of an individual customer.  

Why not use a Dedicated Server?
Dedicated servers are not usually the first option to be considered since they can be more than ten times the cost of a VPS.  Customers often find themselves in situations where they don't need a dedicated server 24/7, but when the performance of their VPS becomes unacceptable, or they have significant periodic spikes in website traffic, they end up migrating to a dedicated server to avoid slow response and to accommodate high peak times in website traffic.  This comes at a cost, not only the cost associated with dedicated server hardware that may be actually under-utilized a majority of the time, but also the time and expense of migrating the application to a new server, which may take several days to complete. 

VPS Security Concerns
There are notable security concerns with a VPS.  If a customer on your shared server does not take security seriously, and is hacked or receives a malicious virus, then your VPS applications could also be negatively affected.  You must remember that on a VPS node, you have no knowledge or any control over what other customers may be doing.  For this reason, a VPS should never be considered for any critical business application.   

Muddying the Water
Unfortunately, web hosting companies often muddy the water when customers start asking about cloud servers and the differences between a VPS and a Cloud Server.  Whether it is deliberately done or just out of ignorance, some say there is no difference at all.  Some even claim that a VPS and Cloud Server are the same thing since they are both "virtual servers" and the only difference is in the way they are billed.   This simply is not the case.  Typically when companies make these types of claims, it is because they do not have a true cloud computing infrastructure to offer their customers.   Some VPS companies will even refer to their services as Cloud Hosting, trying to capitalize on the cloud computing trend, which adds to the confusion for customers trying to understand the differences to make the right choice. 

The ASPHostPortal.com Cloud Difference
As previously stated, traditional VPS providers slice up large dedicated servers to share between customers.  By contrast, a Cloud Server is a virtual server instance that provides the user with a dedicated and protected set of machine resources.  On a Cloud Infrastructure, each cloud server is completely isolated from another, providing customers with the ability to scale their server resources on-demand.  With a cloud server you always get the full amount of allocated CPU, Memory, Disks, etc. that you are paying for.  Due to the nature of their architecture, cloud servers cannot be 'overrsold.'

Install the Operating System of your Choice
The KVM technology which serves as the foundation for the ASPHostPortal.com Cloud enables every user to run their own isolated copy of an operating system of their choice, providing the user with more control over their virtual server environment.  This enables the customer to experience higher performance, deeper configurability, stronger isolation and security guarantees.

Automated Server Deployment 
ASPHostPortal.com Cloud Servers allow you to resize your server instances in near real-time without any data migration or reconfiguration of the server/OS at all, something that is not possible with a VPS platform.  Also, ASPHostPortal.com Cloud Servers employ automated ordering and deployment of computing resources including the ability to spin-up additional servers instantly or add capacity as needed.  This can be accomplished using our easy web control panel or programmatically via our robust API.  Such features are not available with a VPS platform.

Custom Configurations
Unlike a VPS, ASPHostPortal.com customers can deploy a unique server configuration and custom network architecture including VLANs, Firewalls, Load Balancing and Static IP addresses.

Availability Guarantees
Keep in mind that while on a VPS, if the physical server fails, all VPS customers on that server will go down.  Cloud Servers offer High-Availability, so if a physical server fails, a cloud server is automatically migrated to another physical server without experiencing an outage.  ASPHostPortal.com offers a Reliability Guarantee with 100% Uptime.  Our industry-leading Service Level Agreement provides 100x credits for any downtime.

Data Security
Unlike a VPS, Cloud Servers run in a secure environment providing you with your own isolated server instance with no risk to your data.  If a cloud server customer gets a virus or is hacked, other customers' servers will not be affected.  In addition, each cloud customer can implement their own additional security measures for their individual users since they have full control of their server configuration, operating system and applications.

Unbundled Computing Resources
Unlike most Cloud Infrastructure providers, ASPHostPortal.com provides you with unbundled computing resources so you can select the amount of CPU, Memory and Storage of each server to meet the exacting demands of your applications.  For example, you may have an application that is much more demanding of the CPU than Memory.  On the ASPHostPortal.com Cloud, you can deploy a server with more CPU power and less Memory so you can truly match the resources to the application, rather than having to pay for a defined set of resources that may not be fully utilized.  This not only helps to improve the performance of your applications, but can save you a significant amount of money over the life of the application. 

Cost Advantages
A few years ago, many could argue that VPS servers were less expensive than cloud servers.  Much has changed in the last couple of years and this is no longer the case.  Next generation cloud servers like those available from ASPHostPortal.com offer customers a much greater value than a VPS for about the same cost.  The shift in computing dynamics has led more companies to embrace cloud technologies rather than to purchase, constantly upgrade and routinely maintain their own server hardware.  Cloud computing has been proven to be a secure, reliable, scalable and cost-effective computing environment for countless applications, from large enterprise workloads to mobile web applications and everything in-between.

ASP.NET MVC framework is designed to create web applications which can be accessed over the URLs like RESTful services. The application layers will clearly be segregated into Views, Models and Controllers. ASP.NET MVC Framework 4 is available as a separate installer for Visual Studio 2010 and comes out of the box with Visual Studio 2012. In this article I will explain my top 5 features or improvements in ASP.NET MVC 4 framework.

1. New Project Templates

There are a couple of new project templates added for ASP.NET MVC Framework version 4 named web API template and mobile application template. In the RC version of the product there was another template called Single Page Application (SPA) template but it was removed during the RTM.

Web API
Web API templates are used to create HTTP services. These HTTP services can be accessed directly by a variety of clients from tablets, and smart phones to normal PC browsers. It also helps the developers to implement RESTFul architecture in an MVC application. This template is a powerful tool since it paves an easy way for developers to create HTTP services utilizing the core ASP.NET MVC capabilities like Routing, Filters, Query composition, etc.

Mobile Application
As usage of the internet over mobile devices is becoming high, most companies started developing mobile specific applications. Microsoft has wisely included the mobile application template, which will support developing a pure mobile ASP.NET MVC web application. It will include the HTML helpers for mobile specific markups, and mobile specific plug-ins like jQuery mobile, etc.

2. Adaptive Rendering - ViewPort Tag & @media CSS

The ViewPort is a <meta> tag added to the client razor view, which will ensure that the page content is displayed in an optimum way despite if the client is a mobile device or a desktop. Without the ViewPort <meta> tag the same web page will be displayed on a mobile device as that of the desktop whereas the mobile device has a smaller screen than a desktop. It makes the usability of the application difficult on the mobile device. The below mentioned ViewPort tag solves this problem.

<meta name="viewport" content="width=device-width" />

The ViewPort tag does content resizing only at the page level. If the developer wants to customize each control styling based on the client device then the @media CSS tag can be used. It applies / overrides the CSS based on the size of the client screen.

   @media only screen and (max-width: 650 px)    
    {   
           /*CSS in this section will be applied when the request is made by a device with a screen and the width is less than 650 pixels*/    
           /*Custom CSS*/    
    }

3. Display Modes

This feature enables the developers to have different sets of views for each device and load them based on who is accessing the web application. This is required when the requirement is to change the view, content, control look or the operations different from device to device.
In order to have the display modes working, the razor views should be named as _Layout.mobile.cshtml and _Layout.cshtml. The idea is to load the former template view when accessed from a mobile device and to load the later one when accessed from a desktop. In the global.asax Application_Start event add the code below and MVC 4 takes care of doing it automatically.

 DefaultDisplayMode mobileDisplayMode = new DefaultDisplayMode("mobile")
                {
                    ContextCondition = (context => context.Request.Browser.IsMobileDevice)
                };
 DisplayModeProvider.Instance.Modes.Insert(0, mobileDisplayMode);

4. Support for Async Controller Actions

The Asp.Net MVC 4 application developed on .net framework 4.5 will support asynchronous action methods. An asynchronous controller action method will return a Task of ActionResult and will use async / await keywords. Below is a sample async action method.

namespace MvcApplication1.Controllers
    {
         public class HomeController : Controller
        {
     //Asynchronous Action Method of the controller
            public async Task<ActionResult> GreetAsync()
            {
                return View(await GetGreetMessageAync());
            }
            private async Task<string> GetGreetMessageAync()
            {
                string greetingText = String.Empty;
                await Task.Run(() =>
                    {
                        greetingText = "Welcome to async MVC action method demo";
                    });
                return greetingText;
            }
        }
    }

5. App_Start Folder

Another improvement, which I see with respect to the ASP.NET MVC solution architecture, is the introduction of App_Start folder, which helps in grouping all the code that is used for configuring the behavior of the Asp.Net MVC framework application. In the earlier versions on ASP.NET MVC all the configurations were directly done inside the global.ascx. Below are few of the config files that are added to the folder by default in an internet application template.

a.  AuthConfig.cs
b. BundleConfig.cs
c.  FilterConfig.cs
d. RouteConfig.cs
e. WebApiConfig.cs

ASP.NET MVC 4 also has lot of other features like the OAuth, bundling & minification, etc.