I run both IIS and Apache Web servers in my honeynet. The Apache Web server gets attacked significantly more than the IIS server does. Also, most reported hacks are against Apache Web servers.

The real answer, of course, is that both IIS and Apache, if installed as directed by the developers, are relatively secure. Most malicious Web site infections are the result of administrative ...