******************** Windows & .NET Magazine Security UPDATE--brought to you by Security Administrator, a print newsletter bringing you practical, how-to articles about securing your Windows Server 2003, Windows 2000, and Windows NT systems. http://www.secadministrator.com ******************** ~~~~ THIS ISSUE SPONSORED BY ~~~~ Register & Win an American Express Gift Card! http://list.winnetmag.com/cgi-bin3/DM/y/eQWq0CJgSH0CBw08pN0A4 HP & Microsoft Network Storage Solutions Road Show http://list.winnetmag.com/cgi-bin3/DM/y/eQWq0CJgSH0CBw07cD0Af (below IN FOCUS) ~~~~~~~~~~~~~~~~~~~~ ~~~~ SPONSOR: REGISTER & WIN AN AMERICAN EXPRESS GIFT CARD! ~~~~ Sybari is committed to securing your enterprise -- protection of your messaging and collaboration servers can't be achieved with the traditional "throw in the mail server" security suite. If your responsibility is the 100% uptime of your networks then evaluate Antigen. See for yourself how we are redefining the messaging security suite by delivering a true multi-level approach to protecting your most vulnerable and critical servers through our proven, comprehensive expert technology. Click Here ( http://list.winnetmag.com/cgi-bin3/DM/y/eQWq0CJgSH0CBw08pN0A4 ) to register for the next Antigen web demo! Attend a demo by June 1st and you could win an American Express Gift Card! ~~~~~~~~~~~~~~~~~~~~ April 16, 2003--In this issue: 1. IN FOCUS - Security Industry Trends: Consolidation and Integration 2. SECURITY RISKS - DoS in Microsoft ISA Server 2000 and Microsoft Proxy Server 2.0 - System Compromise Vulnerability in Microsoft VM - Authentication Bypass Vulnerability in Oracle E-Business Suite 3. ANNOUNCEMENTS - Couldn't Make the Microsoft Mobility Tour Event? - Microsoft Tech-Ed 2003 Europe, June 30 - July 4, Barcelona 4. SECURITY ROUNDUP - News: VeriSign and nCipher Offer Hardware-Protected SSL Certificates - News: ISS Releases Internet Risk Impact Summary for First Quarter 2003 - Feature: OWA 2003's New Security Features 5. HOT RELEASE (ADVERTISEMENT) - Evaluating Next-Generation High-Performance Firewall Appliances 6. INSTANT POLL - Results of Previous Poll: WEP and WPA - New Instant Poll: Windows Server 2003 7. SECURITY TOOLKIT - Virus Center - FAQ: How Can I Parse Log Files with SQL-Style Queries? 8. NEW AND IMPROVED - Inoculate Your Windows Systems Against Malware - Submit Top Product Ideas 9. HOT THREAD - Windows & .NET Magazine Online Forums - Featured Thread: Integrated Windows Authentication and IIS 10. CONTACT US See this section for a list of ways to contact us. ~~~~~~~~~~~~~~~~~~~~ 1. ==== IN FOCUS ==== (contributed by Mark Joseph Edwards, News Editor, markat_private) * SECURITY INDUSTRY TRENDS: CONSOLIDATION AND INTEGRATION If you've watched security companies in general over the past year, a noticeable trend seems to be emerging: consolidation. What might consolidation mean for the security segment of the computer industry as a whole? Large companies, such as Computer Associates (CA), Network Associates, Symantec, and Internet Security Systems (ISS), have over time built suites of products. Whereas in the past, a given security technology vendor might provide one or two products, larger vendors now offer several products integrated into suites and into even broader management platforms. Although many security management platforms are available, complete cross-platform communication between different vendors' products is still uncommon. Of course, software development kits (SDKs) support some interactivity, such as virus scanners communicating with firewalls to prevent viruses from entering a network. But by and large, cross-platform communication (vendor to vendor) among security products is still a challenge. The current situation is probably natural. After all, vendors want to protect and enlarge their market space. But is that really beneficial to computer users as a whole? How can niche security vendors continue to compete? Interoperability might offer an answer. The Organization for the Advancement of Structured Information Standards (OASIS--see the first URL below) recently announced a new standard, the Application Vulnerability Description Language (AVDL--see the second URL below). According to the description, AVDL "is a new security interoperability standard being proposed by leading application security vendors as part of the OASIS standards process. The goal of AVDL is to create a uniform way of describing application security vulnerabilities using XML." http://www.oasis-open.org/home/index.php http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=avdl AVDL's effect will be to let security-related applications interoperate. Initially, five companies are proposing AVDL: Citadel Security Software, GuardedNet, NetContinuum, SPI Dynamics, and Teros. The five companies offer a range of security products that detect vulnerabilities, automate vulnerability remediation, aggregate event and log information, protect Web applications, and more. With a standard such as AVDL implemented in the listed security categories as well as other product categories, users who don't buy single-vendor suites can more easily integrate information sources for reporting and action. But which other companies will support AVDL? Many large companies support the OASIS project, but fewer actually contribute to it. I think that the larger companies might prefer to consolidate rather than to integrate. http://www.oasis-open.org/about/contributors.php The security market's consolidation trend might be similar to the last decade's consolidation within the ISP market and the communications market. Smaller companies were often either forced out of the market or assimilated by larger companies. How long can niche security companies last, even if they have great products? I think AVDL is a good way for niche vendors to team up for expanded interoperability, and it might offer a survival strategy in the consolidating market. AVDL would let users build a sort of "virtual suite" of individual products of their own choosing. At the same time, AVDL could help niche vendors avoid having industry giants squash them out of the market over time if consolidation becomes a key market factor as we witnessed with ISPs and communications companies. ~~~~~~~~~~~~~~~~~~~~ ~~~~ SPONSOR: HP & MICROSOFT NETWORK STORAGE SOLUTIONS ROAD SHOW ~~~~ JOIN THE HP & MICROSOFT NETWORK STORAGE SOLUTIONS ROAD SHOW! Now is the time to start thinking of storage as a strategic weapon in your IT arsenal. Attend the HP & Microsoft Network Storage Solutions Road Show, and learn how existing and future storage solutions can save your company money--and make your job easier! There is no fee for this event, but space is limited. Register now! http://list.winnetmag.com/cgi-bin3/DM/y/eQWq0CJgSH0CBw07cD0Af ~~~~~~~~~~~~~~~~~~~~ 2. ==== SECURITY RISKS ==== (contributed by Ken Pfeil, kenat_private) * DoS IN MICROSOFT ISA SERVER 2000 AND MICROSOFT PROXY SERVER 2.0 A vulnerability in Microsoft Internet Security and Acceleration (ISA) Server 2000 and Microsoft Proxy Server 2.0 can result in a Denial of Service (DoS) condition on the vulnerable server. The vulnerability, which results from a flaw in the Winsock Proxy service, lets malicious users on the internal network send specially crafted packets that can cause the server to stop responding to internal and external requests. Receipt of such a packet causes CPU utilization on the server to reach 100 percent. Microsoft has released Security Bulletin MS03-012 (Flaw In Winsock Proxy Service And ISA Firewall Service Can Cause Denial Of Service) to address this vulnerability. http://www.secadministrator.com/articles/index.cfm?articleid=38683 * SYSTEM COMPROMISE VULNERABILITY IN MICROSOFT VM A vulnerability in Microsoft Virtual Machine (VM) can result in the execution of code on the vulnerable system under the user's security context. This vulnerability occurs because the ByteCode verifier doesn't correctly check for the presence of certain malicious code during the loading of a Java applet. An attacker can exploit this vulnerability by creating a malicious Java applet and inserting it into a Web page. Microsoft has released Security Bulletin MS03-011 (Flaw in Microsoft VM Could Enable System Compromise) to address this vulnerability. http://www.secadministrator.com/articles/index.cfm?articleid=38682 * AUTHENTICATION BYPASS VULNERABILITY IN ORACLE E-BUSINESS SUITE Stephen Kost of Integrigy discovered that a vulnerability in the communications protocol that Oracle Applications FND File Server (FNDFS) uses lets an attacker bypass any OS, database, and application authentication to retrieve files from Oracle Applications Concurrent Manager servers. If the attacker has direct access to the Concurrent Manager server through SQL*Net, he or she can retrieve sensitive data or files (e.g., any file that the oracle or applmgr accounts can access) that contain critical passwords. Oracle has released a security bulletin regarding this vulnerability and recommends that affected users download and apply the appropriate update. http://www.secadministrator.com/articles/index.cfm?articleid=38686 3. ==== ANNOUNCEMENTS ==== (brought to you by Windows & .NET Magazine and its partners) * COULDN'T MAKE THE MICROSOFT MOBILITY TOUR EVENT? If you were too busy to catch our Microsoft Mobility Tour event in person, now you can view the Webcast archives for free! You'll learn more about the available solutions for PC and mobile devices and discover the direction mobility marketplace is headed. http://list.winnetmag.com/cgi-bin3/DM/y/eQWq0CJgSH0CBw06Kw0A6 * MICROSOFT TECH-ED 2003 EUROPE, JUNE 30 - JULY 4, BARCELONA Connect at Microsoft's premier European conference for building, deploying and managing connected solutions. Choose from 270+ in-depth technical sessions and hands-on labs to realize your full potential on the latest Microsoft technologies, platforms and tools. Register now and save 300 Euros! http://list.winnetmag.com/cgi-bin3/DM/y/eQWq0CJgSH0CBw0zFv0A8 4. ==== SECURITY ROUNDUP ==== * NEWS: VERISIGN AND nCIPHER OFFER HARDWARE-PROTECTED SSL CERTIFICATES nCipher announced a new product, the Hardware Protected SSL Certificate. The new offering ensures that Secure Sockets Layer (SSL) certificates are protected by Federal Information Processing Standard (FIPS)-validated cryptographic hardware, which allows a stronger level of authentication. The hardware complies with the FIPS 140-2 specification. nCipher is partnering with VeriSign to provide certificates for the new hardware-based certificate model. http://www.secadministrator.com/articles/index.cfm?articleid=38623 * NEWS: ISS RELEASES INTERNET RISK IMPACT SUMMARY FOR FIRST QUARTER 2003 Internet Security Systems (ISS) released its Internet Risk Impact Summary report for first quarter 2003. According to the report, the number of security incidents increased 84 percent, compared with fourth quarter 2002. http://www.secadministrator.com/articles/index.cfm?articleid=38624 * FEATURE: OWA 2003'S NEW SECURITY FEATURES Microsoft has put great effort into improving the security of Exchange Server 2003, and that effort is apparent in the new version of Microsoft Outlook Web Access (OWA)--especially if you run Exchange 2003 on Windows Server 2003. (In that scenario, OWA runs on Microsoft Internet Information Services--IIS--6.0, which has a much improved security model compared to IIS 5.0 and earlier.) If you have more than a handful of OWA users, you'll find that OWA's new features make it well worth upgrading to Exchange 2003. The most noteworthy features are support for encryption, cookie authentication, and various content blocks. http://www.secadministrator.com/articles/index.cfm?articleid=38599 5. ==== HOT RELEASE (ADVERTISEMENT) ==== * EVALUATING NEXT-GENERATION HIGH-PERFORMANCE FIREWALL APPLIANCES Download this free technical white paper now from Windows & .NET Magazine's White Paper Central. Brought to you courtesy of WatchGuard. http://ad.doubleclick.net/clk;5219034;7402808;e?http://click.atdmt.com/CWS/go/wndwnwq100100023cws/direct/01/ 6. ==== INSTANT POLL ==== * RESULTS OF PREVIOUS POLL: WEP and WPA The voting has closed in Windows & .NET Magazine's Security Administrator Channel nonscientific Instant Poll for the question, "Will your company replace Wired Equivalent Privacy (WEP) with Wi-Fi Protected Access (WPA)?" Here are the results from the 92 votes. (Deviations from 100 percent are due to rounding errors.) - 20% Yes - 32% No - 22% No--We're waiting for 802.11i - 27% Undecided * NEW INSTANT POLL: WINDOWS SERVER 2003 The next Instant Poll question is, "Will your company upgrade to Windows Server 2003 for better security?" Go to the Security Administrator Channel home page and submit your vote for a) Yes--within 1 year, b) Yes--within 2 years, c) Yes--within 3 years, d) Not sure, or e) No. http://www.secadministrator.com 7. ==== SECURITY TOOLKIT ==== * VIRUS CENTER Panda Software and the Windows & .NET Magazine Network have teamed to bring you the Center for Virus Control. Visit the site often to remain informed about the latest threats to your system security. http://www.secadministrator.com/panda * FAQ: How Can I Parse Log Files with SQL-Style Queries? (contributed by Microsoft) A: You can use Microsoft's free tool, Log Parser 2.0, to perform Microsoft SQL-style queries on a variety of log files. The tool is a set of scriptable COM objects that permits the query outputs to be displayed on screen or written to an output file or SQL database. The tool runs on Windows Server 2003, Windows XP, and Windows 2000. You can download a copy from Microsoft's Web site. http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=8cde4028-e247-45be-bab9-ac851fc166a4 8. ==== NEW AND IMPROVED ==== (contributed by Sue Cooper, productsat_private) * INOCULATE YOUR WINDOWS SYSTEMS AGAINST MALWARE BBX Technologies has announced ImmuneEngine, a network OS layer that resides with Microsoft OSs and protects your desktops and servers from known and unknown viruses and malicious mobile code. ImmuneEngine monitors all Windows kernel operations, including the memory stack, mouse activity, and keyboard activity as applications execute. IT also monitors all file creation input/output operations that the OS performs. The software detects and deletes most unauthorized executables before they can launch, but if they launch, it will also persistently try to stop their execution. ImmuneEngine restores to their original state both protected portions of the registry that are modified and protected system files that are damaged--and it creates a forensic report for your review. The management console lets you automate the configuration, installation, and monitoring of your Windows systems across the network. Because ImmuneEngine doesn't use signature files, you won't need to distribute signature updates. A double-key protection system requires two administrators to disable ImmuneEngine's defenses and let you install or modify new software. ImmuneEngine supports Windows XP/2000/NT/9x. Prices start at $175 per workstation or laptop and $10,000 per enterprise server. Leading systems integrators distribute ImmuneEngine, which the National Security Agency (NSA) has approved for sale to the government. Contact BBX Technologies at 212-686-2828 or infoat_private http://www.bbxtechnologies.com * SUBMIT TOP PRODUCT IDEAS Have you used a product that changed your IT experience by saving you time or easing your daily burden? Do you know of a terrific product that others should know about? Tell us! We want to write about the product in a future What's Hot column. Send your product suggestions to whatshotat_private 9. ==== HOT THREAD ==== * WINDOWS & .NET MAGAZINE ONLINE FORUMS http://www.winnetmag.com/forums Featured Thread: Integrated Windows Authentication and IIS (Three messages in this thread) A user writes that he has a subdirectory within a Web site on Microsoft Internet Information Services (IIS) 5.0 that users log on to with their username and password. The Web server is placed in a demilitarized zone (DMZ) and isn't part of the domain. Local accounts created on the server require NTFS permissions on the subdirectory. On the IIS level, the directory is enabled with "Integrated Windows Authentication" only. However, whenever users try to log on from within the domain through their Windows XP clients, they receive a message that they aren't authorized for access. No logon page appears on which they can enter their credentials. The user writes that he can make the logon page display from within the domain only by enabling Basic Authentication (but he doesn't want to leave Basic Authentication enabled for security reasons). He wants to find a way around this problem. Lend a hand or read the responses: http://www.winnetmag.com/forums/rd.cfm?cid=42&tid=57203 10. ==== CONTACT US ==== Here's how to reach us with your comments and questions: * ABOUT IN FOCUS -- markat_private * ABOUT THE NEWSLETTER IN GENERAL -- lettersat_private (please mention the newsletter name in the subject line) * TECHNICAL QUESTIONS -- http://www.winnetmag.com/forums * PRODUCT NEWS -- productsat_private * QUESTIONS ABOUT YOUR SECURITY UPDATE SUBSCRIPTION? Customer Support -- securityupdateat_private * WANT TO SPONSOR SECURITY UPDATE? emedia_oppsat_private ******************** This email newsletter is brought to you by Security Administrator, the print newsletter with independent, impartial advice for IT administrators securing a Windows 2000/Windows NT enterprise. Subscribe today! http://www.secadministrator.com/sub.cfm?code=saei25xxup Receive the latest information about the Windows and .NET topics of your choice. Subscribe to our other FREE email newsletters. http://www.winnetmag.com/email |-+-|-+-|-+-|-+-|-+-| Thank you for reading Security UPDATE. MANAGE YOUR ACCOUNT You can manage your entire Windows & .NET Magazine Network email newsletter account on our Web site. Simply log on and you can change your email address, update your profile information, and subscribe or unsubscribe to any of our email newsletters all in one place. http://www.winnetmag.com/email Thank you! __________________________________________________________ Copyright 2003, Penton Media, Inc. - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Thu Apr 17 2003 - 04:32:59 PDT