==================== This email newsletter comes to you free and is supported by the following advertisers, which offer products and services in which you might be interested. Please take a moment to visit these advertisers' Web sites and show your support for Security UPDATE. Exchange & Outlook Administrator http://list.windowsitpro.com/t?ctl=C2C9:4FB69 Cost Control Through Remote Control: A practical approach to reducing the cost of supporting PC's in a multi-platform environment http://list.windowsitpro.com/t?ctl=C2BC:4FB69 ==================== 1. In Focus: Supercharging Snort 2. Security News and Features - Recent Security Vulnerabilities - WSUS Available, Microsoft Update Now Live, MBSA 2.0 on the Way - Cisco's New DDoS Protection Solution - IIS 6.0 Enhancements in Windows 2003 SP1 3. Security Toolkit - Security Matters Blog - FAQ 4. New and Improved - Manage Compliance and Vulnerability Remediation ==================== ==== Sponsor: Exchange & Outlook Administrator ==== Try a Sample Issue of Exchange & Outlook Administrator! If you haven't seen Exchange & Outlook Administrator, you're missing out on key information that will go a long way towards preventing serious messaging problems and downtime. Request a sample issue today, and discover tools and solutions you won't find anywhere else to help you migrate, optimize, administer, backup, recover, and secure Exchange and Outlook. Order now! http://list.windowsitpro.com/t?ctl=C2C9:4FB69 ==================== ==== 1. In Focus: Supercharging Snort ==== by Mark Joseph Edwards, News Editor, mark at ntsecurity / net Certainly you've heard of the open-source Intrusion Detection System/Intrusion Prevention System (IDS/IPS) Snort. Maybe you're one of the countless people who use it. If so, you know it's a great tool with a huge amount of support from the user community. You might also know that Sourcefire, the company behind Snort, offers a commercial version of Snort and other network-protection tools. When I recently visited the Snort.org Web site, I learned that you can now subscribe to the Sourcefire Vulnerability Research Team's certified rulesets, which means that you can receive the latest rulesets five days sooner than those rulesets are released to the general public. http://list.windowsitpro.com/t?ctl=C2D2:4FB69 Maybe you write your own rules in addition to using rulesets available at the Snort Web site. As with the source code for any application, the way a rule is written affects the performance of Snort. Poorly written rules take more time to process. A few extra microseconds of processing time here and there might not seem like a big deal, but when you consider an overall traffic load, those microseconds add up to full seconds really fast, and of course those seconds add up to minutes. The more efficient your rules, the more efficiently your IDS runs and the less likely that some sort of anomalous traffic-dropping occurs. So how can you determine how efficient your rules are? An easy way is to use the new TurboSnortRules online benchmarking tool, sponsored by VigilantMinds. TurboSnortRules is a Web-based service that lets you enter a rule and test its performance on various versions of Snort against a set of control data. The test output shows you how fast your rule operates on those selected versions. http://list.windowsitpro.com/t?ctl=C2D5:4FB69 As an example of how effective the service can be, take a look at the two sets of test results listed at the URLs below. Both tested rules are designed to detect Yahoo! Messenger logons. As you'll see in the results, one rule operates much faster than the other. http://list.windowsitpro.com/t?ctl=C2C5:4FB69 http://list.windowsitpro.com/t?ctl=C2C4:4FB69 For another example, look at the two sets of test results for rules designed to detect the Mytob Trojan horse (at the first two URLs below). One rule operates faster than the other, but in this case, the difference in speed isn't as dramatic as in the comparison of the Yahoo! Messenger rules. Even so, every little bit of speed improvement helps. One slow rule could cause Snort to begin dropping packets, which could jeopardize your overall security. See the third URL below too, which graphically illustrates the damage one poorly written rule can do. http://list.windowsitpro.com/t?ctl=C2C2:4FB69 http://list.windowsitpro.com/t?ctl=C2C3:4FB69 http://list.windowsitpro.com/t?ctl=C2D0:4FB69 Also at the TurboSnortRules site, you'll find a searchable database for looking up rules that are either part of the Snort distribution or that have been submitted to the site by administrators for testing. The database is a good way to find rules you might need but don't want to write yourself, and the related performance data shows you how well those rules perform. Another excellent resource at the site is the Snort Performance Wiki, which has a lot of useful suggestions about how to make Snort run as fast as possible. ==================== ==== Sponsor: Netopia ==== Cost Control Through Remote Control: A practical approach to reducing the cost of supporting PC's in a multi-platform environment While the price for personal computers continues to decline, the actual cost to own and operate PCs continues to rise. In this free white paper get the insights and solutions into some of the less visible, but very real costs of PC and LAN ownership. You'll learn a practical approach to reducing the cost of supporting PC's and customers in a multi-platform environment. Plus -- you'll also get a Cost Savings Model for help desks that demonstrates the cost savings that can be realized by implementing remote control technology. http://list.windowsitpro.com/t?ctl=C2BC:4FB69 ==================== ==== 2. Security News and Features ==== Recent Security Vulnerabilities If you subscribe to this newsletter, you also receive Security Alerts, which inform you about recently discovered security vulnerabilities. You can also find information about these discoveries at http://list.windowsitpro.com/t?ctl=C2C0:4FB69 WSUS Available, Microsoft Update Now Live, MBSA 2.0 on the Way Have you been waiting for the release of the finished Windows Server Update Services (WSUS)? Wondering when the new Microsoft Update site will go live? Both are available now, and Microsoft Baseline Security Analyzer (MBSA) 2.0 is on the way. http://list.windowsitpro.com/t?ctl=C2CD:4FB69 Cisco's New DDoS Protection Solution Cisco Systems announced its new Distributed Denial of Service (DDoS) Protection solution that allows ISPs to protect their own networks, sell protected wholesale connections, and offer customers managed protection against DDoS attacks. http://list.windowsitpro.com/t?ctl=C2CC:4FB69 IIS 6.0 Enhancements in Windows 2003 SP1 Although most of the major Windows Server 2003 Service Pack 1 (SP1) changes concentrate on the core OS, SP1 doesn't neglect Microsoft IIS. The service pack contains several significant enhancements to IIS 6.0, the Web server application that's bundled with Windows 2003. Michael Otey outlines those changes in this brief summary on our Web site. http://list.windowsitpro.com/t?ctl=C2C8:4FB69 ==================== ==== Resources and Events ==== True High Availability -- Going Beyond Backup and Data Replication In this free Web seminar discover the various categories of high availability and disaster recovery solutions available and the pros and cons of each. You'll learn what solutions help you take preemptive, corrective action without resorting to a full system failover, or in extreme cases, that perform a non-disruptive, automatic switchover to a secondary server. Register Now! http://list.windowsitpro.com/t?ctl=C2BD:4FB69 Attend the Black Hat Briefings Attend the Black Hat Briefings & Training USA, July 23-28, 2005 in Las Vegas. World renowned security experts reveal tomorrow's threats today. Free of vendor pitches, the briefings are designed to be pragmatic regardless of your security environment. Featuring 25 hands- on training courses and 10 conference tracks. Lots of Windows stuff profiled. http://list.windowsitpro.com/t?ctl=C2D7:4FB69 Get Ready for SQL Server 2005 Roadshow in Europe Get the facts about migrating to SQL Server 2005. SQL Server experts will present real-world information about administration, development, and business intelligence to help you implement a best-practices migration to SQL Server 2005 and improve your database computing environment. Receive a 1-year membership to PASS and 1-year subscription to SQL Server Magazine. Register now! http://list.windowsitpro.com/t?ctl=C2BF:4FB69 Streamline Desktop Deployments Managing desktop software configurations doesn't have to be a manual process, resulting in unplanned costs, deployment delays, and client confusion. In this free Web seminar find out how to manage the software package preparation process and increase your desktop reliability, user satisfaction, and IT cost effectiveness. You'll learn how to simplify the deployment and configuration process, starting with the new- application request, review, and approval process and progressing through software packaging and deployment. http://list.windowsitpro.com/t?ctl=C2BA:4FB69 Safeguard Your Exchange Servers -- Plus Receive A FREE eBook Managing storage growth, providing application resiliency, and handling small errors and problems before they grow are all important aspects of boosting your Exchange uptime. In this free Web seminar discover how storage and application management techniques for Exchange can be used to improve the resiliency and performance of your Exchange infrastructure. Register now and get your free eBook! http://list.windowsitpro.com/t?ctl=C2B7:4FB69 Win A Windows IT Pro VIP Subscription -- Register And You Could Win! In this free Web seminar, learn what the most common fax messaging challenges encountered in the workforce are and solutions for how to turn these common fax "headaches" into cost-effective, easy-to-use, business communications. You'll also receive a free industry white paper on fax deployment and integration techniques. Register now and you'll receive a 30-day software trial and a Starbucks gift card for attending! http://list.windowsitpro.com/t?ctl=C2BB:4FB69 ==================== ==== Featured White Paper ==== Security Management in a Multi-platform World In this free white paper you'll learn how to reduce management overhead when dealing with multiple platforms and the costs and benefits of a centralized "holistic" approach to security management. Get the ins and outs of managing multi-platform security and how you can safely, securely, and sanely manage the security infrastructure of complex, multi-platform environments. http://list.windowsitpro.com/t?ctl=C2B8:4FB69 ==================== ==== 3. Security Toolkit ==== Security Matters Blog by Mark Joseph Edwards, http://list.windowsitpro.com/t?ctl=C2D3:4FB69 10 Security Patches Due June 14 Microsoft released 10 security updates on June 14, at least one of which is considered by the company to be critical. Seven of the patches are for Windows OSs, one corrects a problem in Windows Services for UNIX, the eighth corrects a problem in Exchange Server, and the ninth corrects a problem with Internet Security and Acceleration (ISA) Server and Small Business Server (SBS). Microsoft also scheduled a Webcast for today at 2 P.M. Eastern Time (11 A.M. Pacific Time) to discuss the security updates. http://list.windowsitpro.com/t?ctl=C2C1:4FB69 New Feature Pack for Windows Mobile 5.0 to Enhance Security Speaking last week at TechEd 2005, Steve Ballmer, chief executive officer of Microsoft, announced that the company's new Messaging & Security Feature Pack for Windows Mobile 5.0 will allow administrators to remotely enforce IT policy, remove all information from a device, and reset a device to its original state, including the ability to erase local device memory when the correct password isn't entered within the designated number of attempts. http://list.windowsitpro.com/t?ctl=C2CA:4FB69 FAQ by John Savill, http://list.windowsitpro.com/t?ctl=C2CF:4FB69 Q: Where is cached Universal Group information stored? Find the answer at http://list.windowsitpro.com/t?ctl=C2CB:4FB69 ==================== ==== Announcements ==== (from Windows IT Pro and its partners) Why Do You Need the Windows IT Pro Master CD? There are three good reasons to order our latest Windows IT Pro Master CD. One, because it's a lightning-fast, portable tool that lets you search for solutions by topic, author, or issue. Two, because it includes our Top 100 Windows IT Pro Tips. Three, because you'll also receive exclusive, subscriber-only access to our entire online article database. Click here to discover even more reasons: http://list.windowsitpro.com/t?ctl=C2CE:4FB69 ==================== ==== 4. New and Improved ==== by Renee Munshi, products@private Manage Compliance and Vulnerability Remediation Citadel Security Software is now shipping Hercules 4.0. The new version adds two new modules: Hercules Compliance Manager, for auditing and reporting security policy compliance, and Hercules Remediation Manager, for managing vulnerability remediation and enforcing security policies. Hercules is available as a full suite or as individual modules. Citadel also now offers Hercules as a hardware appliance and in a pricing model that lets you pay for compliance audits and remediation actions as they're performed--these appliance and pay-per- use features are designed to make Hercules more appealing to smaller businesses. For more information, visit http://list.windowsitpro.com/t?ctl=C2D8:4FB69 Tell Us About a Hot Product and Get a T-Shirt! Have you used a product that changed your IT experience by saving you time or easing your daily burden? Tell us about the product, and we'll send you a T-shirt if we write about the product in a future Windows IT Pro What's Hot column. Send your product suggestions with information about how the product has helped you to whatshot@private Editor's note: Share Your Security Discoveries and Get $100 Share your security-related discoveries, comments, or problems and solutions in the Windows IT Security print newsletter's Reader to Reader column. Email your contributions (500 words or less) to r2rwinitsec@private If we print your submission, you'll get $100. We edit submissions for style, grammar, and length. ==================== ==== Sponsored Links ==== Ensuring Protection and Availability for Microsoft Exchange Download this free white paper now! http://list.windowsitpro.com/t?ctl=C2B9:4FB69 Quest Software Eleven things you must know about quick AD recovery! http://list.windowsitpro.com/t?ctl=C2D9:4FB69 A New Dimension in IT Infrastructure Management: Integrated KVM and Serial Console Control Systems Reduce downtime, mean-time-to-repair, lower costs & improve ROI. http://list.windowsitpro.com/t?ctl=C2BE:4FB69 ==================== ==== Contact Us ==== About the newsletter -- letters@private About technical questions -- http://list.windowsitpro.com/t?ctl=C2D4:4FB69 About product news -- products@private About your subscription -- windowsitproupdate@private About sponsoring Security UPDATE -- emedia_opps@private ==================== This email newsletter is brought to you by Windows IT Security, the leading publication for IT professionals securing the Windows enterprise from external intruders and controlling access for internal users. Subscribe today. http://list.windowsitpro.com/t?ctl=C2C6:4FB69 View the Windows IT Pro privacy policy at http://www.windowsitpro.com/AboutUs/Index.cfm?action=privacy Windows IT Pro, a division of Penton Media, Inc. 221 East 29th Street, Loveland, CO 80538 Attention: Customer Service Department Copyright 2005, Penton Media, Inc. All rights reserved. _________________________________________ Attend the Black Hat Briefings and Training, Las Vegas July 23-28 - 2,000+ international security experts, 10 tracks, no vendor pitches. www.blackhat.com
This archive was generated by hypermail 2.1.3 : Thu Jun 16 2005 - 00:36:30 PDT