With the growth and increasing popularity of the Internet have come a variety of vulnerabilities. Because the Internet is essentially an open network, security risks are always a threat to its users. The most common threats, viruses or worms, pose the greatest danger to systems because they can spread so quickly and cause so much damage.
Like it or not, Microsoft has played a huge role in the popularity of the Internet. In the past, Microsoft has been blamed for distributing products that expose systems to common threats unnecessarily. Whether that criticism is accurate or not is up for debate. Since Microsoft produces so many popular products, hackers get more bang for their buck when they exploit security holes on a Windows system. On the other hand, some of these threats could have been avoided by giving more attention to security concerns during development.
As the Internet continues to grow, more emphasis must be placed on making it a secure environment. In this Daily Feature, I’ll give an overview of a new program Microsoft has put in place to ensure Internet security for its customers and examine a new tool kit it offers as a fix for certain security concerns.
Microsoft MCTS Training, Microsoft MCITP Training login in to Certkingdom.com
The Strategic Technology Protection Program
Because Microsoft’s investment in the Internet is so great (in fact, Bill has bet the company’s future on it), the company has decided to roll out a new program aimed at addressing security concerns. With the Strategic Technology Protection Program (STPP), Microsoft is promising a whole new strategy for combating security risks with its products.
The STPP is an effort to more effectively bring Microsoft’s resources to individuals and organizations affected by security threats. Instead of just offering security patches when the latest virus hits, this approach to security is expected to encompass an ongoing relationship among Microsoft, its vendors, its customers, and even its competitors. The program uses a two-pronged approach. The first step is designed to help customers already affected by a virus or other problem and the second is meant to keep them secure from future attacks.
A big part of this effort is the Microsoft Security Tool Kit. You can download this free, comprehensive security package, which encompasses all the latest security tools offered by Microsoft. Alternatively, you can order a CD through snail mail. TechNet subscribers can expect this kit in their November release sans the automatic installation feature. A stand-alone version will be distributed with the December TechNet CD.
A look inside the online Microsoft Security Tool Kit
The kit is broken down by operating system (either Windows 2000 or NT, with a further classification for Terminal Server Edition). It contains four main sections: Guides, Software Updates, Deployment and Management Tools, and Online Resources.
Guides
You can use the first section to ensure your systems have all the latest security updates. At the top of the list are the Guide To Baseline Security and Baseline Security Checklists (see Figure A). The checklists are advertised as a front line of defense for your systems that are vulnerable to security risks. The steps included in the checklists provide basic security procedures you’ll want to have in place before moving on with the rest of the kit.
Figure A
These checklists go over some of the steps you should take to secure your systems.
Though not as comprehensive as the baseline checklists, the remaining guides, Windows 2000 Service Pack and Hotfix Installation and Deployment Guide, Deploying Service Pack 6a with SMS, and the Internet Explorer Deployment Guides should appear familiar to you from working with previous upgrades.
Software Updates
Perhaps the most important section in the kit is Software Updates. Here, you’ll find everything from Windows 2000 Service Pack 2 to the latest version of Internet Explorer. The complete list consists of:
* Windows 2000 Service Pack 2
* Internet Information Server 4.0 Security Rollup Package
* Internet Information Server 5.0 Security Rollup Package
* Windows NT 4.0 Service Pack 6a
* Windows NT 4.0 Security Rollup Package
* Windows NT 4.0 Service Pack 6 For Terminal Server Edition
* Internet Explorer 5.01 Service Pack 2
* Internet Explorer 5.5 Service Pack 2
* Internet Explorer 6.0
* Security Bulletin MS01-008
* Security Bulletin MS00-095
* Security Bulletin MS00-070
* Security Bulletin MS00-052
In the Microsoft Security Tool Kit, the Windows 2000 and NT updates come with a brief description as well as a link for more details. The Internet Explorer updates just come with the download link. Each Security Bulletin contains a Technical Details link that will take you to the appropriate patch download page. Though you can get these updates separately on Microsoft’s Web site, I think the company made a wise decision by combining these selections given the significant impact each update makes to a system.
Deployment and Management Tools
The tools included here are useful for both server and client, but I’ll elaborate on the three significant tools that’ll be good for the client side. The first, Hfnetchk.exe, assesses the patch status of Windows clients from a remote location. Hfnetchk.exe will scan the patch status for the following Microsoft products:
* Windows NT 4.0
* Windows 2000
* All system services, including Internet Information Server 4.0 and 5.0
* SQL Server 7.0 and 2000 (including Microsoft Data Engine)
* Internet Explorer 5.01 and later
The next handy client tool is the Critical Update Notification Tool, which periodically checks for updates on the Windows Update Web site and sends a notification to the client machine. This link provides instructions on activating this product, which is already installed with Windows 98, 98SE, and 2000.
Qchain is the last utility in this section concerned with Windows clients. It allows you to chain multiple hotfixes together to eliminate rebooting for each installation. This tool keeps user downtime to a minimum when multiple hotfixes are necessary.
Online Resources
This section is a catchall for security issues not directly addressed by the tool kit. It lists links to popular Microsoft technical support sites you can use to protect your systems:
* Microsoft TechNet Security Web Site
* Sign up to receive security bulletins
* Security Bulletin Search site
* Microsoft Personal Security Advisor
* Other Security Tools and Checklists
Conclusion
Today’s computing environment is fraught with security concerns. New, more dangerous code is finding its way onto the Internet with alarming regularity. With so much at stake, it’s no wonder Microsoft is taking a more active role in securing the Internet. At first glance, the company appears positioned to take on the challenge of making the Internet a safe place to do business. However, that will not be easy. It faces a significant obstacle given the viciousness of today’s hackers. The Microsoft Security Tool Kit is definitely a step in the right direction, as it encompasses the latest security defenses Microsoft has to offer. With each new layer of security, your network is that much more unattractive to would-be intruders.
