Daily Tips and Tricks Special Delivery

Sign up for other newsletters | Unsubscribe | Update your profile Preview Slide Shows For a quick preview of a slide show while you're editing a presentation, hold down the CTRL key while clicking View Show on the Slide Show ribbon. Instead of opening in full-screen mode, the presentation, starting with the current slide, appears in a small window over the slide being edited. To edit the slide and see your changes in real time, align the Microsoft Office PowerPoint window so that the preview slide is in view. Any modifications that you make appear in the preview window. Register Your Regular E-Mail Contacts as Safe Senders Here's how to designate anyone you send mail to as a safe sender: 1. Click Actions, point to Junk E-mail, and then click Junk E-mail Options. 2. On the Safe Senders tab, select the Automatically add people I e-mail to the Safe Senders List check box. Now anyone you send an e-mail message to will be designated a safe sender. • Tips and Tricks Web site • Microsoft Office Online • Help Privacy note: Microsoft respects your privacy and that of your friends. Please do not use the Tell a Friend button to send mail to more than 10 people. Microsoft cannot collect any data about the people you send mail to unless they sign up for Tips and Tricks Special Delivery. To cancel your subscription to this newsletter, reply to this message with the word "unsubscribe" in the subject line. You can also unsubscribe at the Microsoft.com Profile Center. You can manage all your Microsoft.com communication preferences at this site. Legal information Microsoft Corporation One Microsoft Way Redmond, WA 98052 Sign up for other newsletters | Unsubscribe | Update your profile © 2008 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement

Microsoft Security Newsletter - Volume 5, Issue 11

Sign up for other newsletters | Unsubscribe | Update your profile

Welcome to the Microsoft Security Newsletter - a monthly newsletter for IT professionals and developers bringing security news, guidance, updates, and community resources direct to your inbox. To view an online version of this newsletter, please click here. If you would like to receive less technical security news, guidance and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter. Viewpoint The Great Debate: Security by Obscurity By Jesper M. Johansson, Software Architect and Microsoft MVP in Enterprise Security, and Roger Grimes, Senior Security Consultant, Microsoft ACE Team Security by obscurity involves taking measures that do not remove an attack vector but instead conceal it. Some argue that this is a bad practice while others claim that as part of a larger strategy, every bit counts. The debate is quite heated, and, in this article, some of our finest security experts face off, explaining security by obscurity and presenting both sides of the debate. Top Stories New Microsoft Security Intelligence Report Released Volume 5 of the Security Intelligence Report (SIR) contains an all-new examination of the threat ecosystem and the use of botnets to spread threats. It also includes unique content on browser-based exploits and updated information on software vulnerability disclosures, vulnerability exploits, security and privacy breaches and trends in malicious and potentially unwanted software. With extensive guidance on mitigations and countermeasures, SIR is a valuable tool for all IT professionals who need to know what is happening in the threat ecosystem. Microsoft Code Name "Geneva" Microsoft code name "Geneva" is an open platform for simplified user access based on claims. This release consists of three components: Geneva Framework for .NET developers, Geneva Server for IT Pros, and Windows CardSpace Geneva for users. Read the white paper by David Chappell for an overview of the platform, and then visit the Microsoft Connect Geneva home page for access to downloads and other resources. Research Paper: Malware Development Lifecycle Presented at the Virus Bulletin 2008 (VB2008) Conference in October, this paper tracks the evolution of certain families of malware as they have grown and diversified, adapting and improving to effectively accomplish their required results. Security Guidance Microsoft Security Assessment Tool 4.0 The Microsoft Security Assessment Tool employs a holistic approach to measuring your security posture by covering topics across people, process, and technology. This revised version features an updated defense-in-depth assessment plus questions related to the evolving threat landscape. Findings are coupled with prescriptive guidance and recommended mitigation efforts, including links to more information for additional industry guidance. IT Compliance Management Guide The IT Compliance Management Guide can help you shift your governance, risk, and compliance (GRC) efforts from people to technology. Use its configuration guidance to help efficiently address your organization's GRC objectives. Microsoft Encrypting File System Assistant The Encrypting File System (EFS) Assistant is a software tool you can use to centrally control EFS settings on your mobile or desktop PCs. The EFS Assistant can help you encrypt the sensitive files on your users' laptops, regardless of where those files are located. Part of the Data Encryption Toolkit for Mobile PCs, a community version of the tool, is also available from CodePlex at www.codeplex.com/EFSAssistant. Configuring Security in IIS 7.0 Windows Server 2008 featuring Internet Information Services 7.0 (IIS 7.0) is a powerful Web application and services platform that delivers rich Web-based experiences. Learn how to install and configure security settings for IIS 7.0, including built-in user and group accounts, URL authorization, SSL, and request filtering. UrlScan v3.0 UrlScan version 3.1 is a security tool that restricts the types of HTTP requests that Internet Information Services (IIS) 6.0 will process. UrlScan screens all incoming requests to the server by filtering the requests based on rules that are set by the administrator. Filtering requests helps secure the server by ensuring that only valid requests are processed. Checklist: Securing Web Services Part of the patterns and practices guide for "Improving Web Application Security," this checklist is designed to help developers build and secure Web services by outlining design, development, and administrative considerations. A Guide to Securing ISA Server 2006 Get best practices for securing your servers, using the Security Configuration Wizard, and assigning administrative roles. This Month's Security Bulletins Critical: • MS08-069: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (955218) Important: • MS08-068: Vulnerability in SMB Could Allow Remote Code Execution (957097) Community / MVP Update MVP of the Month: Don Kiely Don Kiely, MVP, MCSD, MSDE, is a senior technology consultant specializing in developing secure desktop and Web applications that integrate databases, Microsoft Office, and related technologies, using tools including SQL Server, Visual Basic, C#, ASP.NET, and XML. Don has authored and coauthored several programming books and writes regularly for many industry journals, including InformationWeek, IEEE Computer, Visual Studio .NET (VBPJ), and other magazines. Don also trains developers and speaks regularly at industry conferences, including Tech•Ed, VSLive!, DevConnections, and others. Microsoft Product Lifecycle Information Find information about your particular products on the Microsoft Product Support Lifecycle Web site. • See a List of Supported Service Packs: Microsoft provides free software updates for security and nonsecurity issues for all supported service packs. Security Events and Training Digital Blackbelt Series: Defend Your Code from Attacks Learn the rewards of building security into the development process and cultivate "defensive thinking." Explore secure development by examining decomposition, asset analysis, and other steps in the threat-modeling methodology. Identity and Access Management Learning Resources Microsoft provides technologies that legitimate users can use to access resources, while raising the bar for unauthorized users such as external hackers or internal disgruntled employees. See which tools verify user identity, control what resources users can access, and protect access to data throughout its lifecycle. Upcoming Security Webcasts Interactive Security Webcast Calendar Upcoming security webcasts in a dynamic, interactive format. For IT Professionals • TechNet Webcast: Microsoft Security Intelligence Report 5: Latest Trends in Vulnerabilities, Exploits, and Malicious Software (Level 200) Friday, November 14, 9:30 AM Pacific Time Jimmy Kuo, Principal Development Manager, Malware Protection Center, Microsoft Corporation, Jeff Jones, Director, Trustworthy Computing, Microsoft Corporation, and Ziv Mador, Senior Program Manager, Malware Protection Center, Microsoft Corporation • TechNet Labcast: Exchange Server 2007 (Part 2 of 5): Configuring an Edge Server and Compliance and Retention Using Exchange Server 2007 RTM (Level 200) Friday, November 14, 11:00 AM Pacific Time Jeff Sparks, Senior Consultant, United Training • Intelligent Application Gateway (IAG) Overview Wednesday, November 19, 9:00 AM Pacific Time • TechNet Webcast: Identity Lifecycle Manager "2" (Part 1 of 3): Empowering Users with Self-Service Identity Management Solutions (Level 200) Wednesday, November 19, 9:30 AM Pacific Time Brjann Brekkan, Technical Product Manager, Microsoft Corporation • TechNet Webcast: Identity Lifecycle Manager "2" (Part 2 of 3): Expressing and Enforcing Business Policy (Level 300) Wednesday, December 3, 11:30 AM Pacific Time Brjann Brekkan, Technical Product Manager, Microsoft Corporation • TechNet Webcast: Comparing LAMP to the Microsoft Web Platform (Level 200) Wednesday, December 10, 2008 8:00 AM Pacific Time Keith Combs, IT Pro Evangelist, Microsoft Corporation • TechNet Webcast: Rights Management Services in Windows Server 2008 (Level 400) Wednesday, December 10, 2008 9:30 AM Pacific Time Yung Chou, IT Pro Evangelist, Microsoft Corporation • TechNet Webcast: Information About Microsoft December Security Bulletins (Level 200) Wednesday, December 10, 2008 11:00 AM Pacific Time Christopher Budd, Security Response Communications Lead, Microsoft Corporation and Adrian Stone, Lead Security Program Manager, Microsoft Corporation • TechNet Webcast: Identity Lifecycle Manager "2" (Part 3 of 3): Extensibility and Provisioning with ILM "2" (Level 300) Wednesday, December 10, 2008 11:30 AM Pacific Time Brjann Brekkan, Technical Product Manager, Microsoft Corporation For Developers • MSDN Webcast: Windows CardSpace "Geneva" Under the Hood (Level 400) Tuesday, November 18, 2008 11:00 AM Pacific Time Dan Guberman, Program Manager, Microsoft Corporation. • MSDN Webcast: BenkoTIPS Live and On-Demand: Security Sidebars and Hacker Tricks! (Level 200) Wednesday, November 26, 2008 9:00 AM Pacific Time Mike Benkovich, Developer Evangelist, Microsoft Corporation Microsoft On-Demand Webcasts • MSDN Webcast: "Geneva" Deep Dive (Level 400) In this webcast, we examine the architecture of code name "Geneva" and how you can customize the architecture for advanced security scenarios. At the center of the discussion is the Security Token Service (STS), a core component that provides authentication and identity services. Learn how many applications benefit from an embedded STS and how many scenarios call for an STS that is built on a specialized user store. • Tech•Ed Online Tech•Talk: Adapters, Cryptography, AJAX Control Toolkit, and IIS 7 Join Robert Boedigheimer and Richard Campbell discuss areas of ASP.NET that are really useful but underused. They review some of the cool features in IIS 7 from an ASP.NET developer's perspective. • TechNet Webcast: Information Regarding an Out-of-Band Security Bulletin Release (Level 200) On October 23, Microsoft released an out-of-band security bulletin. Join us for a brief overview of the technical details of the security bulletin. Volume 5, No. 11 November 2008 In This Issue: Viewpoint Top Stories Security Guidance This Month's Security Bulletins Community / MVP Update Microsoft Product Lifecycle Information Security Events and Training Upcoming Security Webcasts Security Program Guide • Security Awareness Materials Guidance, samples, and templates for creating a security-awareness program in your organization. • Learn Security On the Job • Learning Paths for Security - Microsoft Training References and Resources Upcoming Chats • Windows Internet Explorer 8 Expert Zone Chat October 16, 10:00 AM Pacific Time • View a listing of upcoming technical chats Free In-Person Events • TechNet Events Security Blogs • Michael Howard • Eric Lippert • Eric Fitzgerald • Steve Lamb • MSRC Blog • ACE Team • Jeff Jones • Windows Vista Security • Solution Accelerators - Security & Compliance • Kai Axford • Security Vulnerability Research & Defense • Steve Riley • Security Development Lifecycle (SDL) Security Newsgroups • General Security issues/questions Open with newsreader • Virus issues/questions Open with newsreader • ISA Server Open with newsreader • Windows 2000: Security Open with newsreader • Window Vista: Security Open with newsreader • SQL Server: Security Open with newsreader • Windows Server: Security Open with newsreader • Other Security Newsgroups Community Web Sites • IT Pro Security Community • Security Newsgroups • Related Communities Additional Security Resources • Security Help and Support for IT Professionals • TechNet Troubleshooting and Support Page • Microsoft Security Glossary • TechNet Security Center • MSDN Security Developer Center • Midsize Business Security Center • Sign-Up for the Microsoft Security Notification Service • Security Bulletin Search Page • Home Users: Protect Your PC • MCSE/MCSA: Security Certifications • Subscribe to TechNet • Register for TechNet Flash IT Newsletter © 2008 Microsoft Corporation. All rights reserved. Microsoft, Forefront, MSDN, SQL Server, Visual Basic, Windows CardSpace, and Windows Server are trademarks of the Microsoft group of companies To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at http://www.microsoft.com/info/unsubscribe.htm. You can manage all your Microsoft.com communication preferences at this site. Legal Information. This newsletter was sent by the Microsoft Corporation One Microsoft Way Redmond, Washington, USA 98052 Sign up for other newsletters | Unsubscribe | Update your profile © 2008 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement