Microsoft Security Newsletter - Volume 6, Issue 11

Sign up for other newsletters | Unsubscribe | Update your profile

This is a monthly newsletter for IT professionals and developers—bringing security news, guidance, updates, and community resources directly to your inbox. To view an online version of this newsletter, click here or subscribe to the Featured Security and Privacy Content RSS feed to receive more frequent updates on news and featured resources. If you would like to receive less technical security news, guidance, and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter. Note from the Editor I'm guessing you have Windows 7 loaded up by now and have been playing with it for some time. You've overcome the technical hurdle of explaining to your spouse (kids, grandparents, in-laws, etc.) the reason why you and they made the upgrade to Windows 7. Good times. But we all know where the REAL action is…it's in "Big Iron." The server. The infrastructure. That beast that hums with so much pure power it makes you stand back and stare in awe. Why run a laptop with a pitiful 2GB of RAM when you can fire up a massive rack of servers with enough horsepower to run the entire business or government? Your infrastructure guys are in the process of upgrading to Windows Server 2008 R2, and I can't blame them -- it's sweetness in the server room. One of the things I'm particularly fond of in Windows Server 2008 R2 is DirectAccess. Very few things will dramatically change the way you do your security job. This is one of them. Think about the advantages of having all the machines in your domain, connected to the domain, 24/7/365, securely…all without ever having to fire up a VPN client! Users love it because they don't have to open up a separate connection to view an internal site; the help desk loves it because they don't have to troubleshoot a VPN client over the phone with the sales person in Pocatello; and the security guy likes it because he or she is able to push down new A/V signatures and software updates as needed, without having to wait for the sales person to return to the office. Not to mention all IP traffic is routed through proxies, which means outbound traffic rules still work. "But Kai, what about my SSL gateways, my perimeter firewalls, and the fact that I'm running Network Access Protection (NAP)? Heck, I even implemented Server Domain Isolation last year!" My friends, it's okay. You can still continue to use all of these great things; we're just changing the way the traffic comes into your network. Think of DirectAccess as a 5,000 mile/kilometer CAT-5 cable. Plug it into the corporate network. If your users are connected to the Internet, they are connected to you, regardless of physical location. The DirectAccess Design and Deployment Guides can provide more details as to how to implement this in your environment. One last thing. As some of you may know, I'm passionate about protecting children online. At the end of the day, as we leave the office and head home, we are parents, we are uncles, we are aunts, we are grandparents. Everyone knows a child who would benefit from the knowledge you have about Internet safety. Kids really do think that "nothing bad can happen to them" on the Internet, and you can help educate them. I would encourage each of you to take a moment and head over to the Microsoft Consumer Online Safety Education site and share these videos, tools, and techniques with a child today. Have a great November! Kai Axford, MBA, CISSP, MCSE http://blogs.technet.com/kaiaxford Top Stories Microsoft Report Reveals Resurgence of Worms; Rogue Security Software Still Top Threat On November 2, Microsoft released the seventh volume of the Microsoft Security Intelligence Report (SIRv7), which indicates that worm infections in the enterprise rose by nearly 100 percent during the first half of 2009 over the preceding six months. Rogue security software remains a major threat to customers; however, 20 percent fewer customers were affected by rogue infections during the past six months. Gain a quick summary of the report's findings, and then read the full report for more detailed information. Forefront Threat Management Gateway 2010 Release Candidate Now Available Allow employees to safely and productively use the Internet for business without worrying about malware and other threats. Forefront Threat Management Gateway provides multiple layers of continuously updated protections -- including URL filtering, antimalware inspection, intrusion prevention, application- and network-layer firewall, and HTTP/HTTPS inspection. All of these protections are integrated into a unified, easy-to-manage gateway, reducing the cost and complexity of Web security Update Your Microsoft Forefront and Antigen Engine Configuration by December 1 As announced in July, Microsoft is revising its engine mix on December 1 for Forefront and Antigen products that customers can use to help optimize detection, but that also allow Microsoft to invest in new areas for increasing overall protection for customers. Learn more about the changes, including product-specific instructions, on the Antimalware Engine Notifications and Developments site. Cloudmark Antispam Engine Released Now you can experience even greater antispam support with the Cloudmark Antispam Engine, just released from beta after having undergone extensive internal testing and customer trials. The Cloudmark antispam engine provides a better than 99 percent detection rate and less than 1 in 250,000 false positives (West Coast Labs). It replaces the Mail-Filters SpamCure antispam engine, set to retire on December 1. Be sure to upgrade to the latest service pack releases before December 1 to continue your antispam defenses and have access to the new Cloudmark engine. Update on Antigen 8.0 EOL and Engine Revision Make sure you're up to date on Antigen 8.0 end-of-life plans and associated engine revisions, including information on upcoming engine changes occurring later this year and what you need to know in order to maintain continued security protection. Security Guidance Security Tip of the Month: Top Five Security-Related Group Policy Settings In this article, Microsoft Group Policy MVP Jeremy Moskowitz takes a look at five policy setting areas and shows you how they can deliver settings you might use to help make your world more secure. What's New in Windows Security Auditing in Windows Server 2008 R2 Learn about the enhancements in Windows Server 2008 R2 and Windows 7 that increase the level of detail in security-auditing logs and simplify the deployment and management of auditing policies. What's New in Group Policy Learn about the changes available in Windows Server 2008 R2 with Remote Server Administration Tools (RSAT), from the ability to manage Group Policy from the Windows PowerShell command line to additional types of Group Policy preferences and improvements to starter Group Policy Objects (GPOs). Using Windows Server 2008: Controlling Communication with the Internet This white paper provides information about the communication that flows between features in Windows Server 2008 and sites on the Internet, and it describes steps to take to limit, control, or prevent that communication in an organization with many users. Windows Server 2008 Security Compliance Management Toolkit Get the guidance and tools you need to help you efficiently create, deploy, and maintain a secure environment for a variety of servers running Windows Server 2008. Infrastructure Planning and Design (IPD) Guide for DirectAccess This guide provides actionable guidance for designing a DirectAccess infrastructure. The guide's easy-to-follow, four-step process gives a straightforward explanation of the infrastructure required for clients to be connected from the Internet to resources on the corporate network, whether or not the organization has begun deploying IPv6. Server Security Policy Management in Windows Server 2008 There are many tools in Windows Server 2008 that you can use to help keep your computers secure. This discussion focuses on three tools that you can use alone or together to manage the security policies on your servers: the Security Configuration Wizard (SCW) and the Scwcmd command-line tool, the Security Templates snap-in, and the Security Configuration and Analysis snap-in. Security Audit Events for Windows 7 and Windows Server 2008 R2 You can use Windows security and system logs to record and store collected security events so that you can track key system and network activities to monitor potentially harmful behaviors and to mitigate those risks. The information in this download can help you analyze the data included in event-log data. Microsoft Security Development Lifecycle (SDL) for Agile Development Download the latest SDL process guidance, which includes SDL for agile development, a streamlined approach that melds agile methods and security. Microsoft Forefront Security for Office Communications Server Best Practices Analyzer Microsoft has released the Forefront Security for Office Communications Server Best Practices Analyzer (BPA) to help you maximize your configuration settings. The BPA compares your existing Forefront Security for Office Communications Server deployment with recommended best practices to identify configuration setting changes that could help you improve FSOCS performance and malware detection rates. Benefits of Regulatory Requirements with Respect to Business Optimization Gain an understanding of IT infrastructure security compliance and the benefits that an IT infrastructure compliance maturity model can provide to management and compliance and IT stakeholders as well as to the business at large. This Month's Security Bulletins Critical: • MS09-063: Vulnerability in Web Services on Devices API Could Allow Remote Code Execution (973565) • MS09-064: Vulnerability in License Logging Server Could Allow Remote Code Execution (974783) • MS09-065: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947) Important: • MS09-066: Vulnerability in Active Directory Could Allow Denial of Service (973309) • MS09-067: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652) • MS09-068: Vulnerability in Microsoft Office Word Could Allow Remote Code Execution (976307) Security Bulletin Overview for November 2009 • Microsoft Security Response Center (MSRC) Blog Post • Windows Media Video (WMV) • Windows Media Audio (WMA) • iPod Video (MP4) • MP3 Audio • High Quality WMV (2.5 Mbps) • Zune Video (WMV) Microsoft Product Lifecycle Information Find information about your particular products on the Microsoft Product Lifecycle Web site. • See a list of supported service packs: Microsoft provides free software updates for security and nonsecurity issues for all supported service packs. Security Events and Training Direct Access and Unified Access Gateway: Deep Dive Dive deep into Unified Access Gateway (UAG) with Direct Access with Microsoft Program Managers Ben Bernstein and Stephen Bowie. Learn how UAG supports legacy IPv4 clients and how the client knows to connect to the proper DNS server -- and much more. Course 6407B: First Look: Getting Started with Security and Policy Control in Windows Server 2008 Hands-On Lab This one and one-half hour lab provides hands-on experience with the following security and policy enforcement functionality in Windows Server 2008: Security Enhancements in Windows Server 2008 and Network Access Protection in Windows Server 2008. Course 50255A: Managing, Maintaining, and Securing Your Networks Through Group Policy In this course, you will learn to control and manage computer systems and domain users running Windows Server 2003, Windows Server 2008, Windows XP, and Windows Vista. You will learn to create Group Policies, implement administrative and security templates, and determine best practices when deploying software packages. Walk away with the experience and tools you need to optimize your enterprise systems and networks. Upcoming Security Webcasts • Identity & Security in Challenging Economic Times Friday, November 13, 9:00 AM Central Time • Microsoft Software+Services Webcast: Computing in the Cloud Overview Wednesday, November 18, 10:00 AM Pacific Time • Momentum Webcast: Security and Reliability in the Cloud -- A Microsoft Online Services Perspective (Level 100) Wednesday, December 9, 11:00 AM Pacific Time Interactive Security Webcast Calendar Upcoming security webcasts in a dynamic, interactive format. For IT Professionals • TechNet Webcast: Technical Overview: System Center Configuration Manager 2007 SP2 and R3 (Level 200) Tuesday, November 24, 10:00 AM Pacific Time • TechNet Webcast: Information About Microsoft December Security Bulletins (Level 300) Wednesday, December 9, 11:00 AM Pacific Time For Developers • MSDN Webcast: Real-World Solutions: Project Server Security in SQL Server Reporting Services (Level 300) Tuesday, November 24, 1:00 PM Pacific Time Now On Demand • TechNet Webcast: How Microsoft IT Managed Windows Server 2008 Network Security (Level 300) Discover the networking advancements and policy-driven network security features in Windows Server 2008. • TechNet Webcast: Windows Network Policy Server Fundamentals (Level 300) Learn how to deploy and configure NAP, how it works, and how it employs NPS. And then move to learning how to enable debug tracing, and how it can be used for monitoring and troubleshooting connectivity problems. • TechNet Webcast: Hardening Windows Server 2008 Deployments with the Windows Server 2008 Security Guide (Level 300) Attend this session to learn how the Windows Server 2008 Security Guide can help you keep networks and servers safe from attack. See a live demonstration of best practices, thoroughly tested security configurations, and automated tools that speed your deployments by up to 80 percent! Volume 6, No. 11 November 2009 In This Issue: Top Stories Security Guidance This Month's Security Bulletins Microsoft Product Lifecycle Information Security Events and Training Upcoming Security Webcasts Security Program Guide • Microsoft SDL – Developer Starter Kit • Security Awareness Materials • Learn Security on the Job • Learning Paths for Security – Microsoft Training References and Resources Upcoming Chats • View a listing of upcoming technical chats Security Blogs • Trustworthy Computing Security/Privacy Blogs • Michael Howard • Eric Lippert • Eric Fitzgerald • MSRC Blog • ACE Team • Windows Security • Solution Accelerators - Security & Compliance • Kai Axford • Security Vulnerability Research & Defense • Security Development Lifecycle (SDL) Security Newsgroups • General Security issues/questions Open with newsreader • Virus issues/questions Open with newsreader • ISA Server Open with newsreader • Window Vista: Security Open with newsreader • SQL Server: Security Open with newsreader • Windows Server: Security Open with newsreader Community Web Sites • IT Pro Security Community Additional Security Resources • Security Help and Support for IT Professionals • TechNet Troubleshooting and Support Page • Microsoft Security Glossary • TechNet Security Center • MSDN Security Developer Center • Sign-Up for the Microsoft Security Notification Service • Security Bulletin Search Page • Home Users: Protect Your PC • MCSE/MCSA: Security Certifications • Subscribe to TechNet • Register for TechNet Flash IT Newsletter © 2009 Microsoft Corporation. All rights reserved. Microsoft, Forefront, MSDN, PowerShell, SQL Server, Windows, Windows Media, Windows Server, Windows Vista, and Zune are trademarks of the Microsoft group of companies. To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at http://www.microsoft.com/info/unsubscribe.htm. You can manage all your Microsoft.com communication preferences at this site. Legal Information. This newsletter was sent by the Microsoft Corporation One Microsoft Way Redmond, Washington, USA 98052 Sign up for other newsletters | Unsubscribe | Update your profile © 2009 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement