Thursday, September 23, 2010

Microsoft Security Newsletter - September 2010


NOTE FROM THE EDITOR

Tim Rains Welcome to September's Security Newsletter! In the newsletter this month you'll find plenty of content and information on virtualization. Patch management and compliance management in a virtual environment are topics that many IT professionals are interested in today. The flexibility virtual machines provide, bringing them online when and where you need to, can make it challenging to ensure all those virtual machines are in compliance with your current IT policy. Keeping virtual machines offline for extended periods almost guarantees that they will be out of compliance the next time they are brought online. Ensuring that even offline virtual machines are kept up to date with the latest security updates for the operating system (OS) and all applications, as well as the latest antimalware signatures could help avoid costly security exposures in your environment.

The Offline Virtual Machine Servicing Tool, a free Solution Accelerator from Microsoft, provides a way to automate the process of updating virtual machines. While you are at it, as part of your security and compliancy strategy, check out the Hyper-V Security Guide. If you'd rather watch a webcast on Hyper-V, check out our 300 level-webcast on Security Best Practices for Hyper-V and Server Virtualization.

You'll find even more information on virtualization in the newsletter below.

Best regards,
Tim Rains, Group Product Manager, Microsoft Trustworthy Computing

Follow the Microsoft Security Response team on Twitter @MSFTSecResponse for the latest information on the threat landscape.



A Fun Way to Get Started Threat Modeling: The Elevation of Privilege (EoP) Card Game
Threat modeling is a core component of the design phase in the Microsoft Security Development Lifecycle (SDL). The EoP card game helps clarify the details of threat modeling and examines possible threats to software and computer systems such as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.


September 2010 Edition

IN THIS ISSUE

•  Top Stories
•  Security Guidance
•  Community/MVP Update
•  Cloud Security Corner
•  This Month's Security Bulletins
•  Microsoft Product Lifecycle Information
•  Security Events and Training
•  Upcoming Security Webcasts
SECURITY PROGRAM GUIDE

•  Microsoft SDL - Developer Starter Kit
•  Security Awareness Materials
•  Learn Security On the Job
•  Learning Paths for Security -Microsoft Training References and Resources

Security Tip of the Month: Post aVirtualiptica - Addressing Incidents in a Virtual Environment
Explore some of the tools, techniques, and processes involved in obtaining information about your virtual machines and addressing an incident.

Virtual Domains in Forefront Online Protection for Exchange
This video will show you how to create and configure virtual domains within Forefront Online Protection for Exchange to provide different filtering settings for a particular group of users, specify a different mail delivery location for a subset of users, and to rewrite recipients' email address based on the needs of your organization.

Planning for Security and Protection for Microsoft Application Virtualization (App-V)
Security for an App-V system relies on proper setup of the software and the environment in which it operates. Get guidance on how to configure the various App-V components to enhance the security of your environment at the client, server, and sequencer level.

Microsoft App-V Security Guide
This guide introduces you to important information about deployment decisions that can affect the security of your system. It also provides you with the necessary steps to configure App-V security settings to enhance the security of your environment. If the security settings are specific to Windows but not to App-V, the documentation includes the appropriate links to additional information.

Planning for Hyper-V Security
You should secure your virtualization server using the same measures you would take to safeguard any server running Windows Server 2008. This article discusses those measures plus a few extra to help secure virtual machines, configuration files, and data.

Hyper-V Security Guide
Elevate the security of virtualized Windows Server environments to address your business-critical needs. This guide provides instruction on how to harden Hyper-V, delegate virtual machine management, and protect virtual machines.

Secure Remote Desktop Services (RDS) Connections with SSL
By default, RD Session Host sessions use native RDP encryption. However, RDP does not provide authentication to verify the identity of an RD Session Host server. Learn how you can enhance the security of RD Session Host sessions by using Secure Sockets Layer (SSL) Transport Layer Security (TLS 1.0) for server authentication and to encrypt RD Session Host communications.

A Guide to Data Governance for Privacy, Confidentiality and Compliance Part 5: Moving to Cloud Computing
Maintaining the privacy and confidentiality of data, as well as meeting the requirements of a growing list of related compliance obligations, are top concerns for government organizations and enterprises alike. Looking ahead to the coming decade, we can see that cloud computing will likely magnify these concerns. Learn how data governance challenges change when organizations opt to use cloud-based services, and how the framework and techniques presented in Part 3 of the guide "Managing Technological Risk" can be applied in this new context.

Active Directory Federation Services 2.0: Open Doors to the Cloud
By Jeffrey Schwartz, Editor at Larger, Redmond Magazine
Learn how the new Microsoft Active Directory Federation Services release promises to up the ante on cloud security.

Security Talk Series - Cloud Computing Webcasts
Gain insight and prescriptive guidance on a range of cloud security issues from overviews of Windows Azure security to deep dives into Azure federated identity security using ADFS 2.0.

Security in Provisioning and Billing Solutions for Windows Azure Platform
Gain an in-depth overview of the security aspects associated with development against Service Management API (SMAPI) and MOCP, within the context of Cloud Provisioning & Billing (CPB) solution. CPB abstracts and merges operations of MOCP and Windows Azure portals, providing value-add features necessary for cloud resource resellers and cloud ISVs. CPB is primarily targeted at service providers wanting to sell Windows Azure services and resources in combination with their own, and application vendors wanting to give their customers an ability to customize their applications before they get deployed to Windows Azure.

Critical:
• MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290)
• MS10-062: Vulnerability in MPEG-4 Codec Could Allow Remote Code Execution (975558)
• MS10-063: Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution (2320113)
• MS10-064: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2315011)

Important:
• MS10-065: Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960)
• MS10-066: Vulnerability in Remote Procedure Call Could Allow Remote Code Execution (982802)
• MS10-067: Vulnerability in WordPad Text Converters Could Allow Remote Code Execution (2259922)
• MS10-068: Vulnerability in Local Security Authority Subsystem Service Could Allow Elevation of Privilege (983539)
• MS10-069: Vulnerability in Windows Client/Server Runtime Subsystem Could Allow Elevation of Privilege (2121546)

Security Bulletin Overview for September 2010
SECURITY BLOGS

•  Trustworthy Computing Security/Privacy Blogs RSS
•  Michael Howard RSS
•  Eric Lippert RSS
•  Windows auditing team RSS
•  MSRC Blog RSS
•  ACE Team RSS
•  Windows Security RSS
•  Forefront Team RSS
•  Solution Accelerators - Security & Compliance RSS
•  Security Research & Defense RSS
•  Security Development Lifecycle (SDL) RSS
UPCOMING CHATS

•  View a listing of upcoming technical chats
COMMUNITY WEBSITES

•  IT Pro Security Community
ADDITIONAL SECURITY RESOURCES

•  Security Help and Support for IT Professionals
•  TechNet Troubleshooting and Support Page
•  Microsoft Security Glossary
•  TechNet Security Center
•  MSDN Security Developer Center
•  Sign-Up for the Microsoft Security Notification Service
•  Security Bulletin Search Page
•  Microsoft Security Center
•  Home Users: Protect Your PC
•  MCSE/MCSA: Security Certifications
•  Subscribe to TechNet
•  Register for TechNet Flash IT Newsletter

Find information about your particular products on the Microsoft Product Lifecycle Web site.

MSDN Simulcast Event: Windows Phone 7 Developer Launch: Jump-Start Your Mobile Development
Tuesday, October 12, 2010 8:45 AM Pacific Time - 2:00 PM Pacific Time
Learn how to develop applications for the Windows Phone 7 platform, and develop them with security in mind. This event will take you under the hood of Windows Phone 7 and the Windows Phone 7 platform with a progressive set of learning sessions. We'll start with the basic tools and fundamentals of Windows Phone 7 application development, plus key design guidelines and our philosophy behind the all-new Metro interface paradigm. As the day unfolds, we'll go deeper into Windows Phone 7 development scenarios using Silverlight, XNA and the Windows Phone 7 SDK. You'll also see how to earn cash for your apps in the fully loaded Windows Phone 7 Marketplace.

For Decision Makers For IT Professionals
Interactive Security Webcast Calendar
Upcoming security webcasts in a dynamic, interactive format.




This is a monthly newsletter for IT professionals and developers-bringing security news, guidance, updates, and community resources directly to your inbox. If you would like to receive less technical security news, guidance, and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter.

© 2010 Microsoft Corporation. All rights reserved. Microsoft, MSDN, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at http://www.microsoft.com/info/unsubscribe.htm. You can manage all your Microsoft.com communication preferences at this site.

Legal Information.

This newsletter was sent by the Microsoft Corporation
One Microsoft Way
Redmond, WA, 98052, USA





Sign up for this newsletter | Unsubscribe | Update your profile
© 2010 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement
 

Your cOmment"s Here! Hover Your cUrsOr to leave a cOmment.


Subscribe to: Post Comments (Atom)