Microsoft Security Newsletter - September 2010

	NOTE FROM THE EDITOR Welcome to September's Security Newsletter! In the newsletter this month you'll find plenty of content and information on virtualization. Patch management and compliance management in a virtual environment are topics that many IT professionals are interested in today. The flexibility virtual machines provide, bringing them online when and where you need to, can make it challenging to ensure all those virtual machines are in compliance with your current IT policy. Keeping virtual machines offline for extended periods almost guarantees that they will be out of compliance the next time they are brought online. Ensuring that even offline virtual machines are kept up to date with the latest security updates for the operating system (OS) and all applications, as well as the latest antimalware signatures could help avoid costly security exposures in your environment. The Offline Virtual Machine Servicing Tool, a free Solution Accelerator from Microsoft, provides a way to automate the process of updating virtual machines. While you are at it, as part of your security and compliancy strategy, check out the Hyper-V Security Guide. If you'd rather watch a webcast on Hyper-V, check out our 300 level-webcast on Security Best Practices for Hyper-V and Server Virtualization. You'll find even more information on virtualization in the newsletter below. Best regards, Tim Rains, Group Product Manager, Microsoft Trustworthy Computing Follow the Microsoft Security Response team on Twitter @MSFTSecResponse for the latest information on the threat landscape. A Fun Way to Get Started Threat Modeling: The Elevation of Privilege (EoP) Card Game Threat modeling is a core component of the design phase in the Microsoft Security Development Lifecycle (SDL). The EoP card game helps clarify the details of threat modeling and examines possible threats to software and computer systems such as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. September 2010 Edition IN THIS ISSUE •  Top Stories •  Security Guidance •  Community/MVP Update •  Cloud Security Corner •  This Month's Security Bulletins •  Microsoft Product Lifecycle Information •  Security Events and Training •  Upcoming Security Webcasts SECURITY PROGRAM GUIDE •  Microsoft SDL - Developer Starter Kit •  Security Awareness Materials •  Learn Security On the Job •  Learning Paths for Security -Microsoft Training References and Resources

Security Tip of the Month: Post aVirtualiptica - Addressing Incidents in a Virtual Environment Explore some of the tools, techniques, and processes involved in obtaining information about your virtual machines and addressing an incident. Virtual Domains in Forefront Online Protection for Exchange This video will show you how to create and configure virtual domains within Forefront Online Protection for Exchange to provide different filtering settings for a particular group of users, specify a different mail delivery location for a subset of users, and to rewrite recipients' email address based on the needs of your organization. Planning for Security and Protection for Microsoft Application Virtualization (App-V) Security for an App-V system relies on proper setup of the software and the environment in which it operates. Get guidance on how to configure the various App-V components to enhance the security of your environment at the client, server, and sequencer level. Microsoft App-V Security Guide This guide introduces you to important information about deployment decisions that can affect the security of your system. It also provides you with the necessary steps to configure App-V security settings to enhance the security of your environment. If the security settings are specific to Windows but not to App-V, the documentation includes the appropriate links to additional information. Planning for Hyper-V Security You should secure your virtualization server using the same measures you would take to safeguard any server running Windows Server 2008. This article discusses those measures plus a few extra to help secure virtual machines, configuration files, and data. Hyper-V Security Guide Elevate the security of virtualized Windows Server environments to address your business-critical needs. This guide provides instruction on how to harden Hyper-V, delegate virtual machine management, and protect virtual machines. Secure Remote Desktop Services (RDS) Connections with SSL By default, RD Session Host sessions use native RDP encryption. However, RDP does not provide authentication to verify the identity of an RD Session Host server. Learn how you can enhance the security of RD Session Host sessions by using Secure Sockets Layer (SSL) Transport Layer Security (TLS 1.0) for server authentication and to encrypt RD Session Host communications. A Guide to Data Governance for Privacy, Confidentiality and Compliance Part 5: Moving to Cloud Computing Maintaining the privacy and confidentiality of data, as well as meeting the requirements of a growing list of related compliance obligations, are top concerns for government organizations and enterprises alike. Looking ahead to the coming decade, we can see that cloud computing will likely magnify these concerns. Learn how data governance challenges change when organizations opt to use cloud-based services, and how the framework and techniques presented in Part 3 of the guide "Managing Technological Risk" can be applied in this new context. Active Directory Federation Services 2.0: Open Doors to the Cloud By Jeffrey Schwartz, Editor at Larger, Redmond Magazine Learn how the new Microsoft Active Directory Federation Services release promises to up the ante on cloud security. Security Talk Series - Cloud Computing Webcasts Gain insight and prescriptive guidance on a range of cloud security issues from overviews of Windows Azure security to deep dives into Azure federated identity security using ADFS 2.0. Security in Provisioning and Billing Solutions for Windows Azure Platform Gain an in-depth overview of the security aspects associated with development against Service Management API (SMAPI) and MOCP, within the context of Cloud Provisioning & Billing (CPB) solution. CPB abstracts and merges operations of MOCP and Windows Azure portals, providing value-add features necessary for cloud resource resellers and cloud ISVs. CPB is primarily targeted at service providers wanting to sell Windows Azure services and resources in combination with their own, and application vendors wanting to give their customers an ability to customize their applications before they get deployed to Windows Azure. Critical: • MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) • MS10-062: Vulnerability in MPEG-4 Codec Could Allow Remote Code Execution (975558) • MS10-063: Vulnerability in Unicode Scripts Processor Could Allow Remote Code Execution (2320113) • MS10-064: Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (2315011) Important: • MS10-065: Vulnerabilities in Microsoft Internet Information Services (IIS) Could Allow Remote Code Execution (2267960) • MS10-066: Vulnerability in Remote Procedure Call Could Allow Remote Code Execution (982802) • MS10-067: Vulnerability in WordPad Text Converters Could Allow Remote Code Execution (2259922) • MS10-068: Vulnerability in Local Security Authority Subsystem Service Could Allow Elevation of Privilege (983539) • MS10-069: Vulnerability in Windows Client/Server Runtime Subsystem Could Allow Elevation of Privilege (2121546) Security Bulletin Overview for September 2010 Microsoft Security Response Center (MSRC) Blog Post SECURITY BLOGS •  Trustworthy Computing Security/Privacy Blogs  •  Michael Howard  •  Eric Lippert  •  Windows auditing team  •  MSRC Blog  •  ACE Team  •  Windows Security  •  Forefront Team  •  Solution Accelerators - Security & Compliance  •  Security Research & Defense  •  Security Development Lifecycle (SDL)  UPCOMING CHATS •  View a listing of upcoming technical chats COMMUNITY WEBSITES •  IT Pro Security Community ADDITIONAL SECURITY RESOURCES •  Security Help and Support for IT Professionals •  TechNet Troubleshooting and Support Page •  Microsoft Security Glossary •  TechNet Security Center •  MSDN Security Developer Center •  Sign-Up for the Microsoft Security Notification Service •  Security Bulletin Search Page •  Microsoft Security Center •  Home Users: Protect Your PC •  MCSE/MCSA: Security Certifications •  Subscribe to TechNet •  Register for TechNet Flash IT Newsletter

Find information about your particular products on the Microsoft Product Lifecycle Web site. See a List of Supported Service Packs: Microsoft provides free software updates for security and non-security issues for all supported service packs. MSDN Simulcast Event: Windows Phone 7 Developer Launch: Jump-Start Your Mobile Development Tuesday, October 12, 2010 8:45 AM Pacific Time - 2:00 PM Pacific Time Learn how to develop applications for the Windows Phone 7 platform, and develop them with security in mind. This event will take you under the hood of Windows Phone 7 and the Windows Phone 7 platform with a progressive set of learning sessions. We'll start with the basic tools and fundamentals of Windows Phone 7 application development, plus key design guidelines and our philosophy behind the all-new Metro interface paradigm. As the day unfolds, we'll go deeper into Windows Phone 7 development scenarios using Silverlight, XNA and the Windows Phone 7 SDK. You'll also see how to earn cash for your apps in the fully loaded Windows Phone 7 Marketplace. For Decision Makers Business Insights Webcast: Desktop Lockdown: Securing Endpoints with Microsoft Security Products (Level 100) Wednesday, October 06, 2010 11:00 AM Pacific Time For IT Professionals TechNet Webcast: Information About Microsoft October Security Bulletins (Level 200) Wednesday, October 13, 2010 11:00 AM Pacific Time Interactive Security Webcast Calendar Upcoming security webcasts in a dynamic, interactive format.

This is a monthly newsletter for IT professionals and developers-bringing security news, guidance, updates, and community resources directly to your inbox. If you would like to receive less technical security news, guidance, and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter. © 2010 Microsoft Corporation. All rights reserved. Microsoft, MSDN, Windows, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at http://www.microsoft.com/info/unsubscribe.htm. You can manage all your Microsoft.com communication preferences at this site. Legal Information. This newsletter was sent by the Microsoft Corporation One Microsoft Way Redmond, WA, 98052, USA

Sign up for this newsletter | Unsubscribe | Update your profile © 2010 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement