 | In a new report we just released called The SDL Progress Report, we tested the 41 most popular consumer applications running on Windows to see if they were taking advantage of the security mitigations built into the platform. The news is mixed: while 71% of the applications surveyed fully enabled support for Data Execution Prevention (DEP), only 34% of the applications fully enabled support for Address space layout randomization (ASLR). These are important exploit mitigations that can be valuable tools in helping to mitigate risks posed by both known and unknown vulnerabilities. Please check out the report and draw your own conclusions.
Another useful new piece of content is the second edition of the Microsoft Security Update Guide. The big delta between the second edition of the Security Update Guide and the first edition is the inclusion of a bunch of guidance on how to test security updates before deploying them. This includes guidance from Microsoft internal practices as well as guidance from customers that have solid test processes. This is something many people have asked us for over the years.
Best regards,
Tim Rains, Director, Product Management, Microsoft Trustworthy Computing
Follow the Microsoft Security Response team on Twitter @MSFTSecResponse for the latest information on the threat landscape.
 | |
Security Tip of the Month: 5 Security Tips for Windows Intune
Learn how to use Attack Surface Analyzer, a free tool from Microsoft, to better understand the aggregate attack surface change that may result from the introduction of line-of-business (LOB) applications to the Windows platform.
| Microsoft Security Update Guide, Second Edition
The Microsoft Security Update Guide Second Edition is a valuable source of in-depth information and guidance that helps IT professionals deploy Microsoft security updates and create a safer, more secure computing and Internet environment.
| Windows Security Survival Guide
Many companies invest a good amount of money trying to protect their resources by adding more software to provide additional layers of protection, and by enhancing policies and procedures to enforce security. Get a better understanding of the core principles of Windows Security and how to take advantage of Windows operating system security capabilities to achieve your company's security goals.
| Security and Compliance in the Cloud, Part 1
Join Jim Reavis of the Cloud Security Alliance, Pete Boden of Microsoft and Allan A. Friedman of the Brookings Institution to see what you need to consider as you move to data and applications to the cloud. Watch Part 2 of the discussion for additional insights and tips for organizations of all sizes.
| Windows Azure: Understanding Security Account Management in Windows Azure
Cloud computing relieves some of the security burden, but you still have an active role in managing access, securing communications and ensuring data protection. Learn what you need to know about account management, certificate management, and employee transitions.
| SQL Server: Protect Data at All Costs
Maintaining high availability to corporate data stores managed with SQL Server is an essential element of any data management strategy. Get tips on how to work through the requirements and limitations, align your strategy to those requirements, and test the effectiveness of your approach.
| | |  |  | |
 Security MVP Spotlight: Denis Batrankov
Enterprise Security MVP Denis Batrankov has worked in the security industry for 18 years, starting as a programmer and security administrator and eventually landing in his current role as Solution Architect for HP TippingPoint. Denis specializes in practical ways to protect corporate IT systems against emerging IT threats and enjoys delivering information about the various tools available to today's IT professional from firewalls and intrusion prevention systems to security scanners, deep packet inspections, and Web filtering.
From Denis Batrankov: - Why Now is the Time to Review Corporate Email Security
Many IT professional assume that internal employees use corporate email to do their jobs. But is this a reality? This article explores considerations that can help you keep corporate email effective and help maintain safe email habits for your employees and your customers or partners. |  Security MVP Spotlight: Miha Pihler
Miha Pihler (MCSE, MCT, CISSP) currently works as independent Security Consultant. Pihler has many years of experience in security field and holds many of the most prestigious qualifications. He is a respected and recognized speaker with a wealth of experience. He has worked on the deployment of firewalls for some of the largest organizations in Slovenia, set up of public key infrastructure (PKI) and designed secure authentication systems.
From Miha Pihler: - Simple Firewall Best Practices for Small and Midsize Businesses
All servers require regular maintenance, and their firewalls are no exception. Firewalls involve daily maintenance tasks such as reviewing logs, checking for any alerts, and changing policies—and less frequent tasks such as reviewing policies. Explore several important considerations as well as suggested best practices for effectively maintaining firewalls. | | | | | | |  | | ADDITIONAL SECURITY RESOURCES
| |  | |
Welcome to April's Security Newsletter. 
