Microsoft Security Newsletter - Volume 6, Issue 10

Sign up for other newsletters | Unsubscribe | Update your profile

This is a monthly newsletter for IT professionals and developers—bringing security news, guidance, updates, and community resources directly to your inbox. To view an online version of this newsletter, click here or subscribe to the Featured Security and Privacy Content RSS feed to receive more frequent updates on news and featured resources. If you would like to receive less technical security news, guidance, and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter. Note from the Editor I'm a geek. To me, waiting these next few days for the launch of Windows 7 is like waiting for Christmas. The anticipation is almost unbearable. You see all the gifts that sit underneath the Christmas tree, but you can't open them until Christmas morning! You know it is going to be good. You've seen Kylie on TV telling you that "More Happy is Coming" … and trust me, it is. (Personally, I wish Kylie had gone into the finer points of how BitLocker To Go works on older Windows XP machines, but I digress.) You know that once we fire up the Microsoft marketing engine, everyone on the planet will have heard about Windows 7 by October 22. What I'd like to talk about this month is something that will probably not get as much as focus as the "gigantic enormous worldwide Windows launch event to beat all launch events!" No, I'm not going to spend a long time discussing the security features in Windows 7. I would love to do so, but space prevents me. Instead, I want you to understand one of the "less shiny" processes that make this a terrific operating system and that, if used properly, can help your organization as well. It's a little thing called the Microsoft Security Development Lifecycle (SDL). Microsoft has been talking to developers about this for years, and they understand the importance, but the business owners didn't give them the time to do it right. Now we're starting to see where the SDL makes sense to the decision makers as well. Want proof? Check out the Microsoft SDL: Return On Investment white paper and give these guys the time and resources to code securely! The SDL team also released some great new tools that they'll share with us in this month's Security Tip of the Month, "Using BinScope Binary Analyzer to Improve Code Security." Good stuff! Before you leave me, let me just say to my IT folks: now is the time to make the move off of Windows XP. In the past, we've had what I called the "WinXP chasm"—you wanted to move to a more secure operating system, but application compatibility kept you locked in place. After all, the business must justify the means. Windows 7 is the solution to all of that. Better drivers (many are already available) and the ability to run Windows XP in a virtual machine called Windows XP Mode on Windows 7 really helps tear down those barriers. It just works. So get to that "gigantic enormous worldwide Windows launch," check out the features, and start the migration. After all, "more happy" is just a few days away. See you at the launch party! Kai Axford, MBA, CISSP, MCSE Sr. Security Strategist, Microsoft Trustworthy Computing (TwC) http://blogs.technet.com/kaiaxford Top Stories Securing the Microsoft Cloud Infrastructure By building on the same security principles used to manage risks to Microsoft software development and operating environments, the Online Services Security and Compliance (OSSC) team at Microsoft has created an online Information Security Program—one that results in continuous improvements to security for the Microsoft cloud computing environment. Find out what cloud computing at Microsoft means today. Government Requirements for a Secure Cloud Learn about the U.S. Government's vision for cloud computing, beginning with Apps.gov, an online marketplace where federal agencies can find and purchase cloud-based IT services. Updated Payment Card Industry Data Security Standard Compliance Planning Guide Now Available Learn how to meet Payment Card Industry Data Security Standard (PCI DSS) requirements using standard Microsoft products and technologies. Security Guidance BinScope Binary Analyzer This Microsoft verification tool analyzes binaries on a project-wide level to ensure that they have been built in compliance with Microsoft Security Development Lifecycle (SDL) requirements and recommendations. MiniFuzz File Fuzzer MiniFuzz is a simple fuzzer designed to ease adoption of fuzz testing by nonsecurity people who are unfamiliar with file fuzzing tools or have never used them in their current software development processes. Security Tip of the Month: Using BinScope Binary Analyzer to Improve Code Security As software becomes more vulnerable to attacks, it is important that your team is equipped with tools that effectively help them write more secure code. Learn how to use BinScope to quickly and easily verify that your code complies with the requirements of the Microsoft SDL. Channel 9 Video: Developing and Deploying Your First Windows Azure Service Take a tour of the capabilities of the Microsoft cloud platform by building and running a simple service using the platform SDK. This demo-heavy video highlights some of the features of the platform including service management, storage, and an integrated developer experience. Windows Azure Blob: Programming Blob Storage Windows Azure Storage provides durable, scalable, available, secure, and performance-efficient storage services for the cloud, and it does this through familiar and easy-to-use programming interfaces. Windows Azure Blob provides a simple interface for storing named files along with metadata for a file. Learn about the Windows Azure Blob programming interface and the advanced blob concepts. How Do I: Use Smart Encryption Techniques for Cloud Apps? Get familiar with the encryption algorithms and practices used to create cryptographic schemes for your cloud applications. Learn more about symmetric and asymmetric encryption algorithms, the SHA256 hash encryption algorithms, and how to implement these in a simple application. Windows Azure Platform Training Kit - October Update This comprehensive set of technical content includes hands-on labs, presentations, and demos designed to help you learn how to use and develop for the Windows Azure platform including Windows Azure, SQL Azure, and .NET Services. Design Considerations for Cloud Computing: Securing the .NET Service Bus Explore ways to secure the .NET Services Bus and learn about helper classes and utilities to automate many of the details. This Month's Security Bulletins Critical: • MS09-050: Vulnerabilities in SMBv2 Could Allow Remote Code Execution (975517) • MS09-051: Vulnerabilities in Windows Media Runtime Could Allow Remote Code Execution (975682) • MS09-052: Vulnerability in Windows Media Player Could Allow Remote Code Execution (974112) • MS09-054: Cumulative Security Update for Internet Explorer (974455) • MS09-055: Cumulative Security Update of ActiveX Kill Bits (973525) • MS09-060: Vulnerabilities in Microsoft Active Template Library (ATL) ActiveX Controls for Microsoft Office Could Allow Remote Code Execution (973965) • MS09-061: Vulnerabilities in the Microsoft .NET Common Language Runtime Could Allow Remote Code Execution (974378) • MS09-062: Vulnerabilities in GDI+ Could Allow Remote Code Execution (957488) Important: • MS09-053: Vulnerabilities in FTP Service for Internet Information Services Could Allow Remote Code Execution (975254) • MS09-056: Vulnerabilities in Windows CryptoAPI Could Allow Spoofing (974571) • MS09-057: Vulnerability in Indexing Service Could Allow Remote Code Execution (969059) • MS09-058: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (971486) • MS09-059: Vulnerability in Local Security Authority Subsystem Service Could Allow Denial of Service (975467) Security Bulletin Overview for October 2009 • Microsoft Security Response Center (MSRC) Blog Post • Windows Media Video (WMV) • Windows Media Audio (WMA) • iPod Video (MP4) • MP3 Audio • High Quality WMV (2.5 Mbps) • Zune Video (WMV) The Business of Security What I Look for When Hiring IT Security Staff By Andreas Wuchner, IT Manager and Risk, Compliance, and Security Professional, Deutsche Bank In today's IT security market, more and more people are fighting for the same positions. What skills are companies looking for? How can you improve your chances and set yourself apart? From certification to communication skills, IT Manager Andreas Wuchner shares the insight he has gained from over a decade of hiring IT security and risk professionals. Coming soon... Is there a topic you would like to see us discuss? Send us an e-mail message at secaware@microsoft.com. Microsoft Product Lifecycle Information Find information about your particular products on the Microsoft Product Lifecycle Web site. • See a list of supported service packs: Microsoft provides free software updates for security and nonsecurity issues for all supported service packs. Security Events and Training Security Learning Path: Planning Security into Your Cloud Strategy Security in the cloud must marry the capabilities of the outward-looking Web (reach, customer interaction) with the inward-looking requirements (data retention, security, employee productivity) of an organization. Use this learning path to find out how to flexibly deploy an application on-premises or in the cloud, or both, and learn what you can do to help the business attain its goals of flexibility, usability, and security. The New Efficiency Learn about Windows 7 core platform security improvements at the free, live event "The New Efficiency," with sessions and demonstrations on secure messaging, secure collaboration, information protection, and identity and access management. Upcoming Security Webcasts Interactive Security Webcast Calendar Use this dynamic, interactive format to find upcoming security webcasts. For IT Professionals • TechNet Webcast: Announcing Data Protection Manager 2010 Beta (Level 300) Wednesday, October 21, 10:00 AM Pacific Time • TechNet Webcast: Improving the Wireless Network Infrastructure at Microsoft (Level 300) Tuesday, November 10, 9:30 AM Pacific Time • TechNet Webcast: Microsoft Secure Collaboration Solution (Level 200) Tuesday, October 27, 1:00 PM Pacific Time • TechNet Webcast: Thrive Live! A Technical Framework for Data Governance (Level 200) Wednesday, October 28, 9:00 AM Pacific Time • TechNet Webcast: Identity and Access Management Solution (Level 200) Thursday, October 29, 1:00 PM Pacific Time • TechNet Webcast: Microsoft Information Protection Solution (Level 200) Tuesday, November 3, 1:00 PM Pacific Time • TechNet Webcast: Technical Overview: System Center Configuration Manager 2007 SP2 and R3 (Level 200) Tuesday, November 3, 12:00 PM Pacific Time • TechNet Webcast: Microsoft Secure Messaging Solution (Level 200) Thursday, November 5, 1:00 PM Pacific Time • TechNet Webcast: Microsoft Secure Endpoint Solution (Level 200) Tuesday, November 10, 12:00 PM Pacific Time • TechNet Webcast: Information About Microsoft November Security Bulletins (Level 200) Wednesday, November 11, 11:00 AM Pacific Time For Developers • MSDN Webcast: Overview of Communication Patterns Supported by the .NET Service Bus (Level 200) Tuesday, October 20, 11:00 AM Pacific Time Now On Demand • TechNet Webcast: Securing Virtual Environments (Level 300) Learn how to keep offline virtualized servers up to date and safe from attack. Volume 6, No. 10 October 2009 In This Issue: Top Stories Security Guidance This Month's Security Bulletins The Business of Security Microsoft Product Lifecycle Information Security Events and Training Upcoming Security Webcasts Security Program Guide • Microsoft SDL – Developer Starter Kit • Security Awareness Materials • Learn Security on the Job • Learning Paths for Security – Microsoft Training References and Resources Upcoming Chats • View a listing of upcoming technical chats Security Blogs • Trustworthy Computing Security/Privacy Blogs • Michael Howard • Eric Lippert • Eric Fitzgerald • MSRC Blog • ACE Team • Windows Security • Solution Accelerators - Security & Compliance • Kai Axford • Security Vulnerability Research & Defense • Security Development Lifecycle (SDL) Security Newsgroups • General Security issues/questions Open with newsreader • Virus issues/questions Open with newsreader • ISA Server Open with newsreader • Window Vista: Security Open with newsreader • SQL Server: Security Open with newsreader • Windows Server: Security Open with newsreader Community Web Sites • IT Pro Security Community Additional Security Resources • Security Help and Support for IT Professionals • TechNet Troubleshooting and Support Page • Microsoft Security Glossary • Security TechCenter • MSDN Security Developer Center • Sign-Up for the Microsoft Security Notification Service • Security Bulletin Search Page • Home Users: Protect Your PC • MCSE/MCSA: Security Certifications • Subscribe to TechNet • Register for TechNet Flash IT Newsletter © 2009 Microsoft Corporation. All rights reserved. Microsoft, Azure, BitLocker, BitLocker To Go, MSDN, SQL Server, Windows, Windows Media, Windows Server, and Zune are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. To cancel your subscription to this newsletter, reply to this message with the word UNSUBSCRIBE in the Subject line. You can also unsubscribe at http://www.microsoft.com/info/unsubscribe.htm. You can manage all your Microsoft.com communication preferences at this site. Legal Information. This newsletter was sent by the Microsoft Corporation One Microsoft Way Redmond, Washington, USA 98052 Sign up for other newsletters | Unsubscribe | Update your profile © 2009 Microsoft Corporation Terms of Use | Trademarks | Privacy Statement