Microsoft Advisory Summaries

Microsoft Security Bulletins Summary - March 2005

This is the first month in years that looks as though it will be security bulletin free for Microsoft. That is rather amazing for a set of products that are as broad and far reaching as the Redmond software giant's. It's a good time to reflect on the recent groups of patches (coming off of 12 bulletins and an updated bulletin in February 2005) and how well your organization has done mitigating the numerous flaws discovered in the OS, Internet Explorer, and related products. 

Configuration Management (CM) has been documented extensively and extends well beyond any Microsoft products in the network. Within infectionvectors.com, the use of CM practices extends to various stages of the malware defense plan, including:

-Implementing a Malcode Process Model

-Measuring the Success of Malware Defense Programs

-and the Vector Defense reports

At its heart, CM is simply control over the assets within the organization: control over how they are constructed, versioning on each, how they are defended. The degree of control one has over these things relates directly to the ease with which assets are managed and protected from malicious code. The ability to roll out a single security template, anti virus package, patch group, or spyware tool to a large group of boxes is completely dependant on knowing precisely what the components look like. Malware defense relies on knowing how each device will react to a specific piece of code, whether it is a new Internet worm vector or file-infecting virus - a mixed, unpredictable set of patches, file system configurations, and application versions will require much more with regard to planning, testing, and monitoring.

In the private sector, the requirements of Sarbanes-Oxley may also be driving a tighter adherence to CM. One well-written piece on the subject can be found on the IT Compliance Institute's site:

http://www.itcinstitute.com/display.aspx?ID=154

Check out a wealth of additional resources on CM at the CM Crossroads site:

http://www.cmcrossroads.com/yp/index.php?oldpage=configuration_management.html 

This site offers links to free tools and templates that may provide some cohesion to your organization's CM program. The month of March may be the first time in while that Microsoft-centric shops have been given a little breathing room in terms of patch testing and deployment schedules. Take the opportunity to enlist a few of the engineers to help revamp the CM process or start a CM team.