Security

In the last 6 months, nearly 5,000 laptops were left in London taxis. A cabbie told Matthew Stibbe what else people forget, and we show you how to keep working even if your laptop goes missing.
http://go.microsoft.com/?linkid=2280934
 
VIDEO: HOW PHISHING SCAMS TRY TO STEAL YOUR IDENTITY
Learn three things you can do to protect yourself from being hooked by a phishing email scam.
http://go.microsoft.com/?linkid=2307981

Security Myths: Part One http://go.microsoft.com/?linkid=2420671
Read part one of this two-part series on security myths, taken from the upcoming book Protect Your Windows Network, by Jesper M. Johansson and Steve Riley
 
Security in Operation: Part One -- Windows, Linux and Security Notifications http://go.microsoft.com/?linkid=2420673
Read part one in this four-part series on security in operation by Jeffrey R. Jones, Senior Director, Microsoft Security Business Unit. The articles will examine customer concerns and raise questions on using either a Microsoft Windows-based or a Linux-based operating system.
 
Security Tip of the Month - March 2005
 
Phishing—Hook, Line and Sinker
http://www.microsoft.com/technet/community/columns/sectip/default.mspx

Microsoft Security Bulletin Summary for March 2005
Microsoft has no new security bulletins to release as part of the monthly release cycle for the month of March.
Search for previous security bulletins http://go.microsoft.com/?linkid=2420690
Security Bulletin Feed http://go.microsoft.com/?linkid=2420691 RSS http://go.microsoft.com/?linkid=2420692>
 
Security Clinics & Labs https://www.microsoftelearning.com/security/

Microsoft Security Guidance Center: Recently Published http://www.microsoft.com/security/guidance/recent/default.mspx
 
March 2005
 
• Server and Domain Isolation Using IPsec and Group Policy http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/default.mspx
• Service Management Functions http://go.microsoft.com/fwlink/?LinkId=37696
• Security Tip of the Month http://www.microsoft.com/technet/community/columns/sectip/default.mspx

Top Stories

Don't Get Hooked by "Phishing" Scams http://go.microsoft.com/?linkid=2420676
"Phishing" is the slang term for fraudulent e-mail scams designed to steal your identity online. Thieves send e-mail messages that appear to come from MSN or other reputable companies. Be alert to their hooks. Once you've given them your personal information, they use it to access your credit accounts or create new accounts using your good name.
 
Practical Assurance: Evolution of a Security Development Lifecycle http://go.microsoft.com/?linkid=2420677
Steve Lipner, Director of Security Engineering Strategy at Microsoft, has published a paper on the Security Development Lifecycle (SDL), a Microsoft process for the development of software that needs to withstand malicious attack. Software that has undergone the SDL has experienced a significantly reduced rate of external discovery of security vulnerabilities.
 
Microsoft RMS Bolsters Position in Enterprise DRM Market http://go.microsoft.com/?linkid=2420678
A series of announcements at the RSA Conference in San Francisco the week of February 14 established the Microsoft Rights Management Services (RMS) platform more firmly at the center of the emerging Enterprise Rights Management (ERM) market. Read more in this article from DRM Watch.
 
Why You Need a Company Policy on Internet Use http://go.microsoft.com/?linkid=2420679
If staff members are to feel they have autonomy and ownership, they need to know the rules that go beyond what time to show up, vacation time, and health benefits. You need a written company policy that covers computer and Internet use.
 
Fight "Phishers": Four Tips to Avoid Identity Theft http://go.microsoft.com/?linkid=2420680
Criminals are using e-mail messages to lure victims onto fake Web sites. At these sites, the victims willingly enter their own credit card numbers, bank account numbers, and other important information. Here are four steps to protect against the theft of your own personal information and your company's valuable business data.
 
Security Guidance
 
Aaron Margosis' WebLog: Why You Shouldn't Run as Admin  http://go.microsoft.com/?linkid=2420682
The top reason for running as non-admin is to limit your exposure. When you are an admin, every program you run has unlimited access to your computer. If malicious or other "undesirable" code finds its way to one of those programs, it also gains unlimited access. A corporate firewall is only partial protection against the hostility of the Internet.
 
Aaron Margosis' WebLog: Why You Shouldn't Run as Admin -- Part 2 http://go.microsoft.com/?linkid=2420683
How to combat "Zero-day" attacks by using limited privilege.
 
Description of Promqry 1.0 and PromqryUI 1.0 http://go.microsoft.com/?linkid=2420684
This article introduces two tools that enable you to detect a network sniffer that is running on a computer that is running Windows Server 2003, Windows XP, or Windows 2000.
 
Video: What You Should Know About Phishing Identity-theft Scams http://go.microsoft.com/?linkid=2420685
Watch this video to find out more about phishing e-mail scams and how they are used for identity theft.
 
Service Pack 2 Automatic Update Lift on April 12, 2005 http://go.microsoft.com/?linkid=2420686
The Service Pack 2 automatic update blocker will be lifted on April 12, 2005. Visit the Service Pack 2 deployment resource site http://go.microsoft.com/?linkid=2420687 for information and prepare today.

MVP Article of the Month -- Help Protect Yourself from Online Crime http://go.microsoft.com/?linkid=2420689
Sandi Hardmeier illustrates a few of the tricks that criminals use to try to get you to trust them. She also reveals some of the ways that they hide their real identities and provides information about how to help protect yourself from their harmful effects.

Downloads
 
Sender ID: Sender ID Overview
The print-ready brochure describes the benefits of authenticated e-mail and of Sender ID implementation to both senders and recipients.
http://www.microsoft.com/downloads/details.aspx?FamilyID=0763587e-eb68-449c-8972-8881924ebb4b&DisplayLang=en
 
Securing Wireless LANs with PEAP and Passwords
This solution guide shows you how to plan, deploy, and manage 802.1X wireless LAN security using Microsoft Windows Server 2003. This guidance provides step-by-step instructions for deploying wireless local access network (LAN) security for Microsoft Windows XP, and Pocket PC clients using the Protected Extensible Authentication Protocol (PEAP) and password authentication.
http://www.microsoft.com/downloads/details.aspx?FamilyID=60c5d0a1-9820-480e-aa38-63485eca8b9b&DisplayLang=en
 
Mapping International Security Standards to MOF
How Security Management and Service Management Intersect
The security controls and procedures found in the ISO/IEC 17799:2000 code of practice are closely related to the IT service management processes described in MOF.
http://www.microsoft.com/downloads/details.aspx?FamilyID=b305cc14-de60-4fdb-93d0-4346492e375d&DisplayLang=en

Microsoft® Windows® Malicious Software Removal Tool (KB890830)
This tool checks your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found. Microsoft will release an updated version of this tool on the second Tuesday of each month.
http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&DisplayLang=en
 
Update for Outlook 2003 Junk Email Filter (KB892236)
This optional update provides the Junk E-mail Filter in Microsoft Office Outlook 2003 with a more current definition of which e-mail messages should be considered junk e-mail. This update was released in March 2005.
http://www.microsoft.com/downloads/details.aspx?FamilyID=e478799e-074b-4492-a224-257043c975ad&DisplayLang=en
 
Exchange Server 2003 Security Hardening Guide
Updated February 2005. The download package for this guide includes important security templates. These templates were updated November 2004. This guide walks you through the process of hardening your Exchange 2003 environment, including configuration recommendations and strategies for combating external threats.
http://www.microsoft.com/downloads/details.aspx?FamilyID=6a80711f-e5c9-4aef-9a44-504db09b9065&DisplayLang=en
 
Security Features in Windows XP SP2
Learn about Windows XP Service Pack 2, some of its security features, and how Microsoft IT has implemented the Service Pack.
http://www.microsoft.com/downloads/details.aspx?FamilyID=ff2762b3-f76b-4cb8-b4f4-a44aab970bf9&DisplayLang=en
 
Patch Management Using Systems Management Server 2.0
This solution accelerator provides guidance for deploying software patches, service packs, and Quick Fix Engineering patches using Microsoft® Systems Management Server (SMS). It builds on Microsoft Operations Framework and the service management functions within the MOF Changing Quadrant.
http://www.microsoft.com/downloads/details.aspx?FamilyID=fdb9a1ef-2d53-444c-b29b-31e9c169c5a5&DisplayLang=en
 
Server and Domain Isolation Using IPsec and Group Policy
Server and domain isolation make it possible to create a layer of security to achieve logical isolation of the network traffic that moves between computers or networks.
http://www.microsoft.com/downloads/details.aspx?FamilyID=404fb62f-7cf7-48b5-a820-b881f63bc005&DisplayLang=en
 
Patch Management for Servers
Overview of how Microsoft Information Technology (Microsoft IT) effectively deploys updates to servers. Effective patch management promotes security, higher systems availability, and improved auditing.
http://www.microsoft.com/downloads/details.aspx?FamilyID=8b3a2818-a220-4de7-bdd2-1af5d94f89f6&DisplayLang=en
 
Desktop Patch Management
Overview of how Microsoft Information Technology (Microsoft IT) uses Microsoft Systems Management Server (SMS) 2003 to manage the process of distributing applications, to manage hardware and software assets, and to manage the deployment of security updates and other software updates across the enterprise.
http://www.microsoft.com/downloads/details.aspx?FamilyID=428d8ba0-f2b6-4991-b5ab-2e79591123fe&DisplayLang=en 

Windows Platform

Windows Server 2003 Service Pack 1 has RTW'ed
http://www.microsoft.com/windowsserver2003/downloads/servicepacks/sp1/default.mspx
 
www.microsoft.com/presspass/features/2005/mar05/03-30WinServSP1.asp
www.microsoft.com/presspass/press/2005/mar05/03-30WinServSP1PR.asp
 
Web pages:
TechCenter: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/servicepack/default.mspx
MSDN: http://msdn.microsoft.com/security/productinfo/server2003/
CD ordering: http://www.microsoft.com/windowsserver2003/downloads/servicepacks/sp1/cdorder.aspx
Trial Soft Ware ordering: http://www.microsoft.com/windowsserver2003/evaluation/trial/default.mspx
List of Security Bulletins in SP1: http://www.microsoft.com/technet/security/prodtech/windowsserver2003/sp1.mspx
 
SP1 on Wuv4:
SP1 x86: http://windowsupdate.microsoft.com
 
SP1 on Download center:
SP1 x86: http://www.microsoft.com/downloads/details.aspx?FamilyId=22CFC239-337C-4D81-8354-72593B1C1F43
SP1 Checked Build x86 (ENU only): http://www.microsoft.com/downloads/details.aspx?FamilyId=F07A5E49-4A13-42CB-898B-278A8B287E16
SP1 Ia64: http://www.microsoft.com/downloads/details.aspx?FamilyId=890C5C44-815C-45BD-8B08-4FE901BB8FDF
SP1 Checked Build ia64 (ENU only): http://www.microsoft.com/downloads/details.aspx?FamilyId=C45F733E-A206-432A-87E2-65A08276FB43
 
Tools:
Deployment tools x86: http://www.microsoft.com/downloads/details.aspx?FamilyId=A34EDCF2-EBFD-4F99-BBC4-E93154C332D6 
Deployment tools ia64: http://www.microsoft.com/downloads/details.aspx?FamilyId=E414D11C-AB8F-411F-935A-3C4D16E3FDAC
Support tools x86 (ENU only): http://www.microsoft.com/downloads/details.aspx?FamilyId=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D  
Support tools ia64 (ENU only): http://www.microsoft.com/downloads/details.aspx?FamilyId=8FF14D19-2E1D-4014-AC09-C13B7A538EE0
Symbols: http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx
 
Top KBs:
SP1 list of updates: http://support.microsoft.com/kb/824721
Release Notes for SP1: http://support.microsoft.com/kb/889101
How to obtain the latest service pack for WS03: http://support.microsoft.com/kb/889100
SP1 support tools: http://support.microsoft.com/kb/892777
SP1 deployment tools: http://support.microsoft.com/kb/892778
Hard disk space requirements for SP1: http://support.microsoft.com/kb/892807
How to deploy SP1 by using Systems Management Server: http://support.microsoft.com/kb/894712
 
Downloads
 
SEE WHAT ONENOTE CAN DO FOR YOU
OneNote 2003 enables you to take, organise and share your notes easily and intuitively on your PC. Why not order the free 60-day trial version today?
http://go.microsoft.com/?linkid=2307972
 
WINDOWS SHAREPOINT SERVICES
Windows SharePoint Services is the engine for creating websites that enable information sharing and document collaboration.
http://go.microsoft.com/?linkid=2307973
 
DOWNLOAD EXCEL VIEWER 2003
Open and copy spreadsheets, from Excel 97 to Excel 2003, without having Excel installed.
http://go.microsoft.com/?linkid=2307974
 
OFFICE 2003/XP REMOVE HIDDEN DATA
Permanently remove hidden data and collaboration data, such as change tracking and comments, from Office files.
http://go.microsoft.com/?linkid=2307975
 
DOWNLOAD OUTLOOK 2003 PST BACKUP
Create backup copies of your personal Outlook files at regular intervals, in Outlook 2000 and later versions.
http://go.microsoft.com/?linkid=2307976
 
Common Mistakes When Upgrading a Windows 2000 Domain to a Windows 2003 Domain [Windows Server 2000][Windows Server 2003]  http://go.microsoft.com/?linkid=2356349
 
We are happy to announce the availability of LimitLogin v1.0, an application that adds the ability to limit concurrent interactive user logons in an Active Directory domain. It can also keep track of all logins information in Active Directory domains (without necessarily enforcing logons quotas).
 
The challenge of limiting concurrent logons in a distributed environment is huge, and although LimitLogin is not a "bullet proof" solution to all the aspects of this challenge, many customers might still find this tool helpful, as this capability has been highly requested by different customers (banks, ISPs, libraries etc) in numerous RFPs etc.
 
Please keep in mind that this tool is Not Supported (similar to a resource kit or support tool).
 
The public download location is http://download.microsoft.com/download/f/d/0/fd05def7-68a1-4f71-8546-25c359cc0842/limitlogin.exe  
 
ACT 4.0 provides guidance and tools to resolve the most commonly encountered application compatibility issues for Windows XP and Windows Server 2003. The introduction of Windows XP Service Pack 2 exposes compatibility issues in applications not seen previously. ACT 4.0 has been updated to specifically target the issues that result from the deployment of Windows XP Service Pack 2, thereby reducing the risk of end-user downtime. Additionally, it provides vital assistance in identification and mitigation of compatibility issues, saving IT departments both time and resources by automating onerous tasks such as application inventorying and fix packaging and deployment. By packaging all of the needed tools together with clear, step-by-step instructions, end-users can realize the benefits of a more secure desktop environment even more quickly.
http://www.microsoft.com/windows/appcompatibility/default.mspx

Internet

Internet Security and Acceleration (ISA) Server 2004

http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/vpn_roaming_clients_quarantine_control_ee.mspx VPN Roaming Clients and Quarantine Control in ISA Server 2004 Enterprise Edition
 
Quarantine Control
Quarantine Control provides phased network access for remote (VPN) clients by restricting them to a quarantine mode before allowing them access to the network. After the client computer configuration is either brought into or determined to be in accordance with your organization’s specific quarantine restrictions, standard VPN policy is applied to the connection, in accordance with the type of quarantine you specify. Quarantine restrictions might specify, for example, that specific antivirus software is installed and enabled while connected to your network. Although Quarantine Control does not protect against attackers, computer configurations for authorized users can be verified and, if necessary, corrected before they can access the network. A timer setting is also available, which you can use to specify an interval at which the connection is dropped if the client fails to meet configuration requirements…
 
http://www.microsoft.com/security/incident/im.mspx Protect Against Exploit Code Related to Security Bulletin MS05-009 (MSN IM)
 
http://www.microsoft.com/events/series/rtccollaboration.mspx Real Time Collaboration
Discover how real-time collaboration solutions allow you to bring customers, coworkers, and suppliers closer together and be more productive. Tune in as Microsoft experts present product overviews and strategies for improving productivity and reducing expenses. See technical presentations on configuring, securing, and extending your real-time collaboration infrastructure.
 
http://msevents.microsoft.com/cui/WebCastEventDetails.aspx?EventID=1032268992&Culture=en-US TechNet Webcast: Integration of Microsoft Office Live Meeting with Microsoft Office and Other Products (Level 200)
 
http://www.microsoft.com/office/rtc/client.mspx Microsoft Office Communicator 2005 Overview
Published: March 8, 2005
Microsoft Office Communicator 2005 is an enterprise messenger that integrates communications capabilities (including instant messaging, rich presence, PC-based voice and video, Voice over Internet Protocol (VoIP), and enterprise telephony) with productivity and other communications applications.
 
New Operations Review document on Technet http://www.microsoft.com/technet/itsolutions/cits/mo/mof/omr/or.mspx
This guide provides detailed information about the Operations Review for organizations that have deployed, or are considering deploying, Microsoft technologies in a production computing environment or other type of enterprise computing environment. This is one of the four operations management reviews (OMRs) defined and described in the Microsoft® Operations Framework (MOF) Process Model. The guide assumes that the reader is familiar with the content, intent, background, and fundamental concepts of MOF, the MOF service management functions (SMFs), as well as the Microsoft technologies discussed.
 
Public Beta of the IIS DebugDiag tool is available on http://beta.microsoft.com
Login with a Passport ID and use the guest ID of “DebugDiag” (it’s case sensitive).
Click on the “IIS Debug Diagnostic Tool” link. Click on download link to get the MSI
 
How to avoid logging images in Internet Security and Acceleration Server 2004 http://go.microsoft.com/?linkid=2356346
 
How to configure Internet Security and Acceleration Server 2004 to skip name resolution in a Web proxy chaining configuration  http://go.microsoft.com/?linkid=2356348

BizTalk Server 2004
 
BizTalk Server 2004 named InfoWorld's best Process Automation Solution.
 
On Monday, March 14, the Q3 NewsFlash campaign went live featuring BizTalk Server 2004 recipient of the "Best Process Automation Solution" award by InfoWorld magazine.  Targeting IT professionals, this campaign is integrated with PR outreach, and in this case an advertorial, and will run in US IT trade print and online mediums.  Creative has also been made available across G29, for subs to localize in their markets