Risk
8/11/2010
05:21 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Post Patch Tuesday. Don't Stop There

While you may be well underway testing and deploying this month's hefty batch of patches from Redmond, it's never too soon to ask: how secure do the rest of your applications and servers look?

While you may be well underway testing and deploying this month's hefty batch of patches from Redmond, it's never too soon to ask: how secure do the rest of your applications and servers look?There's no reason to go through all of this trouble month after month deploying all of these Microsoft patches only to leave the rest of your servers and applications porous and open to anyone who has read a beginner's book about Web application hacking. Unfortunately, that's what many medium-sized enterprises tend to do. And there's really no reason for it, beyond not taking the time to cover the security basics.

Here a few steps that can be taken to get your organization headed in the right direction:

Harden Servers. Review your vendor guidance on how to keep the servers secured and establish an acceptable configuration. Test that configuration before deployment into production: turn off unnecessary services, make sure patches are up to date, change manufacture passwords. NIST maintains its 800 series documents, of interest to those responsible for IT security. Check out SP800-123, Guide to General Server Security. Next: make sure they stay hard.

Vulnerability Assessments. Outsource or do-it-yourself: run vulnerability assessments across your infrastructure to: make certain you're aware of all networked devices that are active and to identify and prioritize vulnerabilities that need remediation on those systems. One of the keys to a successful vulnerability management program is repetition: identify vulnerabilities, prioritize, remediate, validate remediation - and repeat.

Review Your Code. In addition to network scans, it's vital to have your application code evaluated for flaws (either by someone trained in-house, or by a consultant familiar with web application security.). The most effective way to build secure applications is to build applications with security as part of the process throughout. That includes from application design through development. With additional careful security testing before moving to production and then throughout maintenance: one wants to build security into the Software Development Life-cycle (SDLC). Microsoft has provided guidance on getting started with what it calls the Secure Development Lifecycle. And the Open Web Application Security Project (OWASP) has plenty of resources on the subject as well.

So while you labor through the pain of patching your systems with these 34 patches, save some energy to test your other applications and to make sure your servers are snug. Otherwise, you're really just wasting your time.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4632
Published: 2015-01-31
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 does not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certifica...

CVE-2014-7287
Published: 2015-01-31
The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

CVE-2014-7288
Published: 2015-01-31
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

CVE-2014-8266
Published: 2015-01-31
Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.

CVE-2014-8267
Published: 2015-01-31
Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.