| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Microsoft IIS miscast as network villain | |
|
||
| Time: 09:25 EST/14:25 GMT | News Source: ZDNet | Posted By: Byron Hinson | ||
|
In a recent report delivered by the Gartner Group, Vice President and Research Director John Pescatore advised that enterprises seek alternatives to the Microsoft IIS platform. After analyzing the recent Code Red and NIMDA attacks, Gartner believes that their clients should reconsider their investments in the Microsoft infrastructure. They are not the first to say so. While concern over these events is clearly merited, following this advice would prove extremely costly, and would do little to address the underlying problems that resulted in the spread of these attacks. | ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 151 Last | Next |
The time now is
11:51:41 AM
ET.
Any comment problems? E-mail us |
| #1 By 116 (129.116.86.41) at 10/5/2001 10:47:56 AM |
| Are you suggesting that MS design team said: "Hey we are going to build this thing insecure." ??? For a self proclaimed computer security expert that would seem a little less than truthful. |
| #2 By 1658 (63.25.166.46) at 10/5/2001 10:58:31 AM |
|
Expert eh???
If even half the administrators of Windows servers in this world would check Windows Update, and www.microsoft.com/technet or www.microsoft.com/security once a day, this Nimda and Code Red crap wouldn't have been even NEEEEEEAR what it has turned into being. Keeping your software update is crucial to the stability and security of any network, that is an indisputable fact. I know it, good administrators know it, and you know it as well! Microsoft doesn't provide security notification services and sites like Technet and Windows Update for free because they don't want you to be secure. There are very few security vulnerabilities I can think of wherein Microsoft has not released a patch for them within 72 hours of the report. Usually much much sooner. Code Red and Nimda are two worms that unfortunately infiltrated many systems because administrators need to go back to school and learn how to appropriately manage network resources and assess priorities. "Gee... Boss wants the new revenue report tomorrow... or I take 5 damn minutes to install the Nimda patch and reboot the server... hmmm." Given that the 3150 servers in my organization have never been hit by any worm or any sort of viral infection, and leaving most of that to merely using Windows Update daily, I'd say it's not so much a matter of someone having to be that intelligent, just objectively minded. I say this not to brag or bow my neck in the demonstration of skill, I say it just to remind people that all software has flaws. Some more than others you are all correct in that statement, however, what matters to me is not necissarily that a piece of software has a bug, it's that the company who produces it, support it and fix it in a timely fashion. So in closing... use the tools provided to you. Use your resources. Microsoft.com isn't the largest web site in the world because there's no useful material there. And if anyone says there isn't, get back to drinking your Evian. (Note: Evian spelled backwards = Naive). This post was edited by aamendala on Friday, October 05, 2001 at 11:05. |
| #3 By 94 (63.207.180.66) at 10/5/2001 11:01:01 AM |
| No he's saying that by default, services (with known vulnerabilities) are installed by default. And that admins are required to download a specific patch to fix it. Or stop running the service. |
| #4 By 1658 (63.25.166.46) at 10/5/2001 11:05:09 AM |
|
Once again, Microsoft Technet online. A free service that has had an IIS Security Checklist in it for at least 3 years now that has been updated on a regular basis.
If administrators would use their resources, they would have seen the entire list of services, threads, registry keys, processes, etc... that they need to either turn off or slightly reconfigure for greater security. IIS is setup no doubt to be the easiest and quickest web server to have running as quick as possible. With that comes some lower security, no doubt. It's just plain to see that if you follow the checklist you'd have a much more secure system. In fact, the IIS 4.0 checklist will put your web server in a C2 NSA tested configuration and come as close as possible with IIS 5.0. Gotta think, read, and work people. The software still can't do everything for you. Maybe someday, but right now MS makes it as easy as they can for ya! This post was edited by aamendala on Friday, October 05, 2001 at 11:06. |
| #5 By 135 (209.180.28.6) at 10/5/2001 3:14:48 PM |
|
Linux rewls!
Everyone should run Linux with Apache cause it rules! |
| #6 By 135 (209.180.28.6) at 10/5/2001 3:16:21 PM |
|
Damn, I need to take my medications. :)
|
| #7 By 1658 (24.29.229.203) at 10/5/2001 5:52:30 PM |
|
All Windows core system and IIS updates ARE available in one place Jag if you aren't aware on the corporate Windows Update site. They are all in one place for easy admin and easy deployment throughout the network with darn near little input from the administrator.
Also note that the updates that make it on the Windows Update site make it there late because they are partially regression tested. That takes time. Microsoft posts the Technet updates to provide immediate fixes. And as for all the ones that don't appear on Windows Update ever, they appear in the service packs after full regression testing. Gotta get your facts straight guys... it's not hard to do some reading every now and then. This post was edited by aamendala on Friday, October 05, 2001 at 17:54. |
| #8 By 116 (66.68.134.68) at 10/7/2001 1:51:24 PM |
| Wouldn't it make sense that MS would eventually plug all holes in the product? Going back to scrap doesn't make much sense to me. Lets start a countdown to see when the next big hole in IIS comes up. I think it is going to be a while before another one is found. |
|
Write Comment
Return to News |
Displaying 1 through 25 of 151 Last | Next |
The time now is
11:51:41 AM
ET.
Any comment problems? E-mail us |
