- 12 myths about how the Internet works
- Smartphone smackdown: Storm vs. iPhone
- IETF: Should we ignore the Kaminsky bug?
- Top 10 wicked cool algorithms
- How to recession-proof yourself
Network World's most recent Tester's Challenge published two weeks ago called on the major operating system vendors to streamline the process of supplying security update information to customers.
Our charge was that, while information might be available on vendor Web sites, it's hard to locate and in some cases is incomplete.
Told that their tools are hard to use and inadequate, Microsoft, Novell, Apple and Red Hat chose to defend their existing approaches. None offered any insight about how they intend to improve the situation other than to point to existing plans to automate update tools, which might obviate the need to disseminate some security information.
We offered Microsoft 800 words to respond to this challenge in print, and while the company declined to write a formal response, it did agree to talk to us about its Web-based security resources.
"I can't say that we hear much about our strategy for pushing out security information being off course, but we do hear often that we can tactically make it better," says Stephen Toulouse, a security program manager with the Microsoft Security Response Center. The center coordinates how vulnerabilities get reported and fixed, and how customers are notified of those security updates.
Toulouse says Microsoft's layered approach to supplying relevant security update information can't be simplified much because its customer base ranges from single Windows users to large enterprise accounts.
Microsoft maintains parallel efforts for consumers and IT staff, both in terms of its e-mail notification services and on its Web site. Consumers can find information at www.microsoft.com/security, while IT staffers will need to hit the Microsoft TechNet Security Resource Center site - www.microsoft.com/technet/security/.
Toulouse says these security pages are updated constantly, even though a prominent link advertised registration for a March 16 event when we spoke with him on March 24.
We pointed out that while Microsoft numbers its security patches in a specific format - MS 04-XXX - you cannot search on that format. Furthermore, the company does not discern between original and updated security bulletins in its overall listings, making it difficult to ensure you have the most recent patches applied.
We also encountered a bug on the security patch search page that did not let us view the security update listing using two different, fully patched Windows XP Pro machines running Internet Explorer. We logged an event error with the support team but had not heard back from them at press time.
Although these points may seem trivial, we argue that security professionals pressed for time need things organized intuitively to ensure their systems are properly secured.
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment