* About Microsoft's "Windows NT 4.0 and Windows 98 Threat Mitigation Guide"
I know there are some of you still running Windows NT 4 servers because you write and tell me about it. That’s why I mentioned the hands-on lab “Migrating from Windows NT 4.0 to Windows Server 2003” a couple of times recently. Now comes more evidence that Redmond is taking seriously your claims that – for whatever reason – you just can’t move away from the NT 4 platform just yet.
One eagle-eyed reader, who is still running NT 4 both for software and budget reasons (thanks Scott!) has pointed out a new security guide issued by Microsoft entitled “Windows NT 4.0 and Windows 98 Threat Mitigation Guide” which was published just a few weeks ago. Now Bill Gates and company still want you to upgrade, but until then, this guide “…identifies security issues in networks that include computers running the Microsoft Windows NT 4.0 and Windows 98 operating systems, and explains the best hardening strategies that an organization can use until they are able to upgrade these operating systems.”
In other words, while Microsoft won’t rewrite code for these operating systems any more, it will point out steps you can take to minimize any threats to their security.
The document, which can be downloaded or read online (https://www.microsoft.com/technet/security/guidance/threatmi.mspx), consists of eight chapters. Discounting the first (“Introduction” or “here’s what we’re going to say”) and last (“Conclusion” or “here’s what we said”), the remaining six are:
* Applying the Security Risk Management Discipline to the Trey Research Scenario – Chapter 2 details a fictitious company scenario that is used to develop the recommendations in this guidance and explains how an IT generalist would assess the security risks and vulnerabilities of the network infrastructure.
* Network Security and Hardening – Chapter 3 describes network security vulnerabilities and the process of hardening network components (including client and server computers) against these vulnerabilities.
* Hardening Windows NT 4.0 – Chapter 4 explains how to harden Windows NT 4.0 (Workstation and Server) by establishing a baseline for the system and then applying specific hardening measures.
* Hardening Windows 98 – Chapter 5 explains how to harden Windows 98 clients and applications, and describes methods for applying patches, updates, and security policies to computers running Windows 98.
* Patch Management – Chapter 6 shows how to find out about new updates in a timely manner, implement them quickly and reliably throughout your organization, and ensure that they are deployed everywhere.
* Anti-virus -Chapter 7 describes the importance of anti-virus software and policies as well as the security and supportability of client-based and server-based anti-virus solutions.
Some of these are generalist topics that apply to just about any operating system (such as the need for anti-virus products), but most of the tips apply specifically to the older systems that may be inhabiting your network. Still, upgrading to the most current systems is the best security solution. As the guide concludes: “The information presented in this guidance will allow you to identify secure networking infrastructure, create baseline configurations for servers and workstations running older operating systems, define procedures for sound patch management, and institute a proactive anti-virus strategy. Together, these techniques can help extend the life of important assets until organizations are able to upgrade to newer, more secure operating systems.”
