Experts urge prep for Microsoft's cert-blocking update
Scan networks for too-short keys, audit systems, test Oct. update before it rolls out, urge security pros
Computerworld - Microsoft yesterday delivered two security updates that patched two vulnerabilities in Visual Studio Team Foundation Server and System Center Configuration Manager.
But security experts essentially ignored the updates -- with some telling users they could delay deploying them -- and again hammered home the message that enterprises should use the small slate to prepare for a potentially disruptive update Microsoft has scheduled for October.
Microsoft's pair of updates -- tagged as MS12-061 and MS12-062 -- were both rated "important," the company's second-highest threat ranking, and could be used by attackers to acquire elevated rights to a compromised system.
"These can safely be postponed until it's convenient to install them, maybe next month when Microsoft releases its October Patch Tuesday updates," said Wolfgang Kandek, CTO of Qualys, in an interview yesterday.
"I agree, there's no need to patch these immediately," said Amol Sarwate, manager of Qualys' vulnerability research lab.
Instead, said Kandek, Sarwate and other security professionals, Microsoft customers should use the next month to audit their networks for soon-to-be-crippled digital certificates, and to test the changes set to hit Windows Update on Oct. 9.
The move was triggered by the discovery of Flame, the sophisticated espionage tool uncovered by Kaspersky Lab. Flame infiltrated networks, scouted out the landscape, and pilfered information. Among its tricks was what one researcher called the "Holy Grail:" It spoofed Windows Update to infect completely-patched Windows PCs.
Microsoft reacted by killing off some of its own certificates and beefing up Windows Update's security. It also decided to harden the Windows certificate infrastructure by blocking access to certificates with keys shorter than 1,024 bits.
"With something that's this big of a change, everyone should be testing the [Oct. 9] update," urged Jason Miller, manager of research and development at VMware.
Microsoft first offered the update last month, posting it as a manual download on its Download Center, so it is available for testing.
Kandek recommended IT administrators scan their networks for digital certificate keys shorter than 1,024 bits. "For internal sites and other services that use certificates such as mail servers and VPNs, we recommend using a scanning tool with SSL support, which all major scanners include," Kandek said.
"The audit is going to be the big thing," said Miller. "But it's the amount of time to fix [uncovered problems] that could be drastic."
Most experts expected some fallout from next month's key-crippling update, but were cautiously optimistic that disruptions would impact a small number of firms and websites.
"I don't think there will be a lot of companies that are negatively affected," predicted Miller, "but some will be crippled."
Kandek and Sarwate of Qualys concurred.
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!