July 18, 2003 (Computerworld) --
Users this week reacted with a mixture of concern and resignation to the discovery of a critical flaw in almost all versions of Microsoft Corp.'s Windows software, including the Windows Server 2003 operating system. The vulnerability exists in a communication protocol that deals with message exchange over TCP/IP (see story). It allows attackers to take over a victim's system and install malicious code; view, modify or delete data; or create new user accounts. "It is probably the most serious vulnerability that we have seen from Microsoft in the past 12 to 18 months," said Chris Rouland, director of Internet Security Systems Inc. in Atlanta. The flaw -- word of which followed the announcement of another major Windows vulnerability only a week before (see story) -- highlights the continuing challenge that users face in securing Microsoft software, said Scott Loach, senior information security engineer at Raymond James Financial Inc., a financial services firm in St. Petersburg, Fla. Raymond James had just completed patching 500 Windows servers against the previous flaw and is now scrambling to protect its systems against the new vulnerability. The frequency with which such patching is needed has prompted the company to consider automated patching technology, Loach said. "We've had endless meetings with Microsoft about the state of their security and the way these patches come out and the trouble it causes us," Loach said. "It's just what you have to live with" when dealing with Microsoft, he added. The flaw discovered this week "is the latest in a seemingly never-ending stream of issues that afflict [Microsoft] products," said Bruce Azuma, corporate director of information technologies at Wilbert Inc., a Broadview, Ill.-based company in the funeral services and industrial plastics businesses. "As a medium-sized business user of Microsoft, I am growing more and more concerned with Microsoft's ability to release stable, secure products." Such flaws also raise questions about the efficacy of Microsoft's Trustworthy Computing initiative, said John Cowan, corporate IT director at Caldwell Industries Inc., a Louisville, Ky.-based injection molding manufacturer. "On a scale of 1 to 10, I would give [the initiative] a 3," Cowan said. "I don't know what the problem is, but it doesn't look like they have been able to lock down their software like they said they would." Discovery of the flaw "cracked the bubble" around Windows Server 2003 security and will force Microsoft to redouble its efforts to find out what went wrong, said Pete Lindstrom, an analyst at Spire Group, a consultancy in Malvern, Pa. But it would be premature to see it as a sign of broader security problems in Windows Server 2003, he said. "I would be embarrassed
"Need help sorting through the hype of cloud computing? Here's some IDC research on the benefits, barriers -- and what..."
Read more...
"Stephen Spoonamore offers more details on what I was trying to drive home in my recent column: Because individual votes..."
Read more... Read more Security posts or See all Blogs
One positive development stemming from the collapse of Wall Street may be a boost in interest in computer science and IT careers among students who were previously interested in financial services jobs.
From Laggard to Leader: Transforming the Data Center
From Laggard to Leader: Transforming the Data Center Register for this complimentary webcast today! Go to the webcast
Computerworld Executive Bulletin: Building a Robust Antivirus Defense
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. (Source: MessageLabs) Antivirus software alone isn't enough to prevent today's speedy, sophisticated virus attacks. Security managers should consider multitiered approaches that include behavior scanning, appliances that check e-mail for worms, and restricting user access to dangerous Web sites. Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs, to learn more. Download this executive briefing
Intercept Spam & Viruses
Download this whitepaper to learn how to outsmart spam & viruses, compliments of MessageLabs. (Source: MessageLabs) Register for a complimentary 30 day trial of MessageLabs' new managed Anti-virus and Anti-spam security solutions. MessageLabs guarantees complete protection against all known and unknown email threats. By providing 24 hour support, your business can increase productivity and decrease risk.Register now for a complimentary trial and receive a free datasheet. Download this white paper
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Go Green with Webroot® Perimeter Security SaaS! Webroot Perimeter Security SaaS is a powerful alternative to obsolete on-premise hardware based security solutions. SaaS allows businesses to obtain flexible protection through an expert security provider, solving the problems caused by software, hardware and appliance solutions. Benefits include easier manageability, better protection and guaranteed performance –all at a lower cost. Register for your free copy of the "Why Security SaaS Makes Sense" whitepaper and Go Green with Webroot! Download this white paper now!
Fired up about IT?Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.
Companies today are realizing that competitive advantage is harder to sustain when based solely on gains in productivity and cost efficiency. The focus is shifting to invest more in business optimization initiatives which rely on trusted information to develop new insights that deliver better business results. But how can this be done efficiently in a business environment across multiple applications and processes. The answer is an Information Agenda - an innovative approach to transforming business information into a strategic asset for competitive advantage.
See your link here
Subscribe to
Computerworld 
or
Other Security Stories
From Laggard to Leader: Transforming the Data Center
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs. 
Download this whitepaper to learn how to outsmart spam & viruses, compliments of MessageLabs.
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Webroot Perimeter Security SaaS is a powerful alternative to obsolete on-premise hardware based security solutions. SaaS allows businesses to obtain flexible protection through an expert security provider, solving the problems caused by software, hardware and appliance solutions. Benefits include easier manageability, better protection and guaranteed performance –all at a lower cost. Register for your free copy of the "Why Security SaaS Makes Sense" whitepaper and Go Green with Webroot! 
Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.
John Brandon: Google Chrome = Dead, Google Search = Hot
Computerworld