Geeks With Blogs
ex-blog Information security world June 2004 Entries
NIST recent publications
NIST has released Special Publication 800-68 to assist IT professionals in securing Windows XP systems. It discusses Windows XP and various application security settings in technical detail and is available for download [via Dana Epp]: The guide provides insight into the threats and security controls that are relevant for various operational environments, such as for a large enterprise or a home office. It describes the need to document, implement, and test security controls, as well as to monitor ......

Posted On Wednesday, June 30, 2004 6:36 AM

Visual Studio 2005 Developer Center launched
Visual Studio 2005 Developer Center launched (via Brian Johnson) with new information about VS2005 features and Visual C++ 2005 Express Edition Beta (Andy Pennell posted about debugger features) available for download (I think this announcment is aligned with TechEd) and it is personalized and RSS-enabled (announcements RSS). Blog entries from various MSFT people with more information: Sara Williams, Duncan Mackenzie, Kent Sharkey and Dan Fernandez (and Chris Sells and Robert Scoble of course ;-) ......

Posted On Tuesday, June 29, 2004 12:34 PM

Why you shouldn't run as admin
Aaron Margosis posted good summary why you shouldn't run as admin. I'm working without admin rights for one and half year (after reading Keith Brown article) and I am also disappointed that runas does not work with some Windows components (as Dana Epp points)

Posted On Monday, June 28, 2004 7:07 AM

It is not possible to keep a real big network 100% virus free
Larry Ostermann posted follow-up to his problems with viruses after Windows XP RTM installation. Interesting that: There are 285,000 Windows machines running on the Microsoft network at any time. Microsoft runs constant scans and forces patches on all unpatched machines within a set timeline (24 hours for emergencies, 14 days for critical updates). Microsoft’s IT department gets patches to more than 99% of the machines on the corporate network within 8 days of the announcement of a critical ......

Posted On Friday, June 25, 2004 12:10 PM

Scoble's on the Security Koolaid ;-)
Robert Scoble posted link to Mac OS X security myth exposed (by Secunia) on TechWorld and I want to agree with Robert: It is an industry problem. If you're a developer (on any platform, system, web or application), you need to think about security and the threats out there. Just for fun: interesting is how OpenVMS for example is fit in this comparision ;-) BTW I'm looking forward to see interview with Frank Swiderski (on threat modeling I think) and Rob Mensching (about WiX and opensource) ......

Posted On Friday, June 25, 2004 11:34 AM

Assessing Network Security book
Michael Horward posted that Kevin Lam, David LeBlanc and Ben Smith have released a new book, that is primarily aimed at security professionals new to penetration testing and IT professionals: Assessing Network Security ......

Posted On Friday, June 25, 2004 10:53 AM

Absolutely mininum of Trusted Root certificates
Trusted Root Certificates That Are Required By Windows 2000, Windows XP, and Windows Server 2003 article posted at MS Support, so now using about 700 mouse clicks (as Peter Gutmann wrote some time ago ;-) security paranoid can delete unneeded trusts and leave only necessary certificates ......

Posted On Thursday, June 24, 2004 1:55 PM

MSResearch article on PreFast
PREfast: Less Bugs, More Reliability article is posted on MS Research News site: Pop Quiz. What are the three things a Microsoft developer can't live without? If you guessed: 1) Pizza, 2) Late-night Xbox play-offs, and 3) PREfast, you'd be pretty darn close. Okay, you're saying. I got the first two, obvious. But PREfast? [via Rob Caron] ;-) BTW MS Research site is RSS enabled (subscribed). More information on site redesign ......

Posted On Tuesday, June 22, 2004 12:51 PM

ISV Community center launched
Christa Carpentiere posted that Microsoft ISV Community is launched: Right now the site is focusing more on resources, like partner programs, resource kits, and other outreach efforts. If you want more dev-specific info, make sure to give them feedback & let them know what would be useful to you ......

Posted On Tuesday, June 22, 2004 12:37 PM

SpaceShipOne landed
SpaceShipOne reached an altitude above 62.5 miles (100 km) during its brief flight Monday morning, making it the first privately built craft to fly in space. Awesome pictures of SpaceShipOne [via Scoble] ......

Posted On Tuesday, June 22, 2004 12:06 PM

DRM issues

Interesting reading: Cory Doctorow’s DRM talk to Microsoft Research [via Valery's blog]

 Kevin Schofield of MSResearch put some comments about this talk (part of Visiting Speakers Series)

Posted On Monday, June 21, 2004 6:57 AM

Securing COM for Windows XP Service Pack 2
Don Box posted notes about changes to COM activations requests in XPSP2: In XPSP2, the launch permission DACL now is used by all activation requests. That means that if your first activation call for a given CLSID failed with E_ACCESSDENIED, so will your next one (barring an admin changing the DACL). Finally, there are two new machine-wide "limiters," one for activation and one for access. These two limiters allow you to globally limit both local and remote activation and access for the entire machine. ......

Posted On Friday, June 18, 2004 7:29 AM

CryptoAPI team chat
The CAPI team that delivers the Microsoft Cryptography SDK will be having an online chat at MSDN chats where they'll answer questions about using Crypto API (6:00pm-7:00pm GMT) on June 23rd. [via Shawn Farkas] [Update] Chat was postponed from the original date and rescheduled to July 7th 6:00 - 7:00 GMT (Outlook reminder) [Update] Chat transcipt is available ......

Posted On Friday, June 18, 2004 6:35 AM

Access the archived user keys in an exit module in a Windows Server 2003 CA
A software update is available that allows you to access the archived user keys in an exit module in a Windows Server 2003 CA (829194): certainly in large enterprise environments key recovery is absolutely needed, but at the same time I fear it is a potential weak link in security chain (misuse .

Posted On Wednesday, June 16, 2004 7:58 AM

Characters in cryptography
Alice, Bob and Eve ;-) Here is a good description of participants in in discussions and presentations about cryptographic protocols [via Valery Pryamikov]

Posted On Tuesday, June 15, 2004 6:56 PM

Outsourcing Trust And The Failure of PKIs
Pretty interesting article about the failure of PKIs at Trust Cannot be Outsourced (via Financial Cryptography). Another major reason why PKIs failed is the fact that vendors claimed they could solve any problem at all. Companies started to implement PKIs without any good idea what they wanted to accomplish with them. Thus, the projects often became bloatware and died a quiet death. Or, they were successfully implemented but there were no applications making use of them. Quiet death once again. [via ......

Posted On Tuesday, June 8, 2004 11:19 AM

Identity Management Resources - Getting Started
Brian Redmond posted collection of resources on getting started with Identity Management (primarly using MIIS 2003)

Posted On Monday, June 7, 2004 8:52 AM

That is why certificate chain building is hard
Larry Osterman posted his little investigation on certificate chain building for MS OCA site: A few minutes of googling discovers that the AIA 48.2 field is also known as the id-ad-caIssuers OID. The authoritative reference for this OID is RFC2459 (the RFC that defines the x.509 certificate infrastructure). It describes this field as: The id-ad-caIssuers OID is used when the additional information lists CAs that have issued certificates superior to the CA that issued the certificate containing this ......

Posted On Friday, June 4, 2004 8:12 PM

Windows Error Reporting
Windows Error Reporting is a set of Microsoft® Windows® technologies that capture crash data and support end-user reporting of crash information to Microsoft. Through the recently enhanced Windows Error Reporting system, Windows Quality Online Services (Winqual) at is helping companies to address device, driver, and application failures. Companies can use the crash reports provided through Windows Error Reporting to identify problems in their code. After the ......

Posted On Wednesday, June 2, 2004 9:08 AM

Copyright © John Doe | Powered by: