2KKUU7ita

224
Part IV: Hacking Operating Systems
Figure 11-20:
Starting
the exploit
process in
Metasploit
Pro is as
simple as
importing
your scanner
findings
and clicking
Exploit.
Countermeasures against missing
patch vulnerability exploits
Patch your systems — both the Windows OS and any Microsoft or third-party
applications running on them. Seriously, that’s all there is to it. Combine that
with the other hardening recommendations I provide in this chapter, and you
have a pretty darned secure Windows environment.
To get your arms around the patching process, you have to automate it
wherever you can. You can use Windows Update — or better yet — Windows
Server Update Services (WSUS) for Microsoft-centric patches, which can
be found at http://technet.microsoft.com/en-us/wsus/default.
aspx. I can’t stress enough how you need to get your third-party patches
for Adobe, Java, and so on under control. If you’re looking for a commercial
alternative, check out GFI LanGuard’s patch management features (www.gfi.
com/network-security-vulnerability-scanner) and Lumension Patch
and Remediation (www.lumension.com/vulnerability-management/
patch-management-software.aspx). I cover patching more in-depth in
Chapter 17.