Improving Web Application Security: Threats and - CGISecurity

470 Part IV: Securing Your Network, Host, and ApplicationStay Current With Service Packs and PatchesSet up a schedule to analyze your server software and subscribe to security alerts.Use MBSA to regularly scan your server for missing patches. The following linksprovide the latest updates:● Windows 2000 service packs. The latest service packs are listed athttp://www.microsoft.com/windows2000/downloads/servicepacks/default.asp.●●●.NET Framework Service Pack. For information about how to obtain the latest.NET Framework updates, see the MSDN article, “How to Get the Microsoft .NETFramework” at http://msdn.microsoft.com/netframework/downloads/howtoget.asp.Critical Updates. These updates help to resolve known issues and help protectyour computer from known security vulnerabilities. For the latest critical updates,see “Critical Updates” at http://www.microsoft.com/windows2000/downloads/critical/default.aspAdvanced Security Updates. For additional security updates, see “AdvancedSecurity Updates” at http://www.microsoft.com/windows2000/downloads/security/default.asp.These also help protect your computer from known security vulnerabilities.Perform Security AssessmentsUse MBSA to regularly check for security vulnerabilities and to identify missingpatches and updates. Schedule MBSA to run daily and analyze the results to takeaction as needed. For more information about automating MBSA, see “How To:Use MBSA” in the “How To” section of this guide.Use Security Notification ServicesUse the Microsoft services listed in Table 16.5 to obtain security bulletins withnotifications of possible system vulnerabilities.Table 16.5 Security Notification ServicesServiceLocationTechNet SecurityWeb sitehttp://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/current.aspUse this Web page to view the security bulletins that are available for yoursystem.Microsoft SecurityNotification Servicehttp://register.microsoft.com/subscription/subscribeme.asp?ID=135Use this service to register for regular email bulletins that notify you of theavailability of new fixes and updates.