Improving Web Application Security: Threats and - CGISecurity

538 Part IV: Securing Your Network, Host and ApplicationPerform Security AssessmentsUse MBSA to regularly check for security vulnerabilities and to identify missingpatches and updates. Schedule MBSA to run daily and analyze the results to takeaction as needed. For more information about automating MBSA, see “How To: UseMBSA” in the “How To” section of this guide.Use Security Notification ServicesUse the Microsoft services listed in Table 18.6 to obtain security bulletins withnotifications of possible system vulnerabilities.Table 18.6 Security Notification ServicesServiceLocationTechNet security Web site http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/current.aspUse this Web page to view the security bulletins that are available foryour system.Microsoft SecurityNotification Servicehttp://register.microsoft.com/subscription/subscribeme.asp?ID=135Use this service to register for regular email bulletins that notify you ofthe availability of new fixes and updatesAdditionally, subscribe to the industry security alert services shown in Table 18.7.This allows you to assess the threat of a vulnerability where a patch is not yetavailable.Table 18.7 Industry Security Notification ServicesServiceLocationCERT Advisory Mailing List http://www.cert.org/contact_cert/certmaillist.htmlInformative advisories are sent when vulnerabilities are reported.Windows and .NETMagazine Security UPDATENTBugtraqhttp://email.winnetmag.com/winnetmag/winnetmag_prefctr.aspAnnounces the latest security breaches and identifies fixes.http://www.ntbugtraq.com/default.asp?pid=31&sid=1#020This is an open discussion of Windows security vulnerabilities andattacks. Vulnerabilities which currently have no patch are discussed.