Improving Web Application Security: Threats and - CGISecurity

746 Improving Web Application Security: Threats and Countermeasures●●●●Acquire. If the vulnerability is not addressed by the security measures already inplace, download the patch for testing.Test. Install the patch on a test system to verify the ramifications of the updateagainst your production configuration.Deploy. Deploy the patch to production computers. Make sure your applicationsare not affected. Employ your rollback or backup restore plan if needed.Maintain. Subscribe to notifications that alert you to vulnerabilities as they arereported. Begin the patch management process again.The Role of MBSA in Patch ManagementThe Microsoft Baseline Security Analyzer (MBSA) is a tool that is designed for twopurposes: first, to scan a computer against vulnerable configurations; and second,to detect the availability of security updates that are released by Microsoft.In this How To, you use MBSA without scanning for vulnerable configurations. Whenusing the graphical user interface (GUI), specify this by unchecking the options inFigure 1 and only choosing Check for security updates.Figure 1MBSA scan optionsWhen using the command line interface (Mbsacli.exe), you can use the followingcommand to scan only missing security updates.Mbsacli.exe /n OS+IIS+SQL+PASSWORDThe option /n specifies the checks to skip. The selection (OS+IIS+SQL+PASSWORD)skips the checks for vulnerabilities and weak passwords.For more details about using MBSA, including the security configuration scan,see “How To: Use MBSA” in the How To section of this guide.Backups and Patch ManagementYou should perform backups prior to deploying an update on production servers.Regularly test backups as well as your backup process. Discovering that your backupprocess is broken during restoration can be devastating.