Improving Web Application Security: Threats and - CGISecurity

748 Improving Web Application Security: Threats and CountermeasuresDetectingUse MBSA to detect missing security patches for Windows NT 4.0, Windows 2000,and Windows XP. You can use MBSA in two modes; GUI and command line. Bothmodes are used to scan single or multiple computers. The command line can bescripted to run on a schedule.Note The login used to run MBSA must be a member of the Administrators group on the targetcomputer(s). To verify adequate access and privilege, use the command net use\\computername\c$ where computername is the network name of a machine which you are goingto scan for missing patches. Resolve any issues accessing the administrative share before usingMBSA to scan the remote computer. To manually detect missing updates using the MBSA graphical interface1. Run MBSA by double-clicking the desktop icon or by selecting it from thePrograms menu.2. Click Scan a computer. MBSA defaults to the local computer. To scan multiplecomputers, select Scan more than one computer and select either a range ofcomputers to scan or an IP address range.3. Clear all check boxes except Check for security updates. This option detectsuninstalled patches and updates.4. Click Start scan. Your server is now analyzed. When the scan is complete,MBSA displays a security report and also writes the report to the%userprofile%\SecurityScans directory.5. Download and install the missing updates.Click the Result details link next to each failed check to view the list of uninstalledsecurity updates. A dialog box displays the Microsoft security bulletin referencenumber. Click the reference to find out more about the bulletin and to downloadthe update. To detect missing updates using the MBSA command line interface●From a command window, change directory to the MBSA installation directory,and type the following command:mbsacli /i 127.0.0.1 /n OS+IIS+SQL+PASSWORDYou can also specify a computer name. For example:mbsacli /c domain\machinename /n OS+IIS+SQL+PASSWORD