Improving Web Application Security: Threats and - CGISecurity

768 Improving Web Application Security: Threats and CountermeasuresMore InformationFor more information about developing with a non-administrative account, see thefollowing articles:● “Essential .NET Security,” at http://www.develop.com/kbrown/book/html/lifestyle.html●“Developing Software in Visual Studio .NET with Non-AdministrativePrivileges,” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechart/html/tchDevelopingSoftwareInVisualStudioNETWithNon-AdministrativePrivileges.aspPatch and UpdateEnsure that your workstation has the latest service packs and patches. Check theoperating system, IIS, SQL Server, MSDE, Microsoft Data Access Components(MDAC), and the .NET Framework. Microsoft offers several tools and methods tohelp you scan and update your system. These include the Windows Update site,the Microsoft Baseline Security Analyzer (MBSA) tool, and the Automatic Updatesfeature.Using Windows UpdateYou can use Windows Update (available from the Start menu) to scan for updatesand patches for Windows. Alternatively, you can directly scan for updates athttp://windowsupdate.microsoft.com.Note After you update your system using the Windows Update site, use MBSA to detect missingupdates for SQL Server, MSDE, and MDAC.Using MBSAYou can use MBSA to assess security and to verify patches. If you used automaticupdates or Windows Update to update your operating system and components,MBSA verifies those updates and additionally checks the status of updates for SQLServer and Microsoft Exchange Server. MBSA lets you create a script to checkmultiple computers. To detect and install patches and updates1. Download MBSA from the MBSA home page at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/Tools/mbsahome.asp.If you do not have Internet access when you run MBSA, MBSA cannot retrievethe XML file that contains the latest security settings from Microsoft. You canuse another computer to download the XML file, however. Then you cancopy it into the MBSA program directory. The XML file is available athttp://download.microsoft.com/download/xml/security/1.0/nt5/en-us/mssecure.cab.