Microsoft Solutions for Security Security Patch Management Brodie Desimone, CISSP Senior Technology Specialist Michael Nowacki, CISSP Senior Security Technology Specialist

Reduce Frequency, Quantity of Patches Inadequate Communications, Guidance, and Training Inconsistent Patching Experience Multiple, Incomplete Patch Management Tools Inconsistent Patch Quality Customer Feedback

Microsoft Solutions for Security Addressing The Situation Security and patch management priority #1 – bar none – at MicrosoftSecurity and patch management priority #1 – bar none – at Microsoft Microsoft problemMicrosoft problem Industry problemIndustry problem Ongoing battle with malicious hackersOngoing battle with malicious hackers Need comprehensive, tactical and strategic approach to addressing the situationNeed comprehensive, tactical and strategic approach to addressing the situation Trustworthy Computing InitiativeTrustworthy Computing Initiative Security framework and focusSecurity framework and focus Patch Management InitiativePatch Management Initiative

Microsoft Solutions for Security TWC Overview

Microsoft Solutions for Security Microsoft’s Security Framework Clear security commitment Clear security commitment Full member of the security community Full member of the security community Microsoft Security Response Center Microsoft Security Response Center Secure architecture Secure architecture Security aware features Security aware features Reduce vulnerabilities in the code Reduce vulnerabilities in the code Reduce attack surface area Reduce attack surface area Unused features off by default Unused features off by default Only require minimum privilege Only require minimum privilege Protect, detect, defend, recover, manage Protect, detect, defend, recover, manage Process: How to’s, architecture guides Process: How to’s, architecture guides People: Training People: Training SD 3 + Communications Secure by Design Secure by Default Secure in Deployment Communications

Patch Management Initiative Goals Cross divisional team with mission to resolve key patch management issues Consistently high quality Consistently small patch sizes Minimize reboots on patch installation Accurate, effective, easily discoverable, and timely information Process and best practice guidance; training Consistent formats and mechanisms for discovery, applicability evaluation, un- installation, etc. of patches and updates The right set of functionality Easy to deploy, administer, use Interoperability with third party solutions Informed & Prepared Customers Superior Patch Quality Consistent & Superior Update Experience Best Patch & Update Management Solutions

Improve the Patching Experience New Patch Policies Extending support to June 2004Extending support to June 2004 Windows 2000 SP2Windows 2000 SP2 Windows NT SP6aWindows NT SP6a Non-emergency security patches on a monthly release scheduleNon-emergency security patches on a monthly release schedule Allows for planning a predictable monthly test and deployment cycleAllows for planning a predictable monthly test and deployment cycle Packaged as individual patches that can be deployed togetherPackaged as individual patches that can be deployed together Achieves benefits of security rollup with increased flexibilityAchieves benefits of security rollup with increased flexibility Patches for emergency issues will still release immediately

Microsoft Solutions for Security By late 2004: Consolidation to 2 patch installers for W2k and later, SQL 2000, Office & Exchange 2003; all patches will behave the same way (update.exe, MSI 3.0) Improved tools consistency By mid-2004: Consistent results from MBSA, SUS, SMS, Windows Update (will all use SUS 2.0 engine for detection) Reduce patch complexity Reduce risk of patch deployment Now: Increased internal testing; customer testing of patches before release By mid-2004: Rollback capability for W2k generation products and later (MSI 3.0 patches) Reduce downtime Now: Continued focus on reducing reboots By late 2004: 30% of critical updates on Windows Server 2003 SP1 installed w/o rebooting (“hot patching”) Your Need Our Response Improve the Patching Experience Patch Enhancements Reduce patch size By late 2004: Substantially smaller patches for W2k generation and later OS & applications (Delta patching technology, next generation patching installers) Improved tools capabilities May 2004: Microsoft Update (MU) hosts patches for W2k server, and over time SQL 2000, Office & Exchange 2003 By mid-2004: SUS 2.0 receives content from MU & adds capabilities for targeting, basic reporting and rollback

Solution Components Analysis Tools Microsoft Baseline Security Analyzer (MBSA)Microsoft Baseline Security Analyzer (MBSA) Office Inventory ToolOffice Inventory Tool Online Update Services Windows UpdateWindows Update Office UpdateOffice Update Content Repositories Windows Update CatalogWindows Update Catalog Office Download CatalogOffice Download Catalog Microsoft Download CenterMicrosoft Download Center Management Tools Automatic Updates (AU) feature in WindowsAutomatic Updates (AU) feature in Windows Software Update Services (SUS)Software Update Services (SUS) Systems Management Server (SMS)Systems Management Server (SMS) Prescriptive Guidance Microsoft Guide to Security Patch ManagementMicrosoft Guide to Security Patch Management Patch Management Using SUSPatch Management Using SUS Patch Management Using SMSPatch Management Using SMS

Patch Management Guidance Prescriptive guidance from Microsoft for effective patch managementPrescriptive guidance from Microsoft for effective patch management Uses Microsoft Operations Framework (MOF)Uses Microsoft Operations Framework (MOF) Based on ITIL* (defacto standard for IT best practices)Based on ITIL* (defacto standard for IT best practices) Details requirements for effective patch management:Details requirements for effective patch management: Technical & operational pre-requisitesTechnical & operational pre-requisites Operational processes & how technology supports themOperational processes & how technology supports them Daily, weekly, monthly & as-needed tasks to be performedDaily, weekly, monthly & as-needed tasks to be performed Testing optionsTesting options Three patch management guidance offeringsThree patch management guidance offerings Microsoft Guide to Security Patch Management**Microsoft Guide to Security Patch Management**Microsoft Guide to Security Patch ManagementMicrosoft Guide to Security Patch Management Patch Management using Software Update Services***Patch Management using Software Update Services***Patch Management using Software Update ServicesPatch Management using Software Update Services Patch Management using Systems Management Server***Patch Management using Systems Management Server***Patch Management using Systems Management ServerPatch Management using Systems Management Server *Information Technology Infrastructure Library **Emphasizes security patching & overall security management ***Comprehensive coverage of patch management using the specified technology

Microsoft Solutions for Security Windows XP SP2Windows XP SP2 Improved network protectionImproved network protection Safer and Web browsingSafer and Web browsing Enhanced memory protectionEnhanced memory protection Beta by end of 2003, RTM based on customer feedbackBeta by end of 2003, RTM based on customer feedback Windows Server 2003 SP1Windows Server 2003 SP1 Role-based security configurationRole-based security configuration Inspected remote computersInspected remote computers Inspected internal environmentInspected internal environment RTM H2 CY04RTM H2 CY04 Delivering Security Technologies

Client Shielding Enhancements Security enhancements that protect computers, even without patches; Included in Win XP SP2 (H104) with more to follow Helps stop network-based attacks, file attachment viruses and buffer overruns Network Protection: Improved ICF protection turned on by defaultNetwork Protection: Improved ICF protection turned on by default Safer Improved attachment blocking for Outlook Express and IMSafer Improved attachment blocking for Outlook Express and IM Safer browsing: Better user controls to prevent malicious ActiveX controls and SpywareSafer browsing: Better user controls to prevent malicious ActiveX controls and Spyware Memory Protection: Improved compiler checks (/GS) to reduce stack overrunsMemory Protection: Improved compiler checks (/GS) to reduce stack overruns What it is What it does Key Features

Enterprise Shielding Enhancements Enterprise Quarantine Only clients that meet corporate security standards are allowed to connect; included in Win 2003 SP1 (H204) with more to follow Protects enterprise assets from infected computers Enforces specific corporate security requirements such as patch level, AV signature state and firewall stateEnforces specific corporate security requirements such as patch level, AV signature state and firewall state Ensure these standards are met whenEnsure these standards are met when VPN connections are made by remote clientsVPN connections are made by remote clients Wired or wireless connections are made by rogue and transient clientsWired or wireless connections are made by rogue and transient clients What it is What it does Key Features

Microsoft Solutions for Security H1 04 H2 04 FutureToday Extended support Monthly patch releases Baseline guidance Community Investments Windows XP SP2 Patching enhancements SMS 2003 SUS 2.0 Microsoft Update Broad training Windows Server 2003 SP1 Security technologies Next generation inspection NGSCB Windows hardening Continued OS-level security technologies

Microsoft Solutions for Security Security Resources New: IT Pro Security ZoneNew: IT Pro Security Zone New: Security Guidance for the EnterpriseNew: Security Guidance for the Enterprise Subscribe to MSRC notifications:Subscribe to MSRC notifications: Trustworthy Computing:Trustworthy Computing: Hot Fix & Security Bulletin Search:Hot Fix & Security Bulletin Search: url=/technet/security/current.asphttp:// url=/technet/security/current.asphttp:// url=/technet/security/current.asphttp:// url=/technet/security/current.asp

Microsoft Solutions for Security © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.