1. Module 6: Patches and Security Updates 1

2. Overview Installing Patches and Security Updates Recent patches and security updates for IIS Recent patches and security updates for Apache Recent patches and security updates for some other web server (TBD) 2

3. 3 Installing Patches and Security Upates

4. Installing Patches and Security Updates

5. MS10-019 MS10-020 MS10-025 MS10-026 MS10-027 MS10-021

6. Installing Patches and Security Updates IIS 5.0 is the version installed by default on W2K computers. If you have SP4 for W2K (and you should), these are the patches that you need to apply to your computer: 327696 MS02-062 321599 MS02-028 319733 MS02-018 6

7. Other IIS Patching Tools You should also look at the IIS Lockdown Tool and URLScan which are valuable tools for "anti-IIS" activity protection: URLScan Security Tool (v2.5) IIS Lockdown Tool (v2.1)

8. IIS 5.1 Required Patches IIS 5.1 is the version available on Windows XP computers. Although it is not installed by default on XP Pro computers, it's still a big security concern. This patch is a cumulative patch that includes the functionality of all security patches released for IIS 5.1 since Windows XP Service Pack 1: 327696 MS02-062:327696 321599 MS02-028:321599 319733 MS02-018:319733

9. Improved Patch Management No service interruption while installing patches. Auto Update. Windows Update Corporate Edition. Resource Free DLLs.

10. Options to Obtain Security Updates Option Microsoft Security Notification Service Newsletter Windows Update SUS

11. Security update Deployment OPTIONDEPLOYMENT Microsoft Security Notification Service Newsletter Manually download the updates and then deploy them manually or automatically by using a software distribution program, such as Microsoft System Management Server. Windows Update Configure Windows Update to do one of the following SUS Configure the SUS to provide updates to the Web server through an updated version of Windows Update called Automatic Updates.

12. Vulnerability Rating RATINGDESCRIPTION Critical A vulnerability that, if exploited, might allow the propagation of an Internet worm without user action. Important A vulnerability that, if exploited, might result in a compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources. Moderate A vulnerability risk that can be mitigated by factors such as default configuration, auditing, or difficulty to exploit. Low A vulnerability that is extremely difficult to exploit, or that has minimal impact.

13. 13 Recent patches and security updates for IIS

14. Security updates Deny resource access by default and only allow resource functionality as desired. Log all web requests as they help identify suspicious activity. Subscribe to the Apache Server Announcement mailing list which can send updates, patches and security fixes.

15. 15 Recent patches and security updates for Apache

16. Security updates Disable default services such as FTP and SMTP unless you need them. Disable the directory browsing function unless it is required as it allows visitors to see which files are running on your system. Disable any FrontPage Server Extensions that are not being used.

17. 17 Recent patches and security updates for OWS

18. 18