Overview • Installing Patches and Security Updates • Recent patches and security updates for IIS • Recent patches and security updates for Apache • Recent patches and security updates for some other web server (TBD)
Installing Patches and Security Updates • MS10-019 • MS10-020 • MS10-025 • MS10-026 • MS10-027 • MS10-021
Installing Patches and Security Updates IIS 5.0 is the version installed by default on W2K computers. If you have SP4 for W2K (and you should), these are the patches that you need to apply to your computer: • 327696 MS02-062 • 321599 MS02-028 • 319733 MS02-018
Other IIS Patching Tools You should also look at the IIS Lockdown Tool and URLScan which are valuable tools for "anti-IIS" activity protection: • URLScan Security Tool (v2.5) • IIS Lockdown Tool (v2.1)
IIS 5.1 Required Patches • IIS 5.1 is the version available on Windows XP computers. Although it is not installed by default on XP Pro computers, it's still a big security concern. • This patch is a cumulative patch that includes the functionality of all security patches released for IIS 5.1 since Windows XP Service Pack 1: • 327696 MS02-062: • 321599 MS02-028: • 319733 MS02-018:
Improved Patch Management • No service interruption while installing patches. • Auto Update. • Windows Update Corporate Edition. • Resource Free DLLs.
Security updates • Deny resource access by default and only allow resource functionality as desired. • Log all web requests as they help identify suspicious activity. • Subscribe to the Apache Server Announcement mailing list which can send updates, patches and security fixes.
Security updates • Disable default services such as FTP and SMTP unless you need them. • Disable the directory browsing function unless it is required as it allows visitors to see which files are running on your system. • Disable any FrontPage Server Extensions that are not being used.