ITinfo: Microsoft Security Programs Yield Conflicting Results

Windows Users Confused

Answers from security analyzers conflict

ITINFO Sponsor

Fast, unlimited hits. Secure SSL servers.
100MB web & ftp storage.
4 Apache SSL-Stronghold webservers.
Unlimited email aliasing, redirection, and autoresponders.
4 multi-homed T3 & T1 lines on the primary backbone.
24/7 Monitoring
Daily access reports
Free, fast & accurate domain registration.

host@dgl.com
DGL Super-Fast Website Hosting

Internet Poll

Have you attended a seminar via e-learning?

	yes
	no
poll archive

Microsoft Security Programs Yield Conflicting Results

by Dave Murphy
ISSN 1535-3613

Most users of Microsoft Windows are familiar with the Windows Update (WU) feature that scans their personal computer and compares its configuration with patches and updates available from Microsoft's Web site. Many system administrators have noticed that the free Microsoft Baseline Security Analyzer (MBSA), reported in this newsletter a few days ago, reports security lapses in system configurations even though the WU reports the system is fully patched and updated.

During a scan of the system, WU reviews the system registry for the presence of installed security patches. If the registry key for a suggested patch is noted, WU does not offer the user the option of downloading and installing the patch. However, users are finding that incomplete patch downloads or installation snags are recording the registry keys even though the patches aren't properly installed.

Using a different technique, MBSA and HFNetChk, another free scanning tool on which MBSA is based, actually scan the system's hard drive for the presence of patches and report any that are missing. However, these programs only search for patches that were released in conjunction with a Microsoft security bulletin.

The bottom line, security-conscious users are getting mixed messages. WU may report their system is fine, MBSA or HFNetChk may report a different answer, and in neither case is the user guaranteed that the system is fully patched and updated.

According to eWeek magazine, Microsoft officials acknowledge the confusion but said much of it has been triggered by two patches—MS02-008 and MS02-009—which were updated after their release and have caused WU and MBSA to report conflicting results. But the company is working to reconcile the differences among the tools.

Dave's Opinion

I noticed the discrepancy between WU and MBSA a two weeks ago, and I figured it was a random anomaly. That is until I saw the problem pop up on other Windows systems. Today I've read a number of articles from IT authors that they, too, are having problems ensuring their systems are secure and ready for the net.

Call for Comments

What do you think? Leave your comments on the message center.

References

Microsoft
eWeek
Message Center

Microsoft Releases Free Security Analyzer

Damar Group, Ltd. helps business use technology.

ITINFO is again accepting sponsors. Sponsor messages are included in ITINFO's email newsletter and are permanently posted to DGL's website and online reference areas.

ITINFO is an electronic publication of Damar Group, Ltd., publisher of Training Express computer learning guides. Comments and submissions to info@dgl.com.

Previous issues are on our website at http://dgl.com/itinfo/.

updated April 25, 2002
http://dgl.com/itinfo/2002/it020425.html