Microsoft Tightens Windows Server 2003 Security

By Larry Seltzer  |  Print this article Print


Desktop-as-a-Service Designed for Any Cloud ? Nutanix Frame

Microsoft ships the first release candidate for Windows Server 2003 Service Pack 1, a security update that makes many of the changes in Windows XP SP2, plus many new network access security enhancements.

Microsoft Corp. has made available for download the first release candidate of a major security update to Windows Server 2003.

The 316MB download contains many of the changes that Windows XP Service Pack 2 brought to that operating system against buffer overflows and other common attacks, including specific support for "no execute" processors.

How has Microsoft's monthly patch release changed the patching habits of enterprises? Find out here.

It also adds a new Security Configuration Wizard, which uses a role-based approach to remove unnecessary services, diminishing "the attack surface." The wizard asks a series of questions about the tasks performed by the server and disables services unnecessary to those roles. The wizard is not installed by default.

To further tighten security on new installations, the Post-setup Security Update Wizard blocks all incoming traffic until the latest updates are applied and Automatic Updates are configured.

The Service Pack adds the Windows Firewall, perhaps the most significant addition to Windows XP SP2. The new firewall is manageable using Windows group policy. Just as with Windows XP SP2, Microsoft acknowledges that the changes in Windows Server 2003 SP1 are basic enough to the behavior of the operating system that they may affect application behavior. The company argues that the improvements are important enough that applications should be changed to accommodate them.

For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzer's Weblog.

SP1 enhances authentication for RPC and DCOM interfaces, which have been popular avenues for attack in the past. A new Network Access Quarantine Control delays access to remote networks until the configuration of those networks has been audited. And VPN Quarantine allows the system to require that clients connecting through a virtual private network have the latest security updates. Finally, an auditing capability has been added for the IIS Metabase, the XML-based data store for the Internet Information Server Web server.

Check out eWEEK.com's for the latest security news, reviews and analysis.

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...