Fending Off Viruses and Spam 0310

Fending Off Viruses and Spam 0310

In Focus: Fending Off Viruses and Spam

Security News and Features
- Feature: Email Security Suites
- Feature: Using Windows Mobile 2003 to Access Exchange
- Feature: Windows XP SP2 Beta Review
- News: Hundreds of Windows XP Registry Tweaks

* New and Improved
- Enable Secure Remote Access
- Policy-Based Remote-Access Security Solution
In Focus: Fending Off Viruses and Spam...

Last week, Mark wrote about three SMTP authentication solutions that
might help curb junk email and the influx of viruses, worms, and
Trojan horses. Sender Policy Framework (SPF) is already rolled out to
more than 7500 networks; the other two solutions, DomainKeys and
Caller ID for E-Mail, are still in the design and testing phases.
However, it's possible that later this year, DomainKeys and Caller ID
will become available to the public, so you might soon be able to
begin implementing and testing them on your own networks.

For the next 2 weeks, we're conducting a poll that asks which of the
three solutions your company might implement.

In the meantime, a couple other options can help you eliminate junk
mail and prevent malicious software (malware) from entering your
network. One technique that many people use is disposable email
addresses--in other words, using a free email address when you sign up
for newsgroups and mailing lists and changing the address when it
begins to receive a lot of unwanted email.

Spammers harvest email addresses from Web sites, newsgroups, and
mailing lists, so if your email address is posted in any of those
formats or forums, it's likely to begin receiving junk mail. For
example, you might think your participation in a private, members-only
mailing list wouldn't lead to the exposure and misuse of your email
address. But if someone archives that mailing list to a Web site
(which is the case with numerous security-related mailing lists),
eventually spammers will harvest the email addresses for their own
use.

Managing disposable email addresses might seem tedious at first. You
must delete the old address, create a new one, and change your email
address for any forum memberships, but those steps take only a few
minutes and are probably far less time-consuming than filtering junk
mail over long periods of time.

Another technique some of you can use is called selective mail
download. Email clients such as Eudora and Pegasus have such a
feature; Microsoft Outlook and Mozilla don't (at least they didn't the
last time I checked). Selective mail download is when a mail client
downloads a list of the headers of all the messages waiting for the
user on the mail server. The displayed list typically includes the To,
From, Subject, Date, and Size parameters of each waiting message. The
user can then choose which messages to download and which messages to
delete. The user can also view a message's complete SMTP header as
written by the mail servers.

The selective mail download technique doesn't prevent you from having
to work with junk mail, but it does let you filter out countless
viruses, worms, Trojan horses, and junk messages before they make it
to your email client. It also lightens the load on desktop antivirus
and spam-filtering solutions.

Check whether your email client software supports a selective mail
download feature. If your client does, consider using the feature; if
not, consider asking your email software vendor to add it.

Microsoft Security Strategies
Network security is at the forefront of everyone's minds. Microsoft
has teamed with Avanade and Network Associates to bring you a full day
of training to better help you secure your organization and keep it
secure.

If you haven't visited our Event Central Web site recently, check
it out. You'll find information about this event and many others.
Event Central provides a comprehensive listing of trade shows,
conferences, and Web seminars targeted to the IT user.

Registered for Microsoft Tech·Ed?
Tech·Ed in San Diego, CA -- the
definitive Microsoft conference for building, deploying, securing and
managing connected solutions. You'll find 11 conference tracks and
over 400 sessions. Get answers to your technical questions, meet
industry experts, evaluate new products, and take advantage of
extensive networking opportunities.

Free Web Seminar--Streamline User Provisioning and Password Management
Analysts estimate that it costs as much as $50 every time a user
calls the Help desk with a password-related problem. In this Web
seminar, you'll discover the tangible benefits of automating,
provisioning, and centralizing password management as well as how to
reduce support costs and security breaches by leveraging Windows
Server 2003 technology.

Security News and Features

Recent Security Vulnerabilities

Feature: Email Security Suites
The enterprise is experiencing an email security crisis. Spam now
constitutes more than 50 percent of all email, and one in every 30
email messages contains a computer worm or virus. Apart from the real
damage these scourges can do, they eat up CPU resources, deplete
bandwidth, take up disk space, and waste our time. Protecting and
reclaiming email servers from this onslaught should be a top priority
for every network administrator. Check out products that can help in
our Email Security Suites Buyer's Guide.

Feature: Using Windows Mobile 2003 to Access Exchange
Last summer, Microsoft released Windows Mobile 2003, the successor
to Pocket PC 2002. If you're considering implementing a Windows Mobile
device as a PDA standard in your enterprise, you'll want to know about
the new and updated Windows Mobile 2003 connectivity and email
features and some improvements that will enhance the security of your
mail system and your enterprise. Read all about how Windows Mobile
2003 accesses Exchange Server in Joseph Neubauer's article.

Feature: Windows XP SP2 Beta Review
In January, Microsoft issued a semipublic beta of its upcoming
Windows XP Service Pack 2 (SP2), a major upgrade that's focused
largely on security. The XP SP2 beta isn't complete, but it does
provide an interesting look at the direction the company is taking
with its so-called "Springboard" security technologies, which are
designed to retroactively apply recent security thinking to older
products. Sneak a peek into XP SP2 in Paul Thurrott's review.

News: Hundreds of Windows XP Registry Tweaks
The Daily Rotation Web site mirrors news from Geek News Central
(GNC) and various other sites. Recently, when I was scanning headlines
at Daily Rotation, I noticed that GNC had posted a link to the Kelly's
Korner site, which has loads of information for Windows XP users. One
resource I found interesting is the XP Tweaks section, in which you'll
find hundreds of registry tweaks for all sorts of situations, many of
which are tweaks that affect security in one way or another. If you
use XP, you might want to check it out.


Assure On-line Compliance--an on-demand Webcast
Is your organization up to speed on best practices in website
management?
Many organizations find that website management is a critical top
and bottom line business issue, but surprisingly, on-line compliance
is often overlooked. To view an on-demand Webcast "Assuring On-line
Compliance with Industry Standards and Current Legislation.

Instant Poll Results
The voting has closed in the Windows & .NET Magazine Network
Security Web page nonscientific Instant Poll for the question, "Do you
rely on bootable Windows or Linux disks for system recovery and
analysis?" Here are the results from the 58 votes.
- 33% Yes (Windows)
- 36% Yes (Linux)
- 19% No, but I plan to start
- 12% No, and I don't plan to start

Virus Center
Panda Software and the Windows & .NET Magazine Network have teamed
to bring you the Center for Virus Control. Visit the site often to
remain informed about the latest threats to your system security.

Virus Alert: Netsky.D
A new variant of the Netsky worm, Netsky.D, is spreading rapidly.
The worm spreads by sending copies of itself through its own SMTP
engine. Copies of the worm target email addresses harvested by
scanning disk drives (C through Z) of an infected system and network.
Netsky.D tries to disable other worms, such as MyDoom.A and MyDoom.B,
and deletes various registry keys.

Virus Alert: New Bagle Variants
Several new variants of the Bagle virus, including Bagle.F,
Bagle.G, Bagle.H, Bagle.I, Bagle.J, and Bagle.K, have emerged. They
each spread through email and can reach a computer in an attached .zip
file that's password protected and thus can't be scanned by some
antivirus software.

FAQ: How can I restore the contents of the Default Domain and Default
Domain Controller Group Policy Objects (GPOs)?

A. You shouldn't modify the Default Domain and Default Domain
Controller GPOs. Instead, you should create new GPOs and link them to
the relevant containers. However, if you've already modified a GPO and
want to restore the default content, perform the steps outlined in
the FAQ.

Featured Thread: Application Service Ports
(Two messages in this thread)
Christian writes that his company is in the process of setting up
security for its new Web application. The Web application is developed
in ASP.NET Framework and requests data from Microsoft SQL Server 2000,
which generates the reports for the clients. His company needs to
tighten security between the Web server in the demilitarized zone
(DMZ) and the internal network on which the SQL Server system resides.
Christian wants to know what service ports must be open for mixed-mode
authentication for access between the Web server and SQL Server.

==== Event Central ====
(A complete Web and live events directory brought to you by Windows
& .NET Magazine:)

New--Microsoft Security Strategies Roadshow!
We've teamed with Microsoft, Avanade, and Network Associates to
bring you a full day of training to help you get your organization
secure and keep it secure. You'll learn how to implement a
patch-management strategy; lock down servers, workstations, and
network infrastructure; and implement security policy management.
Register now for this free, 20-city tour.

==== New and Improved ====

Enable Secure Remote Access
AEP Systems announced the advanced edition of AEP SureWare A-Gate
AG-600, a 19" rack-mount appliance for small and midsized enterprises
that offers secure remote access to company applications and
resources. SureWare A-Gate AG-600's A-Gate Anywhere component lets
employees and partners access email and other Web-enabled or Windows
Terminal Services applications from any PC running a standard browser.
The appliance's A-Gate Central component gives road warriors and
remote workers full access to client/server applications from a client
PC. SureWare A-Gate AG-600 permits remote access for as many as 400
online users and costs $8995. For more information, contact AEP
Systems on the Web.

Policy-Based Remote-Access Security Solution
OPSWAT and Shavlik Technologies signed an OEM and comarketing
agreement, and OPSWAT released OPSTOP SecurePatch, an enterprise
security solution that lets you create and enforce policies
guaranteeing that only well-patched hosts can gain remote access to
networks. To create a policy, you define an exact list of the required
patches or use an automatically updated list (from Microsoft, for
example). OPSTOP SecurePatch leverages Shavlik's HFNetChk scanning
engine and Shavlik's HFNetChkPro patch-management solution. For more
information about the partnership and the products, contact OPSWAT. You can also reach the company on the Web.