Windows Web Solutions UPDATE, March 11, 2003

Windows Web Solutions UPDATE, March 11, 2003

********************

Windows Web Solutions UPDATE--brought to you by Windows Web Solutions, the Windows & .NET Magazine print newsletter with tools and solutions for managing your Web site.
http://www.windowswebsolutions.com ********************

~~~~ THIS ISSUE SPONSORED BY ~~~~

HP and Microsoft Network Storage Solutions Road Show http://www.winnetmag.com/roadshows/nas

~~~~~~~~~~~~~~~~~~~~

~~~~ SPONSOR: HP AND MICROSOFT NETWORK STORAGE SOLUTIONS ROAD SHOW ~~~~ Join the HP and Microsoft Network Storage Solutions Road Show! Now is the time to start thinking of storage as a strategic weapon in your IT arsenal. Come to our 10-city Network Storage Solutions Road Show, and learn how existing and future storage solutions can save your company money--and make your job easier! There is no fee for this event, but space is limited. Register now! http://www.winnetmag.com/roadshows/nas

********************

March 11, 2003--In this issue:

1. COMMENTARY - Behind the Scenes of the SQL Slammer Worm Virus: Readers Respond

2. KEEPING UP WITH IIS - Enabling ASP After IIS Lockdown - Results from Last Issue's Instant Poll: SQL Server Slammer Worm - This Issue's Instant Poll: .NET Web Services

3. ANNOUNCEMENTS - Pharma-IT Summit: Real-World Solutions for Today's Pharma-IT Challenges, March 31, 2003 - Microsoft ASP.NET Connections: Win a Harley Motorcycle

4. RESOURCES - Event Highlight: Spring 2003 VON Trade Show & Expo - Featured Thread: Monitor Web Service Hangs

5. NEW AND IMPROVED - Check your Web Site's Links - Submit Top Product Ideas

6. CONTACT US - See this section for a list of ways to contact us.

********************

1.

COMMENTARY

* BEHIND THE SCENES OF THE SQL SLAMMER WORM VIRUS: READERS RESPOND In my last commentary ( http://www.windowswebsolutions.com/articles/index.cfm?articleid=38138 ), I covered Slammer or Sapphire, a worm that targets systems running either Microsoft SQL Server 2000 or Microsoft SQL Server Desktop Engine (MSDE). Slammer crippled the Web for a long time and affected all Internet users in some way. I also focused on what happened behind the scenes at Microsoft after the worm appeared and the black eye that Slammer gave to the already battered Microsoft security effort. I boldly predicted that as a result of Slammer, every Microsoft product will become a part of Windows Update within the next 6 months. Time will tell how that prediction shakes out, but since my commentary, I've talked to numerous Microsoft employees who have validated my prediction as a good idea--and one that Microsoft is discussing.

I asked you to email me your comments, and I received many interesting and intelligent responses. I stated that many administrators don't install patches and, because of that, IIS 6.0 in Windows Server 2003 is shipping completely locked down with automatic patching enabled. The patch that eliminated the security vulnerability that Slammer exploited was available 6 months before the worm appeared.

I also stated some reasons why administrators don't patch, but I was remiss because I failed to identify one major reason why they don't: the lack of resources to be able to effectively set up a patch-testing environment. Many administrators are afraid of the side effects they often suffer after blindly installing patches without first testing the patches in the proper environment. But testing requires much time and effort--too much, for many overworked administrators. Some administrators have also had a service pack or a patch break something and wreak havoc on their servers and applications. Another factor that causes some administrators not to patch as often as they should is the economy: Downsized support staffs mean that many tasks aren't handled, leaving networks vulnerable to attacks.

Windows Web Solutions UPDATE reader Tariq Hamirani pointed out that another reason administrators don't patch is for fear of Microsoft taking on the role of Big Brother. Hamirani told me about administors' fear of automatic updates sending information to vendors about the machines being updated and their configuration. Hamirani said, "Microsoft may collect information on installed software that might simply have a common key or is flat-out illegal." I don't believe in this particular fear--Microsoft is forthright about what information it collects and when it's collected. Further, I think that companies that run unlicensed software don't have any right to complain about that software.

Anthony Paulina, a network systems architect for CherryRoad Technologies, said, "If your prediction turns out to be true that 6 months from now, all Microsoft products can be updated via Windows Update, my humble opinion is this: It is about bloody time! Currently, Microsoft is underutilizing a really good method of providing fixes for their software. If they provided checks for the other product lines that would be great. Ideally I'd like to see it as a one-stop Web site, unlike today, where you have to go to Office Update for Office and Windows Update for Windows." Richard Rosenheim, CEO of Intelligence Research Systems, agrees: "The idea of having Windows Update handle all the Microsoft updates and patches sounds good to me. In the same vein, I would also like to see SUS [Software Update Services] handle everything (not just critical updates)."

Of course, the Windows Update route might not be as easy as it sounds. Andrew Brust, president and founder of Progressive Systems Consulting, wrote, "One issue with Windows Update is that using it from servers may be tough. Microsoft may need to create a remote console that allows monitoring of pending updates on a collection of servers and applying them via some RPC [remote procedure call]. Otherwise, you have to Terminal Service into each box, log in as an administrator, and click Update. This will just result in more patches not getting applied."

Clearly, Microsoft intends to fix the process problem. Mike Nash, who is vice president of the security business unit at Microsoft and has responsibility for the security component of Trustworthy Computing, said, "The key lesson of Slammer--maybe it's a re-lesson of Slammer--is our work is not done when the patch is available. Our work is done when the patch is installed on the majority of customers' systems." We can glean from his statement that Microsoft acknowledges it's just not there yet. One can only hope it gets there soon.

Tim Huckaby, News Editor, [email protected]

~~~~~~~~~~~~~~~~~~~~

2.

KEEPING UP WITH IIS

* ENABLING ASP AFTER IIS LOCKDOWN Question: "I recently applied the URLScan filter. Now my Active Server Pages (ASP) scripts no longer function, even though I allowed the .asp extension in the urlscan.ini file. What else do I need to do to make ASP work?" To find the answer, click the following link:
http://www.windowswebsolutions.com/articles/index.cfm?articleid=25225

* RESULTS FROM LAST ISSUE'S INSTANT POLL: SQL SERVER SLAMMER WORM The voting has closed in the Windows & .NET Magazine Windows Web Solutions channel's nonscientific Instant Poll for the question, "What systems did the Slammer worm infect?" Here are the results from the 16 responses: - 13% My home systems with MSDE were affected - 6% My production systems with MSDE were affected - 38% My nonproduction SQL Servers were affected - 44% My production SQL Servers were affected

* THIS ISSUE'S INSTANT POLL: .NET Web Services The next Instant Poll question is, "When does your enterprise plan to implement .NET Web services?" Go to the Windows & .NET Magazine Windows Web Solutions home page and submit your vote for a) We already use .NET Web services, b) Within 6 months, c) We plan to, but we're not sure when, or d) We don't plan to use .NET Web services.
http://www.windowswebsolutions.com

3.

ANNOUNCEMENTS

(brought to you by Windows & .NET Magazine and its partners)

* PHARMA-IT SUMMIT: REAL-WORLD SOLUTIONS FOR TODAY'S PHARMA-IT CHALLENGES, March 31, 2003 This annual executive conference highlights the increased focus on network storage, warehousing and security in global pharmaceutical enterprises. Networking, case studies, intensive workshops forums help CIOs, CTOs, CFOs, VPs and other top-decision-makers leverage pharmaceutical IT solutions successfully. Keynote presentations by executives from Aventis, Novartis, Astrazeneca, Hoffman-Laroche and Pfizer, plus US Dept. of Health & Human Services.
http://www.pharmaitsummit.com

* MICROSOFT ASP.NET CONNECTIONS: WIN A HARLEY MOTORCYCLE Microsoft ASP.NET Connections + Visual Studio Connections + SQL Server Magazine Connections equals the largest gathering of Microsoft product architects and independent technology gurus. Three conferences for the price of one! Attendees will have a chance to win a new Harley Davidson motorcycle. Register today and you'll also save $200.
http://www.devconnections.com

4.

RESOURCES

* EVENT HIGHLIGHT: SPRING 2003 VON TRADE SHOW & EXPO March 31 through April 3, 2003 San Jose, California

The Spring 2003 Voice on the Net (VON) Trade Show & Expo is for the IP communications industry. Conference speakers will define problems facing IP communications and what solutions can help grow the industry and help Voice over IP (VoIP) maintain mainstream appeal. The FastNet Futures 2003 conference is co-located with VON. FastNet Futures will cover the Fast Internet and such topics as designing the path to fiber and learning from Japan, Korea, and China.
http://www.von.com

For other upcoming events, check out the Windows & .NET Magazine Events Calendar. http://www.winnetmag.net/events/calendar

* FEATURED THREAD: MONITOR WEB SERVICE HANGS Forum member Craig wants to find a product that can monitor when a Web service hangs--specifically, when a service slows to a crawl without completely stopping. He has tried using performance counters, but they aren't always good at identifying a hung service. To help answer Craig's question, click the following URL:
http://www.winnetmag.com/forums/rd.cfm?cid=41&tid=55232

5.

NEW AND IMPROVED

(contributed by Sue Cooper, [email protected])

* CHECK YOUR WEB SITE'S LINKS REL Software announced Web Link Validator 3.1, an automated Web site management and link checker tool that can find your site's broken links, orphaned files, and slow-loading, outdated, and small pages. Web Link Validator can access secure Web sites and supports a variety of proxy servers. New features include the ability to access external links that require username- and password-based authentication, an expanded selection of reports, and NT LAN Manager (NTLM) authentication support with Security Support Provider Interface (SSPI). The software runs on Windows XP/NT/9x systems and costs $27 for a personal license and $495 for an unlimited enterprise license. Contact REL Software at [email protected].
http://www.relsoftware.com

* SUBMIT TOP PRODUCT IDEAS Have you used a product that changed your IT experience by saving you time or easing your daily burden? Do you know of a terrific product that others should know about? Tell us! We want to write about the product in a future What's Hot column. Send your product suggestions to [email protected].

6.

CONTACT US

Here's how to reach us with your comments and questions:

* ABOUT THE COMMENTARY -- [email protected]

* ABOUT THE NEWSLETTER IN GENERAL -- [email protected] (please mention the newsletter name in the subject line)

* TECHNICAL QUESTIONS -- http://www.winnetmag.net/forums

* PRODUCT NEWS -- [email protected]

* QUESTIONS ABOUT YOUR WINDOWS WEB SOLUTIONS UPDATE SUBSCRIPTION? Email Customer Support -- [email protected]

* WANT TO SPONSOR WINDOWS WEB SOLUTIONS UPDATE? [email protected]

********************

Receive the latest information about the Windows and .NET topics of your choice. Subscribe to our other FREE email newsletters. http://www.winnetmag.com/email

|-+-+-+-+-+-+-+-+-+-|

Thank you for reading Windows Web Solutions UPDATE.

MANAGE YOUR ACCOUNT You can manage your entire Windows & .NET Magazine Network email newsletter account on our Web site. Simply log in and you can change your email address, update your profile information, and subscribe or unsubscribe to any of our email newsletters all in one place.
http://www.winnetmag.com/email

Thank you!

__________________________________________________________ Copyright 2003, Penton Media, Inc.