Forefront Security for Microsoft OCS Unveiled

Forefront Security for Office Communications Server (FSOCS) was released to manufacturing, Microsoft announced on Tuesday. The solution is designed to protect an organization's network from malware spread through instant messaging (IM). It also provides a filter to support corporate compliance policies.

The FSOCS solution works with Microsoft's Office Communications Server, a unified communications product that enables voice-over-IP telephony, e-mail, video and collaboration. Microsoft rolled out a "launch experience" of OCS 2007 Release 2 in early February.

Microsoft's FSOCS product includes five antivirus suites from Microsoft's security solution partners. The antivirus software comes with the product, without additional costs or licensing, according to Microsoft. IT support personnel can configure the solution to run certain antivirus engines. Alternatively, all of the engines can be run at the same time.

IT personnel can support compliance guidelines for IM traffic using a filter in FSOCS. Messages using certain keywords can be blocked. The filter can be set to block files of a certain size. It can also block file types, such as .exe files, even if the extension has been renamed, according to a Microsoft video.

This FSOCS release provides 64-bit support for OCS 2007 R2 and OCS 2007 Enterprise Edition servers. It also integrates with OCS 2007 Access Edge Server, a component that connects outside users to the OCS network and helps with federation.

A Microsoft FAQ explains that FSOCS can be purchased as a single product or as part of the "Enterprise CAL Suite and Forefront Security Suite." Microsoft also offers a free 120-day trial version, which can be downloaded here.

‘Crossing Over’: Hard Traveling, By Kurt Loder
March Security Bulletin Issued Without Excel Fix
Microsoft’s DNS Patch Flawed, Security Official Says

First Data-Based Security Maturity Model Released

A newly released maturity model could be the first to shed new light on how enterprises are implementing security initiatives in their internal software development efforts.

Security consulting firm Cigital and security solutions provider Fortify Software have together published the Building Security In Maturity Model (BSIMM), derived from the companies' study of the security initiatives of two large players in the financial services industry and seven major technology companies.

BSIMM (pronounced "bee-simm") is based on observations of enterprise security initiatives at Microsoft, Google, Qualcomm, Adobe Systems, EMC, Wells Fargo Bank and the Depository Trust & Clearing Corporation (DTCC). Two other companies who participated declined to be identified.

Gartner Fellow Joseph Feiman believes that the BSIMM is the first maturity model (a tool for describing and assessing an organization's processes) for security initiatives developed from real-world data. "It's a very good idea, and an important first step," Feiman said

A maturity model for security initiatives might help bridge the gap that typically separates businesspeople from technology people, he added. "Processes and methodologies are things that CIOs and department managers know," he said. "The BSIMM provides this maturity model, which would be accepted by those not on the security team."

The BSIMM is based on in-depth interviews with nine companies chosen from 35 organizations the authors considered as having implemented the most successful software security initiatives in the world. They collected a range of data on each organization's software security activities, including things like strategy and metrics, standards and requirements, security testing, code review, and training.

"Our goal was to build an empirical model for software security based on real, observed practices," said Gary McGraw, Cigital's CTO and co-author of the BSIMM.

Based on their observations, the authors compiled a list of 110 practices organized around a Software Security Framework (SSF), which provides a "conceptual scaffolding" for the BSIMM. McGraw emphasized that most organization shouldn't attempt to adopt all 110 practices. "Just do what's smart," he said. В 

A place to start is with 10 activities the authors consider as the core model, said Sammy Migues, Cigital's director of knowledge management and a co-author of the BSIMM. According to the BSIMM, these 10 activities are:

"Create evangelism role/internal marketing. Create policy.Provide awareness training.Create/use material specific to company history.Build/publish security features (authentication, role management, key management, audit/log, crypto, protocols).Have software security group lead review efforts.Use automated tools along with manual review.Integrate black box security tools into the QA process (including protocol fuzzing).Use external penetration testers to find problems.Ensure host/network security basics in place."

The willingness of most of the companies involved to allow their names to be used was a significant surprise, said Brian Chess, Fortify's co-founder and chief scientist and the third author of the BSIMM. "We were floored when we came back, showed them the BSIMM, and seven of the nine companies agreed to allow us to use their names," Chess said.

While companies like Microsoft have been straightforward about what they're doing about software security, others like Wells Fargo rarely disclose what they do around security, Chess said. "I hope this helps to build something that's really missing: a community of software security practitioners," he said.

Steve Lipner, senior director of security engineering strategy in Microsoft's Trustworthy Computing Group, sees the BSIMM as something of a validation of Microsoft's Security Development Lifecycle (SDL). "We do virtually all of the activities defined by the BSIMM," he said. "And about three-quarters of the BSIMM activities are covered by the SDL. The rest are covered by other internal Microsoft security and privacy policies."

The next step is to grow the model, McGraw said. "We want to get to the next nine companies. We might find a 111th activity that clarifies the picture even more."

The authors also want to take their maturity model down-market, Migues said. "We don't know how this model applies to smaller companies," he said. "This comprehensive set of activities appears to work really well for large, established software security groups. But when you have 50 or 100 developers and a small pocket book, and you don't have five or 10 years to evolve, what does that mean? We intend to find out."

Perhaps more important than size is finding out whether this can be applied to companies that are not as technology-focused as those who participated in the BSIMM, Feiman said. "What the BSIMM could use in the future is some recommendations for late technology adopters."

The BSIMM is available now under a Creative Commons license.


Adobe Issues Critical PDF Reader Patch
What Makes ‘Watchmen’ Such A Gutsy Movie?
A ‘Watchmen’ Primer, For Nerds And Newbies
Forefront Security for Microsoft OCS Unveiled

IE Market Share Has 'Stabilized,' Study Finds

A study polling the use of Web browsers and operating systems affirmed Microsoft's dominant market position on both fronts. The March study, published this week by Janco Associates Inc., sampled 465,340 visitors to 13 e-commerce and enterprise-themed Web sites.

Windows Vista continued its slow climb in Janco's poll, with 19.5 percent using Microsoft's flagship OS. Still, that figure is nearly double the use reported in a January Forrester Research study, which found that "fewer than 10% of all PCs within enterprises" were using Vista. The Janco study described Vista's slow adoption as a Microsoft "blunder," noting that it has been 27 months since the availability of Vista Release Candidate 1.

Internet Explorer has "stabilized" its lead over other browsers after a somewhat bumpy ride, according to Janco's research. The study found that Internet Explorer had a 72.2 percent market share in March, up from 69.7 percent in March 2008. Mozilla's Firefox browser held second place at 17.2 percent market share, and Google Chrome was in third place with 2.8 percent market share. Other browsers were statistical blips, falling under 1 percent use.

"The major browser findings of the study are: Microsoft's Internet Explorer's market share has stabilized and Google's Chrome is a non-event," stated Victor Janulaitis, Janco's CEO, in a prepared statement.

Chrome use dropped in the study from 5 percent in March 2008 to 2.8 percent in March 2009. Janulaitis suggested some possible reasons for Chrome's decline in an e-mail.

"First is that once people see a basic flaw, like the lack of ability to access XML files with Chrome, they reject it," he wrote. "Also, the small icons that show the sites visited put a lot of users off."

The Apple Safari browser, at 0.6 percent market share in Janco's study, held fifth place. Even the aging Netscape browser beat Safari, although Netscape is no longer supported by AOL. However, at least one study has found higher figures for Safari use, such as Net Applications' Market Share, which found that Safari was used by 6.8 percent in March.

Janco's study, "Browser & OS Market Share White Paper," can be accessed here. About half of those sampled in the study were located in the United States, with 46 percent abroad. The study also provides sampled data on the use of other operating systems besides Vista, according to Janulaitis.


Windows 7 Is ‘Rescuing’ Apps, Microsoft Says
IE 8 Fastest Browser, Microsoft Says
‘Twilight’ Star Robert Pattinson Talks About Nude Scenes In ‘Little Ashes’

System Center Virtual Machine Manager 2008 R2 Beta Now Available

Microsoft on Friday released the latest beta version of its virtualized server management system. The new System Center Virtual Machine Manager (SCVMM) 2008 R2 beta is especially notable for supporting "live migration," a key virtualization feature not supported in the earlier SCVMM 2008 product.

Live migration lets users move virtual machines (VMs) from one machine to another within a virtual host cluster with little or no downtime, according to Microsoft's Virtual Machine Management blog. The main restrictions are that the "host processors must be from the same manufacturer" and all hosts "must have access to shared storage," the blog explained. Live migration was a notable feature of Windows Server 2008 R2, which was released as a beta in January.

The SCVMM 2008 R2 beta also includes improved support for clustered shared volumes. Previously, SCVMM 2008 supported just one logical unit number (LUN) per VM, which can cause confusion when moving VMs. This restriction is lifted in the SCVMM 2008 R2 beta, according to Rakesh Malhotra, Microsoft's group program manager for SCVMM.

"With CSV (Clustered Shared Volumes) in Windows 2008 R2, a single LUN is accessible by all hosts within a cluster," Malhotra wrote in his blog. "This enables a VM that's on a shared LUN to be migrated without affecting other VMs on that LUN."В 

The beta also features storage area network (SAN) improvements. You can now migrate SANs into and out of clustered hosts, which allows VM migration between those hosts. You can also add or remove virtual hard disks running on a VM without downtime, according to Microsoft.

Two new network speed-up technologies are supported in the beta. Virtual Machine Queue is designed to improve network throughput, and TCP Chimney helps reduce CPU burdens by offloading TCP/IP traffic, according to Microsoft.

The beta also has a new "maintenance mode" feature that lets users change hardware or Hyper-V configurations without worrying about the VMs that are running.

"This [maintenance mode feature] migrates all the virtual machines off the computer (if it is in a cluster, otherwise it places the virtual machines into a saved state) and ensures that no new virtual machines are started on the system until you take it out of maintenance mode," explained Ben Armstrong, Microsoft's program manager for the core virtualization team, in his blog.

The beta of SCVMM 2008 R2 can be accessed here by Microsoft Connect subscribers with a Windows Live account. Signing up requires completing a short survey before downloading the beta.

SCVMM 2008 R2 beta currently provides management support for VMware ESX, Microsoft Virtual Server 2005 R2 and Windows Server 2008 with Hyper-V.


Juan Antonio Bayona To Direct ‘Eclipse’?
IE8 Will Be Removable from Windows 7
‘Terminator Salvation’ Trailer, Shot By Shot: Meet The Cyborg
Windows 7 Is ‘Rescuing’ Apps, Microsoft Says

Cisco Enters Server Market

Cisco Systems Inc., the IT industry’s leading supplier of routers and other networking hardware, is expanding its hardware offerings to include blade servers as part of a comprehensive push into the white-hot world of virtualization.

The blade server architecture is one part of the "Cisco Unified Computing System" (UCS), which also includes networking and storage management capabilities. Cisco envisions an end-to-end datacenter solution, with virtualization technology underpinning the infrastructure. Cisco has put in place partnership deals with a number of giant hardware and software vendors to supply these needs, including Microsoft, VMware, NetApp, BMC, Red Hat, EMC, Novell, Accenture and others.

Cisco, at least initially, is only making blade servers. It includes the Cisco UCS 5100 Series Blade Server Chassis, which supports up to eight blade servers. Those servers will be Cisco UCS B-Series Blade Servers outfitted with Intel Xeon processors. Other products in the line include switches, fabric extenders and network adapters.

All of those components can be virtualized, which will give such a system a great deal of flexibility and scalability. Since virtualization abstracts software from the underlying hardware, multiple operating systems and applications can be loaded on a single server, unlike older systems which generally ran one OS and one application per server. That can lead to big savings on hardware, as well as reduce significant datacenter costs like space, cooling and power.

The announcement is further proof of the skyrocketing popularity of virtualization, which many in the industry believe will thrive in the current economic environment, given its proven and quick return on investment (ROI). Although Cisco says on its Website that it supports both "virtualized and non-virtualized systems," the very idea of a unified computing system implies virtualization. And although companies could use the hardware in a physical-only environment, San Jose, CA-based Cisco has tied its value squarely to its use in virtualized datacenters.

It is also a direct shot across the bow of traditional server vendors like IBM, HP and Dell. Burton Group Analyst Chris Wolf, who specializes in virtualization, called today's announcement "A pretty big deal. There's another competitor now in the server market, which is good. It pushes innovation and pushes the stalwarts."

Although Wolf says Cisco "has a good product," he's not sure how quick uptake will be. "It might take time to penetrate enterprises ... and the server market. It will put pressure on vendors like HP, IBM and Dell."

UCS will be offered with hypervisors and management platforms from both VMware and vSphere (formerly known as Virtual Datacenter Operating System, or VDC-OS), and Microsoft, with Hyper-V and System Center Virtual Machine Manager. Wolf said that Cisco made a good choice in its partnerships. "VMware and Microsoft are the top two vendors in this space, so it makes sense to support those platforms."

Kusnetzky Group Analyst Dan Kusnetzky, in a blog entry, had some questions about Cisco's announcement. He wrote:

This would place them in direct competition with Dell, HP and IBM. The key question that should be in potential customer’s minds is “are they ready?”

...Dell, HP and IBM each have a track record supporting customers increasingly complex environments. This means having relationships with all of the suppliers of operating systems, application frameworks, applications, security software, management tools and virtualization technology. At this point, Cisco does not have a portfolio of products, services, partnerships and alliances that comes close to those fielded by HP or IBM.

Wolf said he believes that the market can support another hardware player, even in the current economic environment. "I think the timing is right, because of the rapid move to virtualization. Virtualization projects aren't slowing down; they're doing just the opposite because of the economy."

He added that he believes Cisco's hardware products are strong right out of the gate, and should garner a lot of interest from businesses. "I think the blade is a good way to get started. You need high I/O, and the Cisco chassis provides that as well."

Wolf went even further, stating that the Cisco strategy is another nail in the coffin of traditional datacenter computing. "The days of building a server platform to run one application are over," he said.

Product availability and pricing information was not given.


Forrester: Businesses Adopting Virtualization
System Center Virtual Machine Manager 2008 R2 Beta Now Available

Hackers Enlist Search Engines for Phishing Attacks

Hackers are increasingly attempting to influence search engines to misdirect users to spurious Web sites. Last week, software security firm Marshal highlighted the phishing-attack problem and the role of search engine optimization (SEO) in a blog post.

Users who are misdirected by the search results typically get hit by a fake security dialog box telling the user to download a fake antimalware program. The misrepresentations that show up in search-engine results include sites mimicking the California Franchise Tax Board and college basketball Web sites, among others, according to Marshal.

Spokespersons for search engine providers Microsoft and Google did not talk directly about what measures their companies take to ensure that search rankings don't divert users to malicious Web sites. Possibly, neither wants to give hackers information or divulge trade secrets.

One of the measures that Microsoft took with its Internet Explorer 8 browser is the addition of a SmartScreen filter that displays popup warnings when users click on links suspected to lead to malicious Web sites, according to a Microsoft spokeswoman. The filter is "URL-reputation-based" and runs a diagnostic scan of the servers hosting downloads to determine if those servers have a track record of parsing out malicious content. Presumably, users will take a common-sense approach and not go to such sites.

Google, for its part, has guidelines on what Webmasters should and shouldn't be doing, explained Google spokesman Nate Tyler, in an e-mail. Google expels Web pages from its search results when Webmasters use programmatic queries to improve search rankings. It also forbids the use of link schemes with hidden coding or the creation of doorway pages used specifically to increase clicks and move up in search rankings. Again, the implication here is that with golden rules in place, users should act at their own discretion.

Hackers also add bad links to other Web sites, particularly in the comments sections. When that's done to blogs, the practice is known as blog spamming. The links typically connect with automated tools that can help hackers gain entry into a computer.

Still, there's no way to prevent people from visiting malicious Web sites and no firewall rule for foolish behavior.

"Unfortunately, there is no Holy Grail product to solve this issue," said Paul Henry, security and forensic analyst at Scottsdale, Ariz.-based Lumension. "Links to increase the SEO for a given Web page -- and, just as concerning, links added that direct users to malware-laden pages -- are increasing at an alarming rate. The most effective mitigation would of course be to make sure that your browser and any related add-ons are fully patched and up to date and does what it is supposed to do."


Microsoft’s DNS Patch Flawed, Security Official Says
IE 8 Fastest Browser, Microsoft Says
‘Watchmen’ Easter Eggs: Our Favorite Blink-And-You’ll-Miss-’Em Moments

Windows 7 Getting Fine Tuned, Features Added

Microsoft on Friday described even more user interface tweaks and bug fixes being carried out by the Windows 7 engineering team in preparation for the release candidate version of the operating system. The release candidate will be the near-final production version of the OS prior to general product release.

This time, Microsoft listed 27 updates to the Windows 7 Beta. The engineering team explained that Microsoft is making most of those changes in response to user feedback. The new updates add to 36 fixes that were reported by the engineering team late last month.

Notably, the team fixed a bug in the Windows 7 Beta where USB devices, such as keyboards and mice, sometimes stopped working after users put the OS into suspended mode and then resumed their sessions. The workaround was unplugging the dead device and plugging it back into the port. Thankfully, you won't have to do that with the release candidate version, according to Microsoft's engineers.

Another hardware-type problem with the Windows 7 Beta involved 1394 HDV cameras. Some users had problems streaming camera content to the PC, but that's been fixed for the release candidate version, according to Microsoft's announcement.

The "new folder" button, which creates folders to store files, is now available at the top of the menu rather than hidden in a submenu. However, Microsoft also fixed a confusing problem in the Windows 7 Beta where that button disappeared when something was selected.

For those concerned with disk space, Microsoft cut down on the amount of drive space grabbed by the Windows Recovery tool, as well as the BitLocker security feature. It's been cut in half, from 200 MB to 100 MB, in the release candidate version.

We all want to save time in our busy days, and the Windows 7 engineering team will save you 400 milliseconds on shutdown and logoff times in the release candidate version of the OS. They accomplished this feat by shaving bits off the associated WAV sound files.

Most of the improvements described by the engineering team concerned the user interface in Windows 7. For instance, the team has improved user control over popup lists. When thumbnails representing windows get long, they collapse into lists. What's new for the Windows 7 release candidate is that you can now open a list item by simply hovering the mouse icon over the item. In addition, there's now a close button on the list.

The release candidate will also allow you to pin items in the desktop jump list, so they are always accessible. Moreover, the jump list for the control panel now automatically shows the user's most recently visited connections at the top of the list.

Microsoft describes all of the updates at its Engineering Windows 7 blog, which can be accessed here.

In other Windows 7 news, a March 12 blog post by Microsoft IT Pro Evangelist Jeff Alexander had showed charts clarifying Microsoft's Windows 7 product lineup, which was announced in early February. The blog post was removed at the time of this article's publication. However, it showed a table listing the six SKUs (stock keeping units) of Windows 7, along with key features associated with those products.

If the Alexander's post was correct, Windows 7 Professional will lack five features that are part of the full-featured Windows 7 Enterprise and Windows 7 Ultimate editions.

Referring to the now missing table, Alexander wrote, "You might notice that BitLocker, BitLocker To Go, AppLocker, DirectAccess, Branch Cache are not part of Windows 7 Professional, which is targeted at the small to medium sector. You need to have Enterprise or Ultimate to get those features." The sixth item not included in Windows 7 Professional edition, according to the table, was Multiple User Interface Language Packs.

It's not clear if the table in Alexander's post was removed because the information was wrong or not, but Microsoft hasn't otherwise publicized all of the features for the Windows 7 SKUs -- to my knowledge. Upgrading will be easy as all of the OS' features are there. They get unlocked when you upgrade to the next Windows 7 license.

Alexander also claimed that all Windows 7 versions will work on netbooks, which are small, low-tech laptop computers.

"And lastly many of you have asked about which SKU will work best with Netbook PC's," he wrote in the missing blog. "All SKU's will work on many of these devices and I have a loaned Pioneer Netbook running Windows 7 Ultimate just fine."

Microsoft has yet to announce when its Windows 7 products will appear. The rumor is that PCs running the new OS will be on the market before the December holidays.

Selena Gomez To Star In ‘Beezus And Ramona’ Movie
Windows 7 Is ‘Rescuing’ Apps, Microsoft Says