Three Tools Boost Windows Security

Responding to concerns that it is too difficult to track the security status of Windows PCs, and that the default settings of Internet Information Server (IIS) are too open, Microsoft has released three free security tools. Hot Fix Checker is a command-line tool that helps administrators determine whether security patches have been applied to servers; the Personal Security Advisor is a Web service that helps users determine the overall security state of desktop PCs; and the IIS Lockdown tool tightens the security settings of IIS.

The need for better security-checking tools has been highlighted by recent attacks such as “Code Red,” which exploited known bugs for which Microsoft had already released patches or updates. The success of the attacks suggests that the overwhelming number of patches Microsoft has released in the last several months to address memory leaks, buffer overflows, and other code problems have made it too hard for administrators to track which patches they need to apply. (For more information on recent security issues, see “Secure Windows Initiative to Tackle Security Vulnerabilities” on page 13 of the Aug. 2001 Update.)