Improving Web Application Security: Threats and Countermeasures

There are several ways you can obtain patches, including:

• Using MBSA report details . MBSA links to the security bulletin that contains the patch, or instructions about obtaining the patch. You can use the link to download the patch and save it on your local network. You can then apply the patch to multiple computers.

• Windows Update . With a list of the updates you want to install, use Internet Explorer on the server that requires the patch, and access http://windowsupdate.microsoft.com/ . Then select the required updates for installation. The updates are installed from the site and cannot be downloaded for installation on another computer. Windows Update requires that an ActiveX control is installed on the server (you will be prompted when you visit the site if the control is not found.) This method works well for standalone workstations or where a small number of servers are involved.

• HotFix & Security Bulletin Search . MBSA includes the Microsoft Knowledge Base article ID of the corresponding article for a given security bulletin. You can use the article ID at the HotFix and Security Bulletin Search site to reach the matching security bulletin. The search page is located at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/current.asp . The bulletin contains the details to acquire the patch.