Ten Immutable Laws Of Security (Version 2.0)

Having a secure computer is not only about the operating system.  As the Microsoft Security Response Center (MSRC) has seen, there are some things that neither Microsoft nor another software vendor can fix.  This is because, although they are real security problems, the problems are not from product flaws.

Dilbert by Scot Adams

Being aware of phishing attempts is only part of having good judgement.  The MSRC delves into the details of the 10 Immutable Laws of Security identified in the following summary.

The 10 Immutable Laws Summary

• Law #1: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore.
• Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore.
• Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.
• Law #4: If you allow a bad guy to run active content in your website, it's not your website any more.
• Law #5: Weak passwords trump strong security.
• Law #6: A computer is only as secure as the administrator is trustworthy.
• Law #7: Encrypted data is only as secure as its decryption key.
• Law #8: An out-of-date antimalware scanner is only marginally better than no scanner at all.
• Law #9: Absolute anonymity isn't practically achievable, online or offline.
• Law #10: Technology is not a panacea.

Learn how using sound judgement will help to improve the security of your computer in the Ten Immutable Laws Of Security.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Security Bulletin Advance Notification for June, 2011

On Tuesday, June 14, 2011, Microsoft is planning to release sixteen (16) bulletins addressing 34 vulnerabilities in Microsoft Windows, Microsoft Office, Internet Explorer, .NET, SQL, Visual Studios, Silverlight and ISA. Nine of the bulletins are identified as Critical in severity and seven as Important.

Although it is advised to restart your computer after installing updates, whether required or not, a number of the scheduled bulletins will require a restart in order to install the updates.  I recommend installing the update to .NET Framework separately as well as other updates requiring a restart.

The Internet Explorer bulletin will address one of the known vectors to the cookie folder related to "“cookiejacking.”  Cookiejacking allows an attacker to steal cookies from a user’s computer and access websites the user has logged into.  Note, however, that the Microsoft Malware Protection Center (MMPC) has not detected attempts to use this technique.

References

• MSRC Blog: June Advance Notification Service and 10 Immutable Laws Revisited
• TechNet: Advance Notification Service for the June 2011 Security Bulletin Released

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Critical Java Security Update

Oracle Java released an  update to Java Runtime Environment (JRK).  The full internal version number for this update release is 1.6.0_26-b03 (where "b" means "build"). The external version number is 6u26.

The Critical Patch Update contains seventeen (17) new security vulnerability fixes for Java SE.  As explained in the Executive Summary, all of the vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.

Although Java is not required (See Do You Need Java?), if you do have Java installed on your computer, it is advisable to install the latest update.

Download Information

Download Link: Java SE Runtime Environment 6u26.  Accept the License agreement and select the correct version for your operating system.

Note: UNcheck any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.

Please check add/remove programs to ensure that you have uninstalled all prior (and vulnerable) versions of SunJava.

After installation, verify that Java has been installed correctly:  Verify Java Installation.

References

Release Notes:  Java SE 6, Update 26
Update Schedule: Critical Patch Updates

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...