|
To
view this update as a Web page, copy this link into your
browser: http://www.qtsnet.com/stayinformed/quiknews/quiknews_september2004.htm.
To
subscribe or unsubscribe, please follow instructions at
the bottom of this page.
Welcome to the September edition of QTS QuikNews, our
monthly e-mail newsletter. In this monthly e-mail, you
will receive an update of what's new at QTS - new
products we support, new patches and upgrades, solution
ideas and promotions to save you money, and information
about our company and our clients.
In
this issue:
- QTS
and Partner News
- Events
- President's
Corner
- QuikSecure
Tip of the Month
- Patches
and Upgrades
- Product
Support Lifecycle Watch
- Solution
Spotlight
- Special
Offers
- Partner
Spotlight
QTS AND
PARTNER NEWS
WELCOME
TO NEW CUSTOMERS
QTS offers a “welcome aboard” to the following new
customer:
·
SARGA
Associates
CUSTOMER
SATISFACTION SURVEY WINNER
Congratulations to Maher “Murph” Malki of the law
firm Blume Goldfaden, whose customer satisfaction survey
was randomly drawn as our Q3 winner.
Murph will receive a $50 gift certificate for
Amazon.com. Thank you to Murph and all other QTS
customers who submitted Customer Satisfaction Surveys in
Q3 – we appreciate the feedback.
QTS
OFFERS FREE SYSTEMS STRATEGY CHECK-UPS
Having developed this award-winning
engagement jointly with Microsoft, QTS is now
offering Systems Strategy Check-Up engagements to
qualified customers and prospects throughout New Jersey
and New York. This
high-value, half-day consulting engagement helps
businesses evaluate how they are using Microsoft
technologies and identifies best practices and
recommendations for how to best deploy Microsoft
technologies in a business.
For more information on this no-charge
engagement, contact your QTS Account Manager or visit www.QTSnet.com/SSCU.
QTS
IS HIRING!
QTS is recruiting for senior level technical personnel,
as well as entry and senior level sales
staff/telemarketers. If you know anyone who might
be a good fit, please have them submit their resume to
Liz Meechan, our Office Manager. Liz can be reached at lmeechan@QTSnet.com,
or (973)984-7600 x223.
PRESS
RELEASES
QTS
OFFERS AT&T SERVICES THROUGH LINKS COMMUNICATIONS
PARTNERSHIP
9/27/2004:
QTS today announced that it
has become an AT&T Sub-Agent through its partnership
with Links Communications. The partnership allows
QTS to offer its customers a wide range of AT&T
services, while leveraging Links' expertise and
long-standing AT&T partnership for administration
and service. Read
more at http://www.QTSnet.com/stayinformed/l3_stay_pr56.htm
Back
to Top
EVENTS
MICROSOFT
“CONNECTING THE DOTS” EVENT
Join
QTS, Microsoft, New Horizons and Softmart at the
“Connecting the Dots…Finding Value in the Microsoft
Platform” event being held on Thursday, October 14th
from 9-11:30AM at New Horizons’ facility in Metro
Park, NJ. The
event will review Microsoft’s vision and platform
strategy, as well as a review of Microsoft Software
Assurance benefits and training benefits within software
assurance. QTS
will also be presenting on “Ten Steps to Secure Your
Microsoft Network” at the event.
For more information, go to http://www.clicktoattend.com/?id=100379.
Back
to Top
PRESIDENT'S
CORNER
Many
of you by now have no doubt implemented Service Pack 2
to Windows XP, either on your business PCs or on home
computers. However,
many others have probably held off for a variety of
reasons. It
is time to re-assess those reasons now.
There
has been a long-standing feeling among many IT managers
and business users (especially in our law firm client
base) that time should be taken before applying patches,
or in some cases that systems that are working well
should not be patched.
“If it ain’t broke, don’t fix it” as an
approach has traditionally had some appeal.
However,
the world we live in today is very different from the
world of 10 years ago, from an IT perspective as much as
otherwise. Over
the last few years, we have seen a sharp reduction in
the time it takes for hackers and virus writers to
develop exploits to known vulnerabilities.
In 2001, it took six months from when an IIS
vulnerability was discovered to when it was exploited by
the Code Red worm.
Earlier this year, the Blaster worm reached us
only 21 days after the vulnerability it exploited was
discovered. Put
simply, we no longer have time to sit back and wait.
This
is, in fact, a large part of what Windows XP Service
Pack 2 is designed to fix, and SP2 is a major component
of Microsoft’s Trustworthy Computing initiative.
Begun in 2001, Trustworthy Computing has become
one of Microsoft’s overriding goals for the past
several years. Since
the wave of worms and viruses at that time (Code Red,
Code Blue, NIMDA, “I Love You”), Microsoft has
acknowledged the vulnerability of its products, but more
important it has acknowledged the process issues around
managing those vulnerabilities (which will always exist
to some degree – NO product is ever fully defect-free,
particularly something as complex as computer software).
Major efforts were put into security awareness
and training. Microsoft’s
Windows Update and Software Update Service technologies
were a major step forward in patch management, but were
not enough to prevent all problems, and adoption of
these technologies is not universal.
So Microsoft needed to take the next major step
to make systems better able to repel attacks, whether
they were patched or not.
One
of the major features of Service Pack 2 is the default
enabling of the personal firewall included in Windows
XP, which is intended to prevent worms and other forms
of hostile/mobile code from spreading from system to
system. This
can break some applications that rely in IP
communications over specific ports, so
environment-specific testing needs to occur.
However, considering the mass proliferation of
worms over the past few years, it is no longer practical
to rely simply on perimeter security to protect your
internal resources.
Windows
XP Service Pack 2 has a number of other security
features that improve the reliability and defensive
proactivity of the operating system.
Of the greatest significance is the improved
memory protection model, which prevents applications
from using memory in ways that could exploit the system.
Unfortunately, many programs were written over
the prior years with a loose security model, and thus
legitimate programs will sometimes perform actions that
“look” like a security exploit, and will thus be
stopped. Testing
is important so that legitimate programs can be
identified and added to the exception list so they are
allowed to execute.
In addition, the service pack improves attachment
handling, wireless security, identity protection and
improved firewall startup/shutdown support, and provides
other security enhancements.
Even
the pop-up blocker that has been added to Internet
Explorer, though it seems like a user convenience, has a
security purpose. Mobile
code often uses pop-ups to interact with the user and
obtain permission to execute.
The pop-up blocker will prevent many forms of
mobile code from executing.
This helps mitigate against many mobile code
attacks, while also making the browsing experience more
pleasant.
Microsoft
has also added a “Security Center” – a status
screen showing in one place the status of antivirus
software, the personal firewall, and Windows
Update/patch management.
From Security Center, one can readily verify that
these functions are running, and whether the system is
current with patches, signature files, etc.
Admittedly, this is directed more at the consumer
market, as well as to make things easier for Microsoft
telephone support.
Most major antivirus vendors have written updates
to their products to “snap into” Security Center.
Windows
XP Service Pack 2 has a significant number of
configurable options to allow customization to your
environment and to match your security policies.
Using Active Directory, the preferred management
mechanism in Microsoft environments, there are over 600
distinct Group Policy objects pertaining to Windows XP
Service Pack 2, allowing for a deployment tailored
specifically to your objectives.
Windows
Server 2003 Service Pack 1 continues this focus and will
have complementary technologies to help secure your
systems. Specifically,
a new feature in the server service pack will allow
policies to be set whereby client PCs that connect to a
network are isolated and unable to communicate with
other systems until they pass a series of site-defined
tests. For
example, a laptop that plugs into your network may not
be allowed to connect to the Domain and communicate on
the network unless it passes antivirus scans and has
current signature files, has its personal firewall
turned on and has all current/approved security patches.
This will help prevent rogue systems from
undermining network security.
At
present Microsoft has no plans to port these features
back to Windows 2000, which is now in its 5th
year of use and halfway to its end of life.
Part of this is clearly because Microsoft wants
to drive its customers to its newest products (whether
that involves additive revenue for them or not).
But part of it is because Windows 2000 pre-dates
the Trustworthy Computing initiative, and therefore the
product would require more massive changes to
incorporate the new features.
The memory protection model is an example of this
– the impact of this change, particularly on older
systems running older applications, could be massive and
create an insurmountable support burden.
As it is with Windows XP, Microsoft has
re-written over 60% of the base operating system code in
SP2, and the SP2 download at over 270MB is larger than
the unpatched operating system in its entirety!
So,
how does one balance the competing considerations of
patching quickly, versus systems stability.
I would suggest that a subset of users be
designated as a “tripwire” group and have patches
applied immediately (perhaps using Windows Update).
If problems are encountered on these machines,
then further testing can be done to determine what needs
to be changed or if the patches cannot be applied yet.
If existing applications are unaffected, then
after a day or two the patches can be pushed down to the
remainder of the organization’s PCs, using a
centralized patch distribution tool like Microsoft SUS
or SMS, Symantec iPatch, or similar technology.
It is important, though, that your test group be
true “users” so you know whether the key
applications are affected (in other words, IT makes a
poor test group in most cases because they often don’t
use the same apps as users, the same way users do).
There
is no “silver bullet” to security, and no solution
that will make all our concerns and issues just go away.
Security is as much about the process and ongoing
management as it is about products and point solutions,
if not more so. One
can invest in the best firewall, the most advanced
Intrusion Prevention System and the most comprehensive
authentication system, but a single user leaving a
password on a post-it note on their monitor can
undermine all these things.
So training and awareness are critical elements
of any security strategy that needs to involve people,
process and technologies to be successful.
Windows XP Service Pack 2 is just another piece
in the puzzle, albeit an important one and a major step
forward.
As
always, feel free to email me your comments or thoughts
at nrosenberg@QTSnet.com.
Thank you.
Neil
Rosenberg
President & CEO
Quality Technology Solutions
Back
to Top
PARTNER
SPOTLIGHT
QTS
is spotlighting Wertheim Inc., its partner for document
management, document imaging and document assembly
solutions. Wertheim
Inc. is a premier provider of document management
systems (DMS) and office automation solutions, and one
of the top business partners in the region for both
Hummingbird and Interwoven.
These systems enable organizations to increase
profits, and to improve their work quality and the level
of professionalism exhibited to their customers and
partners via their electronic documents.
The
company assists clients in all areas of document
management technologies, from initial planning through
final implementation, and also provides preventative
maintenance and audit services. Because of their
extensive experience, they have a unique ability to
provide consulting expertise in the area of best
practices and benchmarking with regards to document
management, document imaging, document assembly, and
knowledge management systems.
The
entire staff at Wertheim Inc. has perfected a style of
interaction which gains accolades up and down the firm's
client list. Put
most simply, clients like them. Their roster of
successful engagements includes clients new to document
management, as well as organizations who needed to
upgrade to the newest versions of existing document and
knowledge management technologies.
Their approach to customers and technology is
very similar to QTS'.
Wertheim
Inc.'s commitment to document and knowledge management
led to the creation of a robust line of software
products. These
applications were written to help manage and administer
Hummingbird and Interwoven environments by providing
cost-effective alternatives to many tedious tasks
required in order to maintain a healthy system.
Their “Winc” suite of products work with your
document management system to facilitate the
synchronization of key document data across
multi-library environments; simplify the process of
granting security to users; and provide a robust array
of DMS administrative utilities.
Wertheim
Inc. is a leading regional service provider, and clients
benefit from their depth of experience with the product
offerings of Hummingbird (DOCS Open/PowerDOCS/ DM5),
Interwoven (WorkSite/WorkSite MP/TeamSite), as well as
document assembly systems from SoftWise and HotDocs, and
document imaging systems from Kofax and eCopy.
While QTS continues to build, enhance and support
networks, this partnership will significantly extend our
capabilities and the total range of services that we can
offer clients.
For
more information on Wertheim Inc., please visit their
web site at www.wertheiminc.com,
email them at info@wertheiminc.com, or call
212-413-8600. Or,
contact your QTS Account Manager.
Back
to Top
|
