Microsoft get back to baseline on security

Microsoft's new-found fondness for security is bearing fruit. The company has recently made the Microsoft Baseline Security Analyser (MBSA) available, a tool that checks for multiple vulnerabilities on Windows 2000 and XP machines. It won't run on NT 4, but will check such computers remotely.

At heart, MBSA is an XML wrapper around a previously available tool, the Hot Fix Network Checker or HFNetChk. That's a command-line only utility that queries a database maintained by Microsoft containing the latest hot fixes issued for each product, checks those installed on the client machine and issues a list of discrepancies. It'll do this for the machine it runs on, or others by IP address, Netbios name, machine name or domain name -- administrator privilege is needed to scan a machine, but otherwise there is no limit on what can be scanned.

While HFNetChk produces a text output of recent hotfixes, MBSA provides a windowed environment, grades the severity of the problem and provides links to Microsoft's site where the relevant files can be examined and obtained. It also adds extra features -- it checks machines for weak or non-expiring passwords, looks for other account vulnerabilities such as multiple administrators on the same machine, checks SQL and IIS for common misconfigurations, and also looks at Office, Outlook and Explorer. The approach it takes is quite simple-minded -- for the weak password check, for example, it tries logging in with blank, username, "password", "admin" or "Administrator" and reports back if it gets in.

That's not configurable: the service check -- where MBSA sees if unauthorised services are running -- is more flexible. As standard the software looks for FTP, Telnet, RAS, Web and SMTP services, but by adding definitions to the services.txt file supplied with the analyser. It only works by name, though, so looking for unauthorised services that aren't known to Windows, such as file sharing or streaming applications, isn't possible.

MBSA is quick to install and get running -- if you just want to scan the machine on which it's loaded, no configuration is required. It produces a list of problems with a straightforward ranking of red, yellow or green, together with details of each and a suggested remedy. So far, so good. Unfortunately, Microsoft is in some confusion about hot fixes and different processes -- such as Windows Update from the browser -- will give a different list of fixes required. We found it a bad idea to use MBSA on a system that hadn't been upgraded for a couple of months: it suggested old patches that themselves generated requirements for new ones, and despite repeated re-installs, downloads, restarts and checks we never managed to get a completely clean bill of health. We finally gave up after MBSA repeatedly reported a hot fix as missing when we had loaded it explicitly several times.

The other aspects of the analyser were better behaved. It gave a good window onto account mismanagement, although fixing the problems usually meant following a link to the Microsoft website, chasing through a few pages of background, instructions, FAQs and so on, before finding and following the appropriate recipe. More work on automating the fix would save much time -- even just opening the appropriate management service would be welcome. It takes a couple of minutes to run per machine, and time-consuming options such as the weak password check can be disabled if a network's worth need to be looked at.

MSBA is a good start, but still too slapdash to give great confidence that Microsoft has really grasped the importance of watertight security. A utility that quickly checks for various common vulnerabilities is a good idea: one that gets things wrong is a terrible idea. The analyser is still worth using, but -- of course -- as part of a bigger, structured security implementation. It's good for checking that all machines in your domain conform to your account policy, but don't get hung up on trying for a clean bill of health as there's a good chance that it will report problems that aren't there. We didn't catch it missing problems that weren't there -- false negatives being more dangerous -- but it's impossible to say that it wouldn't, nor does its behaviour give us great confidence.

Have your say instantly in the Tech Update forum.

Find out what's where in the new Tech Update with our Guided Tour.

Let the editors know what you think in the Mailroom.