Jason, Here's a URL for subscribing to microsofts security service:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/notify.asp I'd also recomend subscribing to a couple of other CERT services. Vulnerabilities are often first discovered by third parties and and MS OS is picked apart immediately upon release. Recently, a number of OTHER security issues (beside MS) could have implications for your security (like the SNMP vulnerability). Subscribing to a non-microsoft list keeps your focus broader than just your OS. First though, tune your server carefully and eliminate ALL unnecessary services and applications. That way, you will not be vulnerable to security issues that would otherwise be irrelevnat to you. For example, if you are not going to use your server as a print server, why would have the spooler service running? Running it takes up resources on the server and opens you up to any security issues related to the spooler service (not that there are any that I know of <g>). Running it also means you are bound to apply a hot fix if it one comes out for that service. Contrary to some doctrine, I don't believe you should install every hot fix. You should do enough research to be able to tell if you are at risk before you apply the fix. Hotfixes are about 95% reliable - but there have been a few released that have subsequently been rolled back because they cause additional problems. That's my 2 cents. As far as keeping up, it's a challenge. If you don't have operations people and you have to do it yourself, the best advice is to create an email folder for all the certs advisories and review them on a weekly scheduled basis. Also get used to surfing around the net and researching the subject on a regular basis - it never ends <g>. Mark -----Original Message----- From: Jason Davis [mailto:[EMAIL PROTECTED]] Sent: Saturday, March 09, 2002 4:04 PM To: CF-Talk Subject: OT: my own box I'm about to start co-locating next month my own win2K server box. from installting, through service packs, hotfixes, sql server and all that... I'm wondering if anyone can share thoughts on installing IIS patches/hotfixes. I know that there are many of them, how do you keep up? any info would be great. ______________________________________________________________________ Dedicated Windows 2000 Server PIII 800 / 256 MB RAM / 40 GB HD / 20 GB MO/XFER Instant Activation · $99/Month · Free Setup http://www.pennyhost.com/redirect.cfm?adcode=coldfusiona FAQ: http://www.thenetprofits.co.uk/coldfusion/faq Archives: http://www.mail-archive.com/cf-talk@houseoffusion.com/ Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
