Light Patch Tuesday will include new encryption rule

Powered by SC Magazine
 

Next week's monthly patch batch from Microsoft is not very burdensome, but it includes a new requirement that certificates must contain RSA key lengths of more than 1,024 bits.

Microsoft is giving IT administrators a break next week, with the software giant only planning to release two patches to remedy four vulnerabilities.

Each of the bulletins, to be distributed Tuesday afternoon EST, is rated "important," meaning they do not meet Microsoft's highest-severity designation of "critical," and address issues in Visual Studio Team Foundation Server and System Center Configuration Manager.

The big news out of next week's automatic update is that it will include new requirements that users must employ certificates carrying an RSA key length of at least 1,204 bits. Customers actually are encouraged to run certs with much higher key lengths, even beyond 2,048 bits.

This is an additional safeguard that the software giant is releasing as a result of the Flame virus, which spread by spoofing Microsoft certificates.

"Though many have already moved away from such certificates, customers will want to take advantage of September's quiet bulletin cycle to review their asset inventories -- in particular, examining those systems and applications that have been tucked away to collect dust and cobwebs because they 'still work' and have not had any cause for review for some time," wrote Angela Gunn of Microsoft Trustworthy Computing in a Thursday blog post.

She acknowledged that customers should be prepared for a number of known kinks, including error messages or other difficulties, when applying the key length update.

Andrew Storms, director of security operations for vulnerability management vendor nCircle, said administrators must take this update seriously.

"This means older, legacy systems that rely on weak encryption or keys that are too short will stop working," he said in prepared email comments sent to SCMagazine.com. "Fix ‘em now, or be seriously sorry when they stop working in October.”

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Light Patch Tuesday will include new encryption rule
 
 
 
Top Stories
Is your lawyer smarter than IBM's Watson?
Sparke Helmore CIO Peter Campbell expects machine learning to take a chunk out of law firm profits. But he’s far from downcast.
 
Australia passes data retention into law
Mammoth last-ditch effort by Greens, indies knocked back.
 
Turnbull introduces bill to block piracy websites
Takes ownership of legislation from Brandis.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Xero now includes an inventory function built-in
Mar 26, 2015
Xero has added inventory and other major new features to the latest release of its cloud ...
Apple reveals its new MacBook
Mar 13, 2015
Replacing the MacBook Air as Apple's thinnest laptop, the new MacBook comes packed with features.
Xero has released a new version of its app for the iPad
Mar 6, 2015
iPad-wielding Xero users can now take advantage of a new version of the iOS app for the cloud ...
Microsoft is offering Azure for Disaster Recovery to Australian SMBs
Feb 10, 2015
If you haven't talked to your IT provider about disaster recovery, it might be worth discussing ...
The 2015 Xero Roadshow is on: here are the locations and dates
Feb 6, 2015
The 2015 Xero Roadshow kicked off this week - see where you can attend at locations around ...
Latest Comments
Polls
Do you support the Government's data retention scheme?

   |   View results
Yes
  9%
 
No
  91%
TOTAL VOTES: 1360

Vote