email article printer friendly

Get help with patches
by Joel Semeniuk

September 2003 Issue

One of the most important ways to keep your enterprise secure is to ensure all your client and server computers are up-to-date with relevant service packs, patches, and hotfixes. It's essential to deploy new patches as soon as possible, because most vulnerabilities aren't exploited until after they're public knowledge and vendors release patches to remedy them. For example, SQL Slammer's impact would have been minimized if there had been a way to detect the vulnerability quickly and deploy the patches already released to resolve it cost effectively. Microsoft has come a long way in helping organizations become, and stay, secure with services such as Windows Update Services and Microsoft Software Update Services, and tools such as HFNetChk and the Microsoft Baseline Security Analyzer. However, none of these options represent a single solution for vulnerability detection and patch deployment across the operating system, server, and desktop application spectrum. This paves the way for vendors such as Shavlik Technologies and its product, HFNetChkPro 4.0.

HFNetChkPro performs security patch assessment and distribution for a wide range of operating systems and applications, including Windows NT 4.0 to Windows Server 2003, Microsoft Exchange, Microsoft SQL Server, Microsoft Office, the Java Virtual Machine, Internet Information Services, Internet Explorer, Windows Media Player, Microsoft Data Access Components (MDAC), ISA Server, Commerce Server, and the .NET Framework. HFNetChkPro provides an intuitive user experience, allowing you to push patches manually or automatically to your local computer, domain, testing servers, or the entire network with a few clicks (see Figure).

You can create your own logical groupings of computers, then add computers by browsing your Active Directory, specifying ranges of IP addresses, or importing computer names stored in a file. This way you can customize the scope of your scans and patch pushes. Installing the product is a breeze, provided you have all the prerequisites in place: MDAC 2.7, Microsoft XML Parser 3.0 SP2, and Microsoft Jet 4.0 SP6 on Windows 2000, Windows XP, or Windows Server 2003.

HFNetChkPro doesn't use agents to deploy patches and hotfixes, which makes it easy to install and use within your environment, and it's built on the same engine that powers the Microsoft Baseline Security Analyzer and the Microsoft Systems Management Server (SMS) Feature Pack. This ensures you get the same quality of patch detection Microsoft uses, and the same database schema the Microsoft Security Bulletin Web site uses drives the product. As you scan your systems, the product downloads an XML file (in the form of a digitally signed CAB file) that contains the latest information on Microsoft security hotfixes available for each product, so your scans are never out-of-date.

If you rely currently on only Windows Update Service, consider HFNetChkPro 4.0 as an option to supplement your security and patch deployment requirements. Even though it will give you some overlap with Windows Update Services, HFNetChkPro provides support for all levels of patches and hotfixes, as well as agent-less support for SQL Server, Exchange, and Office. Within minutes of installing HFNetChkPro, you'll be scanning and deploying patches throughout your enterprise, while maintaining the flexibility you require, such as support for testing and staging deployment environments.