Do you feel more secure? Is your computing experience more reliable these days?
Seriously, you’re reading this article on a computer or phone, connecting to this site on a shared internet with your grandma as well as Russian hackers, North Korean attackers, and lots of teenagers watching TikTok videos. It’s been 20 years since Microsoft CEO Bill Gates wrote his Reliable computer memo where he focused on the safety of the company’s products.
So are we really safer now?
I’ll keep the side effects of last week’s Patch Tuesday security updates in mind and factor them into my response. First, the good news: I don’t see any major side effects on PCs not connected to Active Directory domains (and I haven’t seen any pitfalls when testing my hardware at home). I can still print to my local HP and Brother printers. I can surf and access files. So while I’m not ready to give the green light to install the January updates just yet, I doubt you’ll see any side effects.
But for businesses, this month’s updates deliver a confusing and murky story. Microsoft hasn’t exactly been a good, trustworthy IT partner this month. Instead of taking the past two decades to develop resilient, bulletproof systems, we get servers getting into boot loops and administrators having to boot into DOS mode and run commands to uninstall updates.
It’s not where we were supposed to be at this point.
As Gates said 20 years ago: “Availability: Our products must always be available when our customers need them. System failures should be a thing of the past with a software architecture that supports redundancy and automatic recovery. Self-management should allow service to resume without user intervention in almost all cases.
And yet, I always delay updates on my computer systems because the latest updates, in particular, have shown that the servers may have recovery problems. Example: “Windows server domain controllers may restart unexpectedly.” This appeared after last week’s security patches on all supported Windows server platforms. As noted in the writing a known issue, this occurs after using Microsoft’s own recommended guidance for hardening Active Directory, which included the use of Shadow Principals in Enhanced Security Admin Environment (ESAE) or environments with Privileged Identity Management (PIM). Affected systems include Windows Server 2022 (KB5009555); Windows server, version 20H2 (KB5009543); Windows Server 2019 (KB5009557); Windows Server 2016 (KB5009546); Windows Server 2012 R2 (KB5009624) Windows Server 2012 (KB5009586).
I’ve also seen reports that, following Active Directory security hardening advice (created after the November Security Releases) will trigger the reboot problem if you have set the PACRequestorEnforcement value to 2.
Even with cloud services, availability issues remain unresolved. For example, Microsoft 365 has a Twitter account whose purpose is to communicate availability issues with the service. Hardly a week goes by that I don’t receive an alert about a service issue. Cloud services are strengthened, but I don’t see much progress either with on-premises servers or with cloud services. Instead of planning for automatic recovery, we need to ensure that we have alternative services and other means of communication if our systems are affected by patches or ransomware.
More from Gates: “Security: The data our software and services store on behalf of our customers should be protected from harm and used or modified only as appropriate. Security models should be easy for developers to understand and integrate into their applications. »
Yet last week’s security releases included a confusing communication about a potentially worming flaw. The https bug in the form of CVE-2022-21907 is not clear on which versions are vulnerable. Clarification and analysis had to come from external sources before we could understand that Windows 10 version 1809 and Server 2019 are not vulnerable default — unless registry key HKLM:SystemCurrentControlSetServicesHTTPParameterEnableTrailerSupport is set to 1. Windows 10 versions after 1809 are vulnerable by default. I would say that 20 years after the publication of the reliable IT memo, our security models – and equally important, our security communication – are still not easy to understand.
We also follow issues with HyperV servers on Server 2012R2 (and, it seems, only this platform) where VMs fail to boot after applying KB5009624 on devices using UEFI. If you have virtual servers hosted on Server 2012R2, avoid installing updates on these platforms.
And Windows 10 desktop users who rely on virtual private networks for remote access should uninstall January updates due to a side effect that breaks VPN access on Windows 10 systems or Windows 11. For those who rely on L2TP VPN or IPsec VPN, you fails to connect using VPN after installing updates.
Gates closed his memo with this: “Going forward, we need to develop technologies and policies that help companies better manage ever-larger networks of PCs, servers and other smart devices, knowing that their systems critical trades are immune to damage. Systems will need to become self-managing and inherently resilient. We need to prepare now for the kind of software that will make this possible, and we need to be the kind of company people can rely on to deliver it.
So how did it work? We are in the same place where we were 20 years ago; we always have to rely on ourselves to decide the right time to install updates.
So what do you really think about security? Join the discussion in the AskWoody Forums!
Copyright © 2022 IDG Communications, Inc.
Comments are closed.