Skip to main content



Tim RainsNovember's Security Newsletter is here! The theme of this month's newsletter is secure virtualization. Microsoft Desktop Virtualization is just the thing that many enterprise customers need. It can help resolve application compatibility issues and provide seamless access to older applications while running them on modern Windows 7-based systems with modern browsers. However, just as a physical desktop or server needs to be secured, so do virtual machines and virtual switches.

Virtualization is rapidly becoming more important for many organizations around the world, as the end of support for Windows XP is April 8, 2014. (Can you believe Windows XP was released over 10 years ago? Time flies when you are having fun! Click herefor a fun-spirited infographic about some of the cultural shifts over the last decade.)

If you are interested in learning how virtualization can help you accelerate your Windows XP migration plans and/or how virtualization can help you with other challenges your organization might be facing, check out these resources:

For resources to help you explore, deploy, and maintain secure virtualization options in your IT infrastructure, check out the Security Guidance in this month's newsletter.

November 2011 Edition


Top Stories
Security Guidance
Community/MVP Update
Cloud Security Corner
This Month's Security Bulletins
Microsoft Product Lifecycle Information
Security Events and Training
Upcoming Security Webcasts

Best regards,
Tim Rains, Director, Product Management, Microsoft Trustworthy Computing

Follow the Microsoft Security Response team on Twitter @MSFTSecResponse for the latest information on the threat landscape.

Microsoft Security Compliance Manager Version 2 (SCM 2) Now Available

Security Compliance Manager 2 provides ready-to-deploy policies and Desired Configuration Manager (DCM) configuration packs that are tested and fully supported. The product baselines included in the tool are based on Microsoft Security Guide recommendations and industry best practices, allowing you to manage configuration drift, address compliance requirements, and reduce security threats.

Microsoft Malware Protection Center Threat Report - Poison Ivy
This Microsoft Malware Protection Center (MMPC) Threat Report provides an overview of the Win32/Poison (Poison Ivy) family of malware. Poison Ivy is a malware family whose primary objective is to allow complete control of infected computers in corporate environments. This report examines the background and functionality of Poison Ivy and provides telemetry data and analysis covering the year 2011 until publication. It also discusses how the threat is detected and removed by Microsoft antimalware products and services.

Security Practices and the Consumerization of IT
Encrypting corporate data and/or segregating corporate data from personal data that might cohabitate on computing devices are becoming aspirational goals for many organizations. Learn why establishing acceptable use policies and increasing awareness of those policies and why good data hygiene is critical, are very effective practices whether your workforce is using mobile devices or desktop PCs.

Security Tip of the Month: Simple Security Recommendations When Using Hyper-V

As more small to midsize companies consider virtualization solutions, questions about security and virtualization inevitably arise. Microsoft has a few articles on TechNet that outline some of the key aspects of a secure deployment of the Hyper-V virtualization technology, a feature of Windows Server 2008 R2. To complement the guidelines offered in " Planning for Hyper-V Security," Microsoft IT Evangelist Howard Wong offers some additional thoughts and security considerations around Hyper-V.

Planning for Hyper-V Security
Overall, you should secure the virtual machines running on the virtualization server according to your procedures for securing that kind of server or workload. This document provides best practices to help improve the security of your Windows Server 2008 servers running Hyper-V.

Hyper-V Security Guide
Find instructions and recommendations to help strengthen the security of computers running the Hyper-V role on Windows Server 2008. This guide covers three core topics: hardening Hyper-V, delegating virtual machine management, and protecting virtual machines.

Security Best Practices for Microsoft Enterprise Desktop Virtualization (MED-V) Operations
Get best practices you can follow to help maintain security when preparing, building, testing, deploying, and managing MED-V workspaces.

Authentication of MED-V End Users
Get best practices to follow to help maintain security when verifying the identity of MED-V end users.

Microsoft Application Virtualization (App-V) Security Guide
Familiarize yourself with important information about deployment decisions that can affect the security of your system. This guide provides you with the necessary steps to configure Microsoft App-V security settings to enhance the security of your environment based on the recommendations presented in the downloadable App-V Security Best Practices paper. For those security settings that are specific to Windows, but not to App-V, this guide also offers appropriate links to more information.

Using Smart Cards in Windows Virtual PC
Learn how you can use smartcards in any virtual machine (VM) created using Windows Virtual PC on Windows 7, just as you use smartcards on Windows 7. While each type of smartcard device comes with its own device driver software, that will need to be installed in the operating system (OS) on which the smartcard reader is being used, smartcards can be shared between the host OS (Windows 7) and the VM, or can be assigned exclusively to VMs.

Virtualization: Security Best Practices

By Harry L. Waldron, Microsoft MVP - Enterprise Security
Virtual resources must be safeguarded using the same principles used to keep Windows and Windows Server secure. Administrators must promptly apply security maintenance to all software components and help ensure the environment is restricted from unauthorized users. Strong corporate policies and security awareness help promote the user's role in the process as well. Read this article for key best practices to help you safeguard your virtual information resources.

How to Improve Network Security with Microsoft Solutions

By Rodrigo Immaginario, Microsoft MVP - Enterprise Security: Engineering
Safeguarding network data and systems is one of the greatest challenges for IT professionals who work in the area of security. Meeting the demands of enterprises is essential. Therefore, it is important to know who your users are and what your network assets are--particularly since remote access, wireless networks, different sites and distributed systems are a reality. Learn how to leverage supported Microsoft technologies to help reduce security risks in your environment.

Deploy a Private Cloud Infrastructure Using Virtualization

Cloud computing creates new challenges for IT pros, as well as powerful new capabilities that can cut costs while delivering new value. Find tools, technical articles, and other resources to help you leverage Hyper-V, System Center Virtual Machine Manager and Operations Manager to bring cloud architecture agility to your datacenters.




Security Bulletin Overview for November 2011


Microsoft SDL - Developer Starter Kit
Security Awareness Materials
Learn Security On the Job


Trustworthy Computing Security/Privacy Blogs RSS
Microsoft Security Blog RSS
Michael Howard RSS
Eric Lippert RSS
Eric Fitzgerald RSS
Forefront Team RSS
Solution Accelerators - Security & Compliance RSS
Security Vulnerability Research & Defense RSS
Security Development Lifecycle (SDL) RSS


View a listing of upcoming technical chats


IT Pro Security Community


Security Help and Support for IT Professionals
TechNet Troubleshooting and Support Page
Microsoft Security Glossary
TechNet Security Center
MSDN Security Developer Center
Sign-Up for the Microsoft Security Notification Service
Security Bulletin Search Page
Microsoft Security Center
Home Users: Protect Your PC
MCSE/MCSA: Security Certifications
Subscribe to TechNet
Register for TechNet Flash IT Newsletter

Windows XP End of Support: April 8, 2014

On April 8, 2014, security patches and hotfixes for all versions of Windows XP will no longer be available. This means that, after this date, PCs running Windows XP will be vulnerable to security threats. In addition, many third party software providers are not planning to extend support for their applications running on Windows XP, which translates to even more complexity, risk, and ultimately, added management cost for your IT department if you are still managing Windows XP environments. Explore your options with this blog post from the Springboard Series and download the Windows XP End Of Support Countdown Gadget to help remind you about this important milestone.

Find information about your particular products on the Microsoft Product Lifecycle Web site.

  • See a List of Supported Service Packs: Microsoft provides free software updates for security and non-security issues for all supported service packs.

Microsoft Virtual Academy: Microsoft Virtualization for VMware Professionals - The Platform

This course offers a deep-dive into the important technologies that contribute to the core virtualization infrastructure. Learn about Microsoft's virtualization offerings and strategy, datacenter planning, Hyper-V architecture, VM management, virtualized networking and storage, numerous other Hyper-V features, as well as advanced management with System Center Virtual Machine Manager 2008 R2. Understand high-availability and disaster recovery considerations to keep your VMs up and running using Windows Server Failover Clustering. Explore how Hyper-V is both different and similar to VMware virtualization through technical and terminology comparisons. By the end of this track you will have the tools you need to plan, design and deploy your virtualized datacenter or Private Cloud infrastructure.

Microsoft Virtual Academy: Microsoft Virtualization for VMware Professionals - Management

Familiarize yourself with the full line of Microsoft System Center products: Operations Manager for monitoring servers and services; Configuration Manager for deploying software and maintaining compliance on all types of devices; Service Manager for automating IT processes; Data Protection Manager for backing up and restoring servers and VMs; Opalis for integrated and customized workflow processes; and Virtual Machine Manager 2012 for advanced VM deployment and management. Additional modules will cover the PowerShell scripting utility, the VMM Self-Service Portal 2.0 and Private Cloud concepts. After completing this track you will understand how to centrally manage and automate a datacenter of any size.

Microsoft Virtual Academy: Microsoft Virtualization for VMware Professionals - Virtual Desktop Infrastructure (VDI)
Learn about when to use a Virtual Desktop Infrastructure (VDI), planning considerations, desktop models, Windows 7 integration, application delivery, user state virtualization and comparisons to other technologies. Explore how Microsoft's v-Alliance partnership with Citrix strengthens and broadens the VDI offerings. Upon completing this course you will be able to understand, plan and deploy the appropriate VDI solution for your business.

For IT Professionals

Now on Demand


This is a monthly newsletter for IT professionals and developers--bringing security news, guidance, updates, and community resources directly to your inbox. If you would like to receive less technical security news, guidance, and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter.

2011 Microsoft Corporation Sign up for this newsletter | Update your profile | Terms of Use | Trademarks