==== 3. Security Matters Blog ====
by Mark Joseph Edwards, http://www.winnetmag.com/securitymatters
Check out these recent entries in the Security Matters blog:
It Had to Happen Sooner or Later
- It was inevitable that somebody somewhere would produce a virus that affects Windows CE devices, and it happened this week.
Stopping Malware That Travels Through SSL Connections
- Inspecting Secure Sockets Layer (SSL) traffic isn't possible through standard methods. However, it is possible with a third-party solution.
XML-Based Security Information Feeds
- Really Simple Syndication (RSS) feeds are a great way to quickly gather security-related information, including information about all the latest vulnerabilities.
==== 4. Instant Poll ====
Results of Previous Poll
The voting has closed in the Windows & .NET Magazine Network Security Web page nonscientific Instant Poll for the question, "Do you now use or do you plan to use 802.11i on your wireless LANs?" Here are the results from the 47 votes.
- 13% Yes, we use 802.11i now
- 4% Yes, we plan to use 802.11i in the next 3 months
- 9% Yes, we plan to use 802.11i in the next 6 months
- 17% Yes, we plan to use 802.11i in the next year
- 57% No, we don't plan to use 802.11i
New Instant Poll
The next Instant Poll question is, "Do you use search engines to look for vulnerabilities in the Web sites you manage?" Go to the Security Web page and submit your vote for
- Yes, I do so regularly
- Yes, but only when I become aware of new Web vulnerabilities
- No, but I plan to start
- No, and I don't plan to start
http://www.winnetmag.com/windowssecurity
==== 5. Security Toolkit ====
FAQ: Q. What Are the Relative Identifiers (RIDs) of a Domain's Built-in Accounts?
by John Savill, http://www.winnetmag.com/windowsnt20002003faq
A. Every object in a domain has a SID, which consists of the domain's SID and a RID. For built-in objects, such as built-in accounts, RIDs are hard-coded. A table at the URL below lists the built-in objects, their RID, and their object type. The fact that RIDs are hard-coded explains why merely renaming, say, the Domain Administrator object doesn't often thwart an intruder, who can simply locate the account by using the RID 500. However, you can create a honeypot by renaming the real Domain Administrator account and creating a new account called Domain Administrator that has no permissions. You can use the bogus Domain Administrator account to fool hackers into attacking it, then log the attacks and delay any real damage to the bona fide Domain Administrator account.
http://www.winnetmag.com/articles/misc/table071904.htm