Page II: Learn about the plethora of security enhancements that Microsoft has included in Windows XP Service Pack 2, as well as how these security features could impair the functionality of some applications.
Because of the change in port management, if an application needs to open ports but doesn't use stateful filtering, administrators installing it need to place the program on the white list. With the built-in firewall enabled by default, IPv4-application inbound connections for audio and video, such as for MSN or Windows Messenger, need to have their port opening and closing managed automatically. Inbound services connections (IPv4) will require some changes to configuration and/or code. Services that listen on fixed ports should ask users if the service should be permitted to open the port in ICF and, if so, the service should use the INetFwV4OpenPort API to alter ICF rules.
Another problem is the fact that Microsoft won't be offering this service patch to those who hold pirated copies of Windows XP, which is reasonable enough, but there are a lot of illegal copies out there, especially in the Far East where a lot of worms get a quick foothold in the Internet. SP2 will apparently check Product IDs looking for known pirated copies and will not install on systems with bad Product IDs. This is understandable, but will reduce the overall effectiveness of the security upgrade.
A lot of the potential problems posed by SP2 are beyond the control of administrators. Some programming code for custom applications will have to be rewritten, but at least now you know what to look for when problems come up, rather than deploying XP SP2 and finding out that it breaks your most important line-of-business application.
Further reading
This report can only scratch the surface of such a major overhaul to an operating system. For more information see:
Final word
I expect to hear screams of pain as people deploy SP2 and discover that legacy applications no longer work, but those are probably the same people who complain so loudly (and legitimately) that Microsoft doesn't deploy secure systems.
Nearly every security expert knew that, at some point, Microsoft would be forced to bite the bullet and take a big compatibility hit in order to solidify operating system soft spotsââ,¬"many of which are due to legacy code support. Plus, the XP SP2 changes will force developers to produce more secure applications and not just take advantage of a permissive Windows OS to write code that doesn't pay attention to security.
Of course, I would never recommend that anyone deploy such a major upgrade widely the day it hits the street. You should install SP2 on a testing network (or at least a single testing system) as soon as possible, and begin compatibility testing for your specific applications.
Those of you who have the budgetary luxury of being able to conduct even more extensive testing and want to get a leg up on evaluating XP SP2 even before final release should check out the Technical Preview Program, which makes SP2 RC1 generally available for testing by IT professionals (not just those on the beta list). The initial download, which doesn't include any support other than some Microsoft-sponsored newsgroups, requires Windows XP to be installed already. English and German versions of the update are now available and are about 270 MB in size.
As soon as you feel comfortable that Windows XP SP2 will not cause a significant interruption for users (or you have fixed the issues that would lead to a potential interruption), then you should deploy SP2 company-wide. It is an important upgrade that can only improve the security of your network.
TechRepublic is the online community and information resource for all IT professionals, from support staff to executives. We offer in-depth technical articles written for IT professionals by IT professionals. In addition to articles on everything from Windows to e-mail to firewalls, we offer IT industry analysis, downloads, management tips, discussion forums, and e-newsletters.
©2004 TechRepublic, Inc.
1%
4%
