Microsoft tool helps monitor IIS problems

Microsoft has released a tool to help website operators keep up to date with the numerous security updates for Internet Information Server (IIS) 5.0.

The HFCheck tool lets users check whether they have up-to-date security patches on IIS 5.0, the Windows 2000 Internet server. Security experts said the tool could help to significantly improve internet security.

Security updates for IIS are frequent. There have been seven updates for IIS, including version 5.0, in the past two months alone.

Mark Tennant, Windows 2000 product marketing manager at Microsoft, said: "This is not a product, merely a 'hot fix' that basically checks for new security updates from Microsoft and warns the admin if they are missing the latest patches."

The tool can be run continuously or periodically, against the local machine or a remote one, using either a database on the Microsoft website or a locally hosted copy. When HFCheck finds a patch that hasn't been installed, it can display, dialogue or write a warning to the event log.

The release of the tool was welcomed by security vendor Panda Software, which said that "one of the most important duties of an administrator is to ensure that servers have all available security updates so as to avoid falling victim to attacks that exploit known vulnerabilities".

Clive McCafferty, managing director of security firm Advisor Technologies, said the tool is a good idea that would be even more useful if it was extended to Microsoft's operating system. He added that Unix vendors should develop similar tools, because keeping up to date on security patches is also an issue on those platforms.

"For a long time security administrators have struggled to keep up to date on patches. A tool that allows you to keep up to date on security patches would significantly reduce security breaches, because a large percentage of problems are caused by people not being up to date. Anything that would help people keep up to date is welcome," said McCafferty.

For more information see http://www.microsoft.com/technet/security/tools.asp or http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24168