2.1 Understanding security notices

Many of the major software companies publish security notices when they discover a threat. In this video, we're going to look at the security notices published on the Microsoft website. The link to the website is provided in the text below. When you visit the website, click on Security Updates, followed by Bulletins, to see the latest security notices. We're going to take a look at the security updates for May, 2014, which list the executive summaries relating to a range of different security issues. The key information to note from this list is the particular software that's affected by each security issue. For example, the first two bulletins are in relation to the security issues in Microsoft Windows and Internet Explorer. Whereas, the third deals with issues with the Windows Server operating system.

Let's look at the details of the second security bulletin listed here. The summary table indicates that this affects Windows and Internet Explorer. It also shows that this is a critical vulnerability that could allow an attacker to execute arbitrary code on the affected machine. The first section of the bulletin is an executive summary that explains the threat posed by the vulnerability. In this case, it could cause an information disclosure. In other words, it's possible for an attacker to access data from the computer. The summary also explains a number of key points. The attack only works if the attacker has a valid username and password for the machine, and this vulnerability does not allow attackers to get more access rights than the currently logged in user. This means that users with basic, non administrative privileges on the machine will not be as badly affected by the attack as those users with full administrative privileges.

Scrolling down the page, we can see the key sections of the bulletin that list the affected, and not affected, software, as well as instructions on how to update different versions of Microsoft Windows to fix the security issue. Of course, a more simple way to update your Windows operating system is to enable automatic updates, by following the instructions on the Windows Update site. We've provided the link to this site below.

Many of the major software companies publish security notices when they discover a threat. In this video, we're going to look at the security notices published on the Apple website. A link to the website is provided in the text below.

This page provides advice on how to report security problems with Apple products together with guidance on how to check the security of your system. However, the section that we're interested in is titled security notifications. You can subscribe to receive emails informing you of security updates. And clicking on the link for the Apple security updates page will take you to a list of security notifications.

The security updates page lists the security issues with the most recent at the top. Each issue is identified by the particular software that's affected by the issue. For example, the issue listed here affects the Safari web browser version 6.1.4 and 7.0.4.

Clicking on this link takes us to the detailed information about this vulnerability. The page includes information on how to update your software to remove the vulnerability and also provides a description of what could happen if an attacker were to exploit this vulnerability. In this example, the vulnerability could lead to the Safari browser closing down unexpectedly or the execution of arbitrary code.

An attacker could use the execution of arbitrary code to gain complete access to the machine, allowing them to steal information or install malware. It's important to note that the impacts section also notes that an attack that exploits this vulnerability depends on the user visiting a website that has been specially created by the attacker. As mentioned, the security notification page also includes guidance on how to update your software to remove the vulnerability. In this case, it advises using the Apple software update tool, which can be accessed from the Apple menu.