Re: Any special preparations in anticipation of KB2661254 (Key Length) patch?

[David Lundy <dlundy () PACIFIC EDU>]

Marty:

We use a vulnerability scanner from Digital Defense on our server VLANs.  This scanner notes the certs it sees on each 
server along with other information related to vulnerabilities.  We were able to discover several certs that had key 
length less than 1024 bits by going through the scan results.  We then notified server administrators of the indicated 
servers.  We expect to do follow up on remediation.

David Lundy

------
David Lundy
Assistant IT Security Officer
Office of Information Technology
University of the Pacific
Stockton, CA 95211
Email: dlundy () pacific edu<mailto:dlundy () pacific edu>
Voice: 209-946-3951
Fax: 209-946-2898



On Wed, Sep 12, 2012 at 1:53 PM, Martin Manjak <mmanjak () albany edu<mailto:mmanjak () albany edu>> wrote:
MS will release their Update for Minimum Certificate Key Length to WSUS
next month.

I'm curious about any special preparations anyone may have taken to
identify certs within their domains that may not meet the new minimum
key length standard (1024).

Embedded devices, if using SSL, come to mind as a potential source of
problems.

Also, is anyone briefing their Help Desk staff on how to respond to
callers who report that they can't connect to sites because of the new
requirement?

It's hard to tell how much is going to break with this update.
Marty

--

Martin Manjak
CISSP, GIAC GSEC-G
Information Security Officer
University at Albany
MSC 209 518/437-3813<tel:518%2F437-3813>

The University at Albany will never ask you to reveal your password.
Please ignore all such requests.