If your business uses Windows XP, get ready for April 12, when the mechanism to temporarily disable delivery of Windows XP Service Pack 2 (SP2) expires.

If you have enabled the automatic update feature for Windows XP (the default) and you have installed the block, your machine will begin downloading SP2, a major package of security patches and feature additions for the operating system. In addition to the raft of usual security patches, SP2 also adds features to help you manage your security and privacy while online.

SP2 is the second major update to XP2. You should already have upgraded your Windows XP with Service Pack 1. If you have not, then simply go straight to SP2 which will install everything.

Microsoft released the block to the automatic update feature in XP in August last year after many organisations said it conflicted with many of their installed programs.

The organisations wanted additional time to validate and test the update. At Microsoft?s download site, the company recommends using Systems Management Server (SMS) 2003 or Software Update Services (SUS), among other tools, to install SP2. The management tools allow administrators to control the deployment Windows XP SP2 (as well as other updates) across the company?s machines. The software reduces network traffic into the organisation, since updates only need to be downloaded to one or a small number of servers instead of being downloaded separately to each system requiring the update.

One further note for businesses in Bermuda that have not implemented the update: You are not alone. Many businesses remain suspicious of putting in the service pack because of fears their other software will no longer work, thus meaning a further spend on software. Less than 20 percent of North American companies have adopted Windows XP Service Pack 2, according to a new survey by AssetMetrix. Forty percent are actively avoiding SP2 while just seven percent have accepted the fix.

?To date, more companies are tending to hold back on SP2 than accept it as a standard,? AssetMetrix says on its website.

?Service Pack 2 is an important update that patches any number of Windows holes. But the mass hesitance about the upgrade points out a basic conundrum about Windows security as it stands, which is that patching is ultimately a crummy way to get to a more secure computing platform.?

The survey was conducted on 251 North American corporations. About half of the companies still lack any formal policy on downloading and installing the service pack, AssetMetrix said. Companies face support problems in future by allowing multiple editions of Windows XP to exist in their infrastructure.

SP2 encountered problems after launch when administrators found it clashed with at least 200 commercial applications in addition to internally developed software. In a bid to calm the fear of a major system crash, Microsoft has submitted six ?case studies? online.

You can download Windows SP2 manually (if you have turned off automatic updates) by going to www.microsoft.com. Direct links to the update and important SP2 information can be found at www.SecureBermuda.com.

Businesses should also note that Microsoft released Service Pack 1 for Windows Server 2003 last week. SP1, a major update, protects systems by providing a reduced ?attack surface?, better protected system services with stronger default settings and reduced access privileges.

The new Security Configuration Wizard collects data about specific server roles and then automatically blocks all services and ports that are not needed to carry out those roles. The pack includes an additional Windows firewall to provide network-wide control through group policies. A security update feature blocks all inbound connections to the server until updates are activated on the computer.

Go to: www.SecureBermuda.com for security updates.

* **

Contact Ahmed at ahmed.elaminwanadoo.fr