Re: Gartner Group: DO NOT USE IIS!

[Douglas Handy <dhandy1@xxxxxxxxxxxxx>]

Walden,

>Even if you didn't config as secure had you
>installed the rollup you'd have been safe. Aug 15th was plenty of time to
>install before the attack.

I thought the point of Gartner's recommendation was not that the patches were
ineffective, nor that other products do not need patches.  It was that IIS
required *more frequent* patches and therefore had a higher total cost of
ownership.

Whether virus writers seem to target MS software because it is more vaulnerable,
out of spite, or simply because there are more scripts for the kiddies to choose
from, the fact remains MS has been targeted more than the others.  I'd even go
so far as to say the average IIS shop's security is now much better than it was
a few months ago.  If it were not so, I think we would have seen much wider
problems caused by Nimda.

To say that keeping up on all of MS's available patches protected you from these
viruses is missing the point.  The point is what it takes to stay on top of
these patches and apply them in a timely fashion, relative to competing
products.  And MS's rebuttal article did nothing to address that argument.

Doug