Aelita Software Makes Recommendations Based On Windows 2000 Security Vulnerability.

Business Editors & High Tech Writers

COLUMBUS, Ohio--(BUSINESS WIRE)--Feb. 5, 2002

Case for Multi-Forest Architecture is Now Stronger says Company that

First Identified Domain Trust Vulnerability

Aelita Software Corporation, which provides enterprise management solutions for Windows-centric networks, today released information on how to minimize an organization's vulnerability to elevation of privilege attacks that are made possible by the way domain trust relationships are handled in Windows 2000 and Windows NT. Microsoft issued a security bulletin on this vulnerability on Jan. 30.

Aelita, which was credited by Microsoft for identifying the vulnerability, has unveiled a special section of its Web site, www.aelita.com/ADSecurity, devoted to issues concerning the vulnerability. The company has also released a white paper titled "Protecting Active Directory from the Domain Trust Vulnerability," which can be downloaded from the special Web site section.

"Microsoft has clearly taken this vulnerability seriously and we are encouraging our customers to consider the SID filtering capabilities Microsoft released," said Ratmir Timashev, president and CEO of Aelita Software. "At the same time, we want our customers to understand that because of the way these trust relationships are handled, the forest, not the domain, should be considered the true security boundary in Windows 2000. Organizations should take account of this fact when evaluating their current and future Active Directory designs and give more serious consideration to a multi-forest architecture."

According to Timashev, organizations must balance security against collaboration and administrative overhead when creating an Active Directory architecture for Windows 2000 and Exchange 2000 enterprise environments. The multi-forest approach may also be justified for companies with autonomous divisions, or to comply with specific industry regulations.

Aelita discovered the vulnerability in the process of developing solutions for Windows 2000 migration, administration and recovery. The company immediately notified Microsoft and has been working with Microsoft on the issue so that a strategy for minimizing the vulnerability could be developed prior to release of the information.

According to Microsoft's security bulletin, the trust relationships between Windows NT or Windows 2000 domains do not verify that the trusted domain is actually authoritative for all the SIDs in the authorization data. This could allow a malicious administrator with administrative privileges on the trusted domain, and the technical wherewithal to modify low-level operating system functions, to extend their administrative privileges to the trusting domain and undermine network security policies.

Microsoft developed SID filtering in response to the vulnerability. SID filtering can be used to screen out access from domains with poor physical security or whose administrators may raise doubts.

The Aelita white paper, "Protecting Active Directory from the Domain Trust Vulnerability," describes this security threat in detail and provides expert knowledge that can help high-level administrators and managers design more secure Active Directory infrastructures.

About Aelita Software Corporation:

Aelita Software, a Microsoft Gold Certified Partner, provides comprehensive Windows-centric enterprise management solutions that focus on migration and deployment, administration and provisioning, operations and security, and backup and recovery. Aelita solutions improve the usability and security of Windows 2000, Active Directory, Microsoft Exchange and .NET infrastructures, while also extending Windows-centric network management to multi-platform enterprises. Recent Aelita innovations include ZeroIMPACT(TM) technology migration, the first full-featured Active Directory recovery solution, and a new approach to operations management that is enabling network managers, security directors and CIOs to use operating data in new ways. Aelita Software is headquartered in Columbus, Ohio and can be reached at [phone]. For more information on Aelita, go to www.aelita.com or contact [e-mail].