Citadel Security Software Warns of a High Threat Level Due to Recent Microsoft Source Code Leak.

Business Editors/High-Tech Writers

DALLAS--(BUSINESS WIRE)--Feb. 17, 2004

Microsoft Source Code Leak Contributes to Latest Vulnerability

Threat Released in Days, Expect Imminent Threat of New Critical

Vulnerabilities

Citadel Security Software, Inc. (OTCBB:CDSS), a leader in vulnerability management solutions through automated vulnerability remediation and policy enforcement warns that the vulnerability reported in Microsoft Internet Explorer (IE) version 5 as a result of a recent leak of Windows source code will be the first in a series of new vulnerabilities demonstrating the need for immediate remediation of all Microsoft vulnerabilities. The vulnerability reported allows a remote user to execute arbitrary code on a targeted system via a specially crafted bitmap. When the bitmap is loaded by Internet Explorer version 5, it will trigger an integer overflow and execute arbitrary code and run with the privileges of the target user.

"It is our opinion the leak of Microsoft's source code has the potential to be a serious security threat," said Kent Landfield, security group manager for Citadel. "We expect a wave of new vulnerabilities exploiting Microsoft issues as a result of this intellectual property breach." The leak of a subset of Windows NT and Windows 2000 code provides hackers insight into Windows design and implementation, enabling them to leverage what they have learned to create new vulnerabilities and exploits. Newer versions of Microsoft Internet Explorer, version 6 as an example, are not vulnerable to this exploit, illustrating why organizations should take every precaution to update and remediate their networks to protect against this new emerging threat.

Citadel's Hercules automated vulnerability remediation solution already provides remedies that protect customers from these types of vulnerabilities. To avoid attacks, organizations need to implement up-to-date remediation processes, utilize automation technology and orchestrate the best practices that Citadel recommends.

Citadel's Hercules is the first vulnerability remediation solution to automate the resolution of all five classes of vulnerabilities including unsecured accounts, misconfigurations, unnecessary services, software defects and backdoors. "Our customers can be confident that if they remediate their networks with Hercules, they will be less vulnerable to attacks on older Microsoft issues such as this latest vulnerability in Internet Explorer 5, and will be in a better position to fight new attacks," says Landfield. With the largest library of remediation capabilities across Windows, Sun Solaris and Linux Red Hat platforms and interoperability with industry leading network scanners and vulnerability assessment tools, Hercules allows users to import and aggregate data from multiple sources, review, approve and customize resolutions and systematically deploy vulnerability fixes.

About Citadel

Citadel Security Software Inc., a leader in vulnerability management solutions through automated vulnerability remediation and policy enforcement, helps enterprises effectively neutralize security vulnerabilities. Citadel's patent-pending Hercules(R) technology provides users with full control over the automated remediation process, enabling efficient aggregation, prioritization and resolution of vulnerabilities detected by industry-standard vulnerability assessment tools. Winshield(R) SecurePC(TM) and NetOFF(TM) products enable companies to enforce security policies from a single point of control. Citadel's solutions enable organizations to ensure the confidentiality of information, reduce the time and costs associated with the inefficient manual remediation process, and facilitate compliance with organizational security policies and government mandates such as, FISMA, HIPAA and Gramm-Leach-Bliley legislation. For more information on Citadel, visit www.citadel.com, or contact the company at 214-520-9292.

Safe Harbor/Forward-looking Statements:

This press release contains forward looking statements that are subject to risks and uncertainties including the current economic and geopolitical environment, the current information technology spending trend, the uncertainty of funding of government information technology security projects, a lack of Citadel operating history, uncertainty of product acceptance, uncertainty of ability to compete effectively in a new market and the uncertainty of profitability and cash flow of Citadel, competition ,intellectual property rights and dependence on key personnel. These risks and uncertainties may cause actual outcomes and results to differ materially from expectations in this press release. These and other risks are detailed in Citadel's quarterly reports on Form 10-QSB filed for the quarter ended September30, 2003 and Citadel's annual report on Form 10-KSB filed for the year ended December 31, 2002 and our Form 10-KSB to be filed for the year ended December 31, 2003.

Editors Note: Citadel is a trademark and Hercules(R) is a registered trademark of Citadel Security Software Inc.