RAZOR, BindView's Newly Named Security Team, Discovers `Syskey Bug' on Microsoft NT Feature; Top Security Experts Join RAZOR.

Business/Technology Editors

HOUSTON--(BUSINESS WIRE)--Dec. 22, 1999

BindView Corporation (NASDAQ:BVEW), the leading provider of IT risk management solutions, today announced that members of its newly named security team, RAZOR, have discovered a security vulnerability on Microsoft NT's Syskey feature and have collaborated with Microsoft to release a hot fix. The company is also announcing the addition of top new security experts to RAZOR to further the advancement of its mission to uncover and alert the public to potentially devastating security vulnerabilities.

The Syskey Bug

The latest security hole was discovered during the course of RAZOR's ongoing investigation of the latest network security threats and was reported to Microsoft. This vulnerability has been discovered to exist on Syskey, a Microsoft utility that encrypts registry files. Through various means, hackers can gain access to the Security Accounts Manager (SAM) database where valuable user authorization and password hashes are stored. Access to this information can devastate a network.

"RAZOR's discovery of the Syskey Bug validates our team's ability to keep networks safe and further underscores our commitment to expose network vulnerabilities and alert the public of these devastating risks," said Scott Blake, security program manager at BindView and head of the security team. "This discovery also demonstrates how we effectively partner with Microsoft to resolve Windows NT security issues."

Microsoft issued a Security Advisory on December 14 that can be downloaded at http://www.microsoft.com/Security/Bulletins/ms99-056.asp and includes a URL to the hot fix. BindView customers can download BindView's anti-hacker product, HackerShield 2.0 from www.BindView.com and deploy its Rapid-Fire update feature to find out if the bug exists on their networks.

The RAZOR Team

The BindView security team was formed in 1998. Led by security program manager, Scott Blake, the combined talent of the team can be credited with identifying more than 80 network security vulnerabilities and has played a key role in working with companies like Microsoft to issue patches to these dangerous network threats.

Mark Loveless, senior security analyst, is one of the newest members who brings distributed systems expertise for Unix, Windows NT and Novell NetWare to the RAZOR team. Loveless, better known as Simple Nomad, the founder of the Nomad Mobile Research Centre, has spent years developing and testing various computer systems for security strengths. Todd Sabin, senior security analyst, also is one of the newest RAZOR members and is best known as the author of pwdump2. Sabin contributes security expertise to BindView's HackerShield and NOSAdmin for Windows NT products. He conducts research into new host and network vulnerabilities on Windows NT and 2000.

Stated Eric Pulaski, president and CEO at BindView, "The efforts of BindView's RAZOR are greatly enhanced by the addition of these new security gurus. As corporate networks continue to expand in scope, security risks become much more prevalent, leaving companies vulnerable to internal and external hacker intrusions. Through the efforts of this worldwide team of experts, BindView can minimize potentially devastating risks and continue to provide the necessary products to help corporations keep their networks safe."

About BindView Corporation

Founded in 1990, BindView provides IT risk management solutions for managing the security, configuration and availability of network operating systems, e-services and business applications. Focusing on the critical elements of the corporate IT infrastructure, BindView's award winning products enable corporate IT professionals to effectively leverage their existing technology to achieve their organizations' business goals. More than 7 million licenses of BindView's products have been shipped worldwide to more than 4,500 companies, including 75 of the Fortune 100 and 22 of the largest 25 U.S. banks. Contact BindView via e-mail at [e-mail] or visit BindView's World Wide Web Site at http://www.bindview.com. BindView can also be reached at [phone] or at [phone].

Editors Note: BindView product names used in this document are trademarks, which may be registered in one or more jurisdictions, of BindView. The names of products of other companies mentioned in this document, if any, may be the registered or unregistered trademarks of the owners of the products.