Home / server / Questions / 527656
In Process
Delmonte
Asked: 2013-08-01 07:19:56 +0800 CST

Installing MS Office 2007 in a Windows Server 2003 makes server more vulnerable?

  • 772

In a Windows Server 2003, a asp.net web application needs to convert Word documents to PDF. For that functionality, developers were asking to install MS-Office 2007 in our Windows Server 2003. My boss said no, because installing MS-Office in a server will make it more vulnerable in security issues, and would be worry to keep update with latest patches for MS-Office.

Do you think is that true?

windows-server-2003

2 Answers

  1. It's not so black and white.

    Technically you are increasing your risk by adding services and applications that can be compromised. And you do need to patch the office installations, so it does add overhead. If you are wanting to counter the assessment, then you probably need to do a Risk assessment your self and present the findings and mitigations. Be sure to weigh the value of the request against the Risk/Impact of having those items installed.

    Examples of how to mitigate some of the risk.

    1. if the server is internal, your risk of being compromised is less than if it is exposed to the internet.
    2. you can restrict access to the bits by locking down which accounts can run the applications or access the DLL's, etc. This lowers the risk that a random domain user account can access and exploit the application.
    3. Along with Item 2, if feasible you could also restrict the server to communicating only wiht certain IP's, Subnets, etc.

    This assumes other things like the server is already running in least privileged mode and hardened appropriately, you are using Defense in Depth, etc.

    • 2

  2. Yes, it's true.

    Every bit of software you install on a server increases the number of potential attack vectors on that server. And Office is a particularly huge, bloated suite of applications that comes with a lot security patches and updates and exploits.

    MS Office is very handy to have on your workstation, but you should never install Office on a server. If you absolutely have to for your business to function, then make sure you install only the parts of it that you absolutely need.

    • 1