Andre sikkerhetsløsninger

Transcription

1 Andre sikkerhetsløsninger Business Ready Security Solutions Karl Bjarne Westbye Security & Management, Microsoft 24. Mars 2010

2 Agenda Business and IT Challenges Secure Messaging Secure Collaboration Secure Endpoint Management Solution Resources and Tools Summary

3 Business Needs and IT Challenges Secure access to messaging from virtually anywhere Prevent sensitive information from leaking Protection from advanced threats Receive messaging free of spam Multiple locations and devices Difficulty in discovering and securing sensitive information Financially motivated evolving threats Advanced spam technologies bypassing scanners BUSINESS Needs Agility and Flexibility IT Needs Control

4 Business Ready Security Help securely enable business by managing risk and empowering people Protect everywhere, access anywhere Identity Simplify the security experience, manage compliance Highly Secure & Interoperable Platform Integrate and extend security across the enterprise from: Block Cost Siloed to: Enable Value Seamless

5 Business Ready Security Solutions Secure Messaging Secure Collaboration Secure Endpoint Information Protection Identity and Access Management

6 Source: New Solution Helps Pharmaceutical Maker Improve IT Performance and Security. Microsoft case study, June Protect Messages from Malware Single Engine Multiple Engines 38 times faster An AV-Test of consumer antivirus products revealed: Automatic Engine Updates On average, Forefront engine sets provided a response in 3.1 hours or less. On premises or in the cloud Single-engine vendors provided responses in 5 days, 4 days, and 6 days respectively. 99% spam detection* * With premium antispam services Akihiro Shiotani, Deputy Director of the Infrastructure Group

7 Intern et Server Applications Exchange Front End Exchange Mailbox Server Microsoft AV Multi-engine Manager Client Machines

8 Protect Sensitive Information in Automatically protect sensitive with Active Directory Rights Management Services Outlook Web Access Filter message body and subject based on content criteria Policy-based restricted usage of attachments Jason Foster, Senior Manager of Technology

9 Source: New Solution Helps Pharmaceutical Maker Improve IT Performance and Security. Microsoft case study, June Simplify Security Management Unified policy management for onpremise and cloud-based messaging servers Enterprise-wide visibility into threats through a single console Help enable compliance with depth reporting capabilities Easy to use wizards and templates for system configuration and threat response Amy Babinchak, Harbor Computer Services, Inc.

10 Secure Messaging The Road Ahead Management Consoles Subject to Change

11 Technology Drilldown The Microsoft Solution for Secure Messaging Protect Everywhere. Access Anywhere. Malware and spam protection Information Protection Unified Access Management Integrate and Extend Security. Exchange integration Secure Communication with External Users Simplify Security. Manage Compliance. Central Management Security state assessment

12 Forefront Malware Protection On-Premises Advanced malware protection with multiple scan engines Content and attachment filtering New content filter engine (Cloudmark) Anti-backscatter Microsoft antispyware engine Administration Single administration point for policy management Dashboard to view security state of messaging infrastructure Improved performance In-Cloud Hybrid model Microsoft Forefront Online Protection for Exchange integrated with Microsoft Forefront Protection for Exchange Extend messaging protection to cloud as a crucial first line of defense against malware and spam Eliminate threats before they reach to the corporate firewall Help increase available bandwidth by filtering junk in-cloud Enhanced policy filter search Real-time message trace and reporting from a single management console Disaster recovery

13 Advanced Messaging Protection On-Premises Multiple scan engine technology Up to five engines can run simultaneously on any scan job Removal of a single point of failure Rapid response to new threats Microsoft Rapid Update Process updates the engine signatures as soon as available from vendor External Senders Edge Server Hub Server Store Server Legitimate Junk Legitimate or Junk s Anti-spam Engine 1 Anti-spam Engine 1 Legitimate or Junk s Exchange Users About 90 percent of is junk Engine 4 Engine 5 Engine 2 Engine 43 Engine Inactive down engine for with update most or Scan recent engine updates crashed when activates available, for becomes active scanning for scanning Activated engines for scanning

14 Forefront Hybrid Messaging Protection First line of defense in-cloud for malware and content filtering Helps increase available bandwidth by filtering junk in-cloud Eliminate threads before they reach the corporate firewall Rapid response to ever-evolving threats Edge Server Store Server External Senders Hub Server Legitimate Junk About 90% of is junk Legitimate or Junk s Antivirus Anti-spam Policy * Encryption Disaster Recovery Legitimate sent scanned to user for malware/spam on-premises If junk, sent to quarantine Scanned s to User Onpremises Anti-spam Engine 1 Engine 2 Engine 3 scanned for delivered to malware/spam user Legitimate or Junk s Exchange Users Quarantine Engine 5 In-Cloud On-Premises

15 Forefront Protection 2010 Anti-spam Protection Exchange Forefront 2010 Benefits Connection Filtering Protocol Filtering Content Filtering Forefront Domain Name System (DNS) Block List Unified Management Backscatter Filter Cloudmark Authority Engine Forefront True Type File Filtering Global Exception Lists Streamlined SCL Aggregated Realtime Block List (RBL) data from multiple external and internal vendors No configuration required Consolidated Connection/Sender/Recipient/Sender ID filtering for simplified management Blocks NDR (backscatter) spam Option of alternative third-party content filter Above 99 percent detection rate No configuration required (installs with smart defaults) Real file type inspection (not just extension) Actionable scanning of nested files/within ZIP Single access point to sender and recipient exception lists (allow and block actions) Less ambiguous ratings for fewer false positives end to end West Coast Labs: Spam Catch Rate above 99 percent Premium Antispam certification Virus Bulletin: Continuous Spam Catch Rate above 99 percent: percent (September 2009) percent (November 2009)

16 File Filtering Compressed file filtering Forefront scans within ZIP and other compressed formats, deleting only the offending file. Allow unpack and selectively repack compressed files. Can scan compressed files, even if they are password protected. Quarantine file is replaced by text file for user information. EXE EXE DOC EXE TXT Filter Rules: Delete *.exe Quarantine DOC BMP JPG BMP JPG Container file before scan Container file after scan Inappropriate files quarantined Quarantine

17 Keyword Filtering Scans documents for content considered confidential or inappropriate Helps enforce corporate information usage and language policies Native support for most Microsoft Office application documents and open XML file formats, including those encrypted by Active Directory Rights Management Services or compressed

18 Secure Instant Messaging Multiple antivirus engines in a single solution Blocks conversations containing inappropriate content Prevents the transfer of dangerous file types Scans malware from external communications including public instant messaging (IM) clients or federated networks Integrates with multiple server roles for layered protection Access Edge Server Director Server Front-End Server Federated (Trusted) Organization Internet Keyword Filtering Public IM Networks The word Fabrikam is blocked by the organizational policy and the message will not be transferred to the recipient. Remote Users Internal Users

19 Simplified Security Management Unified policy management Single console for policy management of on-premises and cloud-based messaging servers Single console for creating filtering rules Centralized management for all scan engines Enterprise-wide visibility into e- mail threats through a single console Centralized reporting for realtime, scheduled, and ondemand scanning Help enable compliance with depth reporting capabilities Easy-to-use wizards and templates for system configuration and threat response

20 Enterprise-wide Visibility A single management console for security configuration Enterprise-wide visibility into overall security state of messaging infrastructure Centralized point to manage all Forefront Protection for Exchange agents and servers Real-time reports and alerts In-depth monitoring and reporting with SQL reporting services and System Center Operations Manager Monitoring and Reporting Single Management Console Monitoring and Reporting

21 Manage Compliance Visibility across endpoint, collaboration, and messaging servers; on-premises and cloud security; and the network edge Single console for configuring and viewing the security state Dashboard and risk-centered prioritized view throughout the enterprise Centralized reporting and alerting Centralized scanning initiation Enterprise policy enforcement Delegated permissions Prevention of information leakage from within the documents Ability for organizations to securely exchange trusted information beyond corporate network

22 Secure Messaging Enable more secure business communication from virtually any location or device, while preventing unauthorized use of confidential information PROTECT everywhere ACCESS anywhere INTEGRATE and EXTEND security SIMPLIFY security, MANAGE compliance Best-in-class antimalware on-premises/ in-cloud Protect sensitive information in Provide more secure, always-on access Built-in Information Protection Extend secure with partners Enterprise-wide visibility and reporting Unified management Learn more at:

23 Business Ready Security Solutions Secure Messaging Secure Collaboration Secure Endpoint Information Protection Identity and Access Management

24 Secure Collaboration Simple and easy

25 Agenda The Microsoft Solution for Secure Collaboration Protect Everywhere, Access Anywhere Malware Protection Information Protection Unified Access Management Integrate and Extend Security SharePoint Integration Secure Collaboration with External Users Simplify Security, Manage Compliance Centralized Management Security State Assessment

26 Advanced Malware Protection Multiple scan engine technology Up to five engines can run simultaneously on any scan job Removes single point of failure relative to single-engine approach Enables rapid response to new and emerging threats Microsoft Rapid Update Process updates the engine signatures as soon as available from vendors SharePoint Server External SharePoint Users Malware Inappropriate Content Internet Engine 1 Malware Inappropriate Content Internal SharePoint Users Activated engines for scanning Engine 2 Engine 43 Engine Inactive down engine for with update most or Scan recent engine, updates crashed when activates available, for becomes active scanning for scanning

27 File Filtering Setting up file filters Forefront Protection 2010 for SharePoint blocks attachments by extension and true file type based on application hash Default file filtering rules help to eliminate file types known to carry viruses (for example,.exe,.mp3) Simple change of extension cannot trick the filter Each rule can be configured individually Use *.exe and All Types of files to block anything named *.exe. Use *.* and EXEFILE to block any executable file, no matter what it is named.

28 Keyword Filtering Scans documents for content considered confidential or inappropriate Helps enforce corporate information usage and language policies Native support for most Microsoft Office application documents and open XML file formats, including those encrypted by Active Directory Rights Management Services or compressed

29 Always-on Secure and Seamless Access Integrated SSL VPN capabilities Simplified remote access by non-windows, down-level, or non-trusted endpoints DirectAccess in Windows Server 2008 R2, along with Unified Access Gateway, enables secure, seamless, always-on access to messaging and applications from Windows 7 clients. Data Center/Corporate Network Home/Kiosk Mobile Internet Layer3 VPN HTTPS (443) DirectAccess Exchange CRM SharePoint IIS based IBM, SAP, Oracle TS/ RDS Citrix Business Partners Employee-Managed Machines Non-Web AD, ADFS, RADIUS, LDAP. NPS, ILM

30 Simplified Collaboration Security Management A single management console for security configuration across whole organizational collaboration infrastructure Enterprise-wide visibility through dashboard view Real-time reports and alerts Provides visibility, which helps to secure organizational collaboration solutions Monitoring and Reporting Single Management Console Monitoring and Reporting

31 Manage Compliance Enterprise policy enforcement to protect from unauthorized access Enhanced security with reduced risk of information leaks through persistent data protection Streamlined adoption and deployment with out-of-the-box integration with collaboration workflow, the Microsoft Office system, and Active Directory Prevents information leakage from within the documents while moving to the external user Enterprise policy enforcement for external partners and vendors to protect from unauthorized access Dashboard and riskcentered prioritized view throughout the enterprise Centralized reporting and alerting with Unified Access Gateway management console Access to SharePoint sites and ability to edit documents from virtually anywhere: managed laptops, home computers, kiosks, and mobile devices Includes multiple scanning engines from industry-leading security partners integrated in a single solution to help businesses protect against single point of failure Content filters to help keep users from posting or retrieving ethically questionable material and confidential company information Configurable filefiltering rules to help block file types known for carrying viruses or opening organizations to legal exposure

32 Secure Collaboration Enable more secure business collaboration from virtually any location or device, while preventing unauthorized use of confidential information. PROTECT everywhere, ACCESS anywhere INTEGRATE and EXTEND security SIMPLIFY security, MANAGE compliance Secure, seamless access Protection of sensitive information Best-in-class anti-malware Deep Microsoft SharePoint and Office integration Standards-based interoperability Enterprise-wide visibility Easier partner management Learn more at

33 Business Ready Security Solutions Secure Messaging Secure Collaboration Secure Endpoint Information Protection Identity and Access Management

34 Advanced Protection Against Web-based Exploits Advanced URL filtering for safe web browsing Reputation services for enhanced accuracy Integrated Anti-Malware protection at the edge Inspects encrypted and unencrypted web traffic Prevents exploits against browser-based vulnerabilities

35 Comprehensive Malware Protection For Endpoints Integrated anti-virus/anti-spyware agent for real-time protection Advanced detection technologies for complex malware Malicious Threats Unique vulnerability assessments Rapid response through global threat research team Management Console

36 Leverage Existing Infrastructure Integration with Existing Infrastructure Automated Deployment Compliance-based Access Update Services Integrated Solution

37 Unified Malware Protection Engine Detection and Removal Capabilities One solution for spyware and virus protection Real-time detection using Microsoft Windows Filter Manager technology Assurance that system is fully functional after cleaning Comprehensive Antivirus/Anti-Spyware Protection Single scanning agent to enhance client machine performance On-access protection via kernel mode mini-filter Management Console Behavior analysis User-mode rootkit scanning Heuristic detection Antispyware Antivirus / worms Malicious Threats

38 Scan Mechanism Real-time, scheduled, and on-demand detection and removal Minimal end-user disruptions using Filter Manager Scans for rootkits Behavior analysis for polymorphic viruses Scans for dozens of archives and packers Quick scan in-memory processes Security Administrator Management Console

39 URL Filtering Blocks malicious sites URL category sets and exclusions Integrated with forward proxy Backed by Microsoft Reputation Service (MRS) Web server allows user to access the URL User will able to access the URL 5 MRS validates that the URL should or User requests the URL TMG should forwards not the be request allowed, to per TMG MRS sends a request to the 4 organizational policies Web server to get the URL

40 Intrusion Prevention System Protects against known vulnerability-based threats at the edge of the network Provides same-day availability of patch and NIS signature Minimizes opportunities for exploits Closes the gap between vulnerability announcement and patch deployment on endpoints Signature Updated Corporate User Access to Vulnerable Request Denied MMPC Response Team Vulnerability Research Signature Development Signature Testing Signature Release

41 Single Policy Security Management Single agent security management from threats One console for simplified security administration One policy to manage client protection agent settings Customized Forefront Client Security Specifies threat response Keeps security systems up-to-date Forefront Client Security Console Administrator creates and deploys policy Group Policy Management Console Clients

42 Simplify Security Management Easy-to-use wizards for security and policy configuration Enterprise-wide client state visibility Insightful reports to ensure compliance Security Summary

43 Security State Assessment Defined industry best practices and known vulnerabilities Security State Assessment (SSA)-based reporting functionality to measure security risk profiles Use SSA checks to search for potential vulnerabilities Examine data from the registry, file system, WMI, IIS metabase, SQL, and more Detect common vulnerabilities in the environment and configuration Reporting and Alerting Server Client Computers State Assessment Summary

44 Unified Security Management Simplified security administration, locally or remotely Centralized endpoint and Group Policy management Dashboard view for visibility into threats and vulnerabilities via insightful reports Dashboard View Policy Management Console

45 Secure Endpoint Protect client and server operating systems from emerging threats and information loss, while enabling more secure access from virtually anywhere PROTECT everywhere, ACCESS anywhere INTEGRATE and EXTEND security SIMPLIFY security, MANAGE compliance Advanced malware protection Protect sensitive information Secure, always-on access Integrated with OS security Leverages existing infrastructure Simplified management Enterprise-wide visibility

46 Mer informasjon

47 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.