How Microsoft runs IT. Ludwig Wilhelm CIO Central & Eastern Europe Microsoft IT

Transcription

1 How Microsoft runs IT Ludwig Wilhelm CIO Central & Eastern Europe Microsoft IT

2 2

3 Source: Accenture Cloudrise: Rewards & Risks at the Dawn of Cloud Computing, November

4 Source: Accenture Cloudrise: Rewards & Risks at the Dawn of Cloud Computing, November

5 Processes People Technology Strategy 5

6 Similarities Security and Cost Reduction are our top priorities Too much work, too little time, mostly reactive A mix of Microsoft operating systems and configurations Not all users are cooperative Balancing security, cost, and efficiency is the bottom line Differences Being Microsoft s first and best customer Software deployed more than once Majority of users are technical, local administrators High target for security attacks

7 1,2m PCs and devices SVC Redmond Collaboration 210k mailboxes 3m internal per day 25m+ s from the Internet per day 92% rejected as spam 99.99% availability 746k Sharepoint sites Dublin Users/Sites 106 countries 700+ buildings 7,500 production servers 190K end users Office dweller (40%) Campus Nomad (40%) Remote users (20%) 2.3 Tb DB Single Instance SAP ERP on SQL 2008 R2 Singapore Remote connectivity 2,5m remote con p.m. 78m IMs p.m. 88m RPC/HTTP p.m. 100m Active Sync p.m. High scale Worlds largest corporate website 1.2B hit per day 755k concurrent usr.

8 Processes People Technology STRATEGY 8

9 Global Business Model Customer Requirements Supplier Requirements Security of Information Assets Privacy Protection Industry Mandates Mobile Devices Collaboration Tools Dogfooding

10 Savings FY13: 15% apps in the Cloud FY15: 80% apps in the Cloud FY11: Less than 5% apps in the Cloud Portfolio Mix in FY15 20% Apps retired or last to move 50% Apps moved to Cloud in VM role 20% Apps rearchitected for Cloud 10% New apps written directly to Cloud 10

11 Savings FY15: Effectiveness Fully cross-premise services management FY13: Efficiency Integrated provisioning, feature parity, integrated monitoring and support escalation FY11: Experience Manual provisioning, monitoring, support, and escalation FY11 Services Exchange Online: 3K SharePoint Online: LBI Only FY13 Services Exchange Online: 50% of Users SharePoint Online: Sample of sites and portals Lync Online: Dogfood deployment FY15 Services Exchange Online: Majority of Users SharePoint Online: Majority of sites Lync Online: Majority of users

12 Risk Management Intellectual Property Protection Targeted Malware Attacks Increased Data Leakage and Portability Zero Day Attacks Diverse Compliance Challenges Insider Tracks Foreign National Threats Risk Management vs. Risk Elimination Critical Infrastructure Protection Integration with ERM Initiatives Business Enablement Support for Rapidly Changing Business Focus on New Revenue Streams Mergers, Sourcing and Workforce Changes Increased Value Change Integration Need for Improved Business Intelligence E-Discovery and Investigations Technical Architecture Cloud Computing/SaaS Data Loss Prevention SIEM Platforms and Programs IAM Governance and Process (Role Optimization) Increased Encryption (Data Level and Portables) Application and Code Review Endpoint Security Operational Excellence Better Integration with Board/ERM Doing More with Less Vendor and 3 rd Party Management Security Organization Model and Structure Asset and Configuration Management Executive Reporting and Metrics Managed Security Services Awareness and Training

13 User Empowerment Mobility Proliferation Personal devices User-centric Social networking Partnering IT Controls Cost Reliability Security Efficiency Governance Risk & Compliance

14 Security of Digital Assets Anywhere & any device Access Time

15 P r a c t i t i o n e r Partners Scale thru Partners Policy Driving Policy and Compliance Product MS Security and Management Products Platform Securing the MS Platform

16

17 Processes PEOPLE Technology Strategy 17

18 Site Classification Information Security Risk Branding Upon classification, one of three graphics are affixed to the site.

19 PROCESSES People Technology Strategy 19

20 Impact considers potential financial loss, recovery time, operational scope, reputational impact, legal/regulatory impact

21 The cost of removing an application security vulnerability during the design phase ranges from times less than if removed during production. NIST, IBM, and Gartner Group 100X Customers In the Field 15X System/Acceptance Testing 1 X 6.5X Static Analysis Integration Testing Design Development Testing Deployment Source IDC and IBM Systems Sciences Institute

22 Process that is integrated into software development lifecycles (SDLC) Goals: Assess risk (security/privacy) at every stage within the SDLC Reduce cost of developing secure applications SDLC Envision Design Develop Test Release SDL-LOB App Entry / Risk Assessment Threat Modeling Internal Review Pre-Prod Assessment Post-Prod Assessment Catalog & Classify Identify Controls Implement Controls Verify Controls Monitor Controls

23 Cost Center More Efficient Cost Center Business Enabler Strategic Asset IT staff taxed by operational challenges Users come up with their own IT solutions IT Staff trained in best practices i.e., MOF, ITIL Users expect basic services from IT IT managed environment Users have the right tools, availability, & access to info IT is viewed as a strategic asset IT is a valued partner & enables new business initiatives IT processes undefined Complexity due to localized processes & decentralization Central Admin & configuration of security Standard desktop images defined, not adopted by all SLAs are linked to business objectives Clearly defined and enforced images, security & best practices Self-assessing & continuous improvement Easy, secure access to info from anywhere Patch status of desktops is unknown No unified directory for access mgmt Multiple directories for authentication Limited automated s/w distribution Automated identity/ access management Automated system management Self provisioning & quarantine capable systems ensure compliance & high availability

24 Processes People TECHNOLOGY Strategy 24

25 BASIC STANDARDIZED RATIONALIZED DYNAMIC Two Factor Authentication Secure Remote User Enforce Strong Passwords Secure Wireless Access Network Intrusion Detection Basic to Standardized S Network Segmentation 2FA: Elevated Access Accts Security Event Monitoring LPA Controls Standardized to Rationalized R Network Access Protection Strong User Authent. User Account Control Bitlocker Drive Encryption Rights Management Rationalized to Dynamic D Sticky note

26 Gained Executive Level Support Changed Security and Procurement Polices Include BitLocker Config in Image Store Recovery Keys in AD Tools Deployed BitLocker Automated System Enforcement (BASE) BDEVault: Bitlocker Self-Service Recovery Tool BitLocker Check Automated Notifications Windows 7 BitLocker FAQs

27 Persistent Protection Encryption + Policy: Access Permissions Use Right Permissions

28 28

29 29

30

31 Domain Joined Active Directory policies requiring certificates EAS Pin Policy Remote Wipe secure wireless w/ certificates BitLocker Drive Encryption Direct Access for Remote Access Non-Domain Joined Client Auth Certificate

32 Secure the Network Perimeter Secure the Network Interior Secure Key Assets Monitor and Audit Secure Wireless Direct Access Smart Cards for VPN Network Access Protection Intrusion Detection Anti-Malware Protection Patch Management IPSec - Network Segmentation Smart Cards for Admin Access SecureNet via IPSec Data Classification Rights Management Services BitLocker Drive Encryption Awareness Enforcement BG Scorecard Penalties

33

34 You manage You manage You manage Private (On-Premises) Infrastructure as a Service Platform as a Service Software as a Service Applications Runtimes Security & Integration No Databases provider may Databases fit all requirements Databases Servers Servers Servers However we have a choice now! Virtualization Virtualization BCDR built into most clouds Server HW Storage Networking Applications Runtimes Security & Integration Server HW Storage Networking Managed by vendor Applications Applications We need still to be in control & need to manage risk Runtimes Not all qualifies (yet) to be in the cloud Security & Integration Virtualization Server HW Storage Networking Managed by vendor Runtimes Security & Integration Databases Servers Virtualization Server HW Cloud provider building in depth security expertise Private vs. Public Cloud again is a difference Storage Networking Managed by vendor Control + Cost Efficiency + Savings

35 35

36

37 Additional content on Microsoft IT deployments and best practices can be found on Microsoft Case Study Resources Microsoft Security Intelligence Report

38 How Microsoft Optimizes and Secures its IT Environment 38

39

40 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.