Secure Extranet Deployment and. Forefront Security for SharePoint, ISA, and IAG. Lee Hickin Security Technology Specialist Microsoft Corporation

Transcription

1 Secure Extranet Deployment and Remote Access of SharePoint Using Forefront Security for SharePoint, ISA, and IAG Lee Hickin Security Technology Specialist Microsoft Corporation

2 Agenda Business and Security Challenges Forefront Server Security Product Overview Product Drilldown Summary

3 Business Environment Security Vulnerabilities Still Exist Spam, viruses and phishing now plague blogs and websites Closer relationship between viruses and spam Companies ill-equipped to stay ahead of threats Complianceis a Primary Concern Stiff penalties for corporate asset misuse Need to store, find and produce information quickly Can't comply without policy and monitoring support 1 in 5 employers have had subpoenaed* Intense Pressure on IT to Improve Productivity Focus on value adding projects Make mission-critical systems more reliable Deployment must be secure, reliable, manageable, cost-effective *2005 Electronic Monitoring& Surveillance Survey from American Management Association (AMA) and the epolicyinstitute

4 Information Risk Has High Costs Legal, regulatory, and financial impact Damage to image and credibility Cost of digital leakage per year is measured in $ billions Increasing number and complexity of regulations, e.g. GLB, SOX, state-specific regulations Failing to comply, or losing data, can lead to significant legal fees, fines, and/or jail time Damage to public image and credibility with customers Financial impact on company from lost sales or corrective actions Leaked s or memos can be embarrassing Loss of competitive advantage Disclosure of strategic plans, M&A info, etc. potentially leads to loss of revenue, market capitalisation Loss of research, analytical data, and other intellectual capital Premature disclosure of competitive strategies or market moves

5 What is Microsoft Forefront? Microsoft Forefront is a comprehensiveline of business security products providing greater protection and control through integrationwith your existing IT infrastructure and through simplified deployment, management, and analysis. Client and Server OS Server Applications Edge

6 Securing SharePoint Using Forefront Protection Server-based, multiple-engine antivirus and content filtering solution Publishing Firewall and proxy to provide the basic security needed when publishing SharePoint externally. This includes pre-authentication, HTTP filtering and encryption. Policy Secure remote access gateway to Web applications such as SharePoint and network-based resources

7 Protection Comprehensive Protection Ships with & manages multiple antivirus engines Filters files and keywords Supports Open XML & IRM-protected docs Optimised Performance Deeply integrated with SharePoint Server Scanning innovations and performance controls Maintains uptime and optimisesperformance Simplified Management Easy to manage configuration and operation Updates signatures automatically Provides reporting, notifications, and alerts

8 Forefront Security for SharePoint Protection Scenarios SQL Back End Internet Firewall External SharePoint Users Indexing Server Malware Inappropriate Content Internal SharePoint Users Extranet Web Front End Malware Inappropriate Content Management

9 Harnessing the Strength of Multiple Engines Forefront Security for SharePoint integrates and ships with eight industry-leading antivirus scan engines from: Each scan job in Forefront Security for SharePoint can run up to five engines simultaneously Collaboration Servers A B C E D

10 Forefront Server Security Management Console Features Central management console Deploys and configures Forefront/Antigen Security for Exchange and SharePoint environments Automates signature updates across the enterprise Scans for and pulls updates for multiple antivirus engines Distributes updates to all Forefront/Antigen servers SharePoint Servers Exchange Servers

11 Publishing Authentication Pre Authentication Multi Factor Authentication Single Sign-On (limited) Offloading Security Tasks Adds encryption in front of application servers Enables load balancing between Sharepoint Servers Platform for NLB Network Protection Creates defense-in-depth Stateful inspection firewall HTTP protocol inspection

12 Policy IAG is a simple and secure remote access solution for SharePoint environments enabling employees, partner and customer access from virtually any location. Administrators can enhance security, add functionality and increase productivity by leveraging IAG s combination of granular security controls and SSL VPN technologies. Application Intelligence At the heart of IAG s is a highly granular and intelligent application firewall that improves security, functionality and performance of most applications. Default policies are in place to address common applications such as SharePoint and Exchange, Terminal Services and policies can easily be created to enhance proprietary line of business applications. Endpoint & Access Security IAG includes a comprehensive end point security engine that allows for the detection of a device s security and configuration state. This allows administrators to publish granular and restricted access to unmanaged machines and extend more comprehensive and rich access from corporate assets. Information leakage is prevented using IAG s Attachment Wiper. Easy Management and Customisation With wisarddriven configuration, easy to use policies and a highly intuitive user experience, IAG ensures a fast and easy deployment allowing employees, partners and vendors simple and secure access. Ongoing management and control is simplified via updates to application and endpoint policies.

13 Simplifies Management Wizard driven configuration with built-in in policies Single point of control for external access Create unified policies Manage access from internal and external locations Monitor and audit access in a centralised console

14 Enhances Security Overlay granular access control to specific sites and or features within sites Default policies allow blocking uploads, downloads and administrative functions from unmanaged or un-trusted PCs Built-in in end point security policies Easily create endpoint policies to ensure compliance from partner and home PCs as well as corporate assets Expanded authentication and authorisation capabilities Leverage existing topology including multiple directories, ADFS, KCD and 2 factor authentication Information leakage prevention Attachment Wiper feature to remove any information left on unmanaged assets Network security Spares DMs resources Defense in depth topology

15 Customer Testimonials Forefront works like a dream. We don t have to do anything to it until we re ready to upgrade. With a small IT staff, that s exactly what we want. Alexander Fischer, Chief of IT Infrastructure, Koehler Paper Group We wouldn t put anything else for security on our Exchange Server 2007 machines. The software is well-respected. It s been around; it s proven. Our own experience with Microsoft Antigen is that it s an outstanding product. Forefront Security for Exchange Server makes it even better. Chris Habala, Senior Architect/Analyst, Del Monte We looked at Forefront and it blew us away. We re a Microsoft shop. We want to use products that will integrate well with what we have. And we ve seen the Microsoft roadmap for the Forefront product range, so we know this is a product we can use to increasing advantage in the years to come. Peter Oescheger, CIO, Sasfin The integration of Forefront with Exchange is even better than the integration we saw with Antigen. It integrates proactively as part of the scanning flow. It s not complicated to install or administer. Microsoft has taken one of the best antivirus products for Exchange and just made it better. Will Wilson, Director of Information Systems, Guardian Management

16 DSC-IT & Microsoft Secure Collaboration Example Built on Microsoft Sharepoint Server 2007 & ISA Server 2006 Forefront AV solution is next phase Enables Collaboration (securely) over the internet between DSC- IT and Microsoft Account Team Share technical/confidential information Work collaboratively on accounts

17 Summary FSSP protects your SharePoint environment by eliminating documents that contain malware, confidential information and inappropriate content ISA pre-authenticates users before they gain access to published servers IAG secures remote access to SharePoint virtually from any location Download free evaluation software: Forefront Security for SharePoint - ISA - IAG - Based on our evaluation, we see Forefront Security for SharePoint meeting all of our needs. It gives us an extra layer of protection for our SharePoint environment in ways that no other product can match. It is key to our deployment of the SharePoint-based extranet. - Tom Booth, Senior Collaboration Engineer, SAS The use of Microsoft Intelligent Application Gateway 2007 has helped streamline connections for remote users and is helping our administrators get more done with their time. -Adam Conkle, Network Administrator, Information Control Corporation (ICC)

18 Resources Forefront Security for SharePoint Internet Security & Acceleration (ISA) Server Intelligent Application Gateway (IAG) Forefront Server Security Blog TechNet Forefront Page

19 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.