Exchange 2010 Advanced Security with Forefront. Aleš Chudý IW BG Lead Microsoft Slovakia

Transcription

1 Exchange 2010 Advanced Security with Forefront Aleš Chudý IW BG Lead Microsoft Slovakia

2 Security A Growing Concern Spam problems continue Spammers constantly evolving new techniques Systems often outdated and rely only on IP filtering Only 11% of organizations reported 99% effectiveness* Malware attacks on the rise Malware incidents are increasing in organizations of all sizes* Attacks are often blended (e.g. spammed viruses) Increasing use of attachments to transmit viruses* Increasing need for data encryption New regulations demand increased data privacy Data leakage carries legal, financial risks Encryption can be difficult to implement and manage *IDC, 2009

3 Better Together Protection Integrated defense in depth Encryption Anti-Spam Anti-Virus Automatic Encryption S/MIME Support Information Rights Management Support Basic Premium Multiple Engine Anti- Malware Detection Unified Management Hosted, Hybrid Protection Perimeter Protection

4 Encryption Default encryption internally and externally Client to Server - Secure Sockets Layer (SSL) Server to Server - Transport Layer Security (TLS) Perimeter to Perimeter - Opportunistic TLS Clients Perimeter Network Internet Perimeter Network Internal Network

5 Encryption Protect sensitive data S/MIME Support Enables users to send signed and encrypted to one another from a variety of devices. Send from Outlook, Outlook Web App, and Windows Mobile 6.0+ Information Rights Management Support Provides persistent protection to control who can access, forward, print or copy sensitive data. AD RMS Pre-licensing improves mobile/offline experience Automatic IRM-protection through transport rules Transport decryption to enable AV/AS scanning Native IRM support in OWA

6 Encryption Enable processing of rights protected Protected messages sent to transport server Infected messages and spam can be filtered Messages are re-encrypted and delivered Messages and attachments decrypted to enable content filtering, transport rules Journaled messages include decrypted cleartext copy

7 Perimeter Protection Overview Enterprise Network External mail Edge Transport Routing & AV/AS Hub Transport Routing & policy Mobile phone Mailbox Storage of mailbox items Unified Messaging Voice mail & voice access Web browser Outlook (remote user) Client Access Client connectivity Web services Outlook (local user)

8 Perimeter Protection EdgeSync enhances anti-spam filtering MALWARE SPAM SAFE /BLOCKED SENDER LISTS Internet Edge Server Internal Network

9 Basic Anti-Spam Three layers of protection Filters connections based on internal and third party IP block/allow lists. Filters individual addresses based on internal lists and sender reputation. 1 2 Incoming Internet Connection Filtering Sender-Recipient Filtering Content Filtering Scans words and phrases based on internal lists and automated analysis. Attachment Filtering Mailbox / Store Administrator Quarantine User Inbox User Junk Folder

10 Premium Anti-Spam More protection, less configuration Administrator configures IP block/ allow lists and DNS block lists Pre-configured DNS Block List Aggregates data from multiple vendors Administrator configures senderrecipient lists separately Sender-recipient lists managed from one point on console Configurable content filter Bi-weekly automatic updates Attachments stripped per extension Pre-configured content filter Continuous minute-by-minute updates Inspects file type, not just extension

11 Forefront Anti-Malware One solution, multiple anti-malware engines Deploy single solution using multiple integrated technologies Includes all engines in base cost Run up to five engines simultaneously on any scan job Most up-to-date engine automatically selected for optimal performance A B C Internet D Exchange 2010 E

12 The Multiple Engine Advantage Proven faster, more effective Rapid response to new threats Fail-safe protection through redundancy Diversity of antivirus engines and heuristics Less than 5 hours 5 to 24 hours More than 24 hours Response time 1 (in hours) Single-engine solutions WildList Malware Forefront Number Name Engines Vendor A Vendor B Vendor C 01/09 autorun_itw542.ex_ /09 buzus_itw3.ex_ /09 conficker_itw5.dl_ /09 koobface_itw18.ex_ /09 momibot_itw2.ex_ /09 pinit_itw2.ex_ /09 zbot_itw30.ex_ /09 zbot_itw31.ex_ /09 zbot_itw39.ex_ /09 agent_itw94.ex_ /09 autorun_itw580.ex_ /09 autorun_itw585.ex_ /09 autorun_itw594.ex_ /09 magania_itw21.ex_ /09 onlinegames_itw624.ex_ /09 onlinegames_itw627.ex_ /09 onlinegames_itw643.ex_ /09 zbot_itw42.ex_ /09 autoit_itw90.ex_ /09 autorun_itw597.ex_ /09 autorun_itw598.ex_ /09 autorun_itw601.ex_ /09 autorun_itw616.ex_ /09 ircbot_itw485.ex_ /09 mariof_itw2.ex_ /09 onlinegames_itw651.ex_ /09 zbot_itw43.ex_ ** 0.00 denotes proactive detection 1 Source: AV-Test.org 2009 (

13 Hosted and Hybrid Protection Forefront Online Protection for Exchange Hosted Service On-Premise Software Internet SMTP Edge Transport Hub Transport Mailbox Antivirus and anti-spam protection for Exchange Server 2010 Server Roles A choice of security options Hosted: - Stop spam and viruses before they reach your network - Reduce security management costs and maintenance Hybrid: - Protection for both external and internal threats

14 Unified Management One console for Exchange and Forefront settings Central configuration for managing Exchange 2010 and Forefront on premise and hosted security settings Dashboard for enterprise-wide visibility and reporting Forefront Reports Exchange SPAM Detail Statistics Report Scope: Report Time Span: All Computers Start: 8/29/ :00 PST End: 8/30/ :00 PST Generated on: 8/30/ :00 Consolidated view of filters and settings All dates and times are shown in Pacific Time (GMT -8:00) Exchange SPAM Detail Statistics Data Scope: All Message Blocked by connection filter am 6pm Message Allowed by connection filter IP Block List IP Block Providers IP Allow List Message Blocked by SMTP filter 6am 6pm Sender Sender ID Recipient 6am 6pm Message Distributed by content filter actions Received Rejected Deleted Quarantined 6am 6pm SPAM Confidence Level distribution SCL 0 SCL 1 SCL 2 SCL 3 SCL 4 SCL 5 SCL 6 SCL 7 SCL 8 SCL 9 Unknown

15 Exchange Forefront Better Together Security Superior anti-spam and anti-virus protection Configurable multi-layered filtering agents Continuous automatic content updates Multi-engine malware for faster, more reliable filtering Extended encryption capabilities Automatic encryption inside and outside the organization Broad support for S/MIME and Information Rights Management Simplified management Option of hosted and hybrid AV/AS options for lower TCO Manage Exchange and Forefront settings from one console

16 2009 Microsoft Corporation. All rights reserved. Microsoft and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.