Michael Nowacki, CISSP - ISSAP. Security & Management Solutions Specialist Microsoft Canada Michael.Nowacki@Microsoft.com

Transcription

1 Michael Nowacki, CISSP - ISSAP Security & Management Solutions Specialist Microsoft Canada Michael.Nowacki@Microsoft.com

2 More advanced Application-oriented More frequent Profit motivated Too many point products Poor interoperability Lack of integration Multiple consoles Uncoordinated event reporting & analysis Cost and complexity SIMPLIFIED INTEGRATED COMPREHENSIVE

3 Applying common policy across all platforms Providing documentary evidence that the controls are in operation and are being monitored Tracking evidence to maintain compliance Simplifying your complex security infrastructure Visibility into security and management systems Deploying network based access control Securing your remote access for employees and customers Identity and role based management Centralizing patch management

4 65% of all security breaches are due to misconfiguration or mismanagement. The isolated evolution of security and operations management tools have also led to unnecessary duplications in IT functionality and costs such as separate tools for software distribution: one for systems management, another to distribute anti-malware signature updates, for example.

5 You cannot manage that which you cannot secure! You cannot secure that which you cannot manage!

6

7 Infrastructure Products Solutions Knowledge Management Packs Connectors for Interoperability Solution Accelerators Partner Ecosystem Microsoft Operations Framework (MOF/ITIL) Microsoft Consulting Services Data Center Management Windows Platform Desktop & Device Management Virtualization Technology Open Standards Mid-Market

8 Configuration Management End to End Monitoring Server Compliance Data Protection and Recovery Automated Provisioning and Updating of Physical and Virtual Environments WoL AIS Proactive Platform Monitoring Application & Service Level Monitoring Interoperable and Extensible Platform Configuration Controls and Reporting Centralized Security Auditing Comprehensive Security & Identity and Access Mgmt Business Continuity Through Virtualization Mgmt Backup and Recovery of Physical and Virtual Resources Disaster Recovery

9 Streamlined Application and Desktop Delivery Optimized Client Health and Performance Ease User Access Without Compromise Adaptive Application Delivery Managed client application delivery via traditional and virtual methods Simplified Windows Vista Deployment Automated OS deployment via image standardization Client Infrastructure Monitoring Client health monitoring and proactive issue identification Remote PC Diagnostics & Repair Zero-touch remote diagnosis and remediation with Intel vpro TM End-Point Security Management Enforced compliance with system health policy definitions via remediation Configuration Compliance Assess systems compliance against established configuration baselines

10

11 Updated security guides, pre-defined group policies, the GPOAccelerator tool, and Configuration Packs. more than 700 security and privacy setting options, the tools and guidance are designed to help you fine-tune your deployment of Microsoft operating systems and applications in a fast and reliable manner.

12

13 Deployment Summary Computer Summary Malware Summary Alerts Summary Security Summary Security State Assessment Summary

14 Architecture

15 Forefront Server Security products integrate and ship with industry-leading antivirus scan engines from Each scan job in a Forefront Server Security product can run up to five engines simultaneously Internal Messaging and Collaboration Servers A B C D E

16 Rapid response to new threats Fail-safe protection through redundancy Forefront Set 1 Response Time (hours) Forefront Set 2 Forefront Set 3 Vendor A Vendor B Vendor C 0406 Mytob.NQ@mm Mytob.NQ@mm Spybot!04C Nugache.a Numuen.F Diversity of anti-virus engines and heuristics Small footprint on servers 0506 Numuen.H Numuen.G Banwarum.C@mm Banwarum.B@mm Rbot!E , Bagle.EG Bagle.EH@mm Bagle.EG@mm > 24 hrs 4 to 24 hrs < 4 hrs 0606 Bagle.LY@mm Feebs.gen@mm Feebs.EU Virut.A , AVTest.org, 2006

17 codename Stirling Integrated security system that delivers comprehensive, coordinated protection across endpoints, messaging & collaboration servers, and the network edge that is easier to manage and control Comprehensive, Coordinated Protection Automatically identifies & dynamically responds to threats Integrated, next-generation protection technologies Backed by global malware research & response Simplified Management Management from single, roles-based console Optimized security policy: Asset and user-centric Integrates with your existing infrastructure Critical Visibility Single dashboard provides visibility into threats, vulnerabilities, and configuration risks Real-time reporting with historical and trending views Enables direct remediation from dashboard

18 Comprehensive line of business security products that helps you gain greater protection and secure access through deep integration and simplified management Next Generation Microsoft Forefront

19 Win Server Management Security Integrated Roadmap (timeline) CY beyond Forefront Client Security FCS Ent Manager ISA 2006 & IAG 2007 Forefront Security for OCS SP1 for ISA 2006 SP2 for IAG 2007 Stirling Unified Threat Management* Unified Access Gateway OpsMgr 2007 SP1 for OpsMgr OpsMgr 2007 R2 CfgMgr 2007 CfgMgr 2007 R2 DPM 2007 VMM 2007 VMM 2008 Server Management Suite Service Manager Hyper-V 19

20

21 Integrated security eases defense in depth architecture deployment Adoption of open standards allows cross platform integration Management System Data User Application Device Internal Network Perimeter System Center, Active Directory GPO BitLocker, EFS, RMS, SharePoint, SQL Active Directory and Identity Lifecycle Mgr SDL process, IIS, Visual Studio, and.net Forefront Client Security, Exchange MSFP Network Access Protection, IPSec Forefront Edge and Server Security, NAP

22 Services A well Managed Secure Infrastructure is the key! Edge Server Applications Active Directory Federation Services (ADFS) Client and Server OS Certificate Lifecycle Management Information Protection Identity & Access Management Systems Management Configuration Manager 2007 Operations Manager 2007 Data Protection Manager Mobile Device Manager 2008 SDL TWC

23 $1,320/PC $580/PC $230/PC None No PC life cycle strategy No policy based PC management Many hw, sw configurations Standardization Defined PC lifecycle Limited policy based PC management Many software configurations Stds Compliance Defined PC Lifecycle, stds enforcement Full policy based PC management Minimal hw, sw configurations Multiple Directories Many auth directories No dir synchronization Manual user provisioning Single directory for Auth One authentication directory Automated provisioning Single Sign-on Auto password reset Auto user provisioning Minimal PC Security Anti-virus Manual patching No enforced sec. compliance Limited PC Security PC firewall Auto patching Comprehensive PC Security Anti Spyware Enforced security compliance with Network Access Control No system-wide management Poor sys management tool coverage Duplicate management tools Manual sw, patch deployment Limited system mgmt Single system management tool Software packaging Software distribution Comprehensive system management Hw, sw inventories Hw, sw reporting Auto/targeted sw dist.

24 Secure Platform Security Development Lifecycle (SDL) Windows Server Virtualization (Hypervisor) Role Management Tool OS File Integrity Data Protection Rights Management Services (RMS) Full volume encryption (Bitlocker) USB Device-connection rules with Group Policy Improved Auditing Windows Server Backup Network Protection Network Access Protection (NAP) Server and Domain Isolation with IPsec End-to-end Network Authentication Windows Firewall With Advanced Security On By Default Identity Access Read-only Domain Controller (RODC) Active Directory Federation Services (ADFS) Administrative Role Separation PKI Management Console Online Certificate Status Protocol

25 Disable unneeded services based on role. Remove unused firewall rules and constrain existing firewall rules. Define restricted audit policies. Apply the policy to one or more servers. Analyze and view an SCW policy on multiple servers, including compliance reports that can show any discrepancies in configuration Transform SCW policy into a GPO for centralized deployments and management by using AD DS

26 Customers Web Partners Extranet Employees Partners Vendors Gateway Remote Employees Today s highly connected world calls for a more comprehensive approach to Network Access Control Yesterday s network access control Single function products primarily at the perimeter Gets expanded by NAP Authentication throughout the network Based on identity Based on group and role Across perimeter, internal network, host Governance and risk management Central policy defines healthy Compliance reported, tracked Compliance used for authorization Resulting in Policy Based Access Control Controlled access for guests, vendors, partners Improved resilience to malware as network health increases More robust update infrastructure Managed compliance

27 You cannot manage that which you cannot secure! You cannot secure that which you cannot manage!

28 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29 Client Management License Server Management License Management Server $450 $450 $450 $335/$586 per OSE $335/$586 per OSE $335/$586 per OSE 1 Core CAL Suite 2 Enterprise CAL Suite $25 $32 Prices are Select D ERP, L/L+SA3yr 3 Server Mgmt Suite Enterprise $1181 per physical box (L/SA)

30 Backup Hardware Provisioning Server Management Suite - Enterprise Disaster Recovery Virtual Workload Provisioning Performance and Health Monitoring OS / Software Deploy, Patching and State Mgmt

31 How it works 3 Policy Servers e.g. Patch, Antivirus 1 2 Windows Client DHCP, VPN, Switch/Router Microsoft NPS Not policycompliant Policycompliant 4 Restricted Network Fix Up Servers e.g. Patch Client requests access to network and presents current health state DHCP, VPN, or Switch/Router relays health status to Microsoft Network Policy Server (NPS) via Remote Authentication Dial-In User Service (RADIUS) Network Policy Server (NPS) validates against IT-defined health policy If not policy-compliant, client is put in a restricted VLAN and given access to fix up resources to download patches, configurations, signatures (Repeat 1-4) If policy-compliant, client is granted full access to corporate network 5 Corporate Network

32

33 Comprehensive, coordinated protection with Dynamic Response Simplified management across client, server and edge Critical visibility into security state: Threats and vulnerabilities Antimalware Host Firewall NAP Integration Exchange Protection Content Filtering SharePoint Protection Content Filtering Firewall Web AV Remote Access Additional features and technologies will be announced at a later date