Security Overview for Microsoft Infrastructures


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Security Overview for Microsoft Infrastructures

  1. 1. Security Overview for Microsoft Infrastructures Fred Baumhardt and James Noyce Infrastructure Solutions and Security Solutions Teams Microsoft Security Solutions, Feb 4 th , 2003
  2. 2. Agenda <ul><li>Threats – How you are attacked and from where </li></ul><ul><li>Application Level Attacks – the new Security Battleground </li></ul><ul><li>Overview of Microsoft Server Security Technologies and Tools </li></ul><ul><li>Management and Operations as a Defensive Mechanism </li></ul>
  3. 3. The Three Phases of Hacking <ul><li>Information Gathering and Intelligence </li></ul><ul><li>Analysis of Collected Information </li></ul><ul><li>Probing and Compromise </li></ul>
  4. 4. Management as a Security Tool <ul><li>Detect unauthorised activity on your infrastructure </li></ul><ul><li>Prevent misconfiguration of systems </li></ul><ul><li>Ensure system vulnerabilities are captured and addressed </li></ul>
  5. 5. Security Management Tools <ul><li>Analysis </li></ul><ul><ul><li>Microsoft Baseline Security Analyser (MBSA) </li></ul></ul><ul><ul><li>Systems Management Server (SMS) </li></ul></ul><ul><ul><ul><li>Software Update Services Feature Pack </li></ul></ul></ul><ul><ul><li>Microsoft Software Update Services (MSUS) </li></ul></ul><ul><ul><li>Security Configuration and Analysis snap-in </li></ul></ul><ul><ul><li>RSoP </li></ul></ul><ul><li>Management </li></ul><ul><ul><li>Group Policy Management Console (GPMC) </li></ul></ul><ul><ul><li>Microsoft Operations Manager (MOM) </li></ul></ul><ul><ul><li>Microsoft Audit Collection System (MACS) </li></ul></ul><ul><ul><li>Systems Management Server (SMS) </li></ul></ul><ul><ul><ul><li>Software Update Services Feature Pack </li></ul></ul></ul><ul><ul><li>Microsoft Software Update Services (MSUS) </li></ul></ul>
  6. 6. Infrastructure Tools <ul><li>Snort – Free to Download – even on Windows – </li></ul><ul><li>MBSA – Scans most MS Server products and windows clients </li></ul><ul><li>SUS – Patch management solution </li></ul><ul><li>MOM-MACS-SMS </li></ul><ul><li>IPSEC – within Windows </li></ul><ul><li>IISLockdown – URLScan </li></ul><ul><li>ISA Server with Feature Pack1 </li></ul>
  7. 7. MBSA Version 1.1 <ul><li>The following new features are included with MBSA V1.1: </li></ul><ul><ul><li>Exchange and Windows Media Player security update detection </li></ul></ul><ul><ul><li>Full HFNetChk integration into MBSACLI.exe </li></ul></ul><ul><ul><li>Incorporation of the latest HFNetChk engine code </li></ul></ul><ul><ul><li>Support for Software Update Services (SUS) during security update scanning </li></ul></ul><ul><ul><li>Detection for multiple SQL Server instances </li></ul></ul>
  8. 8. Software Update Services <ul><li>Address Patch Management concerns </li></ul><ul><ul><li>Windows keeps itself up-to-date with the latest critical & security updates </li></ul></ul><ul><ul><li>IT administrators can automatically deploy Windows Update content </li></ul></ul><ul><ul><li>IT administrator gains control over what patches are applied to a system </li></ul></ul><ul><ul><li>Leverage Windows Update web-based infrastructure </li></ul></ul>
  9. 9. System Management Server Software Update Services Feature Pack <ul><li>Security patch inventory </li></ul><ul><li>Office patch inventory </li></ul><ul><li>Patch distribution </li></ul><ul><li>Web reporting </li></ul>
  10. 10. Recommendations for Customers <ul><li>Microsoft’s “A” recommendation for which tool to use: </li></ul><ul><li>**Small Business that work with a VAP should also consider SUS </li></ul><ul><li>Official external positioning is available at: </li></ul><ul><ul><li> </li></ul></ul>SMS (with the Feature Pack) Large Enterprise Software Update Services Medium Enterprise Windows Update** Small Business Windows Update Home User Recommended Technology to deploy critical updates
  11. 11. GPMC Overview <ul><li>What is the GPMC? </li></ul><ul><ul><li>New admin tool for managing Group Policy: </li></ul></ul><ul><ul><ul><li>Set of scriptable objects for managing GP </li></ul></ul></ul><ul><ul><ul><li>MMC Snap-in, built on these objects </li></ul></ul></ul><ul><ul><li>Standalone web release shortly after Windows .NET Server RTM </li></ul></ul><ul><li>GPMC Design goals </li></ul><ul><ul><li>Unify management of Group Policy </li></ul></ul><ul><ul><li>Address key deployment issues </li></ul></ul><ul><ul><li>Provide better UI for visualization </li></ul></ul><ul><ul><li>Enable programmatic access to GP </li></ul></ul>
  12. 12. Microsoft Operations Manager <ul><li>Operations Management – event and performance management </li></ul><ul><ul><li>Built on Microsoft management services </li></ul></ul><ul><li>Microsoft solution manages Windows 2000, Exchange, SQL Server, and other Microsoft apps </li></ul><ul><ul><li>Base Management Pack </li></ul></ul><ul><ul><li>Application Management Pack </li></ul></ul><ul><li>Heterogeneous and value-add solutions from third parties extend this offering </li></ul>
  13. 13. <ul><li>Centralizes Windows security management in MOM </li></ul><ul><li>Out-of-the-box security rules, knowledge, response actions, reports </li></ul><ul><li>Includes: </li></ul><ul><ul><li>XMP for Anti-Virus Applications </li></ul></ul><ul><ul><li>XMP for Microsoft Windows Security </li></ul></ul><ul><ul><li>XMP for NetIQ Security Analyzer </li></ul></ul>Security Management Pack: A set of Security XMP’s for MOM
  14. 14. Microsoft Audit Collection Services <ul><li>Client-Server application to collect security events in real time and store them in a SQL database </li></ul><ul><li>MACS is NOT a security management application (No user interface) </li></ul>
  15. 15. MACS & MOM <ul><li>MACS is a security event collection tool- no management capability </li></ul><ul><li>MOM complements MACS- MOM adds management, alerting, support for other logs </li></ul><ul><li>MACS v2 will likely be integrated with MOM v2 </li></ul><ul><li>MACS v1 will ship with MOM management pack </li></ul>
  16. 16. Services <ul><li>Security is not just about technology </li></ul><ul><li>Crucial to bring in expertise and knowledge transfer into your organisation </li></ul><ul><li>SMB can use service templates and learn from them – such as MSA - </li></ul>
  17. 17. Service Offerings <ul><li>Microsoft Solution for Management </li></ul><ul><ul><li>Allows customers to prioritize, test and deploy Patches to their environment. </li></ul></ul><ul><ul><li>Delivers proven best practices and infrastructure for managing high volumes of patch deployments into a Microsoft tools and technology environment. </li></ul></ul><ul><ul><li>Enables customers to improve their quality of service while reducing total cost of ownership </li></ul></ul>
  18. 18. Next Steps <ul><li>Review your systems </li></ul><ul><li>Web resources </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul><ul><li> </li></ul>