Securing Communication And Collaboration Torgeir Bergsvik

Securing communication and collaboration
Karl BjarneWestbye, Microsoft
Solution Specialist – Security & Management

Forefront Anti-Spam flow
Incoming Internet E-mail
Forefront DNSBL
1
Connection filtering
1
Connection Filtering
2
SMTP Filtering
Backscatter
2
Protocol filtering
Content
Filtering
3
Administrator Quarantine
Mailbox / Store
3
Cloudmark Fingerprinting
Content filtering
User Inbox
User Junk E-mail Folder

Firewall
Hybrid Messaging Security
On-Premise Software
Internet
Spam policy
Mail
Spam policy
FOSE Gateway
Full Management Policy
SMTP
Mail
Exchange Hub
Mailbox Server
Exchange Edge
Antivirus and anti-spam protection for Exchange Server 2007/2010 Server Roles

Forefront Online Security for Exchange
100%
Known VirusProtection
98%
SpamDetection
1:250,000
False Positive Ratio
Spam and VirusFiltering Effectiveness
Cloudprotectiondemo
Filtering Network Performance
Network Uptime
99.999%
Rapid E-mail Delivery
< 1 Minute Average Delivery

TMG Value Proposition
Comprehensive
Integrated
Simplified

TMG New Feature Drill Down
7

TMG Product "Stack"
Built on a solid foundation, Windows Server 2008 platform
Forefront Threat Management Gateway Subscription Services
Web Anti-Virus
Based on MSAV engine
Other Services TBA

How UAG Is Built
Both use Windows Server for:

SSTP VPN
TS Gateway

UAG leverages TMG for:

Logging & Reporting
Policy & Array Infra.
Layer-3 Firewall
IPSec VPN

+7

Incorporates multiple scanning engines from industry-leading partners into a single solution to detect viruses and spyware faster and more effectively than single engine solutions.
Integrated
Security
Comprehensive Protection
Simplified Management

Multiple engine antimalware
File and keyword filtering

Coming Soon:

Antispyware (MSAV engine)
Hybrid antispam protection with 99%+ detection and .04% false positives
Scanning of rights-managed content (Exchange 2010 only)
Intelligent engine selection
Integration with Exchange 2007

Coming Soon:

Integration with Exchange 2010
One-click provisioning of Forefront Online Security for Exchange
Automated updating

Coming Soon:

Integration with Forefront Protection Manager
Dashboard with drill-down reporting
Fast response to security incidents
Unified quarantine across Exchange clusters

Integrated security
Internet
Exchange Mailbox Server
Exchange Mailbox Server
Multi-engine
Manager
Client Machines
Microsoft AV
Server Applications
Exchange Front End

The Multiple Engine Advantage
= More than 24 hours
= 5 to 24 hours
= Less than 5 hours
Response time1 (in hours)
The Microsoft multiple-engine solution
Other single-engine solutions
Rapid response to new threats
Fail-safe protection through redundancy
Diversity of antivirus engines and heuristics
* Includes beta signatures
** 0.00 denotes proactive detection
1 Source: AV-Test.org 2007 (www.av-test.org)

Prevent users from uploading or downloading documents containing malware, out-of-policy content, or sensitive information to SharePoint libraries.
Integrated
Security

Scanning of rights-managed content

Coming Soon:

Antispyware (MSAV engine)
Integration with MOSS 2007

Coming Soon:

Integration with MOSS 14
Automated updating

Coming Soon:

Dashboard with drill-down reporting
Unified quarantine across webfarms

Forefront Security for SharePoint
Virus Protection for Document Libraries

Real-time scanning of documents uploadedand downloaded from document library
Manual and scheduled scanning of document library

SQL Document Library
Document
SharePoint Server
Document
Content Policy Enforcement

File filtering to block documents frombeing posted based on name match, file type or file extension
Content filtering by keywords withindocuments for inappropriate words and phrases

Users

Beskytt sharepointdemo
Forefront Security for Sharepoint

Prevent users from sending instant messages malware, out-of-policy content, or sensitive information.
Integrated
Security

Automated updating
IM notifications for out-of-policy activity
Built-in administrator console
Integration with OCS 2007 (multiple server roles)
Support for federated and public IM

OCS 2007 Enterprise Integration
FSOCS protects each instance of Standard Edition, Front End, Director and Access Edge server roles, with support for OCS 2007 and OCS 2007 R2.
Federated (Trusted) Organization
Access Edge Server
Director Server
Front-End Server
Internet
Public IM Networks
Internal Users
Remote Users

Integrated malware protection for laptops, desktops, and file servers that simplifies control and improves visibility for endpoint security.
Simplified Administration
Unified Protection
Critical Visibility & Control

Manage from a single role-based console.
Rapid update deployment
Integration with Windows Vista

Coming Soon:

Integration with Windows 7
Unified antivirus, antispyware, host firewall management, and vulnerability detection

Coming Soon:

Vulnerability remediation
External device control
Single dashboard for visibility into threats, vulnerabilities and configuration risks
Vulnerability assessment

Coming Soon:

New vulnerability checks

Beskytt OSdemo
Forefront Client Security

Forefront Client - Reporting Capabilities
Summary Report

Key information on security state for taking action against threats,
Snapshot of the top trends and issues in the environment.
Launch point for other reports, allowing the administrator to drill down into details as much as needed.
Ability to review:
Deployment Status: How many machines are up to date or not up to date with the latest signatures
Top issues and issue history: Categorized by type along with history of issues
Top Threats and threat history: Types of threats, their severity and how many machines a specific threat has affected.
Top alerts and alert history: Key alerts impacting environment
Top vulnerabilities and vulnerability history: Through state assessment scans

What is Microsoft NAP?An extensible compliance definition, validation, remediation and reporting frameworkthat can limit access if required
Compliance Definition
Define custom health policies (collections of “compliance checks”) that are relevant to the definition of machine “compliance”.
Validation
NAP assesses the compliance state of machines against an administrator-defined health compliance policy. Validation triggers: resource access attempt, periodic time-basis, client-side compliance check state monitoring.
Remediation
NAP can drive machines to automatically “remediate” or correct their compliance deviations, often without user-intervention.
Reporting
NAP stores compliance state and context data from the NAP framework and NAP extensions in a common database for analysis, reporting and other purposes.
Access Control
Machine compliance state, as evaluated by NAP, can be used to limit access to various resources.
Extensible Framework
The NAP framework is extensible - enabling MS and 3rd parties to extend compliance checks, remediation, compliance data transport/access control technologies and non-MS NAP clients.

Remediation
Servers
Example: Patch
Restricted
Network
Corporate Network
Using Network Access Protection
Security
Policy Servers
such as: Patch, AV
3
1
2
Not policy compliant
4
DHCP, VPN
Switch/Router
Windows
Client
NPS
Policy compliant
5
If not policy compliant, client is put in a restricted VLAN and given access to fix up resources to download patches, configurations, signatures (Repeat 1 - 4)
DHCP, VPN or Switch/Router relays health status to Microsoft Network Policy Server (RADIUS)
Network Policy Server (NPS) validates against IT-defined health policy
If policy compliant, client is granted full access to corporate network
Client requests access to network and presents current health state
2
3
4
5
1

NAP Components
System Health
Servers
Remediation
Servers
Health policy
Updates
Network
Access
Requests
Health
Statements
Client
NPS Policy Server(RADIUS)
(SHA)
MS SHA, SMS
(SHA)
3rd Parties
Health
Certificate
System Health Validator
NAP Agent
802.1x Switches
Policy Firewalls
SSL VPN Gateways
Certificate Servers
(EC)
(DHCP, IPsec,
802.1X, VPN)
(EC)
3rd Party EAP
VPN’s
NAP Server

"Forefront Protection Suite"
Anintegrated security suite that deliverscomprehensive protection across endpoint, application servers, and the edge that is easier to manage and control.
Forefront Protection Manager
Unified Management
In-Depth Investigation
Enterprise-Wide Visibility
Security Assessment Sharing (SAS)
Network Edge
Client &Server OS
Server Applications
Third-Party Partner
Solutions
Other Microsoft Solutions
Active Directory
Network Access
Protection

Security management with FPM

© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.