Better Together: Microsoft Exchange Server 2010 and Microsoft Forefront Secure Messaging Solution Cristian MoraTechnical Product ManagerMicrosoft CorporationSIA 311Alexander NikolayevProgram ManagerMicrosoft CorporationSIA 311

Agenda E-mail Security ThreatsSpam & Malware Phishing & VirusesPremium Antimalware ProtectionPremium Antispam ProtectionAdministration and ManagementForefront/ExchangeBetter Together Security Forefront Protection 2010 for Exchange: Key Differentiators Forefront/Exchange Better Together: Benefits and Better Together SecuritySummary

Top E-mail Threat ConcernsMalware via URLs,Malware via Attachments,Phishing,Spam,Data Leakage.Source: Messaging Security Survey: The Good, Bad, and Ugly Study. IDC, 2009

“The growth in e-mail traffic means that over the next four years, organizations will need increasingly better defenses against all types of spam and malware… Battling spam alone is very costly – in 2009, a typical 1,000-user organization spends over $1.8 million annually to manage spam.”— The Radicati Group, Inc., E-mail Security Market, 2009-2013… Around $8 Billion Lost to Viruses, Spyware and Phishing… 2 million consumers have had to replace their computers over the past two years due to software infections… 1 in 5 online consumers have been victims of Cybercrime…— 2009 State of the Net Survey“As one leading financial institution told us, it routinely sees that at least 14 out of every 15 incoming emails are pure spam”- Forrester Wave Email filtering Q2 2009, April 2009“Almost 60% of organizations reported spam blocking effectiveness of less than 95%” - Brian E. Burke, “Messaging Security Survey” IDC February 2009

7,1975,2595,2424,5644,6304,3674,2803,3262,8542,8702,6252,5601,707MayJunJulAprAugMarSepFebOctJanNovDec04Dec05New Phishing Sites By MonthSource:http://www.antiphishing.org

New Phishing Sites By MonthSource:http://www.antiphishing.org

So, what’s the Solution???

Business Ready SecurityHelp securely enable business by managing risk and empowering peopleProtectionAccessProtect everywhere,access anywhereIdentitySimplify the security experience,manage complianceManagementHighly Secure & Interoperable PlatformIntegrate and extendsecurity across the enterprisefrom:to:BlockEnableCostValueSiloedSeamless

Information ProtectionIdentity and Access ManagementBusiness Ready Security SolutionsSecure EndpointSecure CollaborationSecure Messaging

Secure MessagingEnable more secure business communication from virtually anywhere and on virtually any device, while preventing unauthorized use of confidential informationPROTECT everywhereACCESS anywhereSIMPLIFY security,MANAGE complianceINTEGRATE andEXTEND securityBest-in-class anti-malware on-premise / in-the-cloudProtect sensitive information in e-mailSecure, seamless accessEnterprise-wide visibility and reportingUnified managementBuilt-in information protectionExtend secure e-mail to partners

Best-in-class anti-malware on-premise / in-the-cloud

Protect sensitive information in e-mail

Secure, seamless access

Enterprise-wide visibility and reporting

Unified management

Built-in information protection

Extend secure e-mail to partners

Innovative TechnologiesIndustry Collaboration and CooperationUser EducationEffective Legislation

Forefront Protection 2010 for Exchange ServerAntispam ProtectionDNSBLNew content filter engine Anti-Backscatter Multiple enginesHybrid ModelEnhanced FilteringKeyword FilteringSupport for earlier Exchange server versions (Exchange 2003)FOPE Integration Integrated provisioning and ManagementFile FilteringMultiple Engine SupportAntivirus protectionAntispam protectionExchange 2007 Integration Integrated into the Transport PipelineAdministrationPowershell supportNew Interface dashboardEdge, Hub, and MailboxHyper V supportImproved Performance VSAPI for virus scanningMicrosoft Antispyware engine

Forefront/Exchange Better Together:Surpassing Security ExpectationsExchange 2010Forefront 2010EncryptionAntivirusAntispamDefault Intra-Org ∙Inter-Org mTLS support∙IRM supportMultiple Engine Malware Detection BasicPremiumUnified ManagementHosted, Hybrid ProtectionStandard CALEnterprise CAL

Industry-Leading Performance3600 Malware and Spam ProtectionWest Coast Labs:Spam Catch Rate above 99%Premium Antispam certificationVirus Bulletin:Continuous Spam Catch Rate above 99%:99.77% (September 2009)99.46% (November 2009)

Protection 2010 for Exchange ServerForefront Protection 2010 for Exchange Server Deployment Options

Forefront Protection 2010 for Exchange ServerThreat Management GatewayEnterprise NetworkEdge TransportProtection Availability:Exchange 2010Exchange 2007 SP1Hub TransportRouting & PolicyExternal MailProtection 2010 for Exchange ServerProtection 2010 for Exchange ServerUnified MessagingVoice mail & voice accessMailboxStorage of mailbox itemsMobile phoneProtection 2010 for Exchange ServerThreat Management GatewayClient AccessClient connectivityWeb servicesWeb browserPhone system (PBX or VOIP)Outlook (remote user)Line of business applicationsOutlook (local user)

Protection 2010 for Exchange ServerForefront Protection 2010 for Exchange Server Malware Protection

Protect Messages from MalwareProtect everywhere,access anywhereMicrosoft Solution“Defense in Depth”Competitors’ SolutionsMultiple EnginesSingle Engine38 times fasterAn AV-Test of consumer antivirus products revealed:On average, Forefront engine sets provided a response in 3.1 hours or less.Single-engine vendors provided responses in 5 days, 4 days,and 6 days respectively. Automatic Engine UpdatesOn premises or in the cloud99% spam detection** With premium antispam services““Forefront Security for Exchange Server can support up to five scanning engines at the same time. Thus, it offers a more secure environment, compared with products that support using only a single engine.” - Akihiro Shiotani, Deputy Director of the Infrastructure GroupSource: New Solution Helps Pharmaceutical Maker Improve IT Performance and Security. Microsoft case study, June 2008. http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?CaseStudyID=4000002230

On average, Forefront engine sets provided a response in 3.1 hours or less.

Single-engine vendors provided responses in 5 days, 4 days,and 6 days respectively.

Forefront Protection 2010 for Exchange Server: Multiple AV Scanning Engines AdvantagesLeading antimalware engines deployment via integrated solution,Allows multi-directional protection of messaging stream: inbound, outbound, internal, and data at rest,Intelligent Engine Selection:Automatically chooses the most current and effective engines first,Allows administrators to balance security with performance needs.Removal of a single point of failure in the organization,Lower TCO – all engines included in base cost.

Performance ImprovementsForefront Protection 2010 for Exchange Server vs. Forefront Security for Exchange 2007Results (5 engines test)Technology investmentMessage throughput improvement From 25 to 40 messages/secondMeasured reduction is 30%Reduction in Context SwitchesImprovements in CPU Utilization15% in CPU Utilization improvementNative 64-bit supportCComing in SP1Gated by the Exchange Server perfSpam Filtering throughput

Automatic UpdatesRemote Update ServicesForefront Engines UpdatesMSAV/CMAEDirectly from vendorRedistributionManual Config

Managing Multi-Engine Environment demo

Protection 2010 for Exchange ServerForefront Protection 2010 for Exchange Server Antispam Overview

Forefront Protection 2010 AntispamFunctional Highlights

Forefront Protection 2010 Antispam FeaturesRecipientFilterSender ID FilterSender FilterContentFilterDNSBL FilterBackscatter FilterJunk E-mail FilterIP Block ListLayered Antispam TechnologiesConnection Filtering (IP Block/Allow, DNSBL, SenderID filters)Protocol Filtering (Sender, Recipient, Backscatter filters)Content Filtering (spam/phishing)New additions: DNSBL, Cloudmark CMAE Engine, Backscatter, Hybrid Model

Reducing the Carbon Footprint of Spam: Forefront DNSBLImplemented as SMTP Receive Agent, configuration/maintenance-free feature,Multiple external and internal RBL providers with continuous flow of feeds,Queries sent to Forefront-owned DNS infrastructure,Efficiency: based on internal MSIT numbers 80-85% of all incoming connection requests being denied by DNSBL,Rejection response is actionable (to help with the corrective actions: “550 5.7.1 Do thisto get the IP removed from the DNSBL list…”

"Why I'm getting this NDR??!" Forefront Backscatter ProtectionOutboundCategorizerExchange internalsenderExternal recipientToken Definition:BATV-compliantHashed tag (based off a key, time, sender, expiration, etc.)Keys maintained and rotatedAnti-Backscatter Agent:Implemented as RoutingAgentActs only on Outbound mailAttaches a token to P1.MailFrom:

BATV-compliant

Hashed tag (based off a key, time, sender, expiration, etc.)

Keys maintained and rotated

Implemented as RoutingAgent

Acts only on Outbound mail

Attaches a token to P1.MailFrom:

Forefront Backscatter protectionInboundTransport PipelineNDR generatingMTAExchangeNDR recipientToken Verification:Decrypt the sig using proper keyVerify integrity of the sigIf correct – strip off the sig, stamp the header, and accept NDRIf incorrect – DiscardBackscatter Filter logic:NDR discoveryToken verificationAcceptance decisionSMTP Receive Agent:Disabled by defaultActs upon DSNs only

Decrypt the sig using proper key

Verify integrity of the sig

If correct – strip off the sig, stamp the header, and accept NDR

If incorrect – Discard

NDR discovery

Token verification

Acceptance decision

Disabled by default

Acts upon DSNs only

Forefront Content Filter FingerprintingFingerprint CacheSpamRejectLegitimateFingerprints compared to local cache of known bad fingerprintsCache data updated every 45 seconds Match: message is identified as abuseNo match: message is identified as legitimateMessage reduced to anonymous fingerprints Fingerprints don’t indicate whether the message is legit or spamFingerprinting applied to every incoming message *Relevant parts of the entire message are fingerprinted* Exceptions apply (Safe Senders/Recipients/Safe Listed IPs etc.)

Fingerprints compared to local cache of known bad fingerprints

Cache data updated every 45 seconds

Match: message is identified as abuse

No match: message is identified as legitimate

Message reduced to anonymous fingerprints

Fingerprints don’t indicate whether the message is legit or spam

Fingerprinting applied to every incoming message *

Relevant parts of the entire message are fingerprinted

Content Filter SCL definitionsForefront Content Filter enables normalization of raw spam score from CMAE engine to SCLForefront normalization logic:All messages classified as not spam get SCL:-1SCL assignment logic can be reverted to SCL:0 via powershell (New-FseExtendedOption –Name CFAllowBlockedSenders –Value true)SCL:-1 boundaries are within -1 to 4 in ExchangeActions available for messages within SCL range 5 to 9:Reject/Delete/Stamp and Continue/QuarantineSCL assigned to the message and can be enforced on a per-recipient basis

Spam Configuration and Management demo

Forefront Unified Monitoring and Reporting Single Node – basic reports available for each technology layer,Multi Node – advanced reports available via Forefront Protection Manager,Single connection point to reporting via Forefront UI,Agent Logs, Perfmon Data,Incidents and Quarantine Database, Rich Eventing Model.Author policyDeployCorrectCollect EventsAnalyzeView Alerts & Reports

Simplify Security ManagementSimplify security,manage complianceUnified policy management for on-premise and cloud-based messaging serversEnterprise-wide visibility into e-mail threats through a single consoleHelp enable compliance with in-depth reporting capabilitiesEasy to use inerfaces and templates for system configuration and threat response“"It let them bring everything together into one package for ease of management in the network“- Amy Babinchak, Harbor Computer Services, Inc.Source: New Solution Helps Pharmaceutical Maker Improve IT Performance and Security. Microsoft case study, June 2008. http://www.microsoft.com/casestudies/Case_Study_Detail.aspx?CaseStudyID=4000002230

Unified policy management for on-premise and cloud-based messaging servers

Enterprise-wide visibility into e-mail threats through a single console

Help enable compliance with in-depth reporting capabilities

Easy to use inerfaces and templates for system configuration and threat response

Malware protectiondemo

Protection 2010 for Exchange ServerForefront Protection 2010 for Exchange Server: an extension into Online Services

FirewallHybrid Messaging SecurityWith FPE + FOPE + Exchange On-Premise SoftwareInternetSpam policyMailSpam policyFOPE GatewayFull Management PolicySMTP MailExchange HubMailbox ServerExchange EdgeAntivirus and antispam protection for Exchange Server 2007/2010 Server RolesProtection 2010 for Exchange Server

Malware Protection: Multiple EnginesSpam Protection:Layered DefenseKey DifferentiatorsEase of Administration, Monitoring, and ReportingProtection 2010 for Exchange Server Hybrid Model:Integration with Online Service

Forefront Protection 2010 for Exchange Server BenefitsIntegrated multiple engine malware protection,Best of breed spam protection for on the premises and in the cloud customers:Precise spam detection with above 99% catch rate,Reduction in Carbon Footprint of spam by early rejection of unwanted messaging stream.Hybrid Model and Ease of Administration:Low TCO with High ROI for Exchange organizations,Flexible implementation.

Exchange + Forefront Better Together Security Summary Exchange 2010 provides…Default encryption and broader support for IRMExtensive infrastructure for per-user SCLIncremental Edge Synch for safe/blocked sendersPer recipient list aggregation from Outlook Forefront 2010 extends foundation with…Premium multiple engine antimalware Auto-configuration of antispam agentsUnified management of FPE, Exchange, FOPELeading antispam content filter engine (above 99% detection rate) Option of hosted and hybrid protection for lower TCOConfig/maintenance-free setup.

More Info….Microsoft FPE Web SiteNEW! Microsoft FPE WhitepapersForefront Protection 2010 for Exchange Server Antispam FrameworkForefront Protection 2010 For Exchange Server AntispamForefront Protection 2010 for Exchange ServerForefront Protection 2010 for Exchange Server Scan Actions And SequenceMonitoring Forefront Protection 2010 for Exchange ServerMicrosoft BRS – Secure MessagingMicrosoft Edge - FPE

Microsoft FPE Web Site

NEW! Microsoft FPE Whitepapers

Forefront Protection 2010 for Exchange Server Antispam Framework

Forefront Protection 2010 For Exchange Server Antispam

Forefront Protection 2010 for Exchange Server

Forefront Protection 2010 for Exchange Server Scan Actions And Sequence

Monitoring Forefront Protection 2010 for Exchange Server

Microsoft BRS – Secure Messaging

Microsoft Edge - FPE

Additional SessionsSIA317 – Microsoft Forefront Online Services – Overview, Architecture and RoadmapSIA02-DEMO – End-to-End E-mail ProtectionSIA05-IS – Secure Messaging using AD RMS and Exchange 2010SIA304 – Windows Server 2008 R2 AD RMS

SIA317 – Microsoft Forefront Online Services – Overview, Architecture and Roadmap

SIA02-DEMO – End-to-End E-mail Protection

SIA05-IS – Secure Messaging using AD RMS and Exchange 2010

SIA304 – Windows Server 2008 R2 AD RMS

question & answer

Please Complete An Evaluation FormYour input is important!Multiple ways to access Online Evaluation Forms:CommNet stations located throughout conference venuesVia a Windows Mobile deviceVia the CommNet “Julian” offline Windows Mobile evaluation and session scheduling toolFrom any wired or wireless connection to:https://www.MyTechReady.com1.2.3.4.For more information please refer to your Pocket GuideSpeaker – Click Hereto Launch Video

Complete an evaluation on CommNet and enter to win an Xbox 360 Elite!

© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Content Filter UpdatesBetter Together for ECAL customersECAL customers receive premium Forefront content filter and updates,ECAL customers will always have the freshest spam fingerprints,“Lights Out” engine updates

Secure Messaging – The Road AheadCurrently ShippingCY 2009CY 2010H2H1Manage-mentManagement ConsolesProtection & AccessPlatformSubject to Change