Security for Mere Mortals Steve Lamb Technical Security Advisor Microsoft Ltd

Microsoft Technical Roadshow days of in-depth technology information Birmingham – May Harrogate – 1-2 June London – 7-8 June Register now at:

Ground Rules for this Session It’s YOUR session based on your requests Interaction WILL BE rewarded Don’t be Shy There are NO STUPID questions We’re all friends here!

“You don’t put brakes on a car to go slower – you put them on to go faster more safely” User education is key As are processes and procedures Mis-configured systems are a major threat

“Good Security enables business to do more with less risk” Hold off the Rocket Science Apply Technology to Support the Business Policy Learn how the business works Don’t get in the way!

Keep It Simple Stupid!

Why Security Policies Fail!

Get a decent POLICY First! Forget the Rocket Science Start with a mandate from the top Define a realistic policy based on how users actually work! Keep it up to date Communicate it Why? Punish Offenders

Phishing

ISA – Application Layer Firewalling Currently – most firewalls check only basic packet information Real world equivalent of looking at the number and destination of a bus – and not looking at the passengers

XP SP2

Windows Firewall Basic behavior Outbound TCP Response from target IP only Outbound UDP Response from any IP; closed after 90 seconds of inactivity Outbound b’cast and m’cast Open for 3 seconds to permit reponse from same subnet only Unsolicited for apps Application must be on exception list Unsolicited for services Port must be statically opened Unsolicited RPC Firewall must be configured to permit inbound RPC

Internet Explorer Managing pop-ups

Internet Explorer Pre-SP2 IE ActiveX warning

Internet Explorer New IE ActiveX notice

Training and Awareness PEOPLE Social Engineering: IM and IRC downloads Training and Awareness: Apply procedures Carrot not stick: Recognise employees

Process - The Glue No where else in society do we put so much faith in technology. No-one has said, “This door lock is so effective that we don’t need police protection and breaking and entering laws.” Products work to a certain extent but you need processes in place to leverage their effectiveness. SOURCE: Bruce Schneier, CTO, Counterpane PROCESS

Embrace Process TECHNOLOGY Limit privilege Secure weakest link Defend in depth Enlist users Detect attacks Embrace simplicity Be vigilant Watch the watchers

RMS

How good is YOUR Security Knowledge?

Guidance and Tools Delivering Support, Creating Community Security tools Security Bulletin Search Tool Guidance and training Security Guidance Center How Microsoft Secure our own Infastructure - ITShowcase E-Learning Clinics Community engagement Newsletters Webcasts and chats

© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.