Module 1: Introduction to Designing Security

Overview Overview of Designing Security for Microsoft Networks Introducing Contoso Pharmaceuticals: A Case Study

Lesson 1: Overview of Designing Security for Microsoft Networks Why Invest in Network Security? What Are the Key Principles of Security? The Relationship Between Security Design and Implementation Typical Elements That Require Security in Microsoft Networks Designing Security

Why Invest in Network Security? External Attackers Internal Attackers Incorrect Permissions Corporate Assets Virus Worms

What Are the Key Principles of Security? Definition Defense in Depth Provide multiple layers of protection Least Privilege Grant the least amount of privilege or permissions necessary to perform the required task Minimized Attack Surface Reduce vulnerable points on a network

The Relationship Between Security Design and Implementation Ensures a logical and carefully planned strategy for securing an organizations assets Ensures security is applied throughout the organization in a controlled and logical manner Creates policies and procedures Security Implementation Applies the policies and procedures created during the design Ensures that they are deployed consistently

Typical Elements That Require Security in Microsoft Networks Elements in a Microsoft Network Physical security Hosts Accounts and Services Authentication Data Data Transmission Network Perimeters Branch Office Networks Wireless Perimeter Networks Remote Users

Designing Security Module Phase Task 2 3 4 5-11 12 A, B, C Creating a Design Team Include diverse membership to ensure success and buyoff across organization 3 Performing Threat Modeling Predict attacks to assets 4 Performing Risk Management Analyze and prioritize risk 5-11 Designing Security Measures Create policies and procedures to prevent threats from occurring 12 Detecting and Reacting Detect occurrence and respond to a security incident A, B, C Ongoing Security Management Create policies for managing networks

Lesson 2: Introducing Contoso Pharmaceuticals: A Case Study Introduction to Contoso Pharmaceuticals The IT Security Consultant Role Key Personnel at Contoso Pharmaceuticals Introduction to the Lab Environment

Introduction to Contoso Pharmaceuticals Is a fictional company used throughout this course In each lab, you are a consultant hired to explore Contoso’s security problems and design solutions for the company

The IT Security Consultant Role In each lab, you are a consultant hired to explore the security problems experienced by Contoso Pharmaceuticals and design solutions for the company Branch Office Networks Headquarters Networks Perimeter Networks Wireless Remote Users

Key Personnel at Contoso Pharmaceuticals Garth Fort CEO Ellen Adams CIO Thomas Hamborg CFO John Y. Chen IT Administrator Susan Burk VP Research Michiko Osada Business Analyst

Introduction to the Lab Environment In each lab: Read interviews, e-mail, and other documents Determine the goals for the lab Write your answer Discuss your answers as a class