Deriving more value from your Windows investment Security for Free Deriving more value from your Windows investment Steve Lamb & Sandeep Modhvadia Microsoft

Stop Worms, Viruses, Rootkits and Spyware DEAD Use least privilege Accept that networks are transient Turn off unwanted features Authenticate users and systems Segment your networks Authenticate and Encrypt Wireless Networks Get a sensible policy Get buy-in from Senior Management Raise Security Awareness

The Story of Bob and Jim Bob is a ‘stupid’ end user Bob doesn’t care or want security as it is obtrusive Jim is an over-worked, under-budgeted IT head Jim needs to secure the network, but doesn’t have the funds to buy a lot of new software or hardware

The Needs of a Roaming User Needs a secure laptop baseline Access to internal resources Demands a good experience Risk of data theft/loss Strong proof of identity Secure web browsing

Demo VPN Quarantine Internet Explorer 7 Phishing Filter

The Technology that Delivers VPN Quarantine Encrypting File System (EFS) BitLocker Full Volume Encryption & Secure Startup Windows Defender Internet Explorer 7 Phishing Filter Smart Card Authentication

Securing the Internal Work Force Protect everyone, from everyone else Secure wireless provisioning Secure e-mail

Network Access Protection Walk-through Corporate Network Restricted Network Remediation Servers System Health Servers Here you go. Can I have updates? Ongoing policy updates to Network Policy Server May I have access? Here’s my current health status. Requesting access. Here’s my new health status. Should this client be restricted based on its health? This is a build of Network Access Protection in action (DHCP/VPN example). Health policy is set by the IT administrator. It is asynchronously plumbed by the system health servers to the Network Policy Server (NPS). The NPS server keeps a health cache at any given time. The client tries to come in and requests network access. It passes across its statement of health (SoH). The Network Access Device ships this information over to the Network Policy Server (NPS). NPS compares it to what’s in cache and makes certain determinations. If the SoH doesn’t meet health policy, the Network Policy Server (NPS) tells the Network Access Device to restrict the client. The client could be put in a VLAN or separate subnet. The Network Policy Server (NPS) also tells the Network Access Device what the client needs to be healthy. The NAP system information passed to the client by the NAP platform tells it how to access the fix up servers. The client contacts the fix-up server and requests update(s). Once updated, the client then presents a new SoH to the Network Access Device. This time, the health declarations match policy so the client gains full access to network resources. The SoH is re-used to continue to access network resources until the policy is updated. The cycle continues to go to provide ongoing assessment and protection. When the client requests network access presenting an up-to-date SoH that matches policy, the client is granted immediate access to the network. Changes to policy may dynamically trigger the scan and remediate process. According to policy, the client is up to date. Grant access. According to policy, the client is not up to date. Quarantine client, request it to update. You are given restricted access until fix-up. Client Network Access Device (DHCP, VPN) Network Policy Server Client is granted access to full intranet.

Demo Secure Email

The Technology that Delivers IPSec Server/Domain Isolation Network Access Protection (NAP) Internet Authentication Server (RADIUS) Windows Firewall

The Challenges of Management Server Lockdown Client Lockdown Roles based system Update Management

Demo Security Configuration Wizard Group Policy/SRP Lockdown

The Technology that Delivers Security Configuration Wizard Group Policy Software Restriction Policies Windows Server Update Services (WSUS)

Summary User security: Windows delivers protection from malware and provides the Windows firewall for protection of user devices Mobile security: Quarantine of infected machines, secure connectivity and authentication, data protection Security management: Security update services, system lockdown

Resources The latest news on Microsoft security: www.microsoft.com/uk/security Read and contribute to our blogs: http://blogs.technet.com/sandeep/default.aspx http://blogs.technet.com/steve_lamb/default.aspx IH

www.microsoft.com/uk/security www.microsoft.com/uk/technet/learning © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.