Server Security Technologies Microsoft TechNet Seminar 2006 Server Security Technologies (not Dr.) Fred Baumhardt Security Technology Architect Microsoft Incubation fred@microsoft.com Seminar Name

Microsoft TechNet Seminar 2006 Server Security Microsoft TechNet Seminar 2006 How not to do it This is not the way to protect your front perimeter or edge Seminar Name

Infrastructure Security Architecture Security

Root Causes Enterprise organically grown under “Project” context Infrastructure Architecture Enterprise organically grown under “Project” context Security was Secondary – vendors no best practice Internal Network wide open – everything to everything 0 day undefended – patch is the solution Classic Security Perimeter Unmanaged Unpatched Internet Some Core Systems Extranets Internet Systems Project 1…n System Branch Offices Departments This will Save Me !

Microsoft TechNet Seminar 2006 Security Rules The Biology of Security Worms are Anonymous – they don’t carry your password database…. Pathogens Break protocol rules – you wrote a buffer for 72 characters – attacker sent you 182 Worms send clients something they didn’t ask for Authenticate Traffic – Stops foreign Infection Enforce Protocol Rules at the Network Device – things that break are dropped Don’t process traffic that you didn’t ask for, understand protocols and know what to expect Seminar Name

Server Auth Auth at all levels

Plan + Execute Wipe Out Attack Classes example Outbound Proxy Zone Internet Redundant Routers Redundant Firewalls NIC teams/switches Control Zone Control Zone Control Zone Control Zone Outbound Proxy Zone ExtranetData Network – SQL Presentation Inbound Proxy Control Zone Control Zone Control Zone Control Zone Application Servers Control Zone Control Zone Control Zone Control Zone Data Network – SQL Server Clusters Infrastructure Network – Internal Active Directory Messaging Network – Exchange FE Messaging Network – Exchange BE Control Zone Control Zone Control Zone Control Zone Client Networks 1…n RADIUS Network Intranet Network - Web Servers Management Network – MOM, deployment

Microsoft TechNet Seminar 2006 Plan + Execute Wipe Out Attack Classes NAP and Domain I NAP (will) and Domain Isolation (has) become the standard which new systems roll out to X NAP – can I get onto the network – are you healthy ? Network pre-auth, must be managed to get on. Domain Isolation – Assuming you are healthy where can you go, and what can you do ?   X Seminar Name

Infrastructure Security ForeFront Security

Capabilities Outsource the Risk Resolve the Risk Ignore the Risk Understand The Risks Define the Strategy How Much Risk can we tolerate ? Does it aggregate ? Outsource the Risk Resolve the Risk Ignore the Risk Outsource the risk to others Buy managed services Hire Consultants (outsource blame) Transformation required To prevent re-occurence Should Wipe out Class of risk Quantify Risk and impact Decommission/Transition Allow long term “project” to fix it Low enough risk/cost ratio to allow .

Forefront Naming Transition Previous Current H2 2006 2007+ Client Server Edge TBD TBD

Its about securing the workload Microsoft TechNet Seminar 2006 Its about securing the workload Simple malware at client or server base insufficient Multiple malware vendors scanning traffic inside data repository, need engines per repository For mail, do it at edge and cloud, but other protocols are attacked internally, so protection should be internal Seminar Name

Workload Malware Approach Microsoft TechNet Seminar 2006 Workload Malware Approach Antigen IM and Documents Live Communications Server Antigen EHS SharePoint Server E-mail ISA Server Antigen Exchange Hosted Services Antigen Exchange Front End Servers Exchange & BES Servers Seminar Name

Malware Engines across Products Microsoft TechNet Seminar 2006 Malware Engines across Products Seminar Name

Plan + Execute Admin Training is Key – Users can be useful to IT The Training and Feelings of IT Admin Training is Key – Users can be useful to IT Admins– (like pets ) can Help You – If you train them Work with your new IT to let them understand your architecture and why Security Policy should be open to be evolved, and should be enforced and challenged to application paradigms Application and Infrastructure admins should treat security and FW admins as peers Be Sensitive to Jobs and Roles, re-skilling is pain