In the attack index…what number is your Company?

Microsoft Secures Microsoft with Microsoft An Overview Justin Nelson | Office of CIO | Microsoft Corporation | 27th February 2006

Agenda The Microsoft Landscape Managing Risk What does IT cost? Strategies, Tactics, Solutions

Microsoft IT Environment 111K+ e-mail server accounts 1.9 Tb Db Single Instance SAP 334K+ PCs and devices Dublin Redmond Tukwila Tokyo SVC 3M+ internal e-mail messages per day 10M+ e-mails from the Internet per day 9M+ rejected as spam 99.99% availability Singapore 106K+ end users 98 countries 441 buildings 9.5M+ remote connections per month

Enterprise Risk Model Unacceptable Risk Impact to Business 5 Enterprise Risk Model High Unacceptable Risk Risk assessment drives to acceptable risk (Defined by Business Owner) Impact to Business Acceptable Risk Low Low Probability of Exploit (Defined by Corporate Security) High

Microsoft IT Spend Breakdown FY05 Breakdown Cost Element View People 72% Data & Voice 16% Hardware 5% Facilities 5% Software 2% Software 5% (adjusted to include estimate if MS software were included) Functional View Applications 60% App Development (29%) App Support (31%) Infrastructure 40% Network (14%) Data Center (7%) Employee Services (5%) Voice (5%) Helpdesk (5%) Security (3%) Employee Services = monitoring/Tier 2 (2%), messaging (1%), software deployment (1%), collaboration (0.5%), data protection (0.5%)

Microsoft CISO Concerns Regulatory compliance Mobility of data Unauthorized access to data Malicious software Supporting an evolving client

Key Strategies and Tactics Assessment of risk Identification of potential threats Mitigate risk through five key strategies Secure the Network Identity & Access Management IP and Data Protection Enhanced Auditing & Monitoring Awareness

Key Strategies and Tactics Secure the Network Identity & Access Management IP and Data Protection Enhanced Auditing & Monitoring Awareness Secure Extranet and Partner Connections Secure Remote Access Network Segmentation Network Intrusion Detection Systems Hardening the Wireless Network Strong Passwords Public Key Infrastructure: Certificate Services E-Mail Hygiene and Trustworthy Messaging Least Privileged Access Managed Source Code Security Development Lifecycle - IT Securing Mobile Devices Automated Vulnerability Scans Combating Malware Security Event Collection Information Security Policies Training and Communications For More Information

In summary The Microsoft Landscape Risk Management approach Budgeting Strategies, Tactics, Securing Microsoft with Microsoft For More Information

For More Information Additional content about Microsoft IT deployments and best practices can be found on http://www.microsoft.com Microsoft TechNet http://www.microsoft.com/technet/itshowcase Microsoft Case Study Resources http://www.microsoft.com/resources/casestudies E-mail IT Showcase showcase@microsoft.com

© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.