Bernhard van der Feen Product Solution Manager Security Microsoft

Security status Microsoft Security strategy Propositie Security producten in het Microsoft platform Marktsituatie, marktpositie en concurrentie Discussie

This Security Intelligence Report contains data and trends observed over the past several years, but focuses on the first half of 2007 (1H07) Released October sections Software Vulnerability Disclosures Malicious Software Potentially Unwanted Software Report is successor of H206 report and “MSRT Progress Made, Trends Observed” white paper

More than 3,400 new vulnerabilities disclosed in 1H07 Data represents ALL software vendors (not just Microsoft) A decrease from 2H06 The first period-to- period decrease in total vulnerabilities since 2003

Application vulnerabilities continued to grow relative to operating system vulnerabilities as a percentage of all disclosures during 1H07 Supports the observation that security vulnerability researchers may be focusing more on applications than in the past

While the number of vulnerability disclosures continues to increase across the software industry, the ratio of exploit code available for these vulnerabilities in Microsoft products remains steady and is even on a slight decline Vulnerabilities Vulnerabilities where Exploit Code was available

Windows Defender detected 2.8 times less potentially unwanted software on computers running Windows Vista than on computers running Windows XP SP2 (normalized) The number of detections of potentially unwanted software on computers running Windows Vista was half of the number of detections of potentially unwanted software on computers running Windows Server 2003, after normalization

Attacks targeted and very focused Financial motives for data and/or machine compromise Fraudsters more creative in driving new targets to malicious sites – term called “whaling”. Limited motivation for broad worm/virus attacks Downloader's and Trojans the new attack vector: spearphising, application and web attacks Increasing sophistication of attack tools Increasing use of encryption for files and communications Malware sophistication increasing to avoid detection and emerging signs of conditional malware behavior Newer tehnologies require new approaches to security: Web 2.0, SaaS, Virtulization, Web Services Fraudsters piggyback on search engines By abusing the way that the sites cache search queries to optimize their rankings in other search engines -- most notably, Google -- fraudsters have been able to inject iframe redirects into the cached results. Fraudsters piggyback on search engines By abusing the way that the sites cache search queries to optimize their rankings in other search engines -- most notably, Google -- fraudsters have been able to inject iframe redirects into the cached results. Whaling: Latest scam targets executives “ security service caught 514 s bound for its customers all targeted at C-level executives in various organizations in a two-hour period.” “In September another blast consisted of 1,100 whaling attacks within 15 hours..” Whaling: Latest scam targets executives “ security service caught 514 s bound for its customers all targeted at C-level executives in various organizations in a two-hour period.” “In September another blast consisted of 1,100 whaling attacks within 15 hours..”

Local Area Networks First PC virus Boot sector viruses Create notoriety or cause havoc Slow propagation 16-bit DOS Internet Era Macro viruses Script viruses Create notoriety or cause havoc Faster propagation 32-bit Windows Broadband prevalent Spyware, Spam Phishing Botnets Rootkits Financial motivation Internet wide impact 32-bit Windows Hyper jacking Peer to Peer Social engineering Application attacks Financial motivation Targeted attacks 64-bit Windows

National Interest Personal Gain Personal Fame Curiosity Undergraduate Expert Specialist Largest area by volume Largest area by $ lost Script-Kiddy Largest segment by $ spent on defense Fastest growing segment AuthorVandal Thief Spy Trespasser

Secure Application Architecture36% Secure Application Architecture36% Protection 62% Patch Management 29% Identity and Access 57% Secure Messaging & Collaboration 38% Legacy Platform Migration 14% *Source: CSO Summit 2008 Registration Survey Compliance Management (2007) 44% Compliance Management 29%

Provides capability framework to help you build an optimized infrastructure (not Microsoft- specific) Establishes a foundation based on industry analyst, academic, and consortium research Provides guidance and best practices for step-by-step implementation Drives cost reduction, security and efficiency gains Enables agility Model-Based Approach Application Platform Optimization Model Business Intelligence Enterprise Content Management Collaboration Unified Communications Enterprise Search Business Productivity Infrastructure Optimization Model Development SOA and Business Process Business Intelligence User Experience Data Management Data Protection and Recovery Desktop, Device, and Server Mgmt Identity and Access Management Security and Networking Core Infrastructure Optimization Model IT and Security Process BASIC STANDARDIZE D RATIONALIZE D DYNAMIC BASIC STANDARDIZE D RATIONALIZE D DYNAMIC BASIC STANDARDIZE D ADVANCED DYNAMIC

Technology Process People IT is a strategic asset Users look to IT as a valued partner to enable new business initiatives IT Staff manages an efficient, controlled environment Users have the right tools, availability, and access to info IT Staff trained in best practices such as MOF, ITIL, etc. Users expect basic services from IT IT staff taxed by operational challenges Users come up with their own IT solutions Self-assessing and continuous improvement Easy, secure access to info from anywhere on Internet SLAs are linked to business objectives Clearly defined and enforced images, security, best practices Central Admin and configuration of security Standard desktop images defined, not adopted by all IT processes undefined Complexity due to localized processes and minimal central control Self provisioning and quarantine capable systems ensure compliance and high availability Automate identity and access management Automated system management Multiple directories for authentication Limited automated software distribution Patch status of desktops is unknown No unified directory for access mgmt BasicStandardizedRationalizedDynamic Improve IT Maturity while Gaining ROI $1320/PC Cost$580/PC Cost $230/PC Cost < $100/PC Cost