Securing your data Security with Microsoft Infrastructure and Internet Explorer Matt Kestian Strategic Security Advisor | National Security Team | Microsoft Corporation | March 11,2005 Version 1.0

Microsoft Confidential – NDA Material Agenda Some true stories….. Phishing/Malware Demonstration Strategy for securely browsing with internet explorer Defense in Depth Securing the perimeter Securing the network Securing the hosts Securing applications Securing the data

Microsoft Confidential – NDA Material True stories from the field Phishing gone high tech Bank in Latin America between two companies (actually this one is personal)

Microsoft Confidential – NDA Material Internet Explorer in XP SP2 More Secure Infrastructure Zone & domain restrictions Block suspicious content Anti-spoofing More User Control Download monitoring Pop-up blocker Information bar Add-on manager Key improvements: Major upgrade focused on security mybank.com evilhacker.com Internet Intranet Trusted Sites Local Machine Can’t elevate privileges Locked Can’t see across domains Zone/Domain Security Download Monitoring

IE Security Improvements in XP SP2

Microsoft Confidential – NDA Material Post XP SP2 Observations Strengths Big security investments were worthwhile Balance of app compat and security seems good Opportunities to Improve Needed to consider cleanup, not just protection Info disclosure just as important as code execution Servicing IE with the OS is difficult for some customers Configuration management – are we doing all we can? Everyone wants new features – even security pros IE 7 will beta this summer with even more phishing and malware protection

Microsoft Confidential – NDA Material Threat Modeling Spoofing An unauthorized user impersonating a valid user Tampering An attacker illegally modifying or destroying data Repudiation Ability of a user to deny performing an action Information Disclosure Releasing information to unauthorised users Denial of Service Causing the system to be unavailable to valid users Elevation of Privilege An attacker illegally gains a higher level of access

Microsoft Confidential – NDA Material Web servers Exchange front end DNS IDS Exchange Directory Web apps LOB apps SMS/MOM DNS Directory SQL cluster Disk array Desktops [VLAN] Attack Methodologies  Reconnaissance - Port Scanning network mapping 2Search for known vulnerabilities 3Exploit the vulnerabilities 4Take ownership – Elevate Privileges Download hacker tools, backdoors, rootkits, etc Download hacker tools, backdoors, rootkits, etc 5Perform unauthorized activities Determine other targets and attack them 6Steal the Data 7Cover your tracks Clear Audit Trails X X X X X

Microsoft Confidential – NDA Material Policies, Procedures, & Awareness Physical Security Perimeter Network Host Application Data Defense in Depth An organizing framework for Security Layered Portfolio of Countermeasures Reduce the chance of a single point of vulnerability

Microsoft Confidential – NDA Material Perimeter Layer  The Internet  Branch offices  Business partners  Remote users  Wireless networks  Internet applications Network perimeters include connections to: Business Partner Internet Services LAN Main Office LAN Internet Services Branch Office LAN Wireless Network Remote User Internet

Microsoft Confidential – NDA Material Business Partner Internet Services LAN Main Office LAN Internet Services Branch Office LAN Wireless Network Remote User Internet Perimeter Layer Compromise  Attack on corporate network  Attack on remote users  Attack from business partners  Attack from a branch office  Attack on Internet services  Attack from the Internet Network perimeter compromise may result in:

Microsoft Confidential – NDA Material Perimeter Layer Protection  Firewalls  Blocking communication ports  Port and IP address translation  Virtual Private Networks  Tunneling protocols  Filter traffic- SMTP, Spam blocking, proxy technologies  VPN quarantine Network perimeter protection includes: Business Partner Internet Services LAN Main Office LAN Internet Services Branch Office LAN Wireless Network Remote User Internet

Microsoft Confidential – NDA Material ISA Server 2004 Application level FW VPN Quarantine Sybari Antigen – Anti-Virus, Anti-Spam Lab Unmanaged guest

Microsoft Confidential – NDA Material Network Layer Marketing Human Resources Finance Sales Wireless Network

Microsoft Confidential – NDA Material Network Layer Compromise Unauthorized access to systems Sniff packets from the network Unexpected communication ports Access all network traffic Unauthorized access to wireless networks

Microsoft Confidential – NDA Material Security Zones Tier Restrictions Intra-zone Tier Communication Restrictions Inter-zone Communication Restrictions

Microsoft Confidential – NDA Material Network Layer Protection Implement mutual authentication Segment the network (Vlan, internal FW) Encrypt network communications Block communication ports Control access to network devices Sign network packets Multi home some servers

Implementing IPSec Policy

Microsoft Confidential – NDA Material Host Layer Specific network role Operating system configuration The term “host” is used to refer to both workstations and servers

Microsoft Confidential – NDA Material Host Layer Compromise Unsecured Operating System Configuration Unmonitore d Access Exploit Operating System Weakness Distribute Viruses

Microsoft Confidential – NDA Material Malicious Web content Buffer overrun attacks Port-based attacks Malicious attachments Malicious attachments Attack Vectors Days to exploit and complexities around patching makes patching a less effective defense strategy

Microsoft Confidential – NDA Material Windows XP Service Pack 2 Windows Server 2003 Service Pack 1 Microsoft Windows AntiSpyware Software Restriction Policies Future: Network Access Protection

Microsoft Confidential – NDA Material Manage configuration changes Host Layer Protection Harden operating system Install security updates Implement auditing Disable or remove unnecessary services Install and maintain antivirus software Use Group Policy – implement templates XP and Server Run AV and keep up to date Implement IPSec for mutual authentication Restrict anonymous access where able Rename the admin account disable guest Use Windows Firewall

Microsoft Confidential – NDA Material Application Layer Applications That Create and Access Data Server Applications (for example, Exchange Server or SQL Server) Security issues specific to applications Functionality must be maintained

Microsoft Confidential – NDA Material Application Layer Compromise Loss of application Execution of malicious code Extreme use of application Unwanted use of applications

Microsoft Confidential – NDA Material Application Layer Protection Enable only required services and functionality Configure application security settings Install security updates for applications Install and update antivirus software Run applications with least privilege

Microsoft Confidential – NDA Material Data Layer Documents Directory Applications

Microsoft Confidential – NDA Material Data Layer Compromise Documents Directory Applications View, Change, or Modify Information Interrogate Directory Files Replace or Modify Application Files

Microsoft Confidential – NDA Material Persistent information protection New “lockbox” business scenarios Deployment, usability enhancements Offline support FIPS compliance Smartcard integration Technology Investments

Microsoft Confidential – NDA Material Data Layer Protection Encrypt files with EFS Secure SQL server according to SQL server security guidelines Move files from the default location Create data backup and recovery plans Protect documents and with Windows Rights Management Services Utilize NTFS Access control lists

Microsoft Confidential – NDA Material Microsoft Baseline Security Analyzer (MBSA) v1.2 Virus Cleaner Tools Systems Management Server (SMS) 2003 Software Update Services (SUS) SP1 Internet Security and Acceleration (ISA) Server 2004 Standard Edition Windows XP Service Pack 2 Patching Technology Improvements (MSI 3.0) Systems Management Server 2003 SP1 Microsoft Operations Manager 2005 Windows malicious software removal tool Windows Server 2003 Service Pack 1 Windows Update Services ISA Server 2004 Enterprise Edition Windows Rights Management Services SP1 Windows AntiSpyware System Center 2005 Windows Server 2003 “R2” Visual Studio 2005 Vulnerability Assessment and Remediation Active Protection Technologies Antivirus Prior H2 04 Future 2005

© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.