1. Deriving more value from your Windows investment
Security for Free
Deriving more value from your Windows investment
Steve Lamb & Sandeep Modhvadia
Microsoft

2. Stop Worms, Viruses, Rootkits and Spyware DEAD
Use least privilege
Accept that networks are transient
Turn off unwanted features
Authenticate users and systems
Segment your networks
Authenticate and Encrypt Wireless Networks
Get a sensible policy
Get buy-in from Senior Management
Raise Security Awareness

3. The Story of Bob and Jim Bob is a ‘stupid’ end user
Bob doesn’t care or want security as it is obtrusive
Jim is an over-worked, under-budgeted IT head
Jim needs to secure the network, but doesn’t have the funds to buy a lot of new software or hardware

4. The Needs of a Roaming User
Needs a secure laptop baseline
Access to internal resources
Demands a good experience
Risk of data theft/loss
Strong proof of identity
Secure web browsing

5. Demo
VPN Quarantine
Internet Explorer 7 Phishing Filter

6. The Technology that Delivers
VPN Quarantine
Encrypting File System (EFS)
BitLocker
Full Volume Encryption & Secure Startup
Windows Defender
Internet Explorer 7 Phishing Filter
Smart Card Authentication

7. Securing the Internal Work Force
Protect everyone, from everyone else
Secure wireless provisioning
Secure

8. Network Access Protection Walk-through
Corporate Network
Restricted Network
Remediation
Servers
System Health
Servers
Here you go.
Can I have updates?
Ongoing policy updates to Network Policy Server
May I have access?
Here’s my current
health status.
Requesting access. Here’s my new
health status.
Should this client be restricted based
on its health?
This is a build of Network Access Protection in action (DHCP/VPN example).
Health policy is set by the IT administrator. It is asynchronously plumbed by the system health servers to the Network Policy Server (NPS). The NPS server keeps a health cache at any given time.
The client tries to come in and requests network access. It passes across its statement of health (SoH). The Network Access Device ships this information over to the Network Policy Server (NPS). NPS compares it to what’s in cache and makes certain determinations. If the SoH doesn’t meet health policy, the Network Policy Server (NPS) tells the Network Access Device to restrict the client. The client could be put in a VLAN or separate subnet. The Network Policy Server (NPS) also tells the Network Access Device what the client needs to be healthy.
The NAP system information passed to the client by the NAP platform tells it how to access the fix up servers. The client contacts the fix-up server and requests update(s). Once updated, the client then presents a new SoH to the Network Access Device. This time, the health declarations match policy so the client gains full access to network resources.
The SoH is re-used to continue to access network resources until the policy is updated. The cycle continues to go to provide ongoing assessment and protection. When the client requests network access presenting an up-to-date SoH that matches policy, the client is granted immediate access to the network. Changes to policy may dynamically trigger the scan and remediate process.
According to policy, the client is up to date.
Grant access.
According to policy, the client is not up to date. Quarantine client, request it to update.
You are given restricted access
until fix-up.
Client
Network
Access
Device
(DHCP, VPN)
Network
Policy
Server
Client is granted access to full intranet.

9. Demo
Secure

10. The Technology that Delivers
IPSec Server/Domain Isolation
Network Access Protection (NAP)
Internet Authentication Server (RADIUS)
Windows Firewall

11. The Challenges of Management
Server Lockdown
Client Lockdown
Roles based system
Update Management

12. Demo
Security Configuration Wizard
Group Policy/SRP Lockdown

13. The Technology that Delivers
Security Configuration Wizard
Group Policy
Software Restriction Policies
Windows Server Update Services (WSUS)

14. Summary
User security: Windows delivers protection from malware and provides the Windows firewall for protection of user devices
Mobile security: Quarantine of infected machines, secure connectivity and authentication, data protection
Security management: Security update services, system lockdown

15. Resources The latest news on Microsoft security:
Read and contribute to our blogs: IH

16. www.microsoft.com/uk/security www.microsoft.com/uk/technet/learning
© 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.