1. Jamie Sharp Security Architect Microsoft Corporation jamiesh@microsoft.com

2. Agenda Overview of Microsoft Forefront What is Forefront? Product Drilldowns Product Roadmap & Licensing Summary

3. Microsoft’s Promises to You

4. More advanced More frequent Profit motivated Application-oriented Too many point products Poor interoperability Lack of integration Multiple consoles Uncoordinated event reporting & analysis Cost and complexity Security Solution Requirements Threats are more dangerous than ever Fragmentation of security technology Difficult to use, deploy and manage

5. Microsoft Forefront provides greater protection and control over the security of your business’ network infrastructure by providing: A comprehensive line of information protection and secure access productsA comprehensive line of information protection and secure access products Integration with your existing IT infrastructureIntegration with your existing IT infrastructure Simplified deployment, management, and analysisSimplified deployment, management, and analysis Client and Server OS Server Applications Edge

6. Guidance Developer Tools Systems Management Active Directory Federation Services (ADFS) Identity Management Services Information Protection Encrypting File System (EFS) BitLocker™ Client and Server OS Server Applications Edge Network Access Protection (NAP)

7. Streamline your network Deploying edge security gateways in branch offices and leveraging cache capabilities Safeguard your IT environment Protecting your environment from internal users accessing unwanted or harmful content on the Internet An integrated edge security gateway that helps protect your IT environment from Internet-based threats while providing your users fast and secure remote access to applications and data. Secure Application Publishing Web Access Protection Branch Office Gateway Secure your Microsoft application infrastructure Publish Exchange, SharePoint and Web application servers for secure remote access

8. Application Layer Content: ??????????????????????????????? A Traditional Firewall’s View of a Packet Only packet headers are inspected Application layer content appears as “black box” IP Header Source Address Dest. Address TTL Checksum TCP Header Sequence Number Source Port Destination Port Checksum Forwarding decisions based on port numbers Legitimate traffic and application layer attacks use identical ports Internet Expected HTTP Traffic Unexpected HTTP Traffic Attacks Non-HTTP Traffic Corporate Network

9. Application Layer Content: MSNBC - MSNBC Front Page <link rel="stylesheet" ISA and Application-Layer Filtering Deep Content Inspection: packet headers and application content are inspected IP Header: Source Address, Dest. Address, TTL, Checksum TCP Header: Sequence Number Source Port, Destination Port, Checksum Forwarding decisions based on content Only legitimate and allowed traffic is processed Internet Allowed HTTP Traffic Prohibited HTTP Traffic Attacks Non-HTTP Traffic Corporate Network

10. Whale Ensure the integrity and safety of network and application infrastructure by blocking malicious traffic and attacks Comprehensive policy enforcement drives compliance with legal and business guidelines concerning access to sensitive data The IAG provides SSL-based application access and protection with endpoint security management, enabling granular access control and content inspection from a broad range of devices and locations to line- of-business, intranet, and client-server resources. Control Access Safeguard Information Protect Assets Secure, browser- based access to corporate applications and data from more locations and more devices

11. Names Whale a Leader in its SSL VPN Forrester-Wave Says Whale will be one of the key vendors driving innovation. March 2004  Names Whale a Visionary  “In the SSL VPN space, Whale has the best security model built around it.” Gartner VP Richard Stiennon quoted in Reuters, February 9, 2004“  “Whale … has gone further than other vendors in developing special optimizations for high value applications…” John Girard, December, 2005 Whale is a Recognized Leader  Awards Whale its “2004 Best in Class Award” for app layer security  "Whale Communications understands the diverse and interactive behaviors of business applications, web browsers, and operating systems and hence generates effective solutions that address a myriad of security risks other solutions would not.” February 2004

12. Forefront server security solutions help businesses protect their messaging and collaboration servers against viruses, worms, spam and inappropriate content. Multiple scan engines at multiple layers throughout the corporate infrastructure provide maximum protection against e-mail and collaboration threats Advanced Protection Availability & Control Tight integration with Microsoft Exchange, Windows- based SMTP, SharePoint and Office Communications Servers maximizes availability and management control Secure Content Ensures organizations can eliminate inappropriate language and dangerous attachments from internal and external communications

13. The Benefit of Multiple Engines Recent AV-Test.org results for Forefront engine sets vs. other vendors Signature response times in hours MM/YY VIRUS FF Set 1FF Set 2FF Set 3FF Set 4FF Set 5 Vendor A Vendor B Vendor C 0406 Mytob.NQ@mm 1.531.00 3.079.9317.352.10 0406 Mytob.NQ@mm 1.001.121.00 28.0711.573.52 0406 Spybot!04C2 23.031.0023.0325.281.000.0029.9039.02 0406 Nugache.a 1.0025.451.00 34.1012.9048.05 0506 Numuen.F 0.0024.430.00 1.0010.3314.95 0506 Numuen.H 1.0031.721.00 103.83251.85114.78 0506 Numuen.G 3.158.203.15 1.00151.80468.97 0506 Banwarum.C@mm 87.471.0087.47 1.00116.7372.95129.25 0506 Banwarum.B@mm 12.051.001.82 1.00116.7322.4532.85 0506 Rbot!E905 0.00 1,141.78217.571.00 0606 Bagle.EG 0.00 7.320.00 0606 Bagle.EH@mm 0.001.250.00 18.430.00 0606 Bagle.EG@mm 0.003.620.00 1.000.0026.480.00 0606 Bagle.LY@mm 0.00 6.402.47 0706 Feebs.gen@mm 0.00 503.80 0706 Feebs.EU 0.001.000.00 52.30173.1738.97 0706 Virut.A 0.00 1,317.02 = less than 5 hours = bet 5 and 24 hours= more than 24 hours

14. Internet A B C D E Exchange Server/ Windows-based SMTP Server Distributed protection Performance tuning Content filtering Central management Gartner Magic Quadrant: E-Mail Security Boundary -Leader-

15. Remove most prevalent viruses Remove all known viruses Real-time antivirus Remove all known spyware Real-time antispyware Central reporting and alerting Customisation Microsoft Forefront Client Security MSRT Windows Defender Windows Live OneCare Safety Scanner Windows Live OneCare IT Infrastructure Integration FOR INDIVIDUAL USERS FOR BUSINESS

16. One solution for spyware and virus protection Built on protection technology used by millions worldwide Effective threat response Complements other Microsoft security products One console for simplified security administration Define one policy to manage client protection agent settings Deploy signatures and software faster Integrates with your existing infrastructure One dashboard for visibility into threats and vulnerabilities View insightful reports Stay informed with state assessment scans and security alerts Unified malware protection for business desktops, laptops and server operating systems that is easier to manage and control

17. Desktops, Laptops and Server Operating Systems Running Microsoft Forefront Client Security Microsoft Update SETTINGS REPORTS Management Server Reporting and Alerting Server (OR ALTERNATE SYSTEM) DEFINITIONSEVENTS

18. Forefront Naming Transition PreviousCurrent Client Server Edge H2 2006 2007+ TBD

19. Flexible licensing with multiple choices Standalone offerings to meet your specific needs Suites provide enhanced value and effectively meet your broader security needs in one simple purchase. Standalone offerings available today Suites become available throughout the coming year with upgrade paths for existing customers Standalone Offerings Enterprise CAL Suite Exchange Enterprise CAL Forefront Security Suite Forefront Client Security  Forefront for Exchange Server  Forefront for SharePoint  Antigen for IM  Exchange Hosted Filtering  Other Server CALs  Forefront Licensing All Forefront Security products are available through Microsoft Volume Licensing

20. “IDC believes Forefront will play a key role in Microsoft's ‘people-ready business’ initiative, specifically with protecting information and controlling access.” - IDC “Microsoft Announces Forefront: A Brand for Security Portfolio, Brian E. Burke, June 2006 “Outright, Antigen kills three birds with one stone by providing e-mail, collaboration and antispam protection.” - CRN “Microsoft’s Antigen Securely Automates Antivirus Protection”, Mario Morejon, June 23 2006 “By year-end 2008, Microsoft will have captured 30 percent of the desktop antivirus and anti-spyware market in organizations with fewer than 1,000 employees (0.7 probability).” - Gartner “Midsize Business Security Spending Plans, 2006”, James A. Browning, February 16 2006 Forefront delivers comprehensive, simplified and integrated business security New brand but proven, award-winning products Forefront builds on Windows, Office and Exchange security improvements

21. © 2007 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.