1. Security of Communication & IT systems Bucharest, 21 st September 2004 Stephen McGibbon Chief Technology Officer, Eastern Europe, Russia & CIS Senior Director, EMEA Technology Office

2. Security Enabled Business Reduce Security Risk Assess the environment Improve isolation & resiliency Develop and implement controls Increase Business Value Connect with customers Integrate with partners Empower employees Impact to Business Probability of Attack Risk Level ROI ConnectedProductive

3. Give us better access control” “ Give us better access control” ” Develop reliable and secure software “ Develop reliable and secure software ” Simplify critical maintenance “ Simplify critical maintenance ” “Reduce impact of malware” Improve Updating Engineering Excellence Authentication, Authorization, Access Control Isolation and Resiliency Provide better guidance “ Provide better guidance ” Deliver Security Guidance, Tools, Responsiveness

4. Isolation and Resiliency reducing the modes of attack Communicate and collaborate in a more secure manner without sacrificing information worker productivity Protection Against Buffer Overruns Network Protection Safer Email and IM Safer Web Browsing

5. Isolation and Resiliency Future: Active Protection Application-aware firewalls Application-aware firewalls Intrusion prevention Intrusion prevention Dynamic system protection Dynamic system protection Behavior blocking Behavior blocking

6. Advanced Isolation Clients who do not pass can be blocked and isolated Isolated clients can be given access to updates to get healthy Isolation And Resiliency Client Inspection Heath Checkup Check update level, antivirus, and other plug in and scriptable criteria

7. One update experience Windows Update > Microsoft Update SUS > Windows Update Services SMS 2003 Delta updating for 30-80% smaller update packages Better quality updates Rollback capability for all updates 10-30% fewer reboots Updating Windows 2000+ Generation

8. Today 2004 Windows, SQL, Exchange, Office… Windows, SQL, Exchange, Office… Office Update Download Center SUS SMS “Microsoft Update” (Windows Update) VS Update Windows Update Windows only WindowsUpdateServices Updating: Roadmap

9. Quality & Engineering Excellence Improved Development Process Threat modeling Code inspection Penetration testing Unused features off by default Reduce attack surface area Least Privilege Prescriptive Guidance Security Tools Training and Education Community Engagement Transparency Clear policy

10. 36 Days after availability Number of Bulletins 6 “Critical” & “Important” Security Bulletins Quality & Engineering Excellence

11. Quality & Engineering Excellence Helping Developers Write Secure Code.NET Framework 1.1 Cryptographic APIs Integrated PKI Visual Studio.NET 2003 Security Tools Web Services Enhancements Microsoft Security Developer Center Writing Secure Code v2 Developer webcasts

12. Authentication, Authorization and Access Control Enabling Security Critical Scenarios Windows IPSec integration SSL, RPC over HTTP ISA Server 2004 Deep Windows integration WPA, 802.1x, PEAP Single sign-on, smartcards, biometrics Provision for multiple credential types Rights Management Services Comprehensive Authorization Infrastructure (AD, EFS, ACLs…)

13. Security Tools Microsoft Baseline Security Analyzer 1.2 Security Bulletin Search Tool URLscan IIS Lockdown Blaster cleaner on Windows Update PYPC automatic configuration

14. Security Tools Microsoft Baseline Security Analyzer 1.2 Security Bulletin Search Tool URLscan IIS Lockdown Blaster cleaner on Windows Update PYPC automatic configuration

15. Community Engagement Newsletters ITPro Security Zone Webcasts & chats Executive Updates Security Bulletin Technet/msdn security Security MVP Program Security blogs

16. Community Engagement Newsletters ITPro Security Zone Webcasts & chats Executive Updates Security Bulletin Technet/msdn security Security MVP Program Security blogs

17. Guidance & Training Security Developer’s Center Security Guidance Center How-to Articles, Checklists, Modules Microsoft Security E-Learning Clinics Security Hardening Guides Security Guidance Kit MCSA: Security and MCSE: Security Certifications

18. Guidance & Training Security Developer’s Center Security Guidance Center How-to Articles, Checklists, Modules Microsoft Security E-Learning Clinics Security Hardening Guides Security Guidance Kit MCSA: Security and MCSE: Security Certifications

19. Learn: Take training, read guidance, help educate users Connect: Participate in community. Subscribe to security newsletters. Manage Risk: Implement a security plan and security risk management process. Upgrade laptops & remote systems to Windows XP Standardize edge servers on Windows Server 2003 Defense in depth: Implement multiple countermeasures. http://www.microsoft.com/security/guidance

20. © 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.