1. virtual techdays INDIA │ 22-24 November 2010 Security @ Microsoft Anirudh Singh Rautela │ Technology Specialist - Security

2. virtual techdays INDIA │ 22-24 November 2010 Agenda The Microsoft TWC Initiative Security & Privacy Progress Windows Platform Security

3. Microsoft Privacy Guidelines for developing Software and Services Microsoft Data Governance Framework Managing and Protecting Personal Information Secure against attacks Protects confidentiality, integrity and availability of data and systems Microsoft Security Response Center (MSRC) Microsoft Malware Protection Center (MMPC) Microsoft Security Engineering Center (MSEC) Build solutions that protect privacy Safe guard your corporate data Protect Personal Privacy Microsoft Online Crash Analysis Engineering Excellence Training and Guidelines Microsoft Online Services with high reliability in multiple data centers Vendor Engagement and Windows Hardware Quality Lab Business Continuity explicitly designed in with prescriptive guidance Interop Vendor Alliance Open Source Software Lab Transparent Practices (SDL, Codeplex, etc.) Predictable, consistent, responsive service Maintainable, easy to configure and manage Resilient, works despite changes Recoverable, easily restored Proven, ready to operate Commitment to customer-centric Interoperability Automated Policy based solutions Recognized industry leader, world-class partner Open, transparent SQL Server 2005 Visual Studio 2005 Windows Server 2003 SP1 Malicious SW Removal Tool Windows XP SP2 DSI Launched TWC Announced SDL begins Windows Server 2003 Windows Defender Windows Live OneCare Windows Vista Office 2007 Forefront Windows Server 2008 SQL Server 2008

4. TwC Security Protecting Microsoft customers throughout the entire life cycle (in development, deployment and operations) Microsoft Security Engineering Center (MSEC) Security Assurance Security Science SDLSDL Microsoft Malware Protection Center (MMPC) Microsoft Security Response Center (MSRC) (MSRC) MSRC Engineering MSRC Ops EcoStratEcoStrat Conception Release

6. TrainingTraining Core training RequirementsRequirements Analyze security and privacy risk Define quality gates DesignDesign Threat modeling Attack surface analysis ImplementationImplementation Specify tools Enforce banned functions Static analysis VerificationVerification Dynamic/Fuzz testing Verify threat models/attack surface ReleaseRelease Response plan Final security review Release archive ResponseResponse Response execution VerificationVerification Dynamic/ Fuzz testing Verify threat models/attack surface ReleaseRelease Response plan Final security review Release archive ResponseResponse Response execution TrainingTraining Core training RequirementsRequirements Analyze security and privacy risk Define quality gates DesignDesign Threat modeling Attack surface analysis ImplementationImplementation Specify tools Enforce banned functions Static analysis At Microsoft, we believe that delivering secure software requires Executive commitment  SDL a mandatory policy at Microsoft since 2004 Ongoing Process Improvements  6 month cycle

7. Security Tools & Papers Microsoft Security Assessment Toolkit Infrastructure Optimization Microsoft IT Showcase Microsoft Windows Vista Security Whitepapers Microsoft Security Intelligence Report Security Readiness Education and Training Learning Paths for Security Professionals

8. Virus Information Alliance Global Infrastructure Alliance for Internet Safety Digital PhishNet Global Phishing EnforcementInitiative

9. Threats & Counter measures Security Risk Management Guide Fundamental Computer Investigation Guide for Windows Microsoft Security Assessment Tool 4.0 MBSA Tool & Scripts Microsoft Security Compliance Manager Security Awareness Toolkit SysInternals Toolkit Security Literature to read Misc. Security Tools for Admins

10. Microsoft Security Response Center (MSRC) Microsoft Malware Protection Center (MMPC) Windows Live OneCare and Forefront Client Security, powered by the Microsoft Malware Protection Center SPAM (Sender ID, Phishing Filters) Network Access Protection (NAP/NAC) Security Development Lifecycle process Engineered for security Design threat modeling SD3 Secure by Design Secure by Default Secure In Deployment Automated patching and update services SDL and SD3 Malware Example Consumer Education Laws Firewalls Antivirus Products Antispyware Products Malicious Software Removal Tool Memory Management (ASLR) Law Enforcement Defense in Depth ThreatMitigationThreatMitigation

11. Alert and prescriptive guidance Sasser April 2004 Blaster August 2003 Zotob August 2005 Within 1 day Within 2 hours 2 days prior Within 10 days Within 2 days Same day Within 38 days Within 3 days Within 3 days Online guidance/ Webcast Free worm removal tool Days after the patch we knew of 1 st exploit Products not affected by attacks MS08-067 October 2008 Before publicly known (MAPP) 3 times, 2x Same day Didn’t need one* +11 days+4 days+2 days-11 days none XPSP2 Vista, Win7 Server 2008

12. Vulnerability disclosures in 2H08 down 3% from 1H08 2008 as a whole down 12% from 2H07 Microsoft proportion only 5% of industry total Industry-wide vulnerability disclosures by half-year, 2H03-2H08 Vulnerability disclosures for Microsoft products, by full year, 2004-2008

13. “Why try to chase a difficult overflow out of Vista when you have Acrobat Reader installed, some antivirus software with shoddy file parsing, and the latest iTunes?” Halvar Flake Security Researcher Microsoft BlueHat Conference September 2007 Given this situation, Microsoft deserves high praise for creating, formalizing, and improving SDL as it has led to better software for the masses.” Jon Oltsik Enterprise Strategy Group September 2008

14. Core improvements to the Operating Systems Security by Design, by Default and by Deployment

15. Social Engineering & Exploits Reduce unwanted communications Social Engineering & Exploits Reduce unwanted communications Freedom from intrusion International Domain Names Pop-up Blocker Increased usability Choice and control Clear notice of information use Provide only what is needed Choice and control Clear notice of information use Provide only what is needed Control of information User-friendly, discoverable notices P3P-enabled cookie controls Delete Browsing History InPrivate™ Browsing & Filtering Browser & Web Server Exploits Protection from deceptive websites, malicious code, online fraud, identity theft Browser & Web Server Exploits Protection from deceptive websites, malicious code, online fraud, identity theft Protection from harm Secure Development Lifecycle Extended Validation (EV) SSL certs SmartScreen ® Filter Domain Highlighting XSS Filter/ DEP/NX ActiveX® Controls

16. Secure Platform MalwareProtectionMalwareProtection Secure Access Data Protection Rights Management Services (RMS) SharePoint, Exchange, Windows Mobile integration Encrypting File System (EFS) Bitlocker & Bitlocker To Go User Account Control Network Access Protection (NAP) IPv6IPsec Windows CardSpace Native smart card support GINA Re-architecture Certificate Services Credential roaming AppLocker TM DirectAccess Security Development Lifecycle (SDL) Kernel Patch Protection Kernel-mode Driver Signing Secure Startup Windows Service Hardening x64 Hardware Integration Windows Defender IE Protected Mode Address Space Layout Randomization (ASLR) Data Execution Prevention (DEP) Bi-directional Firewall / multi profile Support Windows Security Center

17. Secure Platform NetworkProtectionNetworkProtection Data Protection IdentityAccessIdentityAccess Security Development Lifecycle (SDL) Windows Server Virtualization (Hypervisor) Role Management Tool OS File Integrity Read-only Domain Controller (RODC) Active Directory Federation Services (ADFS) Administrative Role Separation PKI Management Console Online Certificate Status Protocol Network Access Protection (NAP) Server and Domain Isolation with IPsec End-to-end Network Authentication Windows Firewall With Advanced Security On By Default Rights Management Services (RMS) Full volume encryption (Bitlocker) USB Device-connection rules with Group Policy Improved Auditing Windows Server Backup EFS DirectAccess

18. Minimal installation option Low surface area more secure Command line interface Less patching/Less downtime Server Core Security, TCP/IP, File Systems, RPC, plus other Core Server Sub-Systems Server With WinFx, Shell, Tools, etc. TSIAS Web Server Share Point Etc… Server, Server Roles (for example only) GUI, CLR, Shell, IE, Media, OE, etc. Server Core Server Roles DNSDHCP File/ Print AD Hyper -V Basic Web

19. TWC SDL Systems Management Operations Manager 2007 Configuration Manager 2007 Data Protection Manager Mobile Device Manager 2008 Active Directory Federation Services (ADFS) Identity & Access Management Certificate Lifecycle Management Services Information Protection Encrypting File System (EFS) BitLocker™ Client and Server OS Server Applications Edge Client and Server OS Server Applications Edge A well Managed Secure Infrastructure is the key!

21. virtual techdays INDIA │ 22-24 November 2010 THANK YOU!