1. Introduction to Microsoft Forefront
Ken Lam
Regional Solution Specialist - Security Solution, Incubation Server Team Microsoft Corporation - Greater China Region

2. Microsoft’s Comprehensive Security Products
Services
Edge
Server
Client
Identity Management

3. Managed Services On-Premise Software
Multi-Layer Security
Managed Services
On-Premise Software
Internet
DMZ
Corporate Network
ISA
Server
Internet
External Firewall
Internal Firewall
FrontBridge Filtering Services
Antigen for SMTP Gateways
Advanced Spam Manager
Antigen for Exchange
Network Edge Antivirus and Anti-Spam
Services or on-premise software protect against spam and viruses before they penetrate the network
Firewall Protection
Protocol- and application-layer inspection to help businesses enhance server protection while enabling secure, remote access to Exchange
Internal Antivirus
Protection against external and internal threats, while enforcing content policies in
TDM slide
BETTER TOGETHER WITH EXCHANGE
Software and services use multiple scanning engines to protect Exchange inboxes from threats

4. Multi-Layer E-Mail Security
Tactical Guideline: Enterprises need to be more aggressive at dropping or slowing connections. You do not need to process and quarantine all spam.
External Protection
Internal Protection
ISA Server
Internet
FrontBridge Managed Services
ISA Server
Antigen On-Premise Software
Eliminate spam and viruses before they reach your network with multiple scanning engines
Rapid identification and quickest response to latest threats
Unparalleled reliability and scalability
Securely and easily enable remote access to Exchange
Enhance server protection with pre-authentication of users
Improve security of OWA sessions from unmanaged clients
Protect against internal threats with multiple scanning engines
Enforce content policies in
Provide additional layer of defense against the latest viruses, worms and spam
BDM Slide
Better Together with Exchange

5. Live Communications Server
Forefront Solutions
IM and Documents
Live Communications Server
Viruses
Worms
Spam
SharePoint Server
ISA Server
Windows SMTP Server
Exchange Servers
Layered Defenses
Server Optimization
Content Control
Protect Exchange 5.5, 2000, and 2003 from viruses and provide content filtering
Reduce spam on ISA Server, Exchange and Windows SMTP servers with Antigen’s Advanced Spam Manager option
Protect Live Communications Server 2005 with antivirus and content scanning
Protect SharePoint document libraries from viruses and unwanted content
Stop viruses at the network edge on ISA server and SMTP Gateways

6. Forefront multiple scan engine Integration with Exchange Server 2007
Quarantine
Scan Engine 1
Scan Engine 4
Scan Engine 2
Scan Engine 3
Manage up to 8 scan engines
Eliminate single point of failure
Minimize window of exposure during outbreaks

7. Antigen Anti-virus Engines
4/22/2017 9:05 AM
Antigen Anti-virus Engines
9 Scan engines all included in 1 license
Microsoft Antivirus
Sophos
CA VET
CA InoculateIT
Norman
Kaspersky Lab
AhnLab
Authentium
VirusBuster
New!
©2005 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. 7

8. Signature Updates Antigen Engines
Sober.P Virus Detection Time May 2, 2005 (GMT)
January 2005 Updates
No. Updates/Day
Kaspersky
18.5
Dr. Web
10.7
Sophos
2.7
BitDefender
1.7
ClamAV
1.5
AntiVir
1.4
F-Secure
Panda
1.3
Ikarus
1.1
Symantec
Trend Micro
1.0
Time of Day Hour : Minute
Antigen Engines
AV-Test.org Feb. 2005
Note: the chart (left) represents a single virus outbreak only. It does not represent average response times for the listed antivirus labs.
AV-Test.org May 2005

9. Example: Unique Viruses Caught per Antigen Engine
Viruses Caught Only By (excluding body of message viruses)
2/28
3/1
3/2
3/3
3/4
3/5
3/6
3/7
3/8
3/9
3/10
3/11
3/12
3/13
Engine A 1
Engine B 3 2 5
Engine C
Engine D 4
Engine E
Unique Viruses caught over 14 days
Engine A: 5
Engine B: 23
Engine C: 9
Engine D: 16
Engine E: 7 9

10. Example: Viruses Not Caught per Antigen Engine
Viruses Not Caught By (excluding body of message viruses)
2/28
3/1
3/2
3/3
3/4
3/5
3/6
3/7
3/8
3/9
3/10
3/11
3/12
3/13
Engine A 19 21 23 25 14 22 17 15 10 9
Engine B 18 16 8 11 20 13
Engine C 2 5 6 4 1 3
Engine D 12
Engine E
Viruses missed over 14 days
Engine A: 238
Engine B: 197
Engine C: 86
Engine D: 159
Engine E: 156 10

11. Forefront is positioned in the “Leaders” quadrant of the 2006 E-Mail Security Boundary
Source: Gartner, Magic Quadrant for Security Boundary, 2006

12. Antigen Enterprise Manager
Collect information from all of the managed servers and generate reports for both incoming and outgoing s.
The main Report categories are: 
1. Detection Reports
2. SMTP Traffic Reports
3. Engine Versions
Sample reports;
Antigen provides a variety of reports designed to help administrators analyze the state and performance statistics;
Incident Log
VirusLog.txt
Antigen Incidents
Event Statistics
Quarantine
More info at

13. Central Management Software Deployment
Configuration Template Deployment
Distributed Quarantine Management
Distributed Log File Retrieval
SMTP Servers
Exchange Servers

14. What’s New In ISA Server 2006

15. Secure application publishing
Integrated security
Enhanced multi-factor authentication
AD/LDAP integration
Customizable forms-based pre-authN
Enhanced authentication delegation
Improved session management
Efficient management
Web publishing load balancing
Automated tools for Exchange, SharePoint, other web servers
Better certificate administration
Fast, secure access
More single sign-on choices
Automatic link translation

16. Secure Publishing

17. By the numbers > 35% Unauthorized access to computer resources 1:1
Ratio of external to internal attacks
CSI/FBI 2005 report

18. More wizards Web-based items Other items
OWA
SharePoint
Web servers
Rules and network objects
Other items
SMTP
Exchange RPC
Custom rule
Wizards create network elements and configure link translation as necessary

19. Web listener wizard Authentication Certificate handling
HTTP compression

20. Authentication attributes
Group membership
Protocol
usage
User ID
Schedule

21. Authentication: client to ISA
HTML form
RADIUS
OTP
SecurID
HTTP basic
Client-side SSL
Combine with or fallback to another method
None
Third-party addons

22. Authentication: ISA to validator
Active Directory
Kerberos
LDAP
RADIUS
RADIUS OTP
SecurID

23. Delegation process browser access-request 401 OWA form URL RADIUS
access-accept
group attribs
URL + basic creds
form variables
cookie
data
WinLogon
token AD
WinLogon
URL +
basic creds
token
ISA Server
data
IIS

24. Single sign-on
Occurs automatically between all applications published on a single listener
Think of a listener as a container of authentication settings shared by all published sites in that listener

25. Single sign-on flow dev Papers, please eng sup Papers, please
eng.example.com
sup.example.com
dev.example.com
Seen you
ID+pass
mktg
example.com
Even if listeners share same authentication profile and SSO is enabled

26. Form formats Username and password Username and passcode
Combine (enter both)
ID+passcode: for SecurID or RADIUS OTP
Validated by ISA Server
ID+password: for delegation
Validated by back-end
Predefined form sets (logos, mostly)
Generic ISA Server
Exchange

27. Generic form

28. Next Steps Read whitepapers on Antigen and Advanced Spam Manager
Paste link for launch PressPass article
Download evaluation copy of Antigen security products
Read about Microsoft Secure Messaging solutions

29. © 2006 Microsoft Corporation. All rights reserved.
Business Value Launch 2006
4/22/2017 9:05 AM
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.