1. Sebastian Vijeu Microsoft Romania sebastv@microsoft.com Microsoft Forefront Server & Client Technology

2. Agenda Forefront security family Forefront Client Security (FCS) Forefront for Exchange Forefront for Sharepoint Forefront for OCS

3. Security and Management Technologies Active Directory Federation Services Card Space

4. Consumer/ Small Business Corporate Client Protection Server ProtectionEdge Protection Simple PC maintenance Anti-Virus Anti-Spyware Anti-Phishing Firewall Performance Tuning Backup and Restore Protection Edge, server and client protection “Point to Point” Solutions Security of data at rest and in transit Mobile workforce Manageability

5. One solution for spyware and virus protection Built on protection technology used by millions worldwide Effective threat response One console for simplified security administration Define one policy to manage client protection agent settings Integrates with your existing AD Infrastructures One dashboard for visibility into threats and vulnerabilities View insightful reports Stay informed with state assessment scans and security alerts Unified malware protection for business desktops, laptops and server operating systems that is easy to manage and control

6. Remove most prevalent viruses Remove all known viruses Real-time antivirus Remove all known spyware Real-time antispyware Central reporting and alerting Customization Microsoft Forefront Client Security MSRT Windows Defender Windows Live OneCare Safety Scanner Windows Live OneCare IT Infrastructure Integration FOR INDIVIDUAL USERS FOR BUSINESSES Client Anti-Malware Unified Protection

7. Only AntiVirus is enough?

8. User Account Control IE7 with Protected Mode Randomize Address Space Layout Advanced Desktop Firewall Kernel Patch Protection (64bit) Unified Virus & Spyware Protection Central Management Reporting, Alerting and State Assessment NAP File/Folder Encryption Full Volume Encryption Combined Solution Windows Vista™ Forefront™ Client Security FCS + Windows OS = Complete Client Protection

9. Real-time reporting Enabled by embedded Operations Manager technology Access to real-time data and trends “At-a-glance” view of threats & vulnerabilities across organization Machines reporting security issues (malware not cleaned, critical vulnerabilities present) Machines not reporting issues Machines not reporting 30-day trend history Drill down into detail as required Notification of machines reporting alerts

10. Key information on security state for taking action against threats, Snapshot of the top trends and issues in the environment. Launch point for other reports, allowing the administrator to drill down into details as much as needed. Ability to review: Deployment Status: How many machines are up to date or not up to date with the latest signatures Top issues and issue history: Categorized by type along with history of issues Top Threats and threat history: Types of threats, their severity and how many machines a specific threat has affected. Top alerts and alert history: Key alerts impacting environment Top vulnerabilities and vulnerability history: Through state assessment scans Summary Report

11. “Is my environment compliant with security best practices?” “Has my level of vulnerability exposure changed over time?” “What portion of my environment is at high risk?”

12. Forefront server security solutions help businesses protect their messaging and collaboration servers against viruses, worms, spam and inappropriate content. Multiple scan engines at multiple layers throughout the corporate infrastructure provide maximum protection against e-mail and collaboration threats Advanced Protection Availability & Control Tight integration with Microsoft Exchange, Windows- based SMTP, SharePoint and Office Communications Servers maximizes availability and management control Secure Content Ensures organizations can eliminate inappropriate language and dangerous attachments from internal and external communications

13. Advanced Protection – the strength of single vendor / multiple engines Forefront Server Security products integrate and ship with industry-leading antivirus scan engines from Each scan job in a Forefront Server Security product can run up to five engines simultaneously Internal Messaging and Collaboration Servers A B C E D

14. No single point of failure Problem: Management/Cost SharePoint ISA Server SMTP Server Internet Viruses Advanced Protection – antivirus approaches ExchangeExchange Multi-vendor Multi-engine Worms Spam AB C A E D B C

15. The Multiple Engine Advantage Rapid response to new threats Fail-safe protection through redundancy Diversity of antivirus engines and heuristics Response time 1 (in hours) The Microsoft multiple-engine solution WildList Number Malware Name Forefront Set 1 Forefront Set 2 Forefront Set 3 Vendor A*Vendor B*Vendor C* 01/08 agent_itw14.ex_0.00 268.6565.33 01/08 autorun_itw180.ex_0.00 1023.470.001123.98 01/08 autorun_itw92.ex_0.00 275.670.00731.43 01/08 ircbot_itw227.ex_0.00 1083.70640.45557.53 01/08 ircbot_itw236.ex_0.00 711.471148.27 01/08 ircbot_itw238.ex_0.00 563.13521.73452.13 01/08 ircbot_itw295.ex_0.00 40.08226.0237.32 01/08 ircbot_itw301.ex_387.98 404.13558.98678.73514.55 01/08 ircbot_itw305.ex_387.98 404.13484.80485.77487.38 01/08 ircbot_itw308.ex_0.42 101.0212.032.10 01/08 ircbot_itw314.ex_0.00 808.48355.20802.03 01/08 ircbot_itw317.ex_0.00 12.45506.286.57 01/08 pushbot_itw2.ex_0.00 700.27696.17 01/08 rbot_itw2555.ex_0.00 1083.700.001082.28 01/08 rbot_itw2579.ex_0.00 386.60306.83422.27 01/08 rbot_itw2582.ex_0.00 1117.850.00138.83 01/08 rbot_itw2583.ex_0.00 1112.173.671110.75 01/08 sdbot_itw2584.ex_0.00 961.78344.62795.35 01/08 sdbot_itw2596.ex_0.00 301.77415.2089.50 01/08 sdbot_itw2636.ex_0.00 247.47699.33 02/08 autorun_itw245.ex_0.00 1321.350.001025.30 02/08 ircbot_itw318.ex_0.00 100.02619.72223.42 02/08 ircbot_itw320.ex_0.00 157.67120.12669.15 02/08 ircbot_itw336.ex_0.00 181.08811.6717.47 02/08 ircbot_itw337.ex_0.00 701.95901.8054.68 02/08 ircbot_itw338.ex_0.00 97.73763.3081.02 02/08 rcbot_itw342.ex_0.00 1360.6278.92260.15 * Includes beta signatures ** 0.00 denotes proactive detection 1 Source: AV-Test.org 2008 (www.av-test.org) Other single-engine solutions = Less than 5 hours = 5 to 24 hours = More than 24 hours

16. Forefront Server Multiengine Optimized Performance Bias Engines used are not always the same.They are dynamically allocated from the available pool. A B Max Certainty: uses all engines (100%) Favor Certainty: uses all available engines Neutral: uses approximately 50% of available engines Favor Performance: uses 25% of available engines Max Performance: uses one engine for every scan

17. Viruses Worms Spam Office Communications Server Users Internet SMTP Server ISA Server SharePoint Exchange Server Edge E-mail Collaboration Forefront Comprehensive Security Viruses Worms Inapp. Content Management Microsoft Operations Manager Forefront Management Pack (MP) Forefront Client Security Forefront Security Management Console (actually Antigen Enterprise Manager)

18. Mailbox Client Access Unified Messaging Edge Transport Hub Transport Enterprise network Other SMTP Servers Mailbox  Routing  Hygiene  Routing  Policy Voice Messaging PBX or VoIP Public Folders Fax  Applications: -OWA  Protocols: -ActiveSync, POP, IMAP, RPC / HTTP …  Programmability: Web services,Web parts Exchange 2007 Enterprise Topology for security INTERNETINTERNET

19. Anti-spam Protection Forefront Security for Exchange Server licenses and activates the premium anti-spam features for Exchange 2007 Deployed on Exchange Edge or Hub server role Built upon base anti-spam in Exchange 2007, premium anti-spam protection adds: Microsoft IP reputation filter service and automated updates Automated updates for Microsoft Smartscreen spam heuristics, phishing Web sites and Intelligent Message Filter (IMF) Targeted spam signature data and automatic updates to identify latest spam campaigns

20. Microsoft Forefront Security for SharePoint integrates multiple scan engines from industry- leading vendors and content controls to help businesses protect their Microsoft SharePoint portal and collaboration environments by eliminating documents containing malicious code, confidential information, and inappropriate content. Comprehensive Protection Protection OptimizedPerformance Simplified Management Multiple industry-leading antivirus engines File & Content Keyword Filtering Support for Open XML & IRM-protected docs Native integration with SharePoint Server Scanning innovations and performance controls Continuous scanning during engine updates Administration console for easy setup and management Automated signature updates Centralized reporting, notifications and alerts

21. Why SharePoint Antivirus? File Server AV does not provide the level of protection needed to prevent SharePoint-related infections Desktop AV is not enough to solve the problem Desktop AV may detect infection within the cached copy, but cannot clean the stored copy in the document library Forefront Security for SharePoint cleans the document in the library, ensuring all posted and downloaded documents are safe Signature distribution is often slow and problematic, and never contains five scanning engines

22. Forefront server security solutions help businesses protect their messaging and collaboration servers against viruses, worms, spam and inappropriate content. Multiple scan engines at multiple layers throughout the corporate infrastructure provide maximum protection against e-mail and collaboration threats Advanced Protection Availability & Control Tight integration with Microsoft Exchange, Windows- based SMTP, SharePoint and Office Communications Servers maximizes availability and management control Secure Content Ensures organizations can eliminate inappropriate language and dangerous attachments from internal and external communications

23. Forefront for Instant Messaging – Office Communications Server Find and remove viruses from the IM conversations and file transfer Infected file blocking Continuous scanning IM traffic for removing malicious software Content filtering and support for encrypted traffic Microsoft Office Communicator Office Communications Server Firewall Microsoft Live Messenger

24. Antivirus Protection for IM Integrated scan with Session Initiation Protocol (SIP) for efficient realtime scanning Notifications for file infections Support for OCS 2007 / Live Communications Server 2005 and encrypted traffic

25. Security Guidance and Resources Microsoft Security Home Page: www.microsoft.com/security www.microsoft.com/security Microsoft Security Portal: www.microsoft.com/security/portal www.microsoft.com/security/portal Microsoft Trustworthy Computing: www.microsoft.com/security/twc www.microsoft.com/security/twc Microsoft Security Intelligence Report: www.microsoft.com/sir www.microsoft.com/sir Infrastructure Optimization: www.microsoft.com/io www.microsoft.com/io Microsoft Security Assessment Tool: www.microsoft.com/security/msat www.microsoft.com/security/msat General Information: Microsoft Live Safety Center: safety.live.com safety.live.com Microsoft Security Response Center: www.microsoft.com/security/msrc www.microsoft.com/security/msrc Security Development Lifecycle: http://msdn2.microsoft.com/en- us/library/ms998404.aspx http://msdn2.microsoft.com/en- us/library/ms998404.aspxhttp://msdn2.microsoft.com/en- us/library/ms998404.aspx Get the Facts on Windows and Linux: www.microsoft.com/windowsserver/compare www.microsoft.com/windowsserver/compare Anti-Malware: Understanding malware http://download.microsoft.com/download/a/b/e/abefdf1c- 96bd-40d6-a138-e320b6b25bd3/understandingantimalwaretechnologies.pdf http://download.microsoft.com/download/a/b/e/abefdf1c- 96bd-40d6-a138-e320b6b25bd3/understandingantimalwaretechnologies.pdfhttp://download.microsoft.com/download/a/b/e/abefdf1c- 96bd-40d6-a138-e320b6b25bd3/understandingantimalwaretechnologies.pdf Microsoft Forefront: www.microsoft.com/forefront www.microsoft.com/forefront Microsoft OneCare: www.windowsonecare.com www.windowsonecare.com Microsoft Defender: www.microsoft.com/athome/security/spyware/software www.microsoft.com/athome/security/spyware/software Spyware Criteria: www.microsoft.com/athome/security/spyware/software/isv www.microsoft.com/athome/security/spyware/software/isv Guidance Centers: Security Guidance Centers: www.microsoft.com/security/guidance www.microsoft.com/security/guidance Security Guidance for IT Professionals: www.microsoft.com/technet/security www.microsoft.com/technet/security The Microsoft Security Developer Center: msdn.microsoft.com/security msdn.microsoft.com/security

26. © 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.