Microsoft NDA Material Adwait Joshi Sr. Technical Product Manager Microsoft Corporation

Microsoft NDA Material

BUSINESS Needs Agility and Flexibility BUSINESS Needs Agility and Flexibility IT Needs Control IT Needs Control

Microsoft NDA Material Slovenia Telecom “The integration of Forefront Endpoint Protection with System Center Configuration Manager lets us break down the silos within our organization and increase efficiency.”

Microsoft NDA Material Ease of Deployment Enhanced Protection and Productivity Simplified Desktop Management

Microsoft NDA Material

FEP CENTRAL SITE System Center Configuration Manager PRIMARY SITE

Microsoft NDA Material Secondary Site CENTRAL SITE Primary Site FEP Console Extensions FEP Server Extensions FEP Reports FEP Console Extensions FEP Server Extensions FEP Reports FEP Console Extensions FEP Server Extensions FEP Reports Hierarchical Deployment for Distributed Management FEP REPORTS

Microsoft NDA Material Policy configuration Third-party detection Silent removal of third-party products FEP client installation Signature update Client Distribution Flow

Microsoft NDA Material Event Log UPDATE SOURCES Corporate network (UNC share) Internet (MU/WU) Corporate network (WSUS) Antimalware Service (FEP Client) Network Service Network Service Local System

Microsoft NDA Material

AV Comparatives On Demand Test August 2010 AV Comparatives Proactive Test May 2010 VB100 August 2010 Ranks with market-leading engines Among the leading solutions for proactive detection of unknown threats Consistently delivers among the lowest occurrences of false positives Slovenia Telecom “Forefront Endpoint Protection offers us better virus protection than we had with our previous solution. We had an incident with the Conficker virus, and our old anti-virus product was only able to disable and partially remove the virus. FEP was able to fully remove the virus from our environment. It is definitely a better tool.”

Microsoft NDA Material Reactive Techniques (Against Known Threats) Proactive Techniques (Against Unknown Threats) Windows Firewall Centralized Management Network File System Application Microsoft AppLocker™ Windows 7 Windows Internet Explorer ® 8 SmartScreen Microsoft Malware Protection Center Dynamic Signature Service Vulnerability Shielding (Network Inspection System) Dynamic Cloud Updates Data Execution Prevention Behavior Monitoring Address Space Layout Randomization Windows Resource Protection Anti-malware Dynamic Translation and Emulation Forefront Endpoint Protection

Microsoft NDA Material Real Resources Virtualized Resources Potential Malware Potential Malware Safe Translation Dynamic Translation

Microsoft NDA Material Researchers Real-time Signature Delivery Behavior Classifiers Reputation Client SpyNet/MRS Properties/ Behavior Properties/ Behavior Real-time Signature Sample Request Sample Submit

Microsoft NDA Material A new NIS signature is released Exploits launched Attack is blocked Patch validated and deployed NIS event logged, telemetry sent Time to test the update patch Update patch available With Forefront Endpoint Protection A new vulnerability discovered

Microsoft NDA Material

Simplify Integrate Protect Forefront Endpoint Protection (FEP) 2010, the next version of Forefront Client Security, will enable businesses to simplify and improve endpoint protection while greatly reducing infrastructure costs. It builds on System Center Configuration Manager 2007 R2, allowing customers to use their existing client management infrastructure to deploy and maintain endpoint protection.

Microsoft NDA Material Optimized Desktop: ws/enterprise ws/enterprise TechCenter: m/forefront m/forefront Forefront Endpoint Protection 2010 Trial: ont

Microsoft NDA Material ©2010 Microsoft Corporation. All rights reserved. Microsoft, AppLocker, Forefront, Internet Explorer, SharePoint, SQL Server, Hotmail, Windows, Windows Live, Windows Server, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft NDA Material

PRIMARY SITE CENTRAL SITE FEP Console Extension FEP Server Extensions FEP Reports

Microsoft NDA Material PRIMARY SITE System Center Configuration Manager FEP Console Extension FEP Server Extensions FEP REPORTS FEP Console Extensions

Microsoft NDA Material Secondary Site CENTRAL SITE Primary Site FEP Console Extensions FEP Console Extension FEP Server Extensions FEP Reports

Microsoft NDA Material Secondary Site CENTRAL SITE Primary Site FEP Console Extensions FEP Server Extensions FEP Reports FEP Console Extensions FEP Server Extensions FEP Reports FEP Console Extensions FEP Server Extensions FEP Reports Separate security management and operations to child sites

Microsoft NDA Material FEP Reports Secondary Site CENTRAL SITE Primary Site FEP Console Extensions FEP Server Extensions FEP Reports FEP Console Extensions FEP Server Extensions FEP Reports FEP Console Extensions FEP Server Extensions FEP Reports

Microsoft NDA Material

GLOBAL RESEARCHBROAD INSIGHTINTEGRATED RESPONSE Committed to long-term investment and leadership

Microsoft NDA Material Riga Stradins University “The integration of management and security makes our IT organization more agile. We’re more efficient in the way that we use our personnel. We’ve increased the number of people available to respond to security incidents by 20% with no increase in headcount.” Management Security + + Security personnel have access to desktop configuration data Health status and protection status in a single interface, with consolidated reporting Incident response (identify / patch / remediate) is more targeted One server infrastructure to maintain A single mechanism to deploy software updates to clients Central policy implementation for security and management One set of training for administrators A single license to purchase (ECAL) IMPROVED PROTECTIONLOWER COSTS