Using Software Restriction Policies

Isolation and Resiliency Reducing the Modes of Attack – XP SP2

How SP2 Would Have Helped MSBlaster worm Firewall, by default, blocks the ports DCOM denies unauthenticated requests /GS and/or NX would have prevented exploit of unchecked buffer W32.Sasser.worm Windows Firewall, by default, blocks the ports Mydoom and W32/Nimda.A@mm Attachment Manager would have blocked Mydoom Various spoofing and phishing attacks on the Internet New security features in IE have eliminated many of these attacks

Protecting Servers: What Are the Challenges? Challenges to protecting servers include: Maintaining reliability and performance Maintaining security updates Maintaining antivirus updates Applying specialized defence solutions based upon server role

What Is Server-Based Malware Defence? Basic steps to defend servers against malware include: Reduce the attack surface Apply security updates Enable a host-based firewall Analyze using configuration scanners Analyze port information

Using ISA Server 2004 SMTP Message Screener

Protecting the Network: What Are the Challenges? Challenges related to protecting the network layer include: Balance between security and usability Lack of network-based detection or monitoring for attack

Implementing Application Layer Filtering Application layer filtering includes the following: Web browsing and e-mail can be scanned to ensure that content specific to each does not contain illegitimate data Deep content analyses, including the ability to detect, inspect and validate traffic using any port and protocol

Implementing Filtering with ISA Server 2004

Isolation and Resiliency Network Access Protection Advanced Isolation Clients who do not pass can be blocked and isolated Isolated clients can be given access to updates to get healthy Health Checkup Check update level, antivirus, and other plug in and scriptable criteria

Microsoft Windows AntiSpyware Continuous protection guards 50+ ways spyware gets on a PC Intelligent alerts handle spyware based on your preferences Global SpyNet™ community helps identify new spyware Automatic signature downloads keep you up-to-date Spyware removal reduces PC slow down, pop-up ads, and more Scheduled scans help maintain PC security and privacy

Guidance, Tools & Response Delivering Support and Creating Community Security tools Microsoft Baseline Security Analyzer Security Bulletin Search Tool IIS Lockdown Tool Urlscan tool Port Reporter Tool Malicious Software Removal Tool Guidance and training Security Guidance Center E-Learning Clinics Community engagement Newsletters Webcasts and chats

Session Summary Understanding malware will help you implement an effective defence against malware attacks Use a defence-in-depth approach to defend against malware Harden client computers by applying security updates, installing and maintaining an antivirus strategy and restricting computers using group policy Stage all updates through a test server before implementing into production ISA Server 2004 can be used to implement network defences

Next Steps Find additional security training events: http://www.microsoft.com/seminar/events/security.mspx Sign up for security communications: http://www.microsoft.com/technet/security/signup/default.mspx Order the Security Guidance Kit: http://www.microsoft.com/security/guidance/order/ default.mspx Get additional security tools and content: http://www.microsoft.com/security/guidance Tools http://www.microsoft.com/technet/Security/tools TechNet Lounge / TechNet Subscriptions http://www.microsoft.com/australia/technet

© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.