Defense-in-Depth Against Malicious Software Jeff Alexander IT Pro Evangelist Microsoft Australia

Agenda Characteristics of Malicious Software Malware Defence-in-Depth Malware Defence for Client Computers Malware Defence for Servers Network-Based Malware Defence What about Spyware? Guidance Tools and Response

Malicious Software: Identifying Challenges to an Organisation Malware: A Collection of software developed to intentionally perform malicious tasks on a computer system Feedback from IT and Security professionals include: –“ Users executed the attachment even though we’ve told them again and again not to” –“The antivirus software should have caught this, but the signature for this virus is not installed yet” –“We didn’t know our servers needed to be updated” –“This never should have made it through our firewall; we didn’t realize those ports could be attacked”

Understanding Malware Attack Techniques Common malware attack techniques include: –Social engineering –Backdoor creation – Address theft –Embedded engines –Exploiting product vulnerabilities –Exploiting new Internet technologies

Understanding the Vulnerability Timeline Product shipped Vulnerabilitydiscovered Update made available Update deployed by customer Vulnerabilitydisclosed Most attacks occur here

Understanding the Exploit Timeline

Common Malware Defence Methods Malware AttackDefence Method Mydoom Block port 1034 Update antivirus signatures Implement application security Sasser Block ports 445, 5554, and 9996 Install the latest security update Blaster Install the latest security update Block TCP ports 135, 139, 445, and 593 and UDP ports 135, 137, and 138, and also block UDP ports 69 (TFTP) and TCP 4444 for remote command shell. Update antivirus signatures SQL Slammer Install the latest security update Block UDP port 1434 Download.Ject Install the latest security update Increase security on the Local Machine zone in Internet Explorer Clean any infections related to IIS

What Is Defence-in-Depth? Using a layered approach: Increases an attacker’s risk of detection Reduces an attacker’s chance of success Security policies, procedures, and education Policies, procedures, and awareness Guards, locks, tracking devices Physical security Application hardening Application OS hardening, authentication, update management, antivirus updates, auditing Host Network segments, IPSec, NIDS Internal network Firewalls, boarder routers, VPNs with quarantine procedures Perimeter Strong passwords, ACLs, encryption, EFS, backup and restore strategy Data

Implementing Host Protection Policies, Procedures, and Awareness Recommended policies and procedures include: –Host protection defence policies: Scanning policy Signature update policy Allowed application policy –Security update policy Assess environment to be updated Identify new updates Evaluate and plan update deployment Deploy the updates –Network defence policies Change control Network monitoring Attack detection Home Computer access Visitor access Wireless network policy

Protecting Client Computers: What Are the Challenges? Challenges related to protecting client computers include: –Host challenges: Maintaining security updates Maintaining antivirus software Implementing a personal firewall –Application challenges Controlling application usage Secure application configuration settings Maintaining application security updates –Data challenges Implementing data storage policies Implementing data security Regulatory compliance

Configuring client applications to defend against malware

Today Future Windows, SQL, Exchange, Office… Windows, SQL, Exchange, Office… Office Update Download Center SUS SMS “Microsoft Update” (Windows Update) VS Update Windows Update Windows only Update Management for Malware Defence Windows, SQL, Exchange, Office… AutoUpdate WindowsUpdateServices Due Q4FY05

Configuring SUS to deploy security updates

Blocking Unauthorized Applications with Software Restriction Policies Software restriction policies –Can be used to: Fight viruses Control ActiveX downloads Run only signed scripts Ensure approved software is installed Lock down a computer –Can be applied to the following rules: Hash Certificate Path Zone –Can be set to: Unrestricted Disallowed