1. Using Software Restriction Policies

2. Isolation and Resiliency Reducing the Modes of Attack – XP SP2

3. How SP2 Would Have Helped
MSBlaster worm
Firewall, by default, blocks the ports
DCOM denies unauthenticated requests
/GS and/or NX would have prevented exploit of unchecked buffer
W32.Sasser.worm
Windows Firewall, by default, blocks the ports
Mydoom and
Attachment Manager would have blocked Mydoom
Various spoofing and phishing attacks on the Internet
New security features in IE have eliminated many of these attacks

4. Protecting Servers: What Are the Challenges?
Challenges to protecting servers include:
Maintaining reliability and performance
Maintaining security updates
Maintaining antivirus updates
Applying specialized defence solutions based upon server role

5. What Is Server-Based Malware Defence?
Basic steps to defend servers against malware include:
Reduce the attack surface
Apply security updates
Enable a host-based firewall
Analyze using configuration scanners
Analyze port information

6. Using ISA Server 2004 SMTP Message Screener

7. Protecting the Network: What Are the Challenges?
Challenges related to protecting the network layer include:
Balance between security and usability
Lack of network-based detection or monitoring for attack

8. Implementing Application Layer Filtering
Application layer filtering includes the following:
Web browsing and can be scanned to ensure that content specific to each does not contain illegitimate data
Deep content analyses, including the ability to detect, inspect and validate traffic using any port and protocol

9. Implementing Filtering with ISA Server 2004

10. Isolation and Resiliency Network Access Protection
Advanced Isolation
Clients who do not pass can be blocked and isolated
Isolated clients can be given access to updates to get healthy
Health Checkup
Check update level, antivirus, and other plug in and scriptable criteria

11. Microsoft Windows AntiSpyware
Continuous protection guards 50+ ways spyware gets on a PC
Intelligent alerts handle spyware based on your preferences
Global SpyNet™ community helps identify new spyware
Automatic signature downloads keep you up-to-date
Spyware removal reduces PC slow down, pop-up ads, and more
Scheduled scans help maintain PC security and privacy

12. Guidance, Tools & Response Delivering Support and Creating Community
Security tools
Microsoft Baseline Security Analyzer
Security Bulletin Search Tool
IIS Lockdown Tool
Urlscan tool
Port Reporter Tool
Malicious Software Removal Tool
Guidance and training
Security Guidance Center
E-Learning Clinics
Community engagement
Newsletters
Webcasts and chats

13. Session Summary
Understanding malware will help you implement an effective defence against malware attacks
Use a defence-in-depth approach to defend against malware
Harden client computers by applying security updates, installing and maintaining an antivirus strategy and restricting computers using group policy
Stage all updates through a test server before implementing into production
ISA Server 2004 can be used to implement network defences

14. Next Steps Find additional security training events:
Sign up for security communications:
Order the Security Guidance Kit:
default.mspx
Get additional security tools and content:
Tools
TechNet Lounge / TechNet Subscriptions

15. © 2005 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.