MSAM Launch Vista Final Updated

Slide1 :


Slide2 : Jason Johnson Account Technology Specialist j.johnson@microsoft.com Microsoft Corporation Joseph Lumia Account Technology Specialist jolumia@microsoft.com Microsoft Corporation


Slide3 : Windows Vista Overview Windows Vista Security Fundamentals Threat and Vulnerability Mitigation Identify and Access Control Information Protection Desktop Optimization Pack for Software Assurance


Slide4 : Improve security and compliance Find and use information Optimize desktop infrastructure Enable mobile workforce IT Pros End Users


Slide5 : End Users Find and use information Enable mobile workforce Search – start menu, control panel, document folder Metadata tags - easy to Search and Organize Your Data Tabbed browsing – IE7 and web printing ReadyBoost – USB extends memory Windows Aero – tabbed browsing High Performing, Reliable PC NAP – ensures secure state before connecting to the network (more secure) Easier to Connect, Collaborate, and Share Mobility center – puts most commonly used controls in one location Sync Center – data and devices switch between online and offline states


Slide6 : Improve security and compliance Optimize desktop infrastructure IE7 Protected Mode – prevents silent install of malicious code Services hardening – prevents windows services from being used for abnormal activity UAC – admin vs. standard Anti-phishing Group policy – easier desktop management Fundamentally Secure Platform Cost Effective Networking – automatically optimizes file transfers by detecting how much network bandwidth is available Support Costs = network diagnostics/built-in diagnostics for self healing Reducing Deployment Costs andamp; Complexity IT Pros


Slide7 : demo


Slide8 : TIME ACTIVITY e Gov Services and Access Security / IT governance improvements Financial and political risk


Slide9 : Keep systems secure from malware/spyware Rootkits, keystroke loggers, bots Worms, viruses Phishing attacks Keep inside information inside Lost/stolen laptops and desktops Hacking Accidental/intentional information leaks Decommissioned/donated PCs Simplify identity and access management functions


Slide10 :


Slide11 : Design Define security architecture and design guidelines Document elements of software attack surface Threat Modeling Standards, best practices, and tools Apply coding and testing standards Apply security tools (fuzzing tools, static-analysis tools, etc) Security Push Security code reviews Focused security testing Review against new threats Meet signoff criteria Final Security Review Independent review conducted by the security team Penetration testing Archiving of compliance info RTM and Deployment Signoff Security Response Plan and process in place Feedback loop back into the development process Postmortems Product Inception Assign security advisor Identify security milestones Plan security integration into product


Slide12 : Service Hardening Services run with reduced privilege compared to Windows XP Windows services profiled for allowed actions to the network, file system, and registry Designed to block attempts by malicious software to make a Windows service write to an area of the network, file system, or registry that isn’t part of that service’s profile Active protection File system Registry Network


Slide13 :


Slide14 : Social Engineering Protections Phishing Filter and Colored Address Bar Dangerous Settings Notification Secure defaults for IDN Protection from Exploits Unified URL Parsing Code quality improvements (SDLC) ActiveX Opt-in Protected Mode to prevent malicious software


Slide15 : Improved Detection and Removal Redesigned and Simplified User Interface Protection for all users


Slide16 : Remove most prevalent viruses Remove all known viruses Real-time antivirus Remove all known spyware Real-time antispyware Central reporting and alerting Customization Microsoft Forefront FOR INDIVIDUAL USERS FOR BUSINESSES MSRT Windows Defender Windows Live Safety Center Windows OneCare Live Cost No charge No charge No charge $50/3 PCs TBD


Slide17 : demo


Slide18 : Combined firewall and IPsec management New management tools – Windows Firewall with Advanced Security MMC snap-in Reduces conflicts and coordination overhead between technologies Firewall rules become more intelligent Specify security requirements such as authentication and encryption Specify Active Directory computer or user groups Outbound filtering Enterprise management feature – not for consumers Simplified protection policy reduces management overhead


Slide19 :


Slide20 :


Slide21 : Challenges Windows Vista Solution Easier to Run as Standard User Users can do more on their own Change time zone, power settings, VPN, and more Install approved devices Admin commands clearly marked Higher application compatibility File and registry virtualization Greater Protection for Admins Software runs with lower privileges by default Administrator provides consent before elevation Most users run with full administrator privileges all the time At risk from malware Can’t manage desktops or enforce policy Expensive to support Difficult to run a standard user User can’t perform many tasks Many applications don’t run


Slide22 : View system clock and calendar Change time zone Configure secure wireless (WEP/WPA) connection Change power management settings Create and configure a Virtual Private Network connection Add printers and other devices that have the required drivers installed or allowed by IT policy Disk defragmentation is a scheduled background process Shield icon consistently marks what actions a standard user cannot perform


Slide23 : demo


Slide24 : More Granularity New subcategories for Logon, logoff, file system access, registry access, use of administrative privilege New Logging Infrastructure Easier to filter out 'noise' in logs and find the event you’re looking for Tasks tied to events: When an event occurs, such as administrative privilege use, tasks such as sending an Email to an auditor can run automatically


Slide25 :


Slide26 : Internal threats are just as prevalent as external threats Intentional Accidental Targeted Careless forwarding of documents and Emails Machine disposal or repurposing without data wipe Data lost in transit Confidential data copied via USB and other mobile devices Untrusted network administrator accesses unauthorized data Offline attack on lost/stolen laptop Forwarding of internal-only Email and documents to external parties Branch office server containing directory or database CxO or government official laptop or mobile device Thief plugs external storage device into machine to copy data


Slide27 : BitLocker Drive Encryption enhances the security value of all registry, configuration files, paging files, and hibernation files stored on the fully encrypted volume Encryption of the hibernation file Protects against hibernation of laptop with sensitive docs open Recovery available to any customer with access to a phone and their Administrator Destroying root key allows for the safe re-deployment of corporate hardware by making previous data inaccessible Not an end-user feature Strong interest in enterprise IT


Slide28 : 28 BDE offers a spectrum of protection allowing customers to balance ease-of-use against the threats they are most concerned with.


Slide29 : Nothing Reformat drive Admin wipes drive Delete keys Normal 'Force Recovery' versus


Slide30 : Who are you protecting against? Other users or administrators on the machine? EFS Unauthorized users with physical access? BitLocker™ Some cases can result in overlap. (e.g. Multi-user roaming laptops with untrusted network admins)


Slide31 :


Slide32 : Microsoft SoftGrid: Application Virtualization Microsoft Diagnostic and Recovery Toolset Microsoft Advanced Group Policy Management Microsoft Asset Inventory Services Accelerate deployment and increase manageability Dynamically deliver the virtual application solution Minimize application compatibility issues Transform applications into centrally managed services available when and where needed Translating Software Inventory into business intelligence Powerful tools to accelerate desktop repair Enhancing group policy with change management


Slide33 : Some organizations may benefit from just using Vista Business with minimal application compatibility testing Most Enterprise organizations require more formal procedures for application lifecycle, problem, change and asset management Many organizations require a more robust asset, application and end to end infrastructure administration definition Size Complexity +Application Compatibility Toolkit


Slide34 :


Slide35 : SDL Service Hardening Code Scanning Default configuration Code Integrity IE –protected mode/anti-phishing Windows Defender Bi-directional Firewall IPSEC improvements Network Access Protection (NAP) Threat and Vulnerability Mitigation Fundamentals Identify and Access Control User Account Control Plug and Play Smartcards Simplified Logon architecture Bitlocker RMS Client


Slide36 : 'The bottom line: we give Vista a thumbs up — at least pending the acid test of attempts by hackers and virus writers to locate and penetrate the operating system’s vulnerabilities. If your agency or department has a pressing need for greater security, you should move to Vista as soon as possible.' -Federal Computing Weekly (12/18/2006)


Slide37 : www.microsoft.com/business/uslaunchevent2007


Slide38 :