MSAM Launch Vista Final Updated

Category: Education

Presentation Description

No description available.


Presentation Transcript



Jason Johnson Account Technology Specialist [email protected] Microsoft Corporation Joseph Lumia Account Technology Specialist [email protected] Microsoft Corporation


Windows Vista Overview Windows Vista Security Fundamentals Threat and Vulnerability Mitigation Identify and Access Control Information Protection Desktop Optimization Pack for Software Assurance


Improve security and compliance Find and use information Optimize desktop infrastructure Enable mobile workforce IT Pros End Users


End Users Find and use information Enable mobile workforce Search – start menu, control panel, document folder Metadata tags - easy to Search and Organize Your Data Tabbed browsing – IE7 and web printing ReadyBoost – USB extends memory Windows Aero – tabbed browsing High Performing, Reliable PC NAP – ensures secure state before connecting to the network (more secure) Easier to Connect, Collaborate, and Share Mobility center – puts most commonly used controls in one location Sync Center – data and devices switch between online and offline states


Improve security and compliance Optimize desktop infrastructure IE7 Protected Mode – prevents silent install of malicious code Services hardening – prevents windows services from being used for abnormal activity UAC – admin vs. standard Anti-phishing Group policy – easier desktop management Fundamentally Secure Platform Cost Effective Networking – automatically optimizes file transfers by detecting how much network bandwidth is available Support Costs = network diagnostics/built-in diagnostics for self healing Reducing Deployment Costs andamp; Complexity IT Pros




TIME ACTIVITY e Gov Services and Access Security / IT governance improvements Financial and political risk


Keep systems secure from malware/spyware Rootkits, keystroke loggers, bots Worms, viruses Phishing attacks Keep inside information inside Lost/stolen laptops and desktops Hacking Accidental/intentional information leaks Decommissioned/donated PCs Simplify identity and access management functions



Design Define security architecture and design guidelines Document elements of software attack surface Threat Modeling Standards, best practices, and tools Apply coding and testing standards Apply security tools (fuzzing tools, static-analysis tools, etc) Security Push Security code reviews Focused security testing Review against new threats Meet signoff criteria Final Security Review Independent review conducted by the security team Penetration testing Archiving of compliance info RTM and Deployment Signoff Security Response Plan and process in place Feedback loop back into the development process Postmortems Product Inception Assign security advisor Identify security milestones Plan security integration into product


Service Hardening Services run with reduced privilege compared to Windows XP Windows services profiled for allowed actions to the network, file system, and registry Designed to block attempts by malicious software to make a Windows service write to an area of the network, file system, or registry that isn’t part of that service’s profile Active protection File system Registry Network



Social Engineering Protections Phishing Filter and Colored Address Bar Dangerous Settings Notification Secure defaults for IDN Protection from Exploits Unified URL Parsing Code quality improvements (SDLC) ActiveX Opt-in Protected Mode to prevent malicious software


Improved Detection and Removal Redesigned and Simplified User Interface Protection for all users


Remove most prevalent viruses Remove all known viruses Real-time antivirus Remove all known spyware Real-time antispyware Central reporting and alerting Customization Microsoft Forefront FOR INDIVIDUAL USERS FOR BUSINESSES MSRT Windows Defender Windows Live Safety Center Windows OneCare Live Cost No charge No charge No charge $50/3 PCs TBD




Combined firewall and IPsec management New management tools – Windows Firewall with Advanced Security MMC snap-in Reduces conflicts and coordination overhead between technologies Firewall rules become more intelligent Specify security requirements such as authentication and encryption Specify Active Directory computer or user groups Outbound filtering Enterprise management feature – not for consumers Simplified protection policy reduces management overhead




Challenges Windows Vista Solution Easier to Run as Standard User Users can do more on their own Change time zone, power settings, VPN, and more Install approved devices Admin commands clearly marked Higher application compatibility File and registry virtualization Greater Protection for Admins Software runs with lower privileges by default Administrator provides consent before elevation Most users run with full administrator privileges all the time At risk from malware Can’t manage desktops or enforce policy Expensive to support Difficult to run a standard user User can’t perform many tasks Many applications don’t run


View system clock and calendar Change time zone Configure secure wireless (WEP/WPA) connection Change power management settings Create and configure a Virtual Private Network connection Add printers and other devices that have the required drivers installed or allowed by IT policy Disk defragmentation is a scheduled background process Shield icon consistently marks what actions a standard user cannot perform




More Granularity New subcategories for Logon, logoff, file system access, registry access, use of administrative privilege New Logging Infrastructure Easier to filter out 'noise' in logs and find the event you’re looking for Tasks tied to events: When an event occurs, such as administrative privilege use, tasks such as sending an Email to an auditor can run automatically



Internal threats are just as prevalent as external threats Intentional Accidental Targeted Careless forwarding of documents and Emails Machine disposal or repurposing without data wipe Data lost in transit Confidential data copied via USB and other mobile devices Untrusted network administrator accesses unauthorized data Offline attack on lost/stolen laptop Forwarding of internal-only Email and documents to external parties Branch office server containing directory or database CxO or government official laptop or mobile device Thief plugs external storage device into machine to copy data


BitLocker Drive Encryption enhances the security value of all registry, configuration files, paging files, and hibernation files stored on the fully encrypted volume Encryption of the hibernation file Protects against hibernation of laptop with sensitive docs open Recovery available to any customer with access to a phone and their Administrator Destroying root key allows for the safe re-deployment of corporate hardware by making previous data inaccessible Not an end-user feature Strong interest in enterprise IT


28 BDE offers a spectrum of protection allowing customers to balance ease-of-use against the threats they are most concerned with.


Nothing Reformat drive Admin wipes drive Delete keys Normal 'Force Recovery' versus


Who are you protecting against? Other users or administrators on the machine? EFS Unauthorized users with physical access? BitLocker™ Some cases can result in overlap. (e.g. Multi-user roaming laptops with untrusted network admins)



Microsoft SoftGrid: Application Virtualization Microsoft Diagnostic and Recovery Toolset Microsoft Advanced Group Policy Management Microsoft Asset Inventory Services Accelerate deployment and increase manageability Dynamically deliver the virtual application solution Minimize application compatibility issues Transform applications into centrally managed services available when and where needed Translating Software Inventory into business intelligence Powerful tools to accelerate desktop repair Enhancing group policy with change management


Some organizations may benefit from just using Vista Business with minimal application compatibility testing Most Enterprise organizations require more formal procedures for application lifecycle, problem, change and asset management Many organizations require a more robust asset, application and end to end infrastructure administration definition Size Complexity +Application Compatibility Toolkit



SDL Service Hardening Code Scanning Default configuration Code Integrity IE –protected mode/anti-phishing Windows Defender Bi-directional Firewall IPSEC improvements Network Access Protection (NAP) Threat and Vulnerability Mitigation Fundamentals Identify and Access Control User Account Control Plug and Play Smartcards Simplified Logon architecture Bitlocker RMS Client


'The bottom line: we give Vista a thumbs up — at least pending the acid test of attempts by hackers and virus writers to locate and penetrate the operating system’s vulnerabilities. If your agency or department has a pressing need for greater security, you should move to Vista as soon as possible.' -Federal Computing Weekly (12/18/2006)