Upload
quek-lilian
View
587
Download
0
Tags:
Embed Size (px)
DESCRIPTION
Winodws 7 Security Story Core
Citation preview
Azra RizalSecurity Advisor | DP&E | Microsoft Corporation
Enhance Security and Control
Fundamentally Secure Platform
Protect Users &
Infrastructure
Windows Vista Foundation
Streamlined User Account Control
Enhanced Auditing
Securing Anywhere
Access
Windows 7 Enterprise SecurityBuilding upon the security foundations of Windows Vista, Windows 7 provides
IT Professionals security features that are simple to use, manageable, and valuable.
Protect Data from
Unauthorized Viewing
Network Security
Network Access Protection
DirectAccessTM
AppLockerTM
Internet Explorer 8
Data Recovery
RMS
EFS
BitLocker
Windows Vista Foundation
Enhanced Auditing
Make the system work well for standard users
Administrators use full privilege only for administrative tasks
File and registry virtualization helps applications that are not UAC compliant
Streamlined User Account
Control
XML based
Granular audit categories
Detailed collection of audit results
Simplified compliance management
Fundamentally Secure Platform
Security Development Lifecycle process
Kernel Patch Protection
Windows Service Hardening
DEP & ASLR
IE 8 inclusive
Mandatory Integrity Controls
User Account ControlWindows Vista Windows 7
Streamlined UAC
User provides explicit consent before using elevated privilege
Disabling UAC removes protections, not just consent prompt
Challenges
Users can do even more as a standard user
Administrators will see fewer UAC Elevation Prompts
Customer Value
Reduce the number of OS applications and tasks that require elevation
Refactor applications into elevated/non-elevated pieces
Flexible prompt behavior for administrators
System Works for Standard User
All users, including administrators, run as Standard User by default
Administrators use full privilege only for administrative tasks or applications
Desktop AuditingWindows Vista Windows 7
Simplified configuration results in lower TCO
Demonstrate why a person has access to specific information
Understand why a person has been denied access to specific information
Track all changes made by specific people or groups
Enhanced Auditing
Granular auditing complex to configure
Auditing access and privilege use for a group of users
Challenges
New XML based events
Fine grained support for audit of administrative privilege
Simplified filtering of “noise” to find the event you’re looking for
Tasks tied to events
Network Security DirectAccessTM
Ensure that only “healthy” machines can access corporate data
Enable “unhealthy” machines to get clean before they gain access
Network Access Protection
Security protected, seamless, always on connection to corporate network
Improved management of remote users
Consistent security for all access scenarios
Securing Anywhere Access
Windows Firewall can coexist with 3rd party products
Multi-Home Profiles
DNSSec
Network Access ProtectionWindows 7
Health policy validation and remediation
Helps keep mobile, desktop and server devices in compliance
Reduces risk from unauthorized systems on the network Remediatio
nServers
Example: PatchRestrictedNetwork
WindowsClient
Policy complia
ntNPS
DHCP, VPNSwitch/Router
Policy Serverssuch as: Patch, AV
Corporate Network
Not policy
compliant
Remote Access for Mobile Workers Access Information Anywhere
Situation Today Windows 7 Solution
Same experience accessing corporate resources inside and outside the office
Seamless connection increases productivity of mobile users
Easy to service mobile PCs and distribute updates and polices
DirectAccessTM
Difficult for users to access corporate resources from outside the office
Challenging for IT to manage, update, patch mobile PCs while disconnected from company network
AppLockerTM Data Recovery
Protect users against social engineering and privacy exploits
Protect users against browser based exploits
Protect users against web server exploits
Internet Explorer 8
File back up and restoreCompletePC™ image-based backup System RestoreVolume Shadow CopiesVolume Revert
Protect Users & Infrastructure
Enables application standardization within an organization without increasing TCO
Increase security to safeguard against data and privacy loss
Support compliance enforcement
Application ControlSituation Today Windows 7 Solution
Eliminate unwanted/unknown applications in your network
Enforce application standardization within your organization
Easily create and manage flexible rules using Group Policy
AppLockerTM
Users can install and run non-standard applications
Even standard users can install some types of software
Unauthorized applications may:Introduce malwareIncrease helpdesk callsReduce user productivityUndermine compliance efforts
AppLockerTM
Technical Details
Simple Rule Structure: Allow, Exception & DenyPublisher Rules
Product Publisher, Name, Filename & Version
Multiple PoliciesExecutables, installers & scripts
Rule creation tools & wizardAudit only mode
Social Engineering & ExploitsReduce unwanted communications
Freedom from intrusionInternational Domain NamesPop-up Blocker in IE7Increased usability
Choice and controlClear notice of information useProvide only what is needed
Control of information User-friendly, discoverable noticesP3P-enabled cookie controlsDelete Browsing HistoryInPrivate™ Browsing & Blocking
Browser & Web Server ExploitsProtection from deceptive websites, malicious code, online fraud, identity theft
Protection from harm Secure Development LifecycleExtended Validation (EV) SSL certsSmartScreen® FilterDomain HighlightingXSS Filter/ DEP/NXActiveX Controls
Internet Explorer 8 SecurityBuilding on IE7 and addressing the evolving threat landscape
RMS BitLocker
User-based file and folder encryption
Ability to store EFS keys on a smart card
EFS
Easier to configure and deployRoam protected data between work and homeShare protected data with co-workers, clients, partners, etc.Improve compliance and data security
Protect Data from Unauthorized Viewing
Policy definitionand enforcement
Protects information wherever it travels
Integrated RMS Client
Policy-based protection of document libraries in SharePoint
Data Protection Scenarios
Scenario RMS EFSBitLockerT
M
Remote document policy enforcement
Protect content in transit
Protect content during collaboration
Local multi-user file & folder protection on a shared machine
Remote file & folder protection
Untrusted network administrator
Laptop protection
Branch office server
Local single-user file & folder protection
BitLockerSituation Today Windows 7 Solution
Extend BitLocker™ drive encryption to removable devices
Create group policies to mandate the use of encryption and block unencrypted drives
Simplify BitLocker setup and configuration of primary hard drive
BitLocker To GoTM
+
• Gartner “Forecast: USB Flash Drives, Worldwide, 2001-2011” 24 September 2007, Joseph Unsworth
• Gartner “Dataquest Insight: PC Forecast Analysis, Worldwide, 1H08” 18 April 2008, Mikako Kitagawa, George Shiffler III
2007 2008 2009 2010 20110
200400600800
10001200 Removable
Solid-State Storage Shipments
PCShip-ments
Worldwide Shipments (000s)
BitLockerTechnical Details
BitLocker EnhancementsAutomatic 200 Mb hidden boot partitionNew Key Protectors
Domain Recovery Agent (DRA)Smart card – data volumes only
BitLocker To GoTM
Support for FAT*Protectors: DRA, passphrase, smart card and/or auto-unlockManagement: protector configuration, encryption enforcement
Microsoft Confidential – NDA Only – Microsoft Preliminary Information
Fundamentally Secure Platform
Protect Users &
Infrastructure
Windows Vista Foundation
Streamlined User Account Control
Enhanced Auditing
Securing Anywhere
Access
Windows 7 Enterprise SecurityBuilding upon the security foundations of Windows Vista, Windows 7 provides
IT Professionals security features that are simple to use, manageable, and valuable.
Protect Data from
Unauthorized Viewing
Network Security
Network Access Protection
DirectAccessTM
AppLockerTM
Internet Explorer 8
Data Recovery
RMS
EFS
BitLocker
Microsoft Confidential – NDA Only – Microsoft Preliminary Information
AD RMS & DLP
Microsoft Confidential – NDA Only – Microsoft Preliminary Information
Convergence of DLP and RMSCentralized Policy
Policies Pushed into
Infrastructure
Identify and Classify Data
Leverage Controls to Protect Data
Block Warn RMS Monitor Enable
advance
d
work
flow
Microsoft Confidential – NDA Only – Microsoft Preliminary Information
First Step - RSA DLP Suite integrating with Microsoft AD RMS in DLP 6.5 Release (Dec 2008)
1. RMS admin creates RMS templates for data protection
2. RSA DLP admin designs policies to find sensitive data and protect it using RMS
3. RSA DLP discovers and classifies sensitive files4. RSA DLP applies RMS controls based on policy
• Automate the application of AD RMS protection based on sensitive information identified by RSA DLP• Leverage AD Groups for identity or group aware data loss prevention
Microsoft AD RMS
Legal Department
Outside law firm
Others
View, Edit, Print
View No Access
LegalContractsRMS
RSA DLP
Find Legal Contracts
Apply Legal Contracts RMS
ContractsDLP Policy
5. Users request files - RMS provides policy based access
Legal department
Outside law firm
Others
Laptops/desktops
File shares SharePoint
Microsoft Confidential – NDA Only – Microsoft Preliminary Information
Long term – Microsoft and RSA Building Information Protection into Infrastructure
Add-onPolicies
RSA DLPEndpoint
RSA DLP Enterprise Manager
Microsoft Information Protection Management
RSAMicrosoft
E-mail/UC
Endpoint Network Apps FS/CMS Storage
Built-in DLPClassificationand RMS Controls
Microsoft Environment and Applications
ComplementaryPlatforms andfunctionality
RSA DLPNetwork
RSA DLPDatacenter
• Common policies throughout infrastructure• Built-in approach to protect data based on content, context, identity• Future ready: Seamless upgrade path for current customers
Policies
© 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the
date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.