June 2007 - Technical Rollup Mail - Security
News
Enabling a Strategic IT Infrastructure with Microsoft Forefront and Microsoft System Center https://go.microsoft.com/?linkid=6755493
By Rex Backman, Senior Product Manager, Microsoft Corporation The complexity of the IT environment in many organizations is at an all-time high. To help the business meet its objectives, IT managers need tools and technologies that help secure and manage the IT environment cost-effectively and efficiently. This article explores how businesses can address these challenges and turn a possible IT liability into an asset.
Microsoft Security Intelligence Report https://go.microsoft.com/?linkid=6755495
The Microsoft Security Intelligence Report provides a comprehensive understanding of the types of threats Windows customers face today so they can take appropriate action to help ensure they are better protected. The report highlights trends observed over the past several years, leveraging data collected by Microsoft between July 1 and December 31, 2006, from numerous sources including the Microsoft Malicious Software Removal Tool (MSRT) and Windows Defender.
Microsoft Extends Security and Management Product Lines with Launch of Forefront Client Security and System Center Essentials 2007 https://go.microsoft.com/?linkid=6755496
On May 2, Microsoft outlined its vision for integrated security and management solutions and announced delivery of key products under the Forefront and System Center brands. Watch Microsoft Senior Vice President Bob Muglia's keynote address https://go.microsoft.com/?linkid=6755578 from the Los Angeles launch event on-demand to learn more about how Microsoft is delivering deeper integration with its Forefront and System Center solutions to help customers simplify security management, improve the productivity of IT professionals, and more closely align IT to the needs of their business.
Forefront Client Security 120-Day Trial Download https://go.microsoft.com/?linkid=6755497
Microsoft recently announced the release to manufacture of Microsoft Forefront Client Security, a security solution designed to help protect business desktops, laptops, and server operating systems from viruses, spyware, and other current and emerging threats. Forefront Client Security simplifies administration through central management and provides critical visibility into threats and vulnerabilities to help IT administrators protect their businesses with confidence and efficiency. Register to download the free 120-day trial software. You will receive resources that are targeted to address the challenges specific to each stage of evaluation as you discover, assess, and deploy the software.
Forefront Server Security Case Studies
SAS Extends SharePoint Collaboration Environment to Include an Extranet https://go.microsoft.com/?linkid=6728365
With the help of Microsoft Forefront Security for SharePoint, SAS protects its extranet with up to five simultaneous engines and maintains that protection without needing additional staff.
Vienna International Airport Keeps Its E-mail Flying Smoothly https://go.microsoft.com/?linkid=6728366
With Microsoft Forefront Security for Exchange Server throughout the enterprise, the airport expects the same high level of protection and simplified management that it had with the Forefront Security predecessor Microsoft Antigen.
Cable&Wireless Helps Its Customers Secure Their IT Environments https://go.microsoft.com/?linkid=6728367
After upgrading its managed services infrastructure to the new Microsoft Forefront Security for Exchange Server, Cable&Wireless has a security product that integrates well with its existing IT infrastructure as the company migrates its managed services from Exchange Server 2003 to Exchange Server 2007.
Perot Systems Safeguards Messaging Systems https://go.microsoft.com/?linkid=6728368
Microsoft Antigen for Exchange and Microsoft Antigen Spam Manager -- the predecessors to Forefront Security for Exchange Server -- make it easier for Perot Systems and its customers to block the approximately 8.5 million spam and virus-infected e-mails they receive each month.
Microsoft Forefront Client Security Is Released https://go.microsoft.com/?linkid=6838508
Microsoft announced the release to manufacture of Microsoft Forefront Client Security, a security solution that helps protect business desktops, laptops, and server operating systems from viruses, spyware, and other current and emerging threats.
Read how other IT professionals use Forefront Client Security https://go.microsoft.com/?linkid=6838581
Take the virtual labs https://go.microsoft.com/?linkid=6838582
Download the trial software https://go.microsoft.com/?linkid=6838583
Microsoft Forefront and System Center Demonstration Tool Kit https://go.microsoft.com/?linkid=6878256
See for yourself how Forefront and System Center products integrate with each other and with your infrastructure to put you in control of your environment. Register and try the unified, virtual machine-based demo environment containing Forefront and System Center products.
Microsoft Forefront Demos
Forefront Client Security demo https://go.microsoft.com/?linkid=6878337
Microsoft Security Bulletin Summary for May, 2007
https://www.microsoft.com/technet/security/bulletin/ms07-may.mspx
Search for previous security bulletins https://go.microsoft.com/?linkid=3992478
Security Bulletin Feed https://go.microsoft.com/?linkid=3992479 RSS https://go.microsoft.com/?linkid=3992480
Developer
JSON Hijacking and How ASP.NET AJAX 1.0 Avoids These Attacks https://go.microsoft.com/?linkid=6733509
Scott Guthrie discusses how ASP.NET AJAX 1.0 addresses the threat of JSON hijacking, including disabling web method invocation via GET requests by default.
The Security Development Lifecycle - Welcome to the SDL Blog https://go.microsoft.com/?linkid=6808087
We on the Security Engineering team at Microsoft have been getting a lot of friendly pokes from customers, partners, colleagues and competitors, asking us to say more about the Microsoft Security Development Lifecycle (SDL) in an open forum, so here it is.
Documents
Security Tip of the Month: Improving Management of Client Antimalware Solutions https://go.microsoft.com/?linkid=6755498
By Ryan McGee, Senior Product Manager, Microsoft Forefront Product Team This tip explores the technological adjustments IT teams can make to eliminate some of the challenges of managing client antimalware solutions and gain better control of their environments.
Security Management Tips for Aspiring IT Managers https://go.microsoft.com/?linkid=6755499
In today's fast-changing and often risky business environment, it is critical for IT to effectively secure systems -- a process that's both costly and time-consuming. At the same time, IT managers are expected to enhance worker productivity and implement new technologies that drive competitive advantage for the business. This article describes how, by adopting an organized approach to security, you will spend less time cleaning up messes and more time helping your organization meet its goals.
Five Ways to Improve Data Security: Guidance for Business Managers https://go.microsoft.com/?linkid=6755500
Many business managers think of security as an issue for the IT department, forgetting that the "I" in IT stands for "information." From balance sheets to sales figures to product designs, information is the lifeblood of a business. If unauthorized persons gain access to it, it is not the IT department alone that suffers the consequences. Below are five steps that executives in finance, sales, marketing, and operations roles can take to reduce their vulnerability to serious risks.
Optimize and Secure Your Core Infrastructure https://go.microsoft.com/?linkid=6755501
To help companies transform costly, inefficient IT environments, Microsoft offers guidance in the form of the Infrastructure Optimization model. This model outlines steps that companies can take to analyze where they are today and to create an IT environment that is well-managed, secure, and efficient. Learn how such an IT infrastructure can be a catalyst for company growth.
Core Infrastructure Optimization Implementer Resource Guide: Standardized to Rationalized https://go.microsoft.com/?linkid=6755502
The second in a series, this guide provides the resources needed to make secure your IT infrastructure by implementing strict policies and control, from desktop to server to firewall to extranet.
Service Management Functions: Security Management https://go.microsoft.com/?linkid=6755503
This article focuses on issues that organization leaders and senior managers should consider when developing an effective security policy and implementing it through a security program. It also discusses the individual and team security roles and their interrelationship with operational functions, and reviews tactics and best practices to increase staff awareness and encourage continuous improvement.
Service Management Functions: Security Administration https://go.microsoft.com/?linkid=6755504
This guide provides detailed information about security administration for organizations that have deployed, or are considering deploying, Microsoft technologies in a data center or other type of enterprise computing environment.
Security Monitoring and Attack Detection https://go.microsoft.com/?linkid=6755505
The primary goal of a security-monitoring and attack-detection system is to help identify suspicious events on a network that may indicate malicious activity or procedural errors. This guide describes how to develop a plan to help address the need for such a system on Windows-based networks. It also provides instructions about how to implement, manage, and validate such a system.
Microsoft Security Assessment Tool https://go.microsoft.com/?linkid=6755506
Designed to help organizations with fewer than 1,000 employees assess weaknesses in their current IT security environment, the Microsoft Security Assessment Tool (MSAT) identifies processes, resources, and technologies that are designed to promote good security planning and risk mitigation practices within your organization.
Microsoft Forefront Server Security Management Console Beta 1 https://go.microsoft.com/?linkid=6755507
This console allows administrators to easily manage Forefront Security for Exchange Server, Forefront Security for SharePoint, and Microsoft Antigen, and allows administrators to rapidly respond to outbreaks and update protection across enterprise deployments, improving organizational agility in responding to new threats.
Downloads
Privacy Guidelines for Developing Software Products and Services
This document is a set of privacy guidelines for developing software products and services that are based on our internal guidelines and our experience incorporating privacy into the development process.
Internet Protocol Security Enforcement in the Network Access Protection Platform
This white paper describes the Network Access Protection (NAP) platform, how IPsec protects traffic, and how IPsec Enforcement in NAP provides system health policy enforcement for IPsec-secured communication.
Introduction to Network Access Protection
Read this white paper for an overview of the NAP business scenarios, an outline of the components of NAP, and a description of how NAP works.
Step-by-Step Guide: Demonstrate VPN NAP Enforcement in a Test Lab
Test lab to demonstrate VPN NAP enforcement
Microsoft SCEP Implementation Whitepaper.
This whitepaper provides an overview of Microsoft implementation for SCEP in the Windows Server codename “Longhorn” release
Step-by-Step Guide: Demonstrate DHCP NAP Enforcement in a Test Lab
Test lab to demonstrate DHCP NAP enforcement
Step-by-Step Guide: Demonstrate IPsec NAP Enforcement in a Test Lab
Test lab to demonstrate IPsec NAP enforcement
Microsoft Security Intelligence Report (July – December 2006)
An in-depth perspective of software vulnerabilities, malicious code threats, and potentially unwanted software, focusing on the second half of 2006.
Step By Step Guide: Demonstrate 802.1X NAP Enforcement in a Test Lab
Test lab to demonstrate 802.1X NAP enforcement
Microsoft Forefront and System Center Demonstration Toolkit
Microsoft Forefront business security products help protect client machines, server applications, and the network edge. System Center is a family of IT management solutions that helps proactively plan, deploy, manage, and optimize your IT environment. See how Forefront and System Center products integrate with each other and with your infrastructure to put you in control of your environment.
Podcasts: How Microsoft IT Uses Identity Lifecycle Manager
Learn how Microsoft IT uses ILM and other tools to manage identity and directory services in a large and complex environment.
Podcasts: How Microsoft IT Implemented Information Protection with Windows Rights Management Services
Learn how Microsoft IT implemented Windows Rights Management Services (RMS) to control how sensitive business e-mail messages and business productivity documents could be shared and used, without risking losses in productivity.
Microsoft Forefront and System Center Demonstration Toolkit
Microsoft Forefront business security products help protect client machines, server applications, and the network edge. System Center is a family of IT management solutions that helps proactively plan, deploy, manage, and optimize your IT environment. See how Forefront and System Center products integrate with each other and with your infrastructure to put you in control of your environment.
How to Help Secure a Groove Manager Web Site
This document contains procedures you can use to help secure your Groove Manager Web site.
Microsoft® Internet Security and Acceleration (ISA) Server 2004 Standard Edition Service Pack 3
ISA Server 2004 Standard Edition Service Pack 3 (SP3) provides the latest updates for ISA Server 2004 Standard Edition.
Microsoft® Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition Service Pack 3
ISA Server 2004 Enterprise Edition Service Pack 3 (SP3) provides the latest updates for ISA Server 2004 Enterprise Edition.
Microsoft Forefront Client Security Evaluation Edition
Microsoft® Forefront™ Client Security provides unified malware protection for business desktops, laptops and server operating systems that is easy to manage and control. By delivering simplified administration through central management and providing critical visibility into threats and vulnerabilities, Microsoft Forefront Client Security helps protect your business with confidence and efficiency.
Microsoft Forefront Client Security Evaluation Software End User License Agreement
This document is the end-user license agreement for Microsoft Forefront Client Security.
Certificate Settings in Group Policy Step-by-Step Guide for Windows Server Code Name "Longhorn"
Certificate settings in Group Policy in the Windows Server® Code Name "Longhorn" Beta 3 operating system allow you to manage the settings for certificate path discovery and validation using Group Policy objects.
Microsoft ISA Server Diagnostic Logging Viewer
The ISA Server Diagnostic Logging Viewer is a command-line tool for easily viewing and querying log entries generated by the diagnostic logging feature introduced in Microsoft® Internet Security and Acceleration (ISA) 2004 Service Pack 3.
Microsoft Forefront Client Security Product Documentation
This download provides product documentation for Microsoft Forefront Client Security.
Microsoft Forefront Client Security Privacy Policy
This document describes the privacy policy for Microsoft Forefront Client Security.
Podcasts: Providing Security for Web Applications and Infrastructure: Best Practices for Managing Security Risks
The Windows Live Security team shares best practices, from platform and network security to incident management, for providing security for web applications and infrastructure.
Protecting Your Business from Online Threats
Prescriptive advice on how businesses can protect their domains, customers, and assets
Security Enhancements in Windows Vista™
This article includes information about security enhancements in Windows Vista and how Microsoft used the Security Development Lifecycle to increase the security of the Windows operating system.
User-Based, Self-Service Password Change Solution Guide for MIIS 2003
This Guide describes how to plan and implement a user-based, self-service password change solution using IIS, a Web-based password management application, and WMI. The Step-by-Step document shows how to install, configure, and use IIS, ASP.NET, and the Web-based application.
Active Directory Certificate Services Longhorn Beta3 Certificate Templates Whitepaper
Implementing and Administering Certificate Templates
This white paper details Certificate Templates in Windows Server “Longhorn” Beta3 and Windows Server 2003 Enterprise Certification Authorities.
Active Directory Certificate Services Longhorn Beta3 Key Archival and Recovery Whitepaper
Key Archival and Management
This white paper details the process of key archival and recovery in a Windows Server “Longhorn”– or Windows Server 2003–based certification authority (CA).
Microsoft® Windows® Malicious Software Removal Tool (KB890830)
This tool checks your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps to remove the infection if it is found. Microsoft will release an updated version of this tool on the second Tuesday of each month.
Podcasts:How Microsoft IT Manages Security Knowledge for Better Application Risk Management
The process of threat modeling is built on a simple principle: To build a feasibly secure system, one must understand all the threats in that system. The challenge, however, is in making threat modeling more accessible to non-specialists.
Microsoft IT Showcase: Information Security at Microsoft Overview
Discover the best practices and processes Microsoft IT uses to secure its network. Provides a brief overview of the many aspects of network security; including some of the technologies used to protect against viruses, unapproved access attempts and malicious attacks. Describes the threat analysis and business reasons why certain practices and procedures were put into action.
Events/WebCasts
Microsoft Security Webcast Series: Upcoming and On-Demand
Security Webcast Calendar https://go.microsoft.com/fwlink/?LinkId=37910
Find security webcasts listed in an easy-to-use calendar format.
Upcoming Security Webcasts
https://www.microsoft.com/events/security/upcoming.mspx
Register for the following Webcasts on the link above
TechNet Webcast: Maximizing the Multiple Scan Engine Advantage in Forefront Server Security Solutions (Level 300)
Friday, June 1, 2007 9:30 A.M.-11:30 A.M. Pacific Time
TechNet Webcast: Why I Can Hack Your Network in a Day! [A live demonstration of techniques and tools used by hackers to compromise your network](Level 300)
Wednesday, June 6, 2007 5:30 A.M.-6:45 A.M. Pacific Time
TechNet Webcast: User Account Control Internals and Impact on Malware (Level 400)
Friday, June 8, 2007 7:45 A.M.-9:00 A.M. Pacific Time
TechNet Webcast: Securing Windows Vista with Software and Device Restriction Policies (Level 200)
Friday, June 8, 2007 6:00 A.M.-7:15 A.M. Pacific Time
TechNet Webcast: It's 11:00 P.M., Do You Know Where Your Data Is? (Level 300)
Friday, June 8, 2007 10:00 A.M.-11:15 A.M. Pacific Time
TechNet Webcast: User Account Control in Windows Vista (Level 200)
Monday, June 11, 2007 1:00 P.M.-2:30 P.M. Pacific Time
TechNet Webcast: How Microsoft IT Uses Network Access Protection to Manage Network Health (Level 300)
Tuesday, June 12, 2007 9:30 A.M.-10:30 A.M. Pacific Time
TechNet Webcast: Information About Microsoft June Security Bulletins (Level 200)
Wednesday, June 13, 2007 11:00 A.M.-12:00 P.M. Pacific Time
TechNet Webcast: A Technical Overview of Forefront Client Security (Level 200)
Friday, June 15, 2007 1:00 P.M.-2:30 P.M. Pacific Time
TechNet Webcast: How Microsoft IT Uses SQL Server 2005 to Power a Global Forensic Data Security Tool (Level 300)
Tuesday, June 19, 2007 9:30 A.M.-2\10:30 A.M. Pacific Time
TechNet Webcast: Public Key Infrastructure Enhancements in Windows Vista and Windows Server 'Longhorn' (Level 200)
Wednesday, June 20, 2007 11:30 A.M.-1:00 P.M. Pacific Time
TechNet Webcast: Security Features in Windows Vista (Level 200)
Monday, June 25, 2007 11:30 A.M.-1:00 P.M. Pacific Time
On-Demand Security Webcasts
https://www.microsoft.com/events/security/ondemand.mspx
A.O.B
Microsoft Product Lifecycle Information
Find information about your particular products on the Microsoft Product Lifecycle https://support.microsoft.com/common/international.aspx?rdpath=gp;[ln];lifecycle Web site.
See a List of Supported Service Packs https://go.microsoft.com/?linkid=6233929 - Microsoft provides free software updates for security and nonsecurity issues for all supported service packs.