Securing your data Security with Microsoft Infrastructure and Internet Explorer Matt Kestian Strategic Security Advisor | National Security Team | Microsoft Corporation | March 11,2005 Version 1.0 Agenda Some true stories….. Phishing/Malware Demonstration Strategy for securely browsing with internet explorer Defense in Depth Securing the perimeter Securing the network Securing the hosts Securing applications Securing the data Microsoft Confidential – NDA Material True stories from the field Phishing gone high tech Bank in Latin America E-mail between two companies (actually this one is personal) Microsoft Confidential – NDA Material IE Security Improvements in XP SP2 Post XP SP2 Observations Strengths Big security investments were worthwhile Balance of app compat and security seems good Opportunities to Improve Needed to consider cleanup, not just protection Info disclosure just as important as code execution Servicing IE with the OS is difficult for some customers Configuration management – are we doing all we can? Everyone wants new features – even security pros IE 7 will beta this summer with even more phishing and malware protection Microsoft Confidential – NDA Material Threat Modeling Spoofing An unauthorized user impersonating a valid user Tampering An attacker illegally modifying or destroying data Repudiation Ability of a user to deny performing an action Information Disclosure Releasing information to unauthorised users Denial of Service Causing the system to be unavailable to valid users Elevation of Privilege An attacker illegally gains a higher level of access Microsoft Confidential – NDA Material Attack Methodologies Take ownership – Elevate Privileges Perform Steal Exploit the the unauthorized Data vulnerabilities activities Search for known Reconnaissance -vulnerabilities Port Scanning Cover your tracks Download hacker tools, backdoors, rootkits, etc Determine other and attack them Clear Audit Trailstargets network mapping [VLAN] SMS/MOM X Directory [VLAN] 4 5 6 3 2 1 7 SQL cluster X X Web servers Web apps DNS X X [VLAN] Exchange front end IDS LOB apps Directory IDS Disk array DNS Exchange Desktops Microsoft Confidential – NDA Material Defense in Depth An organizing framework for Security Layered Portfolio of Countermeasures Reduce the chance of a single point of vulnerability Perimeter Network Host Application Data Physical Security Policies, Procedures, & Awareness Microsoft Confidential – NDA Material Perimeter Layer Business Partner Main Office LAN LAN Internet Services Internet Internet Network perimeters include connections to: The Internet Branch offices Business partners Remote users Wireless networks Internet applications Services Branch Office Remote User Wireless Network LAN Microsoft Confidential – NDA Material Perimeter Layer Compromise Business Partner Main Office LAN LAN Internet Services Internet Internet Network perimeter compromise may result in: Attack on corporate network Attack on remote users Attack from business partners Attack from a branch office Attack on Internet services Attack from the Internet Services Branch Office Remote User Wireless Network LAN Microsoft Confidential – NDA Material Perimeter Layer Protection Business Partner Main Office LAN LAN Internet Services Internet Services Internet Network perimeter protection includes: Firewalls Blocking communication Remote User ports Port and IP address translation Virtual Private Networks Tunneling protocols Filter traffic- SMTP, Spam blocking, proxy technologies Branch Office Wireless Network LAN Microsoft Confidential – NDA Material Lab Unmanaged guest ISA Server 2004 Application level FW VPN Quarantine Sybari Antigen – Anti-Virus, Anti-Spam Microsoft Confidential – NDA Material Network Layer Sales Marketing Wireless Network Finance Human Resources Microsoft Confidential – NDA Material Network Layer Compromise Unauthorized access to systems Unexpected communication ports Unauthorized access to wireless networks Sniff packets from the network Access all network traffic Microsoft Confidential – NDA Material Security Zones ` ` Public ` Tier Restrictions Intra-zone Tier Communication Restrictions Inter-zone Communication Restrictions Public DNS Perimeter DNS Perimeter Web Perimeter Web Perimeter DNS Perimeter Core Database Core AD Core Database Core DNS Core Infrastructure Core ` ` ` ` Client Internal Private Microsoft Confidential – NDA Material Network Layer Protection Implement mutual authentication Segment the network (Vlan, internal FW) Encrypt network communications Block communication ports Control access to network devices Sign network packets Multi home some servers Microsoft Confidential – NDA Material Implementing IPSec Policy Host Layer Specific network role Operating system configuration The term “host” is used to refer to both workstations and servers Microsoft Confidential – NDA Material Host Layer Compromise Unsecured Operating System Configuration Distribute Viruses Unmonitore d Access Exploit Operating System Weakness Microsoft Confidential – NDA Material Attack Vectors Malicious e-mail attachments Malicious Web content Days to exploit and complexities around patching makes patching a less effective defense strategy Port-based attacks Buffer overrun attacks Microsoft Confidential – NDA Material Windows XP Service Pack 2 Windows Server 2003 Service Pack 1 Microsoft Windows AntiSpyware Software Restriction Policies Future: Network Access Protection Microsoft Confidential – NDA Material Host Layer Protection Use Group Policy – implement templates XP and Server Use Windows Firewall Manage configuration changes Run AV and keep up to date Harden operating system Implement IPSec for mutual authentication Install security updates Restrict anonymous access where able Implement auditing Rename the admin account disable guest Disable or remove unnecessary services Install and maintain antivirus software Microsoft Confidential – NDA Material Application Layer Security issues specific to applications Functionality must be maintained Server Applications (for example, Exchange Server or SQL Server) Applications That Create and Access Data Microsoft Confidential – NDA Material Application Layer Compromise Loss of application Execution of malicious code Extreme use of application Unwanted use of applications Microsoft Confidential – NDA Material Application Layer Protection Enable only required services and functionality Configure application security settings Install security updates for applications Install and update antivirus software Run applications with least privilege Microsoft Confidential – NDA Material Data Layer Documents Directory Applications Microsoft Confidential – NDA Material Data Layer Compromise Interrogate Directory Files View, Change, or Modify Information Documents Directory Applications Replace or Modify Application Files Microsoft Confidential – NDA Material Technology Investments Persistent information protection New “lockbox” business scenarios Deployment, usability enhancements Offline support FIPS compliance Smartcard integration Microsoft Confidential – NDA Material Data Layer Protection Utilize NTFS Access control lists Encrypt files with EFS Secure SQL server according to SQL server security guidelines Move files from the default location Create data backup and recovery plans Protect documents and e-mail with Windows Rights Management Services Microsoft Confidential – NDA Material Prior H2 04 2005 Microsoft Baseline Security Analyzer (MBSA) v1.2 Virus Cleaner Tools Systems Management Server (SMS) 2003 Software Update Services (SUS) SP1 Internet Security and Acceleration (ISA) Server 2004 Standard Edition Windows XP Service Pack 2 Patching Technology Improvements (MSI 3.0) Systems Management Server 2003 SP1 Microsoft Operations Manager 2005 Windows malicious software removal tool Windows Server 2003 Service Pack 1 Windows Update Services ISA Server 2004 Enterprise Edition Windows Rights Management Services SP1 Windows AntiSpyware System Center 2005 Windows Server 2003 “R2” Visual Studio 2005 Future Vulnerability Assessment and Remediation Active Protection Technologies Antivirus Microsoft Confidential – NDA Material © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.