Microsoft Strategic Technology Protection Programm

Transcription

1 Microsoft Strategic Technology Protection Programm Roland Zeitler Technical Specialist Microsoft Inflation of attacks CERT Coordination Center ( incidence / per year

2 Microsoft has an obligation to the industry John McCormick, TechRepublic, Inc., September 24, 2001, based on data provided by Security Focus Bugtraq Microsoft has an obligation to the industry Reported Vulnerabilities by OS in 2001 Number of incidents Security is an industry-wide issue Redhat Linux 7.0 Sun Solaris 8.0 Windows 2000 Platform SCO Open Server MandrakeS off Linux 7.2 Security In A Complex World Security requires a framework composed of: Process (procedures, guidelines) Technology (hardware, software, networks) People (culture, knowledge) Security will fail if only focusing on part of the problem Technology is neither the whole problem nor the whole solution

3 Process Technology People Planning for security Prevention Detection Reaction Baseline technology Standards, Encryption, Protection Product security features Security tools and products Dedicated staff Training Security - a mindset and a priority External people Microsoft s Commitment To do everything possible to make certain that every customer can work, communicate, and transact securely over the Internet. Brian Valentine, Senior VP, Microsoft

4 Timeline Formation of Microsoft Security Taskforce Cross company team to gather and assess best practices, and make recommendations Issuance of first company-wide guidelines on building secure software, including beginning of threat modeling Creation of Secure Windows Initiative (SWI) Team Carrying forward the charter of building more secure products Windows NT development began with security as a fundamental goal Microsoft Security Response Team started Build standard framework for responding to security problems in any Microsoft product Trustworthy Computing Initiative, Bill Gates Secure Windows Initiative Goals Make Windows more secure Make Microsoft products more secure Methods Education Tools Process Testing Non-Goal More security features

5 Microsoft Security Response Team Microsoft Frameworks Microsoft Enterprise Services Framework Microsoft Solutions Framework Microsoft Operations Framework

6 Enterprise Source Licensing Program Source Code access for Microsoft customers Free of charge Shared Source License Agreement for debugging, development, troubleshooting, evaluation redistribution of changed Codes is prohibit Strategic Technology Protection Program Vision Get Secure Stay Secure

7 Why Is It Hard to Get Secure? I didn t know which patches I needed I didn t know where to find the updates I didn t know which machines needed the update We updated our production servers, but the 4,000 rogue servers got infected Get Secure, Stay Secure Get Secure : Near term program aimed at recovery and baseline security Free Virus Support Hotline Security Assessment Program, Security Tool Kit available Stay Secure : Mid term program to improve manageability, flexibility, responsiveness of secure systems Periodic roll up of security fixes Product security features, including default lockdown states

8 STPP: Get Secure Free Virus support hotline Security Assessment Offerings (MS Services) Microsoft Security Toolkit Enterprise Security Tools - SMS security patch rollout tool - Windows Update Auto-update client Microsoft Security Toolkit Gets Windows NT and 2000 systems to a secure baseline, even in disconnected nets Automates server updates One-button wiard and SMS Scripts Updates and Patches Tools Includes all Service Packs and critical OS and IIS patches through 10/15 HFNetChk SMS Install Scripts IIS Lockdown Windows Update client for Windows 2000 URLScan

9 STPP: Stay Windows Secure 2000 Security Rollup Patches Windows 2000 Service Packs (SP3) - install Service Packs and Security fixes upcoming: Federated Windows Update Service - Allows enterprise to host and select Windows Update Content ongoing: Enhance Product Security - Provide greater security enhancements in the releases of all new products, including the Windows.NET Server family Additional Resources Primary resource: Microsoft Internet Data Center Guide: (TBD) Best Practices for Enterprise Security whitepaper series: Microsoft Security Response Center Security Bulletin Severity Rating System white paper: It s Time to End Information Anarchy white paper: Secrets & Lies Digital Security in a Networked World by Bruce Schneier Hacking Exposed Network Security Secrets & Solutions, Third Edition by Joel Scambray, Stuart McClure, George Kurt CSI/FBI Computer Crimes and Security Survey 2001, available from The Computer Security Institute: The SANS Institute (System Administration, Networking, and Security) Institute: The 10 Immutable Laws of Security Administration: The 10 Immutable Laws of Security: ISA Server information:

10 Thank you for your interest any Question s? Copyright 2001 SAP AG. All rights reserved Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, WINDOWS, NT, EXCEL, Word, PowerPoint and SQL Server are registered trademarks of Microsoft Corporation. IBM, DB2, OS/2, DB2/6000, Parallel Sysplex, MVS/ESA, RS/6000, AIX, S/390, AS/400, OS/390, and OS/400 are registered trademarks of IBM Corporation. ORACLE is a registered trademark of ORACLE Corporation. INFORMIX -OnLine for SAP and Informix Dynamic ServerTM are registered trademarks of Informix Software Incorporated. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, the Citrix logo, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, MultiWin and other Citrix product names referenced herein are trademarks of Citrix Systems, Inc. HTML, DHTML, XML, XHTML are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. JAVA is a registered trademark of Sun Microsystems, Inc. JAVASCRIPT is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. SAP, SAP Logo, R/2, RIVA, R/3, SAP ArchiveLink, SAP Business Workflow, WebFlow, SAP EarlyWatch, BAPI, SAPPHIRE, Management Cockpit, mysap.com Logo and mysap.com are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other products mentioned are trademarks or registered trademarks of their respective companies.