Windows 7 Security Overview

2. Windows 7 Security Overview Paul A. Cooke - CISSP Director Microsoft Corporation SIA327

3. Windows 7 Enterprise Security Building upon the security foundations of Windows Vista,Windows 7 provides IT Professionals security features that are simple to use, manageable, and valuable. Fundamentally SecurePlatform Protect Users & Infrastructure Securing Anywhere Access Protect Data from Unauthorized Viewing

4. Fundamentally Secure Platform Windows Vista Foundation Streamlined User Account Control Enhanced Auditing • Security Development Lifecycle process • Kernel Patch Protection • Windows Service Hardening • DEP & ASLR • Internet Explorer 8 inclusive • Mandatory Integrity Controls Make the system work well for standard users Administrators use full privilege only for administrative tasks File and registry virtualization helps applications that are not UAC compliant XML based Granular audit categories Detailed collection of audit results Simplified compliance management

5. User Account Control Windows Vista • System Works for Standard User • All users, including administrators, run as Standard User by default • Administrators use full privilege only for administrative tasks or applications Streamlined UAC • Reduce the number of OS applications and tasks that require elevation • Re-factor applications into elevated/non-elevated pieces • Flexible prompt behavior for administrators Challenges Customer Value • User provides explicit consent before using elevated privilege • Disabling UAC removes protections, not just consent prompt • Users can do even more as a standard user • Administrators will see fewer UAC Elevation Prompts Windows 7

6. Desktop Auditing Windows 7 Windows Vista Enhanced Auditing • New XML based events • Fine grained support for audit of administrative privilege • Simplified filtering of “noise” to find the event you’re looking for • Tasks tied to events • Simplified configuration results in lower TCO • Demonstrate why a person has access to specific information • Understand why a person has been denied access to specific information • Track all changes made by specific people or groups Challenges • Granular auditing complex to configure • Auditing access and privilege use for a group of users

7. demo UAC & Audit

8. Helping Secure Anywhere Access Network Security Network Access Protection DirectAccess Policy based network segmentation for more secure and isolated logical networks Multi-Home Firewall Profiles DNSSec Support Help ensure that only “healthy” machines can access corporate data Enable “unhealthy” machines to get clean before they gain access Security enhanced, seamless, always on connection to corporate network Improved management of remote users

9. Remediation Servers Example: Update Restricted Network Corporate Network Network Access Protection Policy Servers such as: Update, AV • Health policy validation and remediation • Helps keep mobile, desktop and server devices in compliance • Reduces risk from unauthorized systems on the network Not policy compliant Policy compliant DHCP, VPN Switch/Router Windows Client NPS Windows 7

10. Remote Access for Mobile WorkersAccess Information Virtually Anywhere Situation Today DirectAccess • Difficult for users to access corporate resources from outside the office • Challenging for IT to manage, update mobile PCs while disconnected from company network • Same experience accessing corporate resources inside and outside the office • Seamless connection increases productivity of mobile users • Easy to service mobile PCs and distribute updates and polices Windows 7 Solution

11. Help Protect Users & Infrastructure AppLockerTM Internet Explorer 8 Data Recovery Enables application standardization within an organization without increasing TCO Support compliance enforcement Help protect users against social engineering and privacy exploits Help protect users against browser based exploits Help protect users against web server exploits File back up and restore CompletePC™ image-based backup System Restore Volume Shadow Copies Volume Revert

12. Application Control Situation Today AppLocker • Users can install and run non-standard applications • Even standard users can install some types of software • Unauthorized applications may: • Introduce malware • Increase helpdesk calls • Reduce user productivity • Undermine compliance efforts • Eliminate unwanted/unknown applications in your network • Enforce application standardization within your organization • Easily create and manage flexible rules using Group Policy Windows 7 Solution

13. AppLocker Technical Details • Simple Rule Structure: Allow, Exception & Deny • Publisher Rules • Product Publisher, Name, Filename & Version • Multiple Policies • Executables, installers, scripts & DLLs • Rule creation tools & wizard • Including PowerShellcmdlets • Audit only mode • SKU Availability • AppLocker – Enterprise • Legacy SRP – Business & Enterprise

14. demo AppLocker

15. Internet Explorer 8 Security Building on IE7 and addressing the evolving threat landscape • Social Engineering & Exploits • Reduce unwanted communications • Freedom from intrusion • International Domain Names • Pop-up Blocker • Increased usability • Secure Development Lifecycle • Extended Validation (EV) SSL certs • SmartScreen® Filter • Domain Highlighting • XSS Filter/ DEP/NX • ClickJacking Prevention • ActiveX® Controls • Browser & Web Server Exploits • Protection from deceptive websites, malicious code, online fraud, identity theft • Protection from harm • Choice and control • Clear notice of information use • Provide only what is needed • Control of information • User-friendly, discoverable notices • P3P-enabled cookie controls • Delete Browsing History • InPrivate™ Browsing & Filtering

16. Help Protect Data RMS EFS BitLocker Policy definitionand enforcement Helpsprotect information wherever it travels Integrated RMS Client User-based file and folder encryption Ability to store EFS keys on a smart card Easier to configure and deploy Roam protected data between work and home Share protected data with co-workers, clients, partners, etc.

17. BitLocker Situation Today BitLocker To Go + • Extend BitLocker drive encryption to removable devices • Create group policies to mandate the use of encryption and block unencrypted drives • Simplify BitLocker setup and configuration of primary hard drive Challenges • Dual partition configuration of primary hard drive for IT • End user friendliness and discoverability • Corporate control over ubiquitous, cheap, small, high capacity removable storage devices Windows 7 Solution

18. BitLocker Technical Details • BitLocker Enhancements • Automatic 100 Mb hidden boot partition • New Key Protectors • Domain Recovery Agent (DRA) • Smart card – data volumes only • BitLocker To Go • Support for FAT* • Protectors: DRA, passphrase, smart card and/or auto-unlock • Management: protector configuration, encryption enforcement • Read-only access on Windows Vista & Windows XP • SKU Availability • Encrypting – Enterprise • Unlocking – All

19. demo BitLocker

20. Windows 7 Enterprise Security Building upon the security foundations of Windows Vista®, Windows® 7 provides IT Professionals security features that are simple to use, manageable, and valuable. Fundamentally Secure Platform Helping Secure Anywhere Access Protect Users & Infrastructure Help Protect Data • Windows Vista Foundation • Streamlined User Account Control • Enhanced Auditing • Network Security • Network Access Protection • DirectAccessTM • AppLockerTM • Internet Explorer® 8 • Data Recovery • RMS • EFS • BitLocker ™ & BitLocker To GoTM

21. question & answer

22. Required Slide Speakers, TechEd 2009 is not producing a DVD. Please announce that attendees can access session recordings at TechEd Online. Resources • www.microsoft.com/teched Sessions On-Demand & Community • www.microsoft.com/learning • Microsoft Certification & Training Resources • http://microsoft.com/technet • Resources for IT Professionals • http://microsoft.com/msdn Resources for Developers www.microsoft.com/learning Microsoft Certification and Training Resources

23. Related Content SIA305 – Deploying Windows 7 BitLocker in the Enterprise SIA03-HOL – BitLocker To Go WSV320 – Reinventing Remote Access with DirectAccess SIA402 – Uncovering Two Least-Understood Security Stars in Windows: UAC & WIL

24. Complete an evaluation on CommNet and enter to win!

25. © 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.