Security for Mere Mortals Steve Lamb Technical Security Advisor Microsoft Ltd.
-
Upload
coleen-holt -
Category
Documents
-
view
217 -
download
0
description
Transcript of Security for Mere Mortals Steve Lamb Technical Security Advisor Microsoft Ltd.
Security for Mere MortalsSecurity for Mere Mortals
Steve Lamb Steve Lamb
http://blogs.msdn.com/steve_lambhttp://blogs.msdn.com/steve_lamb
Technical Security AdvisorTechnical Security Advisor
Microsoft LtdMicrosoft Ltd
Microsoft Technical Roadshow 2005Microsoft Technical Roadshow 2005
2-days of in-depth technology information2-days of in-depth technology information
Birmingham – 24-25 MayBirmingham – 24-25 May
Harrogate – 1-2 JuneHarrogate – 1-2 June
London – 7-8 JuneLondon – 7-8 June
Register now at: Register now at: www.microsoft.com/uk/techroadshowwww.microsoft.com/uk/techroadshow
Ground Rules for this SessionGround Rules for this Session
It’s YOUR session based on your requestsIt’s YOUR session based on your requests
Interaction WILL BE rewardedInteraction WILL BE rewarded
Don’t be ShyDon’t be Shy
There are NO STUPID questionsThere are NO STUPID questions
We’re all friends here!We’re all friends here!
““You don’t put brakes on a car to go You don’t put brakes on a car to go slowerslower
– – you put them on to go you put them on to go fasterfaster more more safelysafely””
User education is keyUser education is key
As are processes and proceduresAs are processes and procedures
Mis-configuredMis-configured systems are a major threat systems are a major threat
““Good Security enables business to Good Security enables business to do do moremore with with lessless risk” risk”
Hold off the Rocket ScienceHold off the Rocket Science
Apply Technology to Support the Business PolicyApply Technology to Support the Business Policy
Learn how the business worksLearn how the business works
Don’t get in the way!Don’t get in the way!
Get a decent POLICY First!Get a decent POLICY First!
Forget the Rocket ScienceForget the Rocket ScienceStart with a mandate from the topStart with a mandate from the topDefine a realistic policy based on how users Define a realistic policy based on how users actually work!actually work!Keep it up to dateKeep it up to dateCommunicate itCommunicate itWhy?Why?Punish OffendersPunish Offenders
ISA – Application Layer FirewallingISA – Application Layer FirewallingCurrently – most firewalls check only basic packet informationCurrently – most firewalls check only basic packet information
Real world equivalent of looking at the number and destination of a bus – Real world equivalent of looking at the number and destination of a bus – and not looking at the passengersand not looking at the passengers
Windows FirewallWindows Firewall
Basic behaviorBasic behavior
Outbound TCPOutbound TCPResponse from Response from target IP onlytarget IP only
Outbound UDPOutbound UDPResponse from any Response from any IP;IP;closed after 90 closed after 90 seconds of inactivityseconds of inactivityOutboundOutboundb’cast and m’castb’cast and m’castOpen for 3 seconds Open for 3 seconds to permit reponse to permit reponse from same subnet from same subnet onlyonly
Unsolicited for appsUnsolicited for appsApplication must be Application must be on exception liston exception list
Unsolicited for Unsolicited for servicesservicesPort must be statically Port must be statically openedopened
Unsolicited RPCUnsolicited RPCFirewall must be Firewall must be configured to configured to permit inbound RPCpermit inbound RPC
Training and AwarenessTraining and Awareness
PEOPLE
Social Engineering:•IM and IRC downloads
Training and Awareness:•Apply procedures
Carrot not stick:•Recognise employees
Process - The GlueProcess - The Glue
No where else in society do we put so much No where else in society do we put so much faith in technology. No-one has said, “faith in technology. No-one has said, “This This door lock is so effective that we don’t need door lock is so effective that we don’t need
police protection and breaking and police protection and breaking and entering laws.” entering laws.”
Products work to a certain extent but you Products work to a certain extent but you need processes in place to leverage their need processes in place to leverage their
effectiveness.effectiveness.
SOURCE: Bruce Schneier, CTO, CounterpaneSOURCE: Bruce Schneier, CTO, Counterpane
PROCESS
Embrace ProcessEmbrace Process
TECHNOLOGY
Limit privilege
Secure weakestlink
Defend in depth
Enlist users
Detect attacks
Embrace simplicity
Be vigilant
Watch the watchers
How good is YOUR Security How good is YOUR Security Knowledge?Knowledge?
http://www.microsoft.com/emea/gatekeepertest http://www.microsoft.com/emea/gatekeepertest
Guidance and ToolsGuidance and ToolsDelivering Support, Creating CommunityDelivering Support, Creating Community
Security toolsSecurity toolsSecurity Bulletin Search ToolSecurity Bulletin Search Tool
http://www.microsoft.com/technet/security/current.aspx http://www.microsoft.com/technet/security/current.aspx
Guidance and trainingGuidance and trainingSecurity Guidance CenterSecurity Guidance Center
http://www.microsoft.com/security/guidance/default.mspx http://www.microsoft.com/security/guidance/default.mspx
How Microsoft Secure our own Infastructure - ITShowcaseHow Microsoft Secure our own Infastructure - ITShowcasehttp://www.microsoft.com/itshowcasehttp://www.microsoft.com/itshowcase
E-Learning ClinicsE-Learning Clinicshttps://www.microsoftelearning.com/security/ https://www.microsoftelearning.com/security/
Community engagementCommunity engagementNewslettersNewsletters
http://www.microsoft.com/technet/security/secnews/newsletter.htm http://www.microsoft.com/technet/security/secnews/newsletter.htm
Webcasts and chatsWebcasts and chatshttp://www.microsoft.com/seminar/events/security.mspxhttp://www.microsoft.com/seminar/events/security.mspx
© 2005 Microsoft Corporation. All rights reserved. This presentation is for © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only.informational purposes only.MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.SUMMARY.
www.microsoft.com/uk/security
www.microsoft.com/uk/technet/learning