Microsoft Forefront

1
??????????? ???????????? ??-??????????????
?????????? Microsoft Forefront

• ????? ???????
• MCT ??????? ????? ??????-?????

2
??????????????? ???????

• ????????? ???????? ?????????????? ????????????
• ?????? ? ?????
• ????????????????? ? ???????? ??????????
• ??????? Microsoft ?? ??????????? ????????????
• ?????????????? ??????
• ??????????
• ???????? ? ????????????????
• Microsoft Forefront
• ??????? ???????????? ??? ?????? ISA Server
• ???????????? ?? ??????? ??????? ? ???????
• ???????????? ???????? ??????????
• ???????????? ???????? ? ?????? ???????????

3
???? ?? - ????????
?????? ???, ??? ????? ???????? ??? ???????????
4
???????????????? ????????

• ?????????
• ????????????????
• ????????
• ?????????

?????? ??????????? ???????????? ???????????
???????? ??????????? ??????????, ??? ????????? ?
??????????, ? ????????? ??????? ???????
5
???????? ??????
?????? ????????????? ??????? ??????????????
????????????, ?????????? ????????? ????? ???????
??? ???????????
6
???????? ??????????
?????????? ???????? ???????? ??????? ??? ??????
????????, ??????? ????? ???? ???????????? ???????
7
???????????? ????????

• ?? ?????????? ? 2005 ?. ????? 700 ???????? (?
  ??????? ? 570 ? 2003 ?.)
• ????? ?????? ?? ????????? ???????????? ?????
  130 (210) ???. ?? ???
• 31 (70) ???. ????????? ??????????
• 7 (65) ???. ??-?? ???? ???? ????? ?
  ????????????
• 43 (27) ???. ??-?? ???????? ???? (????? ????
  ???? ????? ? ????????????)
• 90 (82) ???????? ???????????? ???????? ??????
• 84 (77) ???????? ???????????? ?????? ?? ???????
  ????? ???????????
• 53 (40) ???????? ???????????? ?????? ?? ???????
  ???????????

???????? 2003 CSI/FBI Computer Crime and
Security Survey
8
?????? ?????? ? 2005 ?.
9
????? ?????? Microsoft Antimalware
10
???? ??????
?????? ????????, ????????? ??? ????????,
????????? ???? ???? ???????????, ??? ??????
?????? ?????????? ?????????? ??????? ? ????????
??????????? ??? ?????? ???????

• ?????????????? - ?????? ?????????????? ????????
  ????? ?????? ? ?????????? ? ??????????
• ??????????? - ?????????????? ?????? ???????????
  ???????????? ? ???????????????, ???? ????
  ????????? ?????? ???? ????????
• ??????????? - ??????????? ?????? ??????, ????
  ???????????? ???-???? ????????? ???????? ?? ????
  ?? ??? ?????????????? ? ???????????
• ?????????????? - ?????????????? ???????????
  ?????????????? ?????????? ??? ???????
  ????????????????? ? ??????????? ?????? ??
  ??????????????

11
????????? ??????(?????? Defense-in-Depth)
????????, ?????????
?????????? ??????
??????
???????? ? ?????? ???????? ???????, ??????????,
????????? ???????????
??????????
???????? ????, ??????????, ?????? ??????,
??????????, ???????????
???????
???????? ? ????????????, ??????????,
??????????????, ?????, HIDS
?????????? ????
??????????????? ????, ?????????? ???????,
??????????, NIDS
???????? ????
?????????? (firewall), ??????????? ????
??????, ?????, ????????????, ??????????
???????? ????????????? ? ???????????????,
??????????, ?????
12
???????? ?????????? ??????? ?????????
???????????? Microsoft
???????
??????????
????????

• ?????? ?????????? ? ?????????? ????????
• ???????????? ???????
• ????????? ??????????
• ??????? ????????
• ??????????
• ????????? ?????????????? ????? ??????????
  ?????????
• ???????? ?????????? ?????????? ??????????
• 24/7 ????? ??????? ? ???????????? (SRRC)

• ??????????? ??????????
• ???????? ????????????
• ??????? ??????????
• ?????????? ? ???????????? ?? ???????????????
• Active Directory, SQL Server,
  MOM, SMS ? ?? .
• ?????????? ? ??????????? ?????????

• ??????????????? ???????? ? ??????
• ?????????? ?????????? ???????? ??????????
• ???????? ?????????????
• ?????????????????? ?????????? (appliances)
• ??????????? ? ?????????? ???????????
• ????????? ??????????????

13
????????????? ?????? ? ????????????
14
??????? ????????? Forefront
????? ????? ????????? ???????????? Microsoft, ???
???????? 11 ???? 2006 (???????? ????? ??????????)

• ?????? ? ?????????? ???????? ? ???????? ?????????
• Microsoft Internet Security and Acceleration
  Server 2006
• Whale Communications Intelligent Application
  Gateway
• ?????? ????????? ??????????
• Microsoft Forefront Security for Exchange Server
• Microsoft Forefront Security for SharePoint
• Microsoft Forefront Security for Office
  Communication Server
• ?????? ???????????? ?????? ???????? ? ????????
• Microsoft Forefront Client Security
• WSUS

15
?????? ???????? ?????????
VPN

• ISA Server 2006
• ??????, ??????????
• ??????????? ??????? ????
• ??????? ????????
• ?????????? ????????
• ?????? ???????? ??????? (NAP)
• IPSec, RADIUS, SecurID, ???????????

LAN1
LAN2
????????2
16
?????? ???????? ?????????(2)
17
ISA Server 2006 Architecture
PolicyEngine
WebFilter
WebFilter
PolicyStore
Web Filter API (IASPI)
Web Proxy Filter
SMTP Filter
RPCFilter
AppFilter
DNSFilter
Application Filter API
User Mode
Firewall Service
Kernel Mode
Firewall Engine
TCP/IP Stack
NDIS
18
???????????? ?????? ??????????? ?? ?????

• ??????????? ? ???????? ????????? ???????
• ??????? ?????????? ????? ??????????????? ???
  ?????? ????

• ??????? ??????????? ?? ?????? ?????
• ???????? ?????? ? ????? ?????????? ?? ?? ?????

????????????? ????
????????
Expected HTTP Traffic
Unexpected HTTP Traffic
Attacks
Non-HTTP Traffic
19
??????ISA Server ?? ?????

• Packet headers and application content are
  inspected

• ??????? ??????????? ????? ??????? ???????????
• ??????????? ?????? ?????????????? ??????

????????????? ????
????????
Expected HTTP Traffic
Unexpected HTTP Traffic
Attacks
Non-HTTP Traffic
20
???????????? ?? ISA 2006

• ?????????? ?????????????? ??? ???? ??????
• ???????????? ??????????? ???? ? NAP (?????
  ????????)
• ?????????? VPN ?????????? ?? ISA firewall
• ?????? ????? ??????????????? Windows ? RADIUS ???
  ????????? ????????? ??????? ? ????? ????????
• ?????????????? ????????? ?????????? ???
  ?????????? ????????
• ????????? MOM RRAS ? ISA Management Packs ???
  ????????
• ? ????????????? ???????? ????????????
  ????????????? ?????? ?????????? ??????????
  ???????
• ???????????? ???????? ??? ??????????
  ????????????? ??? ??????????? ?????

21
????????? ??????????? ISA-MOM

• ????? 200 ???????, ?????? ? ??????? ??????????
• Cache ???? ? ?????????? ??????????????????
• Firewall ????????? ? ??????????????????
• Logging ???????? ??????? ? ????? ???????
• Monitoring ????????? ?????? ?????????? ?
• Publishing ?????? ?????????????? ????????,
  ???????? ???????
• Storage ???? ??????? ? ????????????
• VPN ?????? ?????????? ? ???????? ???????????
• Web Proxy ???????? ???????????? ?
  ????????????????
• NLB (Enterprise Edition only) ????????????
  ????????? ??? ???? NLB
• ?????? ??????? ???????? ??????????????? ??????
  Knowledge Base ??? ?????? ? ????????? ? ??????
  ??????

22
Microsoft Forefront Client Security
??? ?????????????? ?????????????
??? ???????
Microsoft Forefront Client Security
Windows Defender
Windows Live Safety Center
Windows Live OneCare
MSRT
???????? ??????????? ???????????? ???????
???????? ???? ????????? ???????
?????? ? ???????? ???????
???????? ?????????? ?????????? ??
?????? ? ???????? ??????? ?? ?????????? ??
???????????????? ??????? ? ??????
???????????????
?????????? ? ?? ???????????????
23
Defender - ??? ??? ????????
??????? ???????? ???????
???????? ??????????
????????? ????????? ? DC ?? ??????????????
???????? ? ?????????? ?????????????? ?????????
24
??????????????? Forefront Client Security
?????????
??????
?????? ??????? ? ??????????????
???????
????????
???????, ???????? ? ???????? ? Microsoft Firewall
Client Security
25
??????????? ???????

• ??? ???????? ??????????
• ????? (Security agent) ??????????????? ??
  ???????? ? ???????????? ?????? ? ???????? ???????
  ?? ???????, ?????????? ??, ???????? ? ??????
  ?????
• ?????? (central management system) ????????????
  ???????????????? ???????, ???????????????
  ????????, ????????? ? ????????? ???????
• ??????? ?????????? ???????????????? ??????????
  ????????????, ????????? ???????????, ???????? ???
  ???????????, ??????? ? ??????? ??????????
• ??????????? ??? ????????????? ? ??????????
  ?????????? Active Directory Group Policy. ?????
  ???????????? ? ?????? ?????????? ???????? ??.
• ?????????? ? Microsoft Update ? Windows Server
  Update Services (WSUS). ??????????? ????????????
  ? ????????? ??????????.
• ???????? ?????????? ??? ?????? ? Microsoft
  Operation Manager 2005 ? ?????
• ????????????? Microsoft SQL Server ??? ????????
  ?????????, ?????????? ? ?????????

26
??????? ??????????
27
???????????????? ???????
28
?????????? ? ??????????
29
Microsoft Forefront Client Security
??????????????? ?????? ?? ???????????? ???? ???
???????????? ??????, ??????? ? ????????????? ?
??????????

• ?????? ??????? ??? ?????? ?? ???????????? ????
• ????????? ?? ?????????? ???????????
• ??????????? ????? ?? ??????

• ?????? ??????? ??????????
• ?????????? ??? ?????? ???????
• ?????????? ? ???????????? ???????????????

• ???? ??????? ?????? ????????? ?????
• ???????? ??????????? ???????
• ????????? ???????????? ??????

30
?????? ????????? ??????????

• ??????? ? ????????????????
• ?? ???????? ?? ??????????? ??????
• ????????? ??????? ????????
• ????????? ??????????
• ?????? ????? ???????????? ??????
• ?????????? ??????????
• ?????????????
• ??????????
• ????????, ?????????, ??????????
• ??????? ??????????, ??????????
• ?????????? ??????????????? ? ?????????????
• ????????? ????????????? ? ?????????????
• ?????? ?????????
• ???????????? ????????

31
??????? Forefront (Antigen)
Live Communications
??????, ????? ? ????
SharePoint
???????
??????????? ?????????
?????????? ????? ISA Server
Exchange
Windows SMTP
32
??????????? ?????????
Start-up
1
Client
IMC
Monitor
heartbeat
3
2
Service
Starter
4
Store
GetEngineFiles
Manual
Utility
Statistics
Configuration Log Files
5
Manager
33
?????????? ??????????

• ??????????? ?????
• AntigenMonitor
• ?????????? ????????? ??? ???????????
  ??????????????
• AntigenService
• ??????????? ???? ????????? Antigen
• ??????????? ??????? ? ???????????? ? ????????
• AntigenStore
• ??????????? ????????? ???????? Exchange Store
• AntigenIMC
• ???????? ???????? SMTP service
• AntigenStatistics
• ?????????????? ? Sybari Enterprise Manager
• ???????? ?????????????????
• Antigen Client
• ???????????????? ???????
• ???????????????? ?????????? ??????????
• ?????????? ????? ???-???????
• ???????????/??????????
• ??????????????? ?????????? ????????

• ???????????????
• AntigenRealtime
• ???????? ???????????? ? ???????? ???????
  ????????? Exchange
• AntigenInternet
• ???????? ???????????? ? ???????? ???????
  ????????? SMTP
• AntigenManual
• ???????? ???????????? ?? ?????????? ?????????
  Exchange
• ???????
• ??????????? ?????? programlog.exe
• HR Logs
• ?????? ??????????? Antigendiag.exe
• Watson
• ?????????????
• AntigenStarter
• ??? ???????????? ???????
• GetEngineFiles
• ??????????
• AntUtil
• ???????? ??????????? ?????

34
???????????? ???????????? ??????
????????
Exchange Server/Windows SMTP Server
?? ????????? ?????? ?????? 5 ???? Microsoft
Antivirus SOPHOS Computer Associates Vet
Norman Data Defense Computer Associates
Inoculate ????????????? ????? ???????? ?? 4-?
???? ??????????? ??????????? Virus Buster
Authentium Ahnlab
35
?????? ??????????? ????? (Antigen ??? SMTP-
?????? )
????????

• ???????????? ? ??????? ???????? ?????? ?? ???????
  ???? ??????????? ???????????? ?? ?????? ?????
  SMTP
• ?????? ?????? ?????? ????????? ?????????????
  ???????? ?????? ? ???????? ????????????? ????????
  ?????????
• ????????????? ?????? ??????????? ??????????
• ???????????? ??????????? ???????? ??????????,
  ?????????? ?? ???????? ?????? ? ?? ???????? ??
  ????? ???????? ?????????
• ???????? SMTP-????? Windows Server 2003 ? Windows
  2000 Server
• ??????????? ????????? ??????????????? ??? ????
  ?????????? ???????

?????????? ?????
?????? SMTP-?????/??????-????????
??????? Exchange
???????
36
?????? ?????? ??????????? (Forefront ???
Microsoft Exchange)
????????

• ??????????? ????????? ? ???????? ??????? ?
  ??????????? ??????? ? ?? ?????????
• ???????????? ?? ?????? SMTP-?????
• ???????????? ??????????????? ????????? Exchange ?
  ???????? ???????? ???????
• ????????????? API-?????????? Microsoft ???
  ?????????? ? ????????? Exchange 5.5, 2000 ? 2003
• ?????? ??????? ?????????? ?? ???????? ???
  ???????? ????????? ? ?? ????????
• ???????? ??????????, ?????????? ?? ????????
  ?????? ? ?? ??????????? ?? ?????? ????????? SMTP
• ?????? ???????? Exchange Server 5.5, 2000, 2003,
  2007

VPN
ISA Server
ISA Server
Front End Exchange
Exchange ???????
?????? ????? ?????
???????? ??????
37
???????????????? Forefront for Exchange
38
????????? ?????????? Forefront for Exchange
39
Advanced Spam Manager

• ???????? ? ???????? ??????????????? ?????? ?
  ????????? Antigen ??? SMTP-??????, ? ????? ?
  Antigen ??? ???????? Exchange
• ?????????? ???????????? ???? SpamCure,
  ???????????? ?? ??????????? ???????
• ?????????? ? ???????? ???????? ??????? ??
  ???????? ?????? ? ??????
• ????????? ??????????????? ????????? ???? ??????
  ??????????? ??? ??????????? ??????? ????????????,
  ??????? ? IP ???????

40
?????? ?????? ??????????? (Antigen ??? Instant
Messaging)
??????? IM-???????

• ????????? ?????????, ???????????? ?????????? IM,
  ? ???????? ???????? ???????
• ????????? IM-????????? ? ???????????? ????????
  ???????? ? ????????????? ????????
• ????????? ?? ??????? ??????? ????????????????
  ?????????? ? IM-?????????? ? ??????????
• ????????? ??????????????? ????????? ?????
  ??????, ?????????? ?? ??????? ??????????? ?
  ??????????

?????????? ?????
?????? Live Communications
Microsoft Office Communicator
??????? Windows Messenger
41
?????? ?????? ? ??????????? (Forefront ???
SharePoint)
SQL ?????????? ??????????

• ???????????? ?????? ??? ????????? ??????????
• ???????????? ???? ??????, ??????????? ???
  ????????? ?? ?????????? ??????????
• ???????????? ??????? ??? ?? ?????????? ????
  SPS ?????? (?????????????? WSS ? SPS)
• ?????????? ??????? ?? ??????????? ??????????
• ???????? ??????????, ??????????? ???????????
  ????????????? ????????? ?? ?????? ??? ?????, ????
  ????? ??? ??????????
• ???????????? ?????????? ?? ???????? ?????? ??
  ??????? ??????? ???????????? ???? ? ????

????????
?????? SharePoint ??? WSS
????????
???????
42
(No Transcript)
43
(No Transcript)
44
Sybari Enterprise Manager

• ??????????? ??????? Sybari Enterprise Manager
  (SEM) ???????????? ??? ?????????? ????????????
  ???????????? ???? Antigen
• ?????? SEM ???????? ????? ????????, ????????? ??
  ???? ??????? Antigen, ??????? ????????? ? SEM
  ??????????? ??????????
• ?????????? ??????????? ?????????? ??????????????
  ??????????????? ?? ??????? SEM
• ????????????? SEM ????????? ??????? ?????
  ???????, ???????????? ??? ????????? ?????????? ??
  ?????????

HTTP or FTP
??????? ? ???????????? ????????
?????? Antigen
????? SEM
??????SEM
?????? Antigen
45
?????????? ? MOM 2005

• ?????????? ????? 100 ???????, ???????? ?
  ????????? ??????????????????
• ????????? ?????
• ???? ?????????? ????????????, ??????????? ?
  ???????? ?????????? ? ?????????
• ????? ????????? ??????????? ?? ??????????
• ???????? ??????
• ???????? ???????? ?????????? ????
• ???????????????? ???????? ? ???????????????
  ????????
• ??????, ??????? ? ?????????? ????????
• ?????? ??? ???????????? ???????????? ??
  ??????????
• ??????/?????????/?????????? ?????

46
Forefront Roadmap
47
??????? ? ?????????? ????
Microsoft Security

• ??????? Microsoft ? ??????? ????????????
• http//www.microsoft.com/security/default.mspx

Microsoft Antigen
???????? ?????? ??????????? ????? ? ??????
??????????? http//www.microsoft.com/antigen/de
fault.mspx
Microsoft Forefront
?????? ??????? ????????? ???????????? ???
??????? http//www.microsoft.com/forefront/defau
lt.mspx
???? ???????? ?? ??????????? ????????????
Microsoft http//www.microsoft.com/technet/securit
y/learning/default.mspx