Forefront Security Exchange

1
Forefront SecurityExchange
2
Problem

• Meddelande system och sammarbetsprodukter är
  underbarar mål för elak kod och distrubition av
  äkta dynga
• Viruses
• Worms
• Bot-nets
• Trojans
• Spam
• Phishing
• Profanity / offensive content

3
E-mail Antivirus Approaches
Internet
Viruses Worms Spam
ISA Servers
Windows SMTP Servers
Problem Single Point of Failure
Problem Management/Cost
4
Defense-in-Depth for Exchange Server
Internet
EHS
ISA Server
Exchange
Mail flow
EHS Service
Antigen On-Premise Software
ISA Server 2004/6

• Eliminate spam and viruses before they reach your
  network
• Rapid identification and quickest response to
  latest threats
• Unparalleled reliability and scalability

• Securely enable remote access to Exchange e-mail
• Enhance server protection with pre-authentication
  of users
• Improve security of OWA sessions from unmanaged
  clients

• Protect against internal threats
• Enforce content policies in e-mail
• Provide additional layer of defense against the
  latest viruses, worms and spam

5
The Ideal Solution

• Use a single vendor solution that integrates
  antivirus engines from top worldwide virus labs
  and provides all updates from a single source
• Manages multiple antivirus scan engines on all
  mission critical messaging and collaboration
  servers
• Includes anti-spam, policy and content filtering
  for complete protection and hygiene

AV
AV
AV
AV
AV
AV
Exchange Server/Windows SMTP Server
6
Demo

• Forefront för Exchange

7
E-mail and Collaboration Server Security
Live Communications Server
SharePoint
ISA Server
Collaboration
SMTP Server
Exchange Server
Internet
Users
Edge
E-mail
VirusesWormsInapp. Content
VirusesWormsSpam
Microsoft Operations Manager w/ Antigen
Management Pack
Antigen Enterprise Manager
Management
8
Demo

• Forefront för SharePoint

9
Layered Defenses

• Protection at multiple points in the network
• Edge Antigen for SMTP, Advanced Spam Manager
• E-Mail server Antigen for Exchange, Advanced
  Spam Manager
• Microsoft SharePoint Portal Server (SPS)
  Antigen for SharePoint
• Live Communication Server Antigen for Instant
  Messaging
• Multiple engine management
• Up to eight engines available
• Advanced Spam Manager integration with Microsoft
  Intelligent Message Filter
• Content and Document filtering
• Block mail according to file type
• Scan file names, text within documents, and
  e-mail subject and body for administrator-defined
  keywords

10
ASM IMF Together

• On the same server, IMF scans before ASM
• Each applies an SCL rating the higher the
  rating always wins (i.e. has more confidence)
• Mail that is rejected , deleted or archived by
  IFM will NOT make it to ASM
• Example IMF archived SCL 7,8 9

ASM Spam set to 9
Mail Store
IMF SCL of 0-6
If SCL is 7,8,9
If Admin moves message
11
MOM MP for Antigen

• Over 100 Events, Performance Counters and
  Services Monitored
• Monitors the state of Antigen and its key
  components
• Collects statistical data on scanning, detection
  and removal of messages and attachments
• 5 Antigen Services Polled - Provides timed events
  to poll systems for critical process health
• Key Tasks
• Trigger Scan Engine updates
• Centralized storage and deployment of License
  files
• Import, export and deploy changes for key
  settings
• Immediate and/or scheduling of Manual Scan Jobs.
• Start/Stop control of Antigen services

12
Forefront Management med MOM
13
Competitive Advantages

• Key Points
• Single Points of Failure
• One Engine throughout antivirus suite on all
  platform
• Single Layer of Scanning on Exchange Server
• Different products for different version of
  Exchange
• poor migration support
• Limited Notifications
• No disclaimers
• Limited File and Content Filtering
• PSS Support