As enterprise IT evolves, Microsoft continues to evolve its Forefront security management strategy.  In order to best help customers simplify the security experience and manage compliance, we are aligning security management with systems and application management.

As part of this strategy, Forefront Protection Manager (FPM) will not be released to market.  Instead, multi-server management for Forefront Protection 2010 for Exchange Server (FPE) and Forefront Protection 2010 for SharePoint (FPSP) will be delivered through a streamlined solution for messaging and collaboration workloads, both on-premises and in the cloud. We will share additional details on this solution in the future.

To address customer needs in the near-term, we will release the following in the second half of 2010 at no additional cost to FPE and FPSP customers:

·         A Service Pack release for our established Forefront Server Security Management Console (FSSMC) that will expand support for multi-server management to the latest versions of FPE and FPSP.

·         A Forefront Server Security Script Kit that will allow IT administrators to use Remote PowerShell to configure and report on multiple deployments of FPE and FPSP throughout the enterprise. 

More about our long term strategy:

We are aligning security management with systems and application management at two levels.  The first level will deliver risk management across protection, access, and identity, providing end-to-end visibility into the enterprise and helping enable compliance.  The second level will operationalize and simplify security management by building on application workloads and providing a consistent management experience across physical, virtual, and cloud environments.

As part of this strategy, we announced earlier that Forefront Endpoint Protection 2010 will be built on System Center Configuration Manager for centralized deployment, configuration, updating, and reporting.  This will allow customers to configure, patch, and protect their desktops and laptops with the same infrastructure, delivering comprehensive security with greater efficiency.  This solution is on track for a planned release to market in the second half of 2010.

Microsoft and RSA, the Security Division of EMC, recently commissioned a Forrester Consulting survey of enterprise security managers about information protection.  The results are available in a white paper called "The Value of Corporate Secrets," available here on Microsoft.com (see Technical Resources) and here on RSA.com.  We issued a joint press release about it, too, available here.  Microsoft and RSA have a strategic partnership around information protection solutions, announced more than a year ago.

The most interesting finding of the survey of 305 security decision makers around the world is that while enterprises are investing heavily in compliance and protection against accidental leaks of custodial data (such as customer information), they are under-investing in protection against theft of trade secrets (intellectual property)....which is much more valuable.

“Nearly 90% of enterprises we surveyed agreed that compliance with PCI-DSS, data privacy laws, data breach regulations, and existing data security policies is the primary driver of their data security programs. Significant percentages of enterprise budgets (39%) are devoted to compliance-related data security programs,” according to Forrester Consulting’s study. “But secrets comprise 62% of the overall information portfolio’s total value while compliance-related custodial data comprises just 38%, a much smaller proportion. This strongly suggests that investments are overweighed toward compliance.”

The survey revealed that while organizations focus on data security incidents related to accidental loss, information theft by employees or trusted outsiders is more costly. For example, based on responses received in the survey, employee theft of sensitive information is ten times costlier than accidental loss on a per-incident basis: hundreds of thousands of dollars versus tens of thousands.

Despite a wide range in security spending, views on the value of information and number of incidents, nearly every company rated its security controls to be equally effective.

“Most enterprises do not actually know whether their data security programs work or not, other than by raw incident counting,” according to Forrester Consulting. “‘Compliance’ in all its forms has helped CISOs buy more gear. But it has distracted IT security from its traditional focus: keeping company secrets secure.”

Read the white paper for recommendations from Forrester, Microsoft and RSA to better ensure your information security strategies are appropriately balanced, including:

• Identify the most valuable data assets in your company's portfolio.
• Create a "risk register" of data security risks that documents specific threat scenarios.
• Asses and re-prioritize your IT security program's balance between compliance and trade secrets
• Increase vigilance of external and third party business relationships
• Measure data security program effectiveness.

Active Directory is a critical technology for thousands and thousands of organizations, holding literally billions of identities around the world.  Solutions to ensure AD is backed up and  - should there be a breakdown - recoverable are essential to any business continuity strategy. 

To that end, CionSystems Inc. has announced the release of CionSystems Active Directory Recovery, a web based, easy-to-use and affordable solution that offers quick, granular restoration of individual objects and attributes, as well as multiple domain recovery.

The Microsoft partner ecosystem continues to rally around Forefront Identity Manager (FIM) and Microsoft identity and access management solutions.   For example, Microsoft gold partner Oxford Computer Group and BHOLD Company, which provides software solutions for authorization management and control, announced their partnership to deliver enterprise identity and access governance solutions with FIM.   From their press release:

The partnership sees OCG implementing BHOLD Controls, a robust analysis and detection tool for identity and access audit and reporting, and BHOLD Suite with FIM 2010 for an identity and access management solution which includes role based access management and governance. BHOLD Suite keeps a reliable log of permissions and roles and offers a complete management suite for auditing, reporting, attestation and simulation.

Oxford provides white papers on IAM, including a new one on FIM, available here.

If you are a solution provider partner implementing Microsoft identity and security solutions, be sure to participate in the Microsoft Security Software Advisor Program and earn fees from your customer deployments.