Forefront Team Blog : Forefront Security for Office Communications Serve

Follow Forefront on Twitter

Forefront Blogger — Mon, 30 Nov 2009 19:11:00 GMT

If you are a Twitter fan, be sure to follow us at http://twitter.com/MS_Forefront ! Our own John "JG" Chirapurath, senior director in the MSFT Identity and Security Business Group, is leading the Forefront Tweet charge in his typically pithy way. Come join the conversation about all things identity and security.

Joel Sider

Action by Dec 1 - keep your protection current!

Forefront Blogger — Wed, 04 Nov 2009 23:08:00 GMT

A reminder from the Forefront Server Security blog.

As we announced on July 1, 2009, Microsoft is revising its engine mix on Dec. 1, 2009 for the Forefront and Antigen products. This change will allow customers to utilize a set of engines that help optimize detection, while also allowing us to invest in new areas for increasing overall protection for customers.

Antimalware Protection

The AhnLab, CA, and Sophos engines will be retired on Dec. 1, 2009. After December 1^st, customers will not receive any updates for these retired engines. In order to make sure your Antigen and Forefront products continue to scan efficiently and effectively for malware, any customers running the AhnLab, CA, or Sophos engines must DISABLE these engines before Dec. 1, 2009 and select from the new set of five engines – Authentium, Kaspersky, Microsoft, Norman, and VirusBuster.

SPECIAL NOTE: Antigen for SharePoint 8.0 and Antigen for Instant Messaging 8.0 customers – In order to gain access to the new engine set and provide optimal protection for your messaging and collaboration environments, please download the Service Pack 1 releases of these products on the MVLS or VLSC site prior to Dec. 1, 2009. The updates for the new engine set will use a new update infrastructure as of Dec. 31, 2009 – the Service Pack 1 releases will allow you to continue to receive updates correctly from their new location.

For more information about Service Pack 1 for Antigen for SharePoint and Antigen for IM, see the following KB article:

http://support.microsoft.com/kb/975850/

- SPECIAL NOTE: Antigen for Exchange 8.0 and Antigen for SMTP Gateways 8.0 customers –These products will end of life on Dec. 31, 2009. Customers must upgrade to Antigen 9.0 SP2 for Exchange before this date, as the product will no longer continue to receive anti-malware updates starting Jan. 1, 2010. With the retirement of the CA, Sophos, and AhnLab engines on Dec. 1, customers running Antigen for Exchange 8.0 or Antigen SMTP Gateways 8.0 will only be protected by the Norman engine. For customers who need to continue using this product between Dec. 1, 2009 and the end-of-life date of Dec. 31, 2009, please contact Forefront Contract Administration for access to the revised engine set.

For more information on upgrading your Antigen for Exchange 8.0 or Antigen for SMTP Gateways 8.0 to Antigen 9.0, see the following KB article:

http://support.microsoft.com/kb/932396/

Antispam Protection

One of the most important changes in our engine revision strategy is moving to the Cloudmark antispam engine*, which provides 99%+ detection rate and less than 1 in 250,000 false positives (West Coast Labs).

The Mail-Filters SpamCure antispam engine will be retired on Dec. 1, 2009. Customers using Antigen products for antispam protection must upgrade to the latest service pack releases listed below BEFORE DEC. 1, 2009 to maintain their antispam defenses. This is the only way to gain access to the new Cloudmark engine. The service packs can be accessed on the Microsoft MVLS and VLSC sites:

- Antigen for Exchange Server with Antigen Spam Manager 9.0 with SP2

- Antigen for SMTP Gateways with Antigen Spam Manager 9.0 with SP2

For more information on the engine revision strategy, see the Antimalware Engine Notifications and Developments Web page or contact Forefront Contract Administration . Again, we strongly urge all customers to update to the newest service packs before Dec. 1, 2009 to get the full protection benefits of the Forefront and Antigen server products.

*Please note: Customers using Forefront Security for Exchange Server will get access to the Cloudmark engine in the next version release – Forefront Protection 2010 for Exchange Server – scheduled to be available in Q4 CY09.

Brita Jenquin

Sr. Product Manager

Steve Ballmer on The New Efficiency

Forefront Blogger — Tue, 29 Sep 2009 20:56:00 GMT

Making business decisions regarding IT investment is tougher than ever. To help, today Microsoft hosted a special VIP Business Leadership Roundtable event. CEO Steve Ballmer and moderator Robert Youngjohns, President of the Microsoft US Subsidiary, discussed major trends in the new role of technology in the workplace. Ballmer and Youngjohns were joined by a panel of early adopter customers representing key industries like automotive, hospitality, transportation and IT. Attendees got a close look at how real companies are making IT investments across the desktop, server, network and beyond.

How IT needs to keep pace with increasingly sophisticated users
The ever more mobile and distributed workforce, and
The impact of greater industry regulations and ongoing threats to data.

Forefront identity and security solutions, and our Business Ready Security strategy, are core parts of the way Microsoft is helping customers tackle these issues. You can view highlights of today's event and get lots of info on the range of Microsoft IT solutions - including a Business Ready Security overview, Secure Messaging, Secure Collaboration, Identity and Access Management and Information Protection at www.TheNewEfficiency.com

Analyst: The market impact of security/identity integration

Forefront Blogger — Tue, 21 Jul 2009 23:54:00 GMT

Analyst Jon Oltsik of the Enterprise Strategy Group writes a column for Network World called "Networking Nuggets and Security Snippets." Last week he penned an interesting piece titled "The market impact of security/identity integration."

In the article Oltsik describes how governance, compliance and new electronic business processes are driving more alignment of security policy with users, roles and business activities. He goes on to provide his take on who the leaders, challengers, dark horses and question marks are among vendors in this newly converged space. He cites IBM, Microsoft and, tentatively, CA as leaders.

Yes, I'm flagging the story because Jon's take is very much in line with Microsoft's view and strategy. But it's worth a read.

Business Ready Security news at WPC

Forefront Blogger — Mon, 13 Jul 2009 19:01:00 GMT

This week in New Orleans Microsoft is hosting its annual Worldwide Partner Conference. We made several announcements today at the conference about our identity and security solutions. This news is part of our Business Ready Security strategy to help both partners and customers 1) protect everywhere and access anywhere, 2) integrate and extend security across the enterprise, and 3) simplify the security experience and manage compliance

Official names and pricing for “Stirling”

Forefront codename “Stirling” - the next generation of the Forefront Security Suite for integrated, comprehensive protection across endpoints, servers and the edge – will be officially known as Forefront Protection Suite (FPS).

FPS will include the products in the current suite, plus the Forefront Protection Manager (formerly known as the “Stirling” management console) and the Forefront Threat Management Gateway Web Security Service.

FPS pricing will remain the same as the current Forefront Security Suite and all of the component solutions will continue to be licensed on a subscription basis. They will also be available independently, with Forefront Protection Manager included. (Note that the Forefront Threat Management Gateway license is sold separately on a per processor basis.)

At WPC we are also announcing the following new product solution names:

· Forefront Endpoint Protection 2010 - current version is Forefront Client Security

· Forefront Protection 2010 for Exchange Server - current version is Forefront Security for Exchange Server

· Forefront Protection 2010 for SharePoint - current version is Forefront Security for SharePoint

· Forefront Online Protection for Exchange - currently called Forefront Online Security for Exchange

· Forefront Threat Management Gateway Web Security Service - the next generation of ISA Server 2006.

The new FPS solutions are currently in beta and final versions will ship over the course of the latter half of 2009 and the first half of 2010.

Public beta 2 of Forefront Unified Access Gateway

Forefront Unified Access Gateway beta 2 is available for download at www.microsoft.com/forefront. UAG provides secure, virtually anywhere access to messaging, collaboration and other applications, increasing productivity and policy compliance. UAG also extends the benefits of Windows DirectAccess across the enterprise, enhancing scalability, deployment and management.

Official name for “Geneva”

The three components of Microsoft “Geneva” – the upcoming open platform providing simplified user access and single sign-on for cloud and on-premises applications – have the following names:

· Active Directory Federation Services – formerly known as “Geneva” Server

· Windows Identity Foundation – formerly known as “Geneva” Framework

· Windows Cardspace – same as current version

Partner opportunities

At WPC partners will learn about how the solutions above offer tremendous opportunity to better meet the identity and security needs of customers...and to build their own businesses. Since announcing a $75 million investment in our partner ecosystem at WPC last year, we have seen very strong partner development and growth.

For example, we have seen a 50% increase in participation in the Security Software Advisors (SSA) program, which offers fees to partners who influence deployment. The Security Solutions Competency, which enables partners to differentiate themselves as experts, is one of the fastest growing competencies in Microsoft’s history and in the last year grew 46% in participation. This year we anticipate quadrupling the number of identity and security partners we support with training, marketing and customer engagement.

The multi-engine advantage...and updates

Forefront Blogger — Wed, 01 Jul 2009 22:33:00 GMT

Today we posted a white paper about the Microsoft antimalware engine strategy and changes beginning December 1, 2009. A summary is below - read the full document for a complete overview.

Forefront server security products - such as Forefront Secrurity for Exchange, Forefront Security for Sharepoint and Forefront Security for Office Communications Server incorporate a multi-engine strategy, using both Microsoft and industry-leading security partner technology to consistently drive high detection rates. They also include an advanced multiple engine manager that allows customers to concurrently configure up to five engines. Using multiple scanning engines delivers several critical advantages:

It increases the chances that emerging threats will be caught quickly.
It provides redundancy to help protect against scan failures or defects in individual engines; if an engine fails, other engines continue scanning messages.
It gives administrators an effective way to choose the most appropriate level of protection for their environment given their security needs and server performance capabilities.
It allows engines to be taken offline for updates or reconfiguration without forcing messages or documents to be queued.

Tests performed quarterly by the independent AV-Test.org group have shown that the multi-engine set for Forefront security products rates highest in response times for “in the wild” viruses and variants. We have found that having multiple engines consistently provides the highest detection rates against the competition with average response time of 3-6 hours for new viruses versus competitive single-engine solutions average response times are more than 2-9 days (as noted in recent AV-Test.org data.)

In order to further develop stronger technology relationships with our antimalware partners and ensure continued customer value for the longer term, we are standardizing on a set of five antimalware engines moving forward. We are confident that this solution will continue to provide equal or better detection rates and response times than the industry’s other leading solutions.

What does this mean for Microsoft and its customers? The current and next generation of Forefront server security products, including Antigen, will include five antimalware engines as part of an ongoing strategy to maximize and maintain our malware detection advantages, as well as make investments in other areas that will increase overall protection for our customers.

Customers will be able to take advantage of these new enhancements and engine changes after deploying the Antigen and Forefront service packs released on July 1, 2009. These service packs will allow customers to move to the new set of five engines as well as additional engine changes that Microsoft may release after December 1, 2009.

Microsoft Security Essentials (formerly 'Morro') and Forefront

Forefront Blogger — Tue, 23 Jun 2009 20:20:00 GMT

Today, Microsoft released a public beta of its new, free consumer anti-malware product codenamed “Morro”, which now has an official product name: Microsoft Security Essentials (MSE). This new solution will address the growing need for a PC security solution tailored to the demands of emerging markets. You may remember that “Morro” was originally unveiled back in November 2008 after we announced the discontinuation of retail sales for Windows Live OneCare subscription service effective June 30, 2009. As we described in this blog last year, Microsoft Security Essentials is intended for consumers, not business customers. Microsoft continues to offer security solutions for businesses with the Forefront line of products as part of its Business Ready Security strategy.

It is important to note that MSE will have a very positive impact on Forefront, because it allows Microsoft to capture even more threat intelligence from customers as more people use the free anti-malware solution. We'll be able to use that information to help extend our security research and in the development of signatures and protection capabilities in our Forefront products, which are being deployed by increasing numbers of enterprises today, with thousands of Microsoft security partners certified to sell and deploy Forefront solutions. And, of course, there's an exciting road ahead for Forefront as we release a brand new set of products for this family in our next fiscal year under the codename "Stirling".

Key points about Microsoft Security Essentials (MSE)

· The MSE beta will become available to the first 75,000 visitors to www.microsoft.com/security_essentials starting Tuesday, June 23, 2009. An English language version will be available to beta testers in the U.S. and Israel, and a Brazilian Portuguese version will be available in Brazil. Support for Simplified Chinese in China is scheduled to follow shortly after initial beta release.

· MSE release (RTM) is scheduled for H2 2009 in 10 languages and in the following 20 markets: Australia, Austria, Belgium, Brazil, Canada, China, France, Germany, Ireland, Israel, Italy, Japan, Mexico, Netherlands, New Zealand, Singapore, Spain, Switzerland, United Kingdom, and the United States.

· MSE will include new protection technology, as part of the Microsoft anti-malware engine, called “Dynamic Signature Service (DSS)” which delivers real-time threat signature updates to the client when it detects something suspicious, whether code or behavior. As we mentioned previously in April, Forefront Client Security 2.0 will also include DSS when it releases in H1 2010.

· MSE is designed for consumers and will be offered as a free download separate from Windows (including Windows 7).

Server & Tools Business Exec discusses state of IT, answers your questions on June 23

Forefront Blogger — Thu, 18 Jun 2009 19:15:00 GMT

Are you interested in hearing about how other IT pros are reacting to economic conditions and where they’re investing (particularly security?)

Do you have questions about Microsoft’s efforts to help IT be more cost effective and deliver new solutions to business?

Is there a connection between virtualization and cloud computing?

On Tuesday, June 23rd from 10:30am – 11:00am (PDT), join a teleconference with Bob Kelly, corporate VP of Infrastructure Server Marketing. Bob will talk about the state of IT within the context of results from a new Harris Interactive study of 1,200 IT professionals from the U.S., United Kingdom, Japan and Germany. The study was commissioned by Microsoft’s Server & Tools Business. There will be time for your questions following the brief presentation. Submit questions over the phone or you can submit them at any time leading up to or during the teleconference by tweeting with the Twitter hashtag, #qs4ms. If you are interested in attending, please REGISTER NOW. Once you open the invite box, you can save and close to your calendar.

Trial and win!

Forefront Blogger — Thu, 28 May 2009 01:36:00 GMT

Check out the Forefront Trial Download Sweepstakes:

"Don’t miss the chance to win one of three $10,000 Grand Prize server systems for your home, a D-Link DNS-232 2-Bay Network Storage Enclosure, or a $50 Best Buy gift card instantly!

Now, through June 30, 2009, every time you download a different Microsoft Forefront trial software product, you’ll help keep your business safe and have a chance to win big in the Microsoft Forefront Trial Download Sweepstakes."

Business Ready Security webcasts

Forefront Blogger — Wed, 20 May 2009 00:25:00 GMT

Register here for a new series of webcasts on the entire lineup of Forefront products supporting the Business Ready Security strategy. Starting tomorrow, webcast topics will include: Forefront Identity Manager, the Forefront "Stirling" security suite and component solutions, Forefront Security for Office Communications Server, Active Directory Rights Management Services, "Geneva," and more.

Webcasts on secure collaboration & messaging

Forefront Blogger — Thu, 30 Apr 2009 20:38:00 GMT

Register here for webcasts on using Forefront and Windows solutions to better secure collaboration and messaging applications.

May 5, 1-2:30 PM PST

Secure Collaboration using AD RMS, MOSS and AD FS

Learn all about the different Trust Relationships provided by Active Directory Rights Management Services to securely collaborate with external parties. In this session we will drill down on how to provide extranet access to Information Rights Management (IRM) protected documents stored on Microsoft Office SharePoint Server 2007 using Active Directory Federation Services (AD FS), providing external people Single Sign-On(SSO), and delegating the account management to the external parties.

May 6, 1-2 PM PST

Security for Exchange and SharePoint - what's not in the box?! (Level 200)

Done implementing SharePoint or Exchange? There's more you can do! Spend an hour with us walking through the Identity and Security products and solutions that help make deployments more secure. We'll spend time discussing Forefront Security, The Intelligent Application Gateway, Internet Security and Acceleration Server, Rights Management Services and Identity Lifecycle Manager.

May 7, 1-2:30 PM PST

SharePoint Server 2007 and Exchange Server 2007 Integration with Active Directory Rights Management Services (Level 400)

Microsoft Active Directory Rights Management Services provides the capability to users to protect documents by providing granular permissions to them. This presentation provides an overview of Forefront Security for Exchange and Forefront Security for SharePoint technologies. Learn how Microsoft SharePoint 2007 can be configured and used to implement automatic document protection at the MOSS Document Library level and how Microsoft Exchange 2007 SP1 Pre-licensing Fetching provides more flexibility to roaming users using AD RMS.

The analysts weigh in

Forefront Blogger — Thu, 23 Apr 2009 00:46:00 GMT

As part of last week's introduction of our Business Ready Security strategy, we posted several videos of industry analysts John Olstik of the Enterprise Strategy Group and Scott Crawford of Enterprise Management Associates discussing security issues. One is below, but visit this page to view the rest.

The Enterprise Strategy Group also wrote a paper, called "Business Enablement Demands Tight Identity and Security Integration."

Perspectives on Security: Business-ready Security

Business Ready Security

Forefront Blogger — Thu, 16 Apr 2009 19:27:00 GMT

Today the Identity and Security Division at Microsoft introduced what we call our Business Ready Security strategy. This is a fundamentally new approach to enterprise security, centered on the recognition that security solutions should help companies achieve their business goals while managing risk and empowering their people. Business Ready Security is both a destination for customers and our long term strategy to help them get there. It is based on a much broader definition of security than the status quo, which includes protection, access, management and user identity.

Below is more information, as well as several related news announcements. But, to get an immediate sense for Business Ready Security in the here and now, we suggest watching this video about a customer called Exostar. You can also read more about Business Ready Security in a Q&A with general manager Doug Leland.

Exostar Product Focus

There are three main tenets to Business Ready Security:

One, we are providing protection that spans the breadth of a company’s systems and data while allowing access for employees, based on their identity, from virtually anywhere. For example, today we are introducing Forefront Online Security for Exchange, the first of our Forefront Online services. Note that we have expanded the Forefront brand to cover our portfolio of identity and security solutions. Our Identity Lifecycle Manager product is now officially named Forefront Identity Manager.

Two, we aim to make security experiences and compliance management much simpler and cost-effective for both IT and businesspeople. In support of this, today we released beta 2 of Forefront “Stirling” our integrated security suite.

Three, we want to help customers integrate and extend security across the entirety of their enterprises. That means continuing to build security into Windows and our IT software solutions. It also means interoperating with non-Windows environments through partnerships and open standards Case in point: Today we are also announcing a broad group of companies supporting and extending the capabilities of Forefront “Stirling,” including Brocade, Guardium, Imperva, Juniper Networks, Kaspersky, Q1 Labs, StillSecure, Sourcefire, Inc. Tipping Point and RSA.

A number of analysts are weighing in on the topic of enterprise security, too. You can view videos and download a white paper from the Enterprise Strategy Group here.

We’ll be discussing this strategy more at next week’s RSA conference and beyond. Stay tuned for more info.

The Microsoft Identity and Security Strategy

Forefront Blogger — Thu, 16 Apr 2009 06:43:00 GMT

Tomorrow the identity and security team at Microsoft will unveil new information about its strategy to help customers better manage risk, protect their environments and better realize their business goals. This new approach, and the related product and partner news, builds on last July's creation of the Identity and Security Division.

Look for news and information tomorrow on this page and on our PressPass site.

Thanks,

The identity and security team.

SIR volume 6

Forefront Blogger — Fri, 10 Apr 2009 04:11:00 GMT

Yesterday Microsoft published volume 6 of its Security Intelligence Report. For those not familiar with the SIR - it provides in-depth perspective on the changing threat landscape, as well as countermeasures, based on data from hundreds of millions of Windows users and some of the busiest online services on the Internet.

Just a few of the many insights and findings:

As operating systems become more secure, vulnerabilities are predominantly in the application layer, making software attacks more prevalent with third-party software vendors, Web services providers and original equipment manufacturers.
Computers running Microsoft Forefront Client Security (typically found in corporate environments) were much more likely to encounter worms than home computers running Windows Live OneCare. Home computers also encountered significantly greater percentages of trojans, trojan downloaders and droppers, adware and exploits. Similar percentages of backdoors and spyware were detected by both products. These results are likely due to the different ways people use computers at home and for business. For instance, home computers may be used to browse social networking sites or download media, exposing them to different attack vectors than computers used primarily for business needs
Stolen and lost equipment continued to account for 50 percent of all reported security breaches in the second half of 2008. Stolen equipment was the top reason reported for data loss at 33.5 percent, with lost equipment accounting for 16.5 percent. Less than 20 percent of reported security breaches in the second half of 2008 resulted from incidents caused by malicious software.

The key finds summary is available in 10 languages here. The "Vinny and Tim Show" video also provides a good overview.