Forefront Team Blog : Intelligent Application Gateway

Dark Reading, customers and analysts on TMG

Forefront Blogger — Mon, 07 Dec 2009 21:17:00 GMT

Leading security news site Dark Reading reports on the release of Forefront Threat Management Gateway - including some insightful quotes:

Analyst Rob Enderle: "By focusing on the employee, Microsoft is beginning to address what I believe are some of the most vulnerable parts of the current enterprise. With this, Microsoft is beginning to transition from a company trying to catch up to the market to one that is trying to lead it."

Analyst Chenxi Wang, principal analyst for security and risk management at Forrester. "This is a major step up from what ISA could do in securing Web access. If Microsoft wants to play more in the enterprise security game, it needs to add more functionality to it, and they did in this release."

Customer George Podolak of Architectural firm Pei Cobb Freed & Partners, a TMG customer, uses the gateway to protect both its end users and the business from malware when its users visit social networking or other sites. "I'm not against Facebook [and we allow our users to access it], but when you're using it, we don't want you to wander off to a malware site."

New Forefront enterprise security solutions for safe, productive web surfing and remote access

Forefront Blogger — Thu, 03 Dec 2009 09:00:00 GMT

Following the last month’s launch of Forefront Protection for Exchange, today we are announcing more progress for our Business Ready Security strategy with the release of two new solutions: Forefront Threat Management Gateway 2010 (TMG) and Forefront Unified Access Gateway 2010 (UAG.)

These solutions address two key endpoint security challenges. TMG, available for evaluation and purchase now, helps companies provide safe employee web browsing. UAG, which will release to manufacturing in mid December and be generally available shortly thereafter, enables organizations to give employees (and trusted partners and vendors) secure remote access to corporate resources.

Forefront Threat Management Gateway 2010

Today’s information workers require web access to do their jobs, but web-based threats continue to rise. For example, the recent Microsoft Security Intelligence Report indicated that phishing rose significantly in the first half of 2009, quadrupling in May, and that social networking sites accounted for 76% of all phishing impressions. Securing web use is traditionally challenging for security administrators. Multiple products and vendors create high costs and management difficulty through “security sprawl.”

TMG is a secure web gateway that enables safe employee web use through comprehensive protection against malware, malicious web sites and vulnerabilities. Building on its predecessor, ISA Server 2006, TMG provides new URL filtering, anti-malware, and intrusion-prevention technologies to protect businesses against the latest web-based threats. These technologies are integrated with core network protection features such as firewall and VPN to create a unified, easy-to-manage gateway.

One of the most exciting features of TMG is its use of Microsoft Reputation Services – a new cloud-based system hosted by Microsoft which maintains a centralized database of 45 million (and growing!) web domains and billions of web pages to help customers identify and block malicious web sites. It pulls data from multiple sources, such as Hotmail, the same technology that powers SmartScreen in Internet Explorer 8, the Windows Live Security Platform, and more than 10 partners, such as Brightcloud, M8e6 and FutureSoft. The TMG/ISA blog provides a great overview of TMG and its URL filtering capabilities.

Forefront Unified Access Gateway 2010

Building on its predecessor, Intelligent Application Gateway, UAG enables remote access via managed and unmanaged PCs and mobile devices. Integrating a deep understanding of applications, the health state of end user devices, and the user’s identity – UAG enforces granular access controls, ensures security, and reduces management costs and complexity.

While UAG provides a variety of connectivity options such web publishing and SSL VPN tunnels, one of the best new features is UAG’s support and enhancements for Windows DirectAccess (DA). DA is the future of remote access allowing for seamless, always-on connectivity. Always-on keeps users happy as they are continually productive, but it also keeps administrators content as users are “always-managed.” UAG helps make DA deployments simpler, more extensible and easier to scale.

Follow Forefront on Twitter

Forefront Blogger — Mon, 30 Nov 2009 19:11:00 GMT

If you are a Twitter fan, be sure to follow us at http://twitter.com/MS_Forefront ! Our own John "JG" Chirapurath, senior director in the MSFT Identity and Security Business Group, is leading the Forefront Tweet charge in his typically pithy way. Come join the conversation about all things identity and security.

Joel Sider

Forefront Protection 2010 for Exchange Server launches

Forefront Blogger — Mon, 09 Nov 2009 04:56:00 GMT

Today at the TechEd Europe conference, in conjunction with the launch of Exchange Server 2010, Microsoft launched Forefront Protection 2010 for Exchange Server. The product and evaluation software is available now.

Part of our Business Ready Security strategy, Forefront Protection for Exchange (FPE) offers multiple anti-malware engines for 38 times faster detection than single engine solutions, and 99% guaranteed spam protection with only one in 250,000 spam false positives. Customers also have the choice of using the hosted Forefront Online Protection for Exchange service, or both offerings together for defense-in-depth.

Like all of our Forefront solutions, FPE is designed to help companies balance the needs of business with security requirements. Email is an extremely critical application, of course, and it presents challenges to both businesspeople and IT managers. Employees (and non-employees) needs secure access to messaging and documents from anywhere, as well as a spam-free inbox and protection from malware. On the other hand, IT must manage multiple sites and devices, ensure information protection and compliance, and ward off financially-motivated threats.

Combined with Exchange 2010 and other Microsoft identity and security technologies, FPE is part of Microsoft’s comprehensive solution for secure messaging. (It’s worth watching a video presentation on the whole solution here, in fact.)

New features in Forefront Protection 2010 for Exchange Server include:

· Premium antispam protection, with 99% detection rate, less than 1 in 250,000 false positives, and backscatter filtering

· New user interface with dashboard view of detection statistics and health monitoring

· Antispyware scanning provided by the Microsoft Antimalware Engine

· Support for Exchange 2010, Windows PowerShell, and Hyper-V

· Standardized installation using MSI installer

Already a number of customers have deployed FPE with success. Quotes from two:

“Forefront Protection 2010 for Exchange Server goes hand-in-hand with Exchange Server 2010. We wouldn’t put anything else for e-mail security on our Exchange Server 2010.” Jonathan Wynn, IT Manager– Del Monte Foods.

“Implementing Forefront Protection 2010 for Exchange Server was an easy decision for us following the success of our previous Forefront Security for Exchange Server implementation.” George Podolak, Director of IT, Pei Cobb Freed & Partners

Forefront secure messaging screencast & interview

Forefront Blogger — Wed, 04 Nov 2009 00:15:00 GMT

Cristian Mora Aguilar, Forefront Technical PM, starts off by briefly telling us about Microsoft's secure messaging solution and what business problems it resolves. He then gives us a screencast / demo of some of the cool scenarios enabled and problems solved with the secure messaging solution. Find out how Microsoft products help secure Microsoft Exchange Server.

http://edge.technet.com/Media/Forefront-Secure-Messaging-screencast-and-interview/

Direct Access and UAG video - Deep dive with a Program Manager

Forefront Blogger — Tue, 27 Oct 2009 16:15:00 GMT

Ben Bernstein and Stephen Bowie tell us what the value is for Forefront Unified Access Gateway (UAG) with Direct Access (DA).

After this, we do a whiteboard of UAG + DA architecture, including explaining how it works with multiple UAG servers. Here's how the rest of the interview breaks down:

How UAG supports legacy IPv4 clients (Marker 3 @ 8:02)

How does the client know to connect to the proper DNS server and not the one from the local ISP? (Marker 4 @ 13:17)

How do we know it's securely talking to the proper DNS server? (Marker 5 @ 15:01)

What other components on UAG enable DA? (Marker 6 @ 16:10)

Additional value add for UAG with DA (Marker 7 @ 17:55)

http://edge.technet.com/Media/Direct-Access-and-UAG-video-Deep-dive-with-a-Program-Manager/

MSFT Identity and Access news: Forefront Identity Manager RC1 and ADFS 2.0 SAML interoperability

Forefront Blogger — Wed, 30 Sep 2009 16:00:00 GMT

The RC1 release of Forefront Identity Manager 2010 (FIM) is available today here. The next version of Identity Lifecycle Manager 2007, FIM 2010 dramatically improves enterprise identity management by delivering powerful self-service capabilities for Office end-users, rich administrative tools and enhanced automation for IT professionals, and .NET and WS-* based extensibility for developers. The final release is slated for the first quarter of 2010.

What’s new in FIM RC1:

· Significant performance and scalability improvements across the product.

· Key feature enhancements, including management policy rule (MPR) explorer and capability to enable/disable MPR’s, usability improvements in the portal and ability to disable batch approve/reject of membership requests if needed. Also, a System Center Operations Manager (SCOM) management pack and configuration migration tools are new for RC1.

· The FIM 2010 user interface has enhanced usability and layout in many areas, resulting directly from RC0 customer feedback.

· The product is now rebranded as Forefront Identity Manager 2010, with a few exceptions, replacing the old “ILM 2” codename.

FIM is part of Microsoft’s continued, far-reaching commitment to enabling more secure, identity-based access to applications - on-premises and in the cloud, from virtually any location or device.

This commitment includes other solutions, such as Forefront Unified Access Gateway, and capabilities in the Windows platform, such as Active Directory Federation Services 2.0 (formerly known by codename “Geneva.”) ADFS 2.0 uses identity federation to extend Active Directory authentication and single sign-on to cloud-based services, hosted by Microsoft or others, so IT can gain flexibility and cost savings but avoid managing extra user accounts and passwords.

Another key part of our efforts in identity and access management is work across the industry to ensure interoperability. Today, for example, Microsoft was part of a Kantara Initiative and Liberty Alliance announcement. ADFS passed SAML 2.0 interoperability testing, meaning it will interoperate with heterogeneous environments and provide federation.

And, also, this week the Organization for the Advancement of Structured Information Standards (OASIS) is holding its Identity Management 2009 conference. Microsoft is a sponsor and participating in sessions and discussion around helping governments transparently manage citizens' identities and access to information. Lee Nackman, Microsoft vice president of the Identity and Security Division, is quoted in the OASIS press release.

"Promoting widespread use of secure and trustworthy digital identities, while preserving personal privacy and protecting civil liberties, is a critical challenge for governments and the technology industry. Working with government leaders, industry partners and consortia like OASIS, Microsoft is committed to the technical and policy innovation needed to provide citizens with safe access to resources and services, in both the public and private sectors. Identity Management 2009 will provide an ideal forum for knowledge sharing and collaboration in this area."

Steve Ballmer on The New Efficiency

Forefront Blogger — Tue, 29 Sep 2009 20:56:00 GMT

Making business decisions regarding IT investment is tougher than ever. To help, today Microsoft hosted a special VIP Business Leadership Roundtable event. CEO Steve Ballmer and moderator Robert Youngjohns, President of the Microsoft US Subsidiary, discussed major trends in the new role of technology in the workplace. Ballmer and Youngjohns were joined by a panel of early adopter customers representing key industries like automotive, hospitality, transportation and IT. Attendees got a close look at how real companies are making IT investments across the desktop, server, network and beyond.

How IT needs to keep pace with increasingly sophisticated users
The ever more mobile and distributed workforce, and
The impact of greater industry regulations and ongoing threats to data.

Forefront identity and security solutions, and our Business Ready Security strategy, are core parts of the way Microsoft is helping customers tackle these issues. You can view highlights of today's event and get lots of info on the range of Microsoft IT solutions - including a Business Ready Security overview, Secure Messaging, Secure Collaboration, Identity and Access Management and Information Protection at www.TheNewEfficiency.com

Forefront Unified Access Gateway beta 2

Forefront Blogger — Tue, 14 Jul 2009 01:04:00 GMT

I’m very pleased to announce that today Forefront Unified Access Gateway Beta 2 is available for download from www.microsoft.com/uag . This beta release marks an important milestone in Microsoft’s remote access strategy as it brings together a host of access technologies into one environment.

Chances are you are reading this post from your laptop… and if you’re not currently outside of the corporate network, chances are you will be later today… You might be at home checking your email and getting some last minute work items done… That’s what UAG is all about! It’s about making sure that you, the user, remain as productive as you need to be regardless of what machine or network you are accessing from. Of course, it’s also about making sure that your company’s network and assets remain secure as you work remotely.

We know that when they say that “one size fits all”, it usually means that it fits some people well and the rest of us need to compromise. The same is true with remote access... Each technology is best suited for a different scenario/environment and the trick is to make sure you get the right one for the right task. A VPN client would be overkill for casual access from a kiosk or stealing a minute of time on your friend’s PC at home to check email… On the other hand, being limited to web-access only from your corporate laptop will leave you unfulfilled and wanting more. Unfulfilled, in this case also means: unproductive. That said, having multiple methods of remote access also translates to multiple $$$’s. Each environment needs to be well-managed, supported, scaled, etc. No less important is that each user needs to remember which environment is best to use in which scenario to easily achieve productivity. This means you’re doing less with more and that’s not good… and not just in this economy.

So here’s how UAG solves the problem…. It brings together a variety of remote access technologies such as DirectAccess, SSL VPN, Remote Desktop, web publishing, etc. under one roof and one user/admin experience. This way, administrators can easily roll out access to every type of user (employees, partners, etc) from virtually every location (corporate laptop, home PC, borrowed PC, kiosk, PDAs, etc). Users, in turn, get a simple and straightforward experience that adapts to the level of security of device they are using. If they come in from a corporate machine, they can get full connectivity through DirectAccess or for down-level PCs - SSL VPN. If they come from home PCs or borrowed PCs access policies will be tailored to their specific security. For instance, if they don’t practice safe-computing and don’t have an Anti-Malware software installed, running and up-to-date – UAG can decide to block access to uploads so no potentially harmful files will reach the network. If the user has an updated AV we may allow uploads but consider blocking downloads based on whether or not the Endpoint Session Cleanup (formerly: Attachment Wiper) can run to clean up any residue or temp files.

The policy options are limitless but they are also simple. Built in policies and administrative wizards help guide through setting up SharePoint, Exchange, DirectAccess, Terminal Services and much more….

The features I’m most excited about in UAG are our enhancements for DirectAccess. DirectAccess is really the next step of remote access and provides the best user experience possible. Wherever you may roam, you are simply connected, always-on, to corpnet. There is no need to open a VPN client, wait for connectivity, etc… You simply login and you are connected! What UAG brings to the table is a variety of capabilities to help simplify deployment and management, extend access to older servers and clients and grow the scale of the deployment. If you’re not yet looking at DirectAccess for your organization, you should…. And if you’re looking at DirectAccess you should look at UAG!

I could go on and on about the features and capabilities but why hear it from me?! Go and download the beta and see for yourself.

For more information you may want to try:

· The UAG engineering blog

· UAG website

· UAG TechNet Center

· DirectAccess site and UAG DirectAccess page.

Uri Lichtenfeld

Product Manager - UAG

Business Ready Security news at WPC

Forefront Blogger — Mon, 13 Jul 2009 19:01:00 GMT

This week in New Orleans Microsoft is hosting its annual Worldwide Partner Conference. We made several announcements today at the conference about our identity and security solutions. This news is part of our Business Ready Security strategy to help both partners and customers 1) protect everywhere and access anywhere, 2) integrate and extend security across the enterprise, and 3) simplify the security experience and manage compliance

Official names and pricing for “Stirling”

Forefront codename “Stirling” - the next generation of the Forefront Security Suite for integrated, comprehensive protection across endpoints, servers and the edge – will be officially known as Forefront Protection Suite (FPS).

FPS will include the products in the current suite, plus the Forefront Protection Manager (formerly known as the “Stirling” management console) and the Forefront Threat Management Gateway Web Security Service.

FPS pricing will remain the same as the current Forefront Security Suite and all of the component solutions will continue to be licensed on a subscription basis. They will also be available independently, with Forefront Protection Manager included. (Note that the Forefront Threat Management Gateway license is sold separately on a per processor basis.)

At WPC we are also announcing the following new product solution names:

· Forefront Endpoint Protection 2010 - current version is Forefront Client Security

· Forefront Protection 2010 for Exchange Server - current version is Forefront Security for Exchange Server

· Forefront Protection 2010 for SharePoint - current version is Forefront Security for SharePoint

· Forefront Online Protection for Exchange - currently called Forefront Online Security for Exchange

· Forefront Threat Management Gateway Web Security Service - the next generation of ISA Server 2006.

The new FPS solutions are currently in beta and final versions will ship over the course of the latter half of 2009 and the first half of 2010.

Public beta 2 of Forefront Unified Access Gateway

Forefront Unified Access Gateway beta 2 is available for download at www.microsoft.com/forefront. UAG provides secure, virtually anywhere access to messaging, collaboration and other applications, increasing productivity and policy compliance. UAG also extends the benefits of Windows DirectAccess across the enterprise, enhancing scalability, deployment and management.

Official name for “Geneva”

The three components of Microsoft “Geneva” – the upcoming open platform providing simplified user access and single sign-on for cloud and on-premises applications – have the following names:

· Active Directory Federation Services – formerly known as “Geneva” Server

· Windows Identity Foundation – formerly known as “Geneva” Framework

· Windows Cardspace – same as current version

Partner opportunities

At WPC partners will learn about how the solutions above offer tremendous opportunity to better meet the identity and security needs of customers...and to build their own businesses. Since announcing a $75 million investment in our partner ecosystem at WPC last year, we have seen very strong partner development and growth.

For example, we have seen a 50% increase in participation in the Security Software Advisors (SSA) program, which offers fees to partners who influence deployment. The Security Solutions Competency, which enables partners to differentiate themselves as experts, is one of the fastest growing competencies in Microsoft’s history and in the last year grew 46% in participation. This year we anticipate quadrupling the number of identity and security partners we support with training, marketing and customer engagement.

Server & Tools Business Exec discusses state of IT, answers your questions on June 23

Forefront Blogger — Thu, 18 Jun 2009 19:15:00 GMT

Are you interested in hearing about how other IT pros are reacting to economic conditions and where they’re investing (particularly security?)

Do you have questions about Microsoft’s efforts to help IT be more cost effective and deliver new solutions to business?

Is there a connection between virtualization and cloud computing?

On Tuesday, June 23rd from 10:30am – 11:00am (PDT), join a teleconference with Bob Kelly, corporate VP of Infrastructure Server Marketing. Bob will talk about the state of IT within the context of results from a new Harris Interactive study of 1,200 IT professionals from the U.S., United Kingdom, Japan and Germany. The study was commissioned by Microsoft’s Server & Tools Business. There will be time for your questions following the brief presentation. Submit questions over the phone or you can submit them at any time leading up to or during the teleconference by tweeting with the Twitter hashtag, #qs4ms. If you are interested in attending, please REGISTER NOW. Once you open the invite box, you can save and close to your calendar.

Trial and win!

Forefront Blogger — Thu, 28 May 2009 01:36:00 GMT

Check out the Forefront Trial Download Sweepstakes:

"Don’t miss the chance to win one of three $10,000 Grand Prize server systems for your home, a D-Link DNS-232 2-Bay Network Storage Enclosure, or a $50 Best Buy gift card instantly!

Now, through June 30, 2009, every time you download a different Microsoft Forefront trial software product, you’ll help keep your business safe and have a chance to win big in the Microsoft Forefront Trial Download Sweepstakes."

Self-Service Online HR to Save MOD Millions of Pounds Over 10 Years with

Forefront Blogger — Sat, 23 May 2009 01:26:00 GMT

The U.K. Ministry of Defence (MOD) is providing secure access to 10,000 “orphaned users” who work remotely and had no means of accessing internal administrative services. MOD worked with CapGemeni and is using Microsoft identity and security solutions, such as Identity Lifecycle Manager (next version to be called Forefront Identity Manager), ISA Server (next version Forefront Threat Management Gateway) and Intelligent Application Gateway 2007.

Ministry of Defence advisor to the CIO David Longhurst says: “With all our HR services now online, there will be savings in the back office which could amount to many millions of pounds over 10 years. The savings will far outweigh the cost of the implementation.”

Enabling productivity, saving money. Sounds like Business Ready Security. Read the MOD case study here.

Business Ready Security webcasts

Forefront Blogger — Wed, 20 May 2009 00:25:00 GMT

Register here for a new series of webcasts on the entire lineup of Forefront products supporting the Business Ready Security strategy. Starting tomorrow, webcast topics will include: Forefront Identity Manager, the Forefront "Stirling" security suite and component solutions, Forefront Security for Office Communications Server, Active Directory Rights Management Services, "Geneva," and more.

Business Ready Security and Windows 7

Forefront Blogger — Mon, 27 Apr 2009 22:40:00 GMT

Here's a quick video from the RSA Conference last week, grabbed from the Windows Security Blog. JG Chirapurath, director for MS Identity and Security, discusses how Forefront Client Security in "Stirling," Forefront Unified Access Gateway, and Windows Cardspace (part of "Geneva") all enhance the Windows 7 security experience.

A Look at Microsoft Forefront