Johann's Unified Communications : security

Forefront Security for Office Communications Server Now Available

jkruse — Wed, 18 Mar 2009 03:56:05 GMT

Microsoft Forefront Security for Office Communications Server (FSOCS) provides fast and effective protection against IM-based malware by including multiple scanning engines from industry-leading security partners and can help to reduce corporate liability by blocking IM messages that contain inappropriate content.

The layered, multiple antimalware engine approach provides comprehensive protection against the latest threats, while file and keyword filtering technologies prevent the sharing of out-of-policy files, unauthorized corporate confidential information, or offensive language in IM conversations. Forefront Security for Office Communications Server integrates with Microsoft Office Communications Server to provide high-performance malware scanning optimized for instant messaging environments.

Forefront Security for Office Communications Server includes automated signature updating, IM notification alerts, and built-in management controls to simplify administration.

More information here, and you can download a trial of Forefront Security for Office Communications Server here.

Exchange critical patch

jkruse — Wed, 18 Feb 2009 09:47:15 GMT

Just in case you’re not on the security announcement lists….

Executive Summary

This security update resolves two privately reported vulnerabilities in Microsoft Exchange Server. The first vulnerability could allow remote code execution if a specially crafted TNEF message is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could take complete control of the affected system with Exchange Server service account privileges. The second vulnerability could allow denial of service if a specially crafted MAPI command is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could cause the Microsoft Exchange System Attendant service and other services that use the EMSMDB32 provider to stop responding.

More information and guidance on fixing the vulnerability at http://www.microsoft.com/technet/security/bulletin/MS09-003.mspx

Edge Planning Tool for OCS 2007

jkruse — Mon, 25 Aug 2008 03:20:00 GMT

Confused about Edge Server configuration and security? The best idea is to come to UNC316: Office Communications Server 2007 Security: Architecture and Edge Services with Derrick Buckley and Craig Pringle at Tech.Ed in Sydney next week :)

But if you can't make it to Tech.Ed then it might be worthwhile checking out the Edge Planning Tool.

The Edge Planning Tool asks questions about your proposed or current edge server deployment. The tool uses your answers and Microsoft Office Communications Server 2007 best practices to generate the following reports:

Settings that you can use to configure your certificates, DNS services, and firewalls
Custom documentation for configuring your edge servers, reverse proxy, and next hop server
A comparison of your answers to Microsoft Office Communications Server 2007 best practices

Download it from http://www.microsoft.com/downloads/details.aspx?FamilyID=149e5dd5-eaae-46b6-afba-01c31e88a275&displaylang=en

Share this post :

Designing Your Perimeter Network for Office Communications Server 2007 White Paper

jkruse — Thu, 17 Jul 2008 01:12:37 GMT

This paper answers questions about Office Communications Server 2007 with specific regard to its integration into the perimeter network (also known as DMZ, demilitarized zone, or screened subnet).

The first section, “Commonly Asked Questions,” answers key design questions from customers about the initial stages of product deployment.

The second section, “Architecture and Networking Best Practices,” explores ways to prepare for the edge servers in the perimeter network, taking into consideration issues of physical deployment, ways to ensure a publicly routable IP address, firewall configuration, and load-balancing concerns.

Download the whitepaper at http://www.microsoft.com/downloads/details.aspx?FamilyId=E4A8D703-E41A-47D9-B9DD-2799F894AF92&displaylang=en

Share this post :

Information on A/V Edge Ports and Public IP Addresses

jkruse — Mon, 31 Mar 2008 14:04:00 GMT

I often get asked why the OCS AV Edge server requires a public IP address. The best explanation I've seen was recently posted by Alan Shen over at the OCS Team Blog.

The A/V edge server enables users to participate in audio and video connections from outside the corporate network, such as a point to point call, a conference, leaving a voicemail with Exchange UM, or making a PSTN call. Contoso has deployed the A/V Edge server with two NICs in the perimeter network. The “external” firewall separates the edge server from the internet and the “internal” firewall separates the server from the corporate network. In order for the A/V Edge server to function correctly, the internal firewall must allow traffic to UDP 3478, TCP 443, and TCP 5062 (A/V authentication port). And the external firewall must allow bi-directional traffic to the following ports: UDP 3478, TCP 443, UDP 50,000-59,999, and TCP 50,000-59,999. No NATing behavior is allowed on either firewall. The external IP address must be publically routable and the internal IP address must be routable from within the corporate network.

Read the rest of the article at http://communicationsserverteam.com/archive/2008/03/25/133.aspx

Share this post :

IM me!

Technorati Tags: ocs, edge, security

UC Certificate Partners for Exchange and OCS 2007

jkruse — Fri, 08 Feb 2008 02:32:04 GMT

Exchange 2007 and Office Communications Server 2007 have strict requirements for external/public certificates - specifically the use of Subject Alternative Name (SAN) certificates, aka Unified Communications Certificates.

We have a KB article (kb929395) which lists some of the providers of these UC certs.

INTRODUCTION

Microsoft works with public X.509 certification authorities (CAs) to make sure that Microsoft Exchange Server customers can obtain the certificates that they require in order to use Microsoft Exchange Server 2007 for the Domain Security feature to enable secure client access from the Internet.
Microsoft also works with CAs in order to make sure that Microsoft Office Communications Server 2007 customers can obtain certificates that they require for Communications Server 2007 servers.

http://support.microsoft.com/kb/929395

Share this post :

IM me!

Technorati Tags: uc, ocs, setup, security, certificates

OCS 2007 security guide available for download

jkruse — Mon, 15 Oct 2007 04:03:38 GMT

The security guide provide guidelines for assessing and managing security risks to your Office Communications Server 2007 deployment.

Even if your Office Communications Server 2007 deployment is modest, you probably have components in your network that are themselves the subject of books devoted to their security. Therefore, it is unlikely that this guide covers all aspects of security for all components and areas that are pertinent to your deployment.

Use this guide as a starting point to help secure and maintain a secure Office Communications Server 2007 deployment. This guide provides general guidelines and best practices for assessing and managing the most common security risks. Additional product and security resources are listed at the end of this guide. As new threats and solutions arise, outdated documents, solutions, and methods should be replaced with new ones.

The guide addresses the following:

Common Security Threats

Office Communications Server Security Framework

Addressing Threats to Your Core Infrastructure

Addressing Threats to Your Internet Boundary

Addressing Threats to On-Premise Conferencing

Addressing Threats to Enterprise Voice

Addressing Threats to the Office Communicator 2007 Client

Download it from http://www.microsoft.com/downloads/details.aspx?FamilyId=2D1EA693-25E0-43D9-8C5C-0822EF83955A&displaylang=en

Technorati Tags: ocs, security, doco

Windows Mobile 5/6 in Common Criteria Evaluation

jkruse — Wed, 18 Jul 2007 10:20:44 GMT

Excellent news on the security front for Windows Mobile 5 and 6.

Windows Mobile 5.0 and 6.0 is now on the DSD Evaluated Products List (EPL) list -http://www.dsd.gov.au/infosec/evaluation_services/epl/epl.html

Technorati Tags: wm5, wm6, security

Exchange 2007 certificates

jkruse — Thu, 05 Jul 2007 06:31:00 GMT

While I was having lunch with one of our Exchange Engineers today I asked "what is the most common support call that comes in for Exchange 2007?".

The answer was certificates - customers can be confused about what type of certificate to get, what hostnames are used (most customers use different namespace internally than they do externally), what requirements TLS has, and of course they are completely unaware of things like Subject Alternative Name.

Fortunately there is a great post at You Had Me At EHLO that explains more about this issue and how it can affect your Exchange deployment.

http://msexchangeteam.com/archive/2007/07/02/445698.aspx

Technorati Tags: exchange 2007, certificates

How to protect your IM infrastructure

jkruse — Fri, 25 May 2007 02:07:13 GMT

After reading about the latest worm to infect public IM networks, I wanted to quickly post about how enterprises can protect their LCS infrastructure from these attacks.

We have a free tool for LCS called the Intelligent Message Filter

The Intelligent Instant Message Filter program helps protect your Microsoft Office Live Communications Server deployment against the spread of the most common forms of virus with minimal degradation to the user experience.

The Intelligent Instant Message Filter program is a managed program that can be installed on the following Live Communications Server roles:

Live Communications Server 2005 with SP1, Standard Edition

Live Communications Server with SP1, Enterprise Edition

Live Communications Server with SP1, Access Proxy

Live Communications Server with SP1, Proxy Server

Live Communications Server with SP1 is the minimum version required. The Intelligent IM Filter is not supported on Live Communications Server 2005 without SP1.
The Intelligent Instant Message Filter program enhances the functionality of the IMFilter program, which is installed by default on all Live Communications Servers with SP1, by providing the following:

Enhanced URL filtering

Enhanced file filter control

Logging capabilities

Enhanced URL Filtering

By using the Intelligent Instant Message Filter program, you can configure URL filtering based on the following options available on the URL Filter tab:

Allow hyperlinks to be sent in any conversation. If this option is selected, the hyperlink is active (clickable) or inactive depending on the client configuration. By default, URLs are sent as inactive in Microsoft Office Communicator 2005. The client behavior can be controlled by a GPO policy.

Allow local intranet URLs. If this option is selected, local intranet URLs are permitted in instant message conversations, regardless of the other settings. Be aware that local intranet URLs are defined on each individual Live Communications Server in the Internet Explorer security tab. This Internet Explore setting on each Live Communications Server determines what types of links the server recognizes as an intranet link.

Block all intranet and Internet hyperlinks that contain any of the file extensions defined on the File Transfer Filter tab. If this option is selected, the Intelligent IM Filter blocks any active intranet or Internet hyperlink that contains a file with an extension listed on the File Transfer Filter tab. When the instant message is blocked, an error message is returned to the sender.

Block instant messages that contain hyperlinks. If this option is selected, Intelligent IM Filter blocks the delivery of any instant message that contains a hyperlink, and an error message is sent back to the client. This is the behavior of the IMFilter program, which is installed by default with Live Communications Server 2005 with SP1.

Allow instant messages that contain hyperlinks, but convert the link to plain text. If this option is selected, the program prefixes the hyperlink with an underscore so the hyperlink is not functional and the user cannot click it. Instead, the user must copy the URL, remove the underscore, and paste it into a Web browser to access the site. When you select this option, you can also customize a notice that is sent to users at the beginning of each instant message containing a hyperlink.

Allow instant messages that contain active hyperlinks If this option is selected, the Intelligent IM Filter permits instant messages with active hyperlinks. You can also configure a warning that you want to insert at the beginning of each instant message to notify users of the potential danger of clicking on a link.

Enhanced File Transfer Control

The Intelligent IM Filter program controls how file transfers are enabled in a Live Communications Server deployment. The file transfer feature can also be disabled on the client using a GPO policy.
The following options are available on the server side using the Intelligent IM Filter:

Allow any file transfer request through the server: If this option is selected, file transfer filtering is disabled, and any file transfer request going through the server is routed.

Block file transfer requests for specific file extensions: If this option is selected, the administrator can specify file extensions that should be blocked by the server in file transfer requests. File transfer requests that contain defined file extension are blocked by the server, and an error message is returned to the client.

Block ALL file transfer requests: If this option is selected, all file transfer requests are blocked by the server.

Logging Features

Live Communications Server 2005 Intelligent IM Filter offers logging capabilities so that you can monitor the SIP messages

In addition to the capabilities provided by the Intelligent Message Filter, we also have advanced anti-virus capabilities with Antigen for LCS.

Read more at http://www.microsoft.com/antigen/prodinfo/datasheets/default.mspx
Try a virtual lab at http://www.microsoft.com/technet/traincert/virtuallab/antigen.mspx