Winodws 7 Security Story Core

1. Enhance Security and Control Azra Rizal Security Advisor | DP&E | Microsoft Corporation

2. Windows 7 Enterprise Security Building upon the security foundations of Windows Vista, Windows 7 provides IT Professionals security features that are simple to use, manageable, and valuable. Fundamentally Secure Platform Protect Users & Infrastructure Securing Anywhere Access Protect Data from Unauthorized Viewing Windows Vista Foundation Streamlined User Account Control Enhanced Auditing Network Security Network Access Protection DirectAccessTM AppLockerTM Internet Explorer 8 Data Recovery RMS EFS BitLocker

3. Fundamentally Secure Platform Windows Vista Foundation Enhanced Auditing Streamlined User Account Control Make the system work well for standard users Administrators use full privilege only for administrative tasks File and registry virtualization helps applications that are not UAC compliant XML based Granular audit categories Detailed collection of audit results Simplified compliance management Security Development Lifecycle process Kernel Patch Protection Windows Service Hardening DEP & ASLR IE 8 inclusive Mandatory Integrity Controls

4. User Account Control Windows Vista System Works for Standard User All users, including administrators, run as Standard User by default Administrators use full privilege only for administrative tasks or applications Streamlined UAC Reduce the number of OS applications and tasks that require elevation Refactor applications into elevated/non-elevated pieces Flexible prompt behavior for administrators Challenges Customer Value User provides explicit consent before using elevated privilege Disabling UAC removes protections, not just consent prompt Users can do even more as a standard user Administrators will see fewer UAC Elevation Prompts Windows 7

5. Desktop Auditing Windows Vista Enhanced Auditing New XML based events Fine grained support for audit of administrative privilege Simplified filtering of “noise” to find the event you’re looking for Tasks tied to events Simplified configuration results in lower TCO Demonstrate why a person has access to specific information Understand why a person has been denied access to specific information Track all changes made by specific people or groups Challenges Granular auditing complex to configure Auditing access and privilege use for a group of users Windows 7

6. Securing Anywhere Access Network Security DirectAccessTM Network Access Protection Ensure that only “healthy” machines can access corporate data Enable “unhealthy” machines to get clean before they gain access Security protected, seamless, always on connection to corporate network Improved management of remote users Consistent security for all access scenarios Windows Firewall can coexist with 3rd party products Multi-Home Profiles DNSSec

7. Network Access Protection Remediation Servers Example: Patch Restricted Network Corporate Network Policy Servers such as: Patch, AV Health policy validation and remediation Helps keep mobile, desktop and server devices in compliance Reduces risk from unauthorized systems on the network Not policy compliant Policy compliant DHCP, VPN Switch/Router Windows Client NPS Windows 7

8. Remote Access for Mobile WorkersAccess Information Anywhere Situation Today DirectAccessTM Difficult for users to access corporate resources from outside the office Challenging for IT to manage, update, patch mobile PCs while disconnected from company network Same experience accessing corporate resources inside and outside the office Seamless connection increases productivity of mobile users Easy to service mobile PCs and distribute updates and polices Windows 7 Solution

9. Protect Users & Infrastructure AppLockerTM Data Recovery Internet Explorer 8 Protect users against social engineering and privacy exploits Protect users against browser based exploits Protect users against web server exploits File back up and restore CompletePC™ image-based backup System Restore Volume Shadow Copies Volume Revert Enables application standardization within an organization without increasing TCO Increase security to safeguard against data and privacy loss Support compliance enforcement

10. Application Control Situation Today AppLockerTM Eliminate unwanted/unknown applications in your network Enforce application standardization within your organization Easily create and manage flexible rules using Group Policy Users can install and run non-standard applications Even standard users can install some types of software Unauthorized applications may: Introduce malware Increase helpdesk calls Reduce user productivity Undermine compliance efforts Windows 7 Solution

11. AppLockerTM Technical Details Simple Rule Structure: Allow, Exception & Deny Publisher Rules Product Publisher, Name, Filename & Version Multiple Policies Executables, installers & scripts Rule creation tools & wizard Audit only mode

12. Building on IE7 and addressing the evolving threat landscape Social Engineering & Exploits Reduce unwanted communications Freedom from intrusion International Domain Names Pop-up Blocker in IE7 Increased usability Browser & Web Server Exploits Protection from deceptive websites, malicious code, online fraud, identity theft Protection from harm Secure Development Lifecycle Extended Validation (EV) SSL certs SmartScreen® Filter Domain Highlighting XSS Filter/ DEP/NX ActiveX Controls Choice and control Clear notice of information use Provide only what is needed Control of information User-friendly, discoverable notices P3P-enabled cookie controls Delete Browsing History InPrivate™ Browsing & Blocking Internet Explorer 8 Security

13. Protect Data from Unauthorized Viewing RMS BitLocker EFS User-based file and folder encryption Ability to store EFS keys on a smart card Easier to configure and deploy Roam protected data between work and home Share protected data with co-workers, clients, partners, etc. Improve compliance and data security Policy definitionand enforcement Protects information wherever it travels Integrated RMS Client Policy-based protection of document libraries in SharePoint

14. Data Protection Scenarios

16. Gartner “Dataquest Insight: PC Forecast Analysis, Worldwide, 1H08” 18 April 2008, Mikako Kitagawa, George Shiffler III Windows 7 Solution

17. BitLocker Technical Details BitLocker Enhancements Automatic 200 Mb hidden boot partition New Key Protectors Domain Recovery Agent (DRA) Smart card – data volumes only BitLocker To GoTM Support for FAT* Protectors: DRA, passphrase, smart card and/or auto-unlock Management: protector configuration, encryption enforcement

18. Windows 7 Enterprise Security Building upon the security foundations of Windows Vista, Windows 7 provides IT Professionals security features that are simple to use, manageable, and valuable. Fundamentally Secure Platform Protect Users & Infrastructure Securing Anywhere Access Protect Data from Unauthorized Viewing Windows Vista Foundation Streamlined User Account Control Enhanced Auditing Network Security Network Access Protection DirectAccessTM AppLockerTM Internet Explorer 8 Data Recovery RMS EFS BitLocker

19. AD RMS & DLP

20. Convergence of DLP and RMS Centralized Policy Policies Pushed into Infrastructure Enable advanced workflow Identify and Classify Data Leverage Controls to Protect Data Block Warn RMS Monitor

23. Built-in approach to protect data based on content, context, identity