Welcome to the Microsoft Security Newsletter - a monthly newsletter for IT professionals and developers bringing security news, guidance, updates, and community resources direct to your inbox. If you have suggestions or comments about the Microsoft Security Newsletter, please send us your feedback. To view an online version of this newsletter, please click here. If you would like to receive less technical security news, guidance and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter.
Viewpoint
|
|
By Michael Atalla, Group Product Manager, Microsoft Corporation
Identity is at the crux of the security challenges we face in responding to individuals' and organizations' imperative to connect. The way you address this challenge can determine how quickly your organization can realize pervasive, seamless connectivity to applications, information, and services. Take a measured approach and begin by learning more about the five key areas of identity.
|
Top Stories
|
|
At RSA Conference 2007, top executives from Microsoft outlined a vision for secure and easy "anywhere access" and a commitment to working with the industry to evolve networks, protection, and identity in an effort to achieve that vision for customers. Microsoft also announced a series of product developments, initiatives, and industry alliances including the upcoming availability of Microsoft Identity Lifecycle Manager 2007, the public beta of Microsoft Forefront Server Security Management Console, support for Extended Validation SSL certificates in Microsoft Internet Explorer 7, and new collaboration with industry partners to help combat phishing. Visit the Microsoft at RSA Web site for details and links to conference videos.
|
|
|
Microsoft Identity Lifecycle Manager (ILM) 2007 simplifies managing the life cycle of a user's digital identity by providing identity synchronization, certificate management, and user provisioning from a single solution. Learn more about this new product and the Microsoft identity lifecycle management vision by visiting the Microsoft ILM 2007 Web site and trying the product demo.
|
|
|
The U.S. Energy Policy Act of 2005, passed by the U.S. Congress July 2005, extended Daylight Saving Time (DST) in the United States. As a result, beginning in 2007, DST will start three weeks earlier (on March 11, 2007) and end one week later (on November 4, 2007), resulting in a new DST period that is four weeks longer than previously observed. Read this article for more information on the impact of this "extended DST period" and for recommended preparation steps.
|
|
|
The Fundamental Computer Investigation Guide for Windows provides U.S.-based IT professionals with information about the best practices and tools they need to investigate suspicious use of their organizations' computers and networks. The guide helps customers determine when to turn an investigation over to law enforcement and provides guidance on how to collect, preserve, analyze, and report on key data they uncover in their investigations -- using methods that will stand up in a court of law.
|
|
|
An array of new and in-development technologies is helping IT and security staffers automate security in ways that weren't possible a few years ago. As you consider your next security investments, keep an eye on these emerging technologies: USB tokens, built-in biometrics, self-aware Web applications, encrypted hard drives, and built-in mobile device protection.
|
Security Guidance
|
|
This article provides information to help you install Windows Rights Management Services (RMS) with Service Pack 2 (SP2) in an organization with an existing RMS deployment. Organizations that are deploying RMS for the first time can deploy RMS with SP2 by following the guidelines in Planning an RMS Deployment and Deploying an RMS System in this same documentation collection.
|
|
|
This collection of technical papers is designed to help organizations understand identity and access management issues and related solutions that can be achieved with Microsoft technologies in heterogeneous IT environments. Several code samples and configuration files accompany each paper.
|
|
|
Certificate Services is the essential component of a Windows-based public key infrastructure (PKI). If you deploy an application that is PKI-aware and you want to make use of the security capabilities offered by PKI, you will need Certificate Services. Read this article to learn how Certificate Services covers the request, issuance, enrollment, publication, maintenance, revocation, and expiration of certificates, and how it provides information assurance, meaning that measures are taken to safeguard aspects of information and information systems.
|
|
|
Microsoft Internet Security and Acceleration (ISA) Server 2006 provides controlled secure access between networks, and serves as a Web caching proxy providing fast Web response and offload capabilities, as well as secure Web publishing for remote access. Its multilayered architecture and advanced policy engine provide detailed control of the balance between the level of security you need and the resources that are required. This article provides guidelines for deploying ISA Server with best performance and adequate capacity.
|
|
|
This white paper details how to use ISA Server as an IPsec gateway or proxy within a Server and Domain Isolation solution, from preparation to installation and configuration, and includes best practices to keep in mind during the process. It is written for enterprise technical decision makers, IT administrators, and architects who want to gain a better understanding of the processes and implementation of ISA Server as an IPsec gateway or proxy to extend IPsec interoperability.
|
|
|
Whale's Intelligent Application Gateway is a comprehensive and customizable system based on a Secure Sockets Layer (SSL) virtual private network (VPN) connectivity platform to manage and secure application and network resource access. Read this article and learn more about the Intelligent Application Gateway, which consists of four elements: a SSL VPN platform, endpoint security, application security, and a unified policy management framework.
|
|
|
Learn how the Active Directory Federation Services (ADFS) solution in Windows Server 2003 R2 helps administrators enable organizations to share a user's identity information securely by addressing some of the commonly faced challenges.
|
This Month's Security Bulletins
Critical:
Important:
MVP Update
|
|
|
|
Microsoft MVP Rand Morimoto has been in the computer industry for more than 30 years and is the president of Convergent Computing, an information technology and security consulting firm recognized by Microsoft as "Partner of the Year – West Region" in 2006. A Ph.D. and Microsoft Certified Systems Engineer (MCSE), Rand is the author of a couple dozen books from Sams Publishing, including Windows 2003 Unleashed and Exchange 2007 Unleashed. Rand is also an advisor to the White House on Cyber-Security. He meets with the President of the United States every two weeks, and is the lead diplomat for the U.S. State Department, creating international consensus on Cyber-terrorism.
|
|
|
By Rand Morimoto, Ph.D., Microsoft MVP, MCSE
In this article, Microsoft MVP Rand Morimoto describes how his consulting group designed and implemented a Windows Rights Management Services (RMS) solution for a large corporate customer seeking a method to protect "sensitive" e-mails from being forwarded outside the organization.
|
Microsoft Product Lifecycle Information
Security Events and Training
|
|
It's more than what you learn. It's the impact you make when you get back to the office. Attend Tech-Ed 2007, June 4-8, in Orlando, FL, to learn how to more proactively and effectively protect your organization from attacks. Get in-depth information and advice from some of the best Microsoft and third-party security experts in the industry to take back and implement in your own organization. Register by April 6 and save US$200.
|
|
|
If you want to build a comprehensive SSL-secured access platform that will help you extend and manage the reach of your information systems, Check out these webcasts and other resources for in-depth guidance on edge solutions including ISA Server 2006 and the Whale Intelligent Application Gateway (IAG).
|
|
|
Get ready for Windows Vista, the new Microsoft desktop operating system. During these free webcasts, learn more about key Windows Vista product features and explore deployment, security, management, and productivity. See how advancements in security and reliability, along with operational efficiencies, can give you and your users confidence in your organization's PCs. During live webcasts, get answers to your Windows Vista during the question and answer session. Also, take part in our Windows Vista virtual labs and apply what you've learned in a guided, hands-on environment.
|
Upcoming Security Webcasts
|
|
Friday, February 23, 10:00 AM Pacific Time
|
|
|
Friday, February 16, 1:00 PM Pacific Time
This webcast will provide an overview of information on Microsoft products and resources available to help businesses prepare for the U.S. government-mandated change to Daylight Saving Time. Microsoft Information Technology will share the results of the company’s own internal testing and approach to updating systems.
|
Microsoft On-Demand Security Webcasts
| • |
|
| • |
Microsoft Vision and Strategy for Identity and Access Management
Identity and access (IDA) in connected systems has gone beyond a technical concern and become a top business issue as organizations look to reduce security risk, decrease operational costs, satisfy regulatory requirements, and deepen their electronic relationships with customers and partners. In this session, learn about Microsoft vision for identity and access technology, including the evolution of Active Directory (AD), Microsoft Identity Integration Server (MIIS), Windows CardSpace, and CLM.
|
| • |
Identity and Access Webcasts and Virtual Labs
This webcast and virtual lab series is designed to educate technical decision makers and IT professionals about Microsoft IDA solution areas centered around Windows RMS, ADFS, MIIS, CLM, and AD.
|
| • |
|
For IT Professionals: TechNet Webcasts
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
|
| • |
Information About Microsoft March Security Bulletins (Level 200)
Wednesday, March 14, 11:00 AM Pacific Time Christopher Budd, CISA, CISM, CISSP, ISSMP Security Program Manager, PSS Security, Microsoft Corporation and Mike Reavey, Lead Security Program Manager, Microsoft Corporation
|
| • |
|
For Developers: MSDN Webcasts
|
