套不同风格微软图表素材.ppt

第三篇图例篇 Corpnet Internet RADIUSAuthentication FederationthroughRADIUSproxiesCanbeusedforcentralizedauthenticationservicesDomainmembershipnotrequiredGreatforDMZplacement RADIUSServer IAS Back endServer WebClient Browser HTTPclient ISAServer2000 Old NetworkingModel Fixedzones IN LAT OUT DMZ InternetPacketfilteronlyonexternalinterfacesSingleoutboundpolicyNATalwaysStaticfilteringfromDMZtoInternet InternalNetwork Internet DMZ1 ISA2000 ISAServer2004NetworkingModel AnynumberofnetworksVPNasnetworkLocalhostasnetworkAssignedrelationships NAT Route Per NetworkpolicyPacketfilteringonallinterfacesSupportforDoDAnytopology anypolicy ISA2004 RuleStructure PolicyMapping BasicISA2000rulesProtocolrulesSiteandContentrulesStaticpacketfiltersPublishingrulesWebpublishingrulesSelectedfilteringconfigurationOtherISA2000rulesAddresstranslationrulesWebroutingrules Firewallpolicy Configurationpolicy actionontrafficfromuserfromsourcetodestinationwithconditions AllowDeny SourcenetworkSourceIPOriginatinguser DestinationnetworkDestinationIPDestinationsite ProtocolIPPort Type PublishedserverPublishedwebsiteScheduleFilteringproperties AnyuserAuthenticatedusersSpecificUser Group PolicyEngine NDIS TCP IPStack ISAServer2004Architecture FirewallEngine Firewallservice ApplicationFilterAPI AppFilter Webfilter Webfilter UserMode KernelMode SMTPFilter RPCFilter DNSFilter IIS5RequestProcessing Metabase INETINFO exe Request Response TCP IP X X FTP NNTP SMTP AFD WinSock IIS6 0RequestProcessing XMLMetabase Inetinfo FTP NNTP SMTP IIS6 0 Request Response ApplicationPools TCP IP WhatisRemoteAccessQuarantine Remoteaccessclientauthenticates Internet RASClient RRASServer IASServer Quarantine DetailedQuarantineProcess WMI MonitoredClients MonitoredServers SQL Collector Eventssubjecttotampering Eventsundercontrolofauditors Securitylogs Securitylogs Real TimeIntrusionDetectionApplications ForensicAnalysis ManagementSystem ACSArchitecturalOverview ExploitTimeline Vulnerabilityreported Securitybulletinandpatchreleased Wormorviruscodecreated Patchdeveloped Patchreverseengineered Wormorviruslaunched infectsunprotectedorunpatchedsystems NoExploit Exploit MBSA HowItWorks MSSecure xmlcontainsSecuritybulletinnamesProduct specificupdatesVersionandchecksuminfoRegistrykeyschangedKBarticlenumbersEtc WindowsDownloadCenter MSSecure xml MBSAComputer Policies Procedures Awareness PhysicalSecurity Perimeter InternalNetwork Host Application Data DefenseInDepth UsingalayeredapproachIncreasesattacker sriskofdetectionReducesattacker schanceofsuccess OShardening authentication patchmanagement HIDS Firewalls NetworkAccessQuarantineControl Guards locks trackingdevices Networksegments IPSec NIDS Applicationhardening antivirus ACLs encryption EFS Securitydocuments usereducation RequirementsForSuccessfulPatchManagement Products toolsautomation Projectmanagement Patchmanagementprocess Peoplewhounderstandtheirrolesandresponsibilities EffectiveProcesses EffectiveOperations ToolsandTechnologies PatchManagementProcess SUS HowItWorks ParentSUSServer WindowsUpdate ChildSUSServer Firewall ClientComputers ClientComputers SUS SampleDeploymentScenario MainOfficeSUSServer WindowsUpdate PilotSUSServer Firewall PilotClientComputers MainOfficeClientComputers RegionalClientComputers RegionalSUSServer SUSServer WindowsUpdateService Firewall SoftwareUpdateServiceSUSDeploymentScenario1 SoftwareUpdateServiceSUSDeploymentScenario2 SUSServer WindowsUpdateService Firewall SoftwareUpdateServiceSUSDeploymentScenario3 ParentSUSServer WindowsUpdateService ChildSUSServer Firewall ChildSUSServer ManagingAComplexSUSEnvironment CentrallymanagedownloadingandapprovingupdatesUseOUstructureandGPOstomanageSUSupdatedistributionUsetheWUAU ADMtemplatefiletoconfigureAUclientsettingsAssignGPOstoOUs AgesofSecurity StoneAge BronzeAge InformationAge NodecenttoolsNomythology noguidanceVerylittleinformationsharedGloballackofawareness PrimitiveToolsPrimitivemethodologyLittlesenseofthebigpictureInformationspreadsslowlyAwarenesswidespread butexpertiserareSurvivalmentality Advanced automatedtoolsComprehensivemethodologyWidespreadexpertiseUniversalawarenessThinkintegrated SMS WhatItDoes SecurityPolicyModel Operations Process Implementation Documentation Policy Technology System Programs Servers Solutions Services Comparetostandardsandbestpractices MeasuringSecurityPolicy SecurityPolicy DocumentedProcedures Operations Whatyoumustdo Whatyousayyoudo Whatyoureallydo SecurityOperatingPrinciples CorporateSecurityMissionandVision SecurityStrategy Risk BasedDecisionModel TacticalPrioritization Mission PreventmaliciousorunauthorizedusethatresultsinthelossofMicrosoftintellectualpropertyorproductivitybysystematicallyassessing communicating andmitigatingriskstodigitalassets EnterpriseRiskModel High Low High ImpacttoBusiness DefinedbyBusinessOwner Low AcceptableRisk UnacceptableRisk ProbabilityofExploit DefinedbyCorporateSecurity Riskassessmentdrivestoacceptablerisk Task StatusTracking FormalWorkflow ExpenseManagementBenefitsAdministrationAccountPlanningProcurementGovernmentForms EnterpriseApplications DepartmentApplications TeamCollaboration Dept VerticalWorkflow 5 10users SolutionsLandscape Departmentusers Cross enterpriseusers Formal Ad hoc Team DepartmentIT EnterpriseIT TeamSurveyStatusReportIssueTracking AssetMgmtSalesReportsCustomerServiceHealthcareFormsProjectMgmt Casestudiesat RiskAnalysisByAssetClass Exploitofmisconfiguration bufferoverflows openshares NetBIOSattacks Host Unauthenticatedaccesstoapplications uncheckedmemoryallocations Application Compromiseofintegrityorprivacyofaccounts Account Unmanagedtrustsenablemovementamongenvironments Trust Datasniffingonthewire networkfingerprinting Network Assets ComponentsOfRiskAssessment Asset Threat Impact Vulnerability Mitigation Probability Whatareyoutryingtoassess Whatareyouafraidofhappening Whatistheimpacttothebusiness Howcouldthethreatoccur Whatiscurrentlyreducingtherisk Howlikelyisthethreatgiventhecontrols CurrentLevelofRisk Whatistheprobabilitythatthethreatwillovercomecontrolstosuccessfullyexploitthevulnerabilityandaffecttheasset RiskManagementProcessAndRoles 3 4 SecuritySolutions Initiatives SustainedOperations Cross ITTeams CorporateSecurity TacticalPrioritization 1 PrioritizeRisks 2 SecurityPolicy 5 Compliance TacticalPrioritizationByEnvironment Policiesandmitigationtacticsappropriateforeachenvironment PrioritizedRisks DataCenter Client UnmanagedClient RemoteAccess Mobile WMI MonitoredClients MonitoredServers SQL Collector Eventssubjecttotampering Eventsundercontrolofauditors Securitylogs Securitylogs Real TimeIntrusionDetectionApplications ForensicAnalysis ManagementSystem ACSArchitecturalOverview 802 1Xover802 11 Supplicant Authenticator AuthenticationServer Gottageton Calculatingmykey WowIjustdon tunderstandthisnewmath Calculatingthisguy skey Accessblocked Beforeauthentication ControlledportpreventssupplicantLANaccessUncontrolledportallowsauthenticatortocontactauthenticationserver Supplicant Theair Authenticator AuthNserver Directory Afterauthentication ControlledportnowpermitssupplicanttoaccessLAN Supplicant Theair Authenticator AuthNserver Directory