Edge Security with Forefront Sandeep Modhvadia Security Specialist

Edge Security with Forefront Sandeep Modhvadia Security Specialist

Agenda ISA Server 2006 What’s New What’s Improved SSO Publishing Demo Hardware Sizing Whale Intelligent Application Gateway What is it? How does it Work? Custom Publishing Demo Q&A

ISA Server 2006 – Improved Exchange Publishing Support for Exchange 2007 Certificate Management Forms Based Authentication Custom Forms Multi-Language Support Authentication Enhancements Certificates, OTP, Radius, LDAP

ISA Server 2006 – New Features Single Sign On Cookie based authentication Share. Point publishing Specialised Wizard driven publishing Cross Array Link Translation

Demo Custom FBA and Single Sign On

What Is Whale Policy & Regulation Awareness Centre Citrix OWA … ……. . ………. . . Sharepoint. ………. . Sarb. Ox O Authentication Security Authorization W H O ? User Experience Application SSL VPN Gateway Client/Server Aware Modules Specific Applications High-Availability, Management, Logging, Reporting, Multiple Portals Exchange/ Outlook OWA E? Client H ER Devices Knowledge Centre W PDA …. . Linux ……. . Windows. ………. . . MAC …. . . Web Java/Browser Embedded C Tunneling Generic Applications Basel 2 M W overnance Corporate G 99 H A ISO 77 PL IA T? N T? Applications Knowledge Centre Citrix Share. Point/ Portals

Integrated Solution Benefits Feature Area ISA Server Standalone Intelligent Application Gateway Branch Office Gateway for site-to-site connectivity and security Delivered by ISA Server Proxy / Web Cache Data center Internet access control and Web caching with full network-layer firewall Delivered by ISA Server Application Access Control Access Publish, secure and pre-authenticate access to specific Web services (Exchange, Share. Point) • Flexible app-aware SSL VPN from any device or location • Differentiated and policy-driven access to a broad range of network, server and data resources • Highly granular access and security policy • Customizable, identity-based Web portal experience Protect Assets • Network edge protection through stateful packet inspection • Application protection with advanced protocol filtering and validation • Integration with enterprise infrastructure helps ensure the integrity and safety of network resources and applications • Adaptable Web application firewall enforces app-specific filtering to protect apps from unmanaged PCs and networks • Extensive monitoring and logging helps drive policy compliance by tracking user activity and data usage Safeguard Information Full IPsec VPN network connectivity integrated w/firewall engine for managed-PC access • Strong endpoint security management and verification helps ensure endpoint health compliance and session control • More granular control at the browser over users’ access to Web and non-Web resources • Helps meet corporate information usage guidelines through client-side cleanup

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine Air Gap Switch User types URL into browser File Shares Authentication

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine Transaction is sent over internet to external server Air Gap Switch File Shares Authentication

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine External e-Gap, receives packet Air Gap Switch File Shares Authentication

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine All protocol layers and TCP/IP headers are stripped off Air Gap Switch File Shares Authentication

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine Air Gap Switch File Shares Authentication Still-encrypted data is transferred to memory bank via SCSI connection

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine File Shares Authentication Air Gap Switch disconnects from external server, connects to internal server

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine File Shares Authentication Air Gap Switch Data is fetched from appliance memory

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine File Shares Data Browser-Side Security Manager HAT Engine Authentication Air Gap Switch Data is decrypted, SSL session is established and platform dependent Endpoint Compliance Module is sent back to browser to interrogate machine

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine If Endpoint Compliance Module doesn’t find the machine ‘up to scratch’ stricter security policies are enforced Air Gap Switch File Shares Authentication

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine File Shares Data Browser-Side Security Manager HAT Engine Authentication Air Gap Switch encrypted login page is generated and sent back

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine Customized login page appears in browser’s window Air Gap Switch File Shares Authentication

Data Flow Username: John Smith Password: ****** External World Secur. ID: ***** Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine User completes authorization credentials & submits response Air Gap Switch File Shares Authentication

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine File Shares Authentication Air Gap Switch shuttles the data across the air gap

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Authentication Data SSL Engine Browser-Side Security Manager HAT Engine Air Gap Switch Intranet e-Mail OK File Shares Authentication Internal e-Gap Server checks user credentials with appropriate authentication server; user is authenticated. Authentication credentials are combined with Endpoint Compliance results to determine Access Policy

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine User receives dynamically generated “Home Page” (based on identity and location) and selects desired application Air Gap Switch File Shares Authentication

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine File Shares Authentication Air Gap Switch shuttles the data across the air gap

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Data Authentication Real Web Server SSL Engine Browser-Side Security Manager HAT Engine Air Gap Switch Authentication File Shares (SMB) Application data is inspected and compared to Mandatory Access Control List

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Data Security Manager HAT Engine Air Gap Switch File Shares Authentication HAT Engine determines which back-end server to relay the request to

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet Transaction e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine File Shares Authentication Air Gap Switch Data is dispatched to the appropriate server

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine File Shares Authentication Air Gap Switch Application generates response

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager Data HAT Engine File Shares Authentication Air Gap Switch Response is converted by HAT engine for external use. Response may also be rewritten and/or blocked depending on Policy

External World Applications External e-Gap Internal e-Gap Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine Air Gap Switch File Shares Authentication

External World Applications External e-Gap SBC Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Authentication response SSL Engine Browser-Side Security Manager HAT Engine User works with application as if inside corporate network environment Air Gap Switch File Shares Authentication

External World Applications External e-Gap Internal e-Gap SBC Virtual Web Server App-Level Inspection Intranet e-Mail Authentication SSL Engine Browser-Side Security Manager HAT Engine After user completes session Attachment Wiper cleans up to ensure nothing sensitive remains on access machine Air Gap Switch File Shares Authentication

Demo Custom Application Publishing with Whale

Gateway Roadmap • Whale Intelligent Application Gateway * (incl. ISA Server 2004) • Express Edition • Enterprise Edition • Application Optimizers • Network Connectivity Modules • Integrated appliances with ISA Server 2006 + Whale IAG • Standard Edition • Enterprise Edition • Updated software for ISA and IAG • OEM-ready • Continued 3 rd-party application support • Single-server config • Unified Access Gateway “Longhorn” Svr-wave • OEM appliances • Software availability • NAP, IPv 6, 64 -bit support • Consistent policy framework • Broader authentication tools (ADFS, smartcard) • Enhanced network connectivity • Improved enterprise application support

For More Information www. microsoft. com/isaserver www. microsoft. com/forefront

Thank you for attending this Tech. Net Event Find these slides at: http: //www. microsoft. com/uk/technetslides