MICROSOFT FOREFRONT SECURITY ADMINISTRATION GUIDE
CONTENTS CHAPTER 1 INTRODUCTION TO MICROSOFT FOREFRONT SECURITY SUITE INTRODUCTION COMPONENTS OF THE MICROSOFT FOREFRONT SECURITY SUITE FOREFRONT SECURITY FOR CLIENTS CLIENT SECURITY FEATURES FOREFRONT SECURITY FOR EXCHANGE SERVER FOREFRONT SECURITY FOR SHAREPOINT SERVER ISA SERVER 2006 INTELLIGENT APPLICATION GATEWAY (IAG) 2007 BENE? TS OF USING THE MICROSOFT FOREFRONT SUITE SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 FOREFRONT SECURITY FOR MICROSOFT WINDOWS CLIENTS HOW TO USE MICROSOFT FOREFRONT CLIENT SECURITY CON? GURING AND INSTALLING MANAGEMENT SERVER COLLECTION SERVER REPORTING SERVER DISTRIBUTION SERVER INSTALLING FCS SERVER SOFTWARE FOREFRONT CLIENT SECURITY CONSOLE CREATING AND DEPLOYING POLICIES CREATING A POLICY DEPLOYING A POLICY INSTALLING CLIENT SOFTWARE AGENT HOME CHECKING FOR UPDATES SCAN QUICK SCAN FULL SCAN CUSTOM SCAN FCS KERNEL MODE MINI? LTER HISTORY TOOLS OPTIONS MICROSOFT SPYNET SOFTWARE EXPLORER QUARANTINED ITEMS MICROSOFT FOREFRONT SECURITY CLIENT WEB SITE HELP CHECKING FOR CLIENT VERSION, ENGINE VERSION, ANTIVIRUS AND ANTISPYWARE DE? NITIONS FOREFRONT CLIENT SECURITY AGENT IN ACTION TROUBLESHOOTING MICROSOFT FOREFRONT CLIENT SECURITY DE? NITION UPDATES FOLDER GUID BACKUP FOLDER EVENT VIEWER, SYSTEM LOG SUMMARY CHAPTER 3 DEPLOYING WINDOWS SERVER UPDATE SERVICES TO FOREFRONT CLIENTS USING WINDOWS SOFTWARE UPDATE SERVICES WSUS 3 0 DEPLOYMENT TOPOLOGIES CON? GURING AND INSTALLING WSUS QUIET AND UNATTENDED INSTALLATIONS WSUS 3 0 INTERACTIVE SETUP CON? GURING GROUP POLICY FOR WSUS UPDATES TCP PORT 8530 CLIENT REQUIREMENTS FOR WSUS: 2000 SERVICE PACK 3, XP SERVICE PACK 1 CHECKING FOR UPDATES (CHECK FOR UPDATES NOW) NAVIGATING THE WSUS CONSOLE UPDATE SERVICES SERVER NODE UPDATES UPDATES SUBNODES APPROVE DECLINE CHANGE AN APPROVAL OR DECLINE REVISION HISTORY REPORTS UPDATE REPORTS COMPUTER REPORTS SYNCHRONIZATION REPORTS COMPUTERS COMPUTER GROUPS UPDATE SOURCE AND PROXY SERVER PRODUCTS AND CLASSI? CATIONS UPDATE FILES AND LANGUAGES SYNCHRONIZATION SCHEDULE AUTOMATIC APPROVALS SERVER CLEANUP WIZARD REPORTING ROLLUP E-MAIL NOTI? CATIONS MICROSOFT UPDATE IMPROVEMENT PROGRAM PERSONALIZATION WSUS SERVER CON? GURATION WIZARD TROUBLESHOOTING WSUS WSUS HEALTH CHECKS GROUP POLICY CHAPTER 4 OBSERVING AND MAINTAINING MICROSOFT FOREFRONT CLIENTS USING THE MICROSOFT FOREFRONT CLIENT SECURITY MANAGEMENT CONSOLE DASHBOARD REPORTING CRITICAL ISSUES REPORTING NO ISSUES NOT REPORTING COMPUTERS PER ISSUE SUMMARY REPORTS POLICY MANAGEMENT CREATING A NEW POLICY PROTECTION TAB ADVANCED TAB OVERRIDES TAB REPORTING TAB EDITING A POLICY COPYING A POLICY UNDEPLOYING A POLICY DELETING POLICIES VIEWING REPORTS VIEWING EXTRA REGISTRY SETTINGS IN GROUP POLICY MANAGEMENT CONSOLE FCSLOCALPOLICYTOOL CON? GURING MICROSOFT OPERATIONS MANAGEMENT COMMON RULES DISTRIBUTION ALERTS HOST ALERTS HOST BEHAVIORS MANAGEMENT ALERTS REPORTING ALERTS SERVER ALERTS SERVER BEHAVIOR CON? GURING NOTI? CATIONS SQL REPORTING SERVICES CHAPTER 5 USING FOREFRONT TO GUARD MICROSOFT EXCHANGE SERVER IMPLEMENTING MICROSOFT FOREFRONT SERVER FOR EXCHANGE PLANNING A FSE DEPLOYMENT ANTIVIRUS SCANNING MESSAGE FILTERING INSTALLING FOREFRONT SERVER FOR EXCHANGE CON? GURING MICROSOFT FOREFRONT SERVER FOR EXCHANGE SETTINGS SCAN JOB TRANSPORT SCAN JOB REAL TIME AND MANUAL SCAN JOBS ANTIVIRUS SCANNER UPDATES REDISTRIBUTION SERVER TEMPLATES GENERAL OPTIONS DIAGNOSTICS LOGGING SCANNING BACKGROUND SCANNING FILTERING CONTENT KEYWORD FILE ALLOWED SENDERS FILTER LISTS OPERATE RUN JOB SCHEDULE JOB REPORT NOTI? CATION INCIDENTS QUARANTINE CHAPTER 6 MANAGING MICROSOFT SHAREPOINT PORTAL SECURELY USING FOREFRONT IMPLEMENTING MICROSOFT FOREFRONT SERVER FOR SHAREPOINT INSTALLING AND CON? GURING FOREFRONT SECURITY FOR SHAREPOINT FOREFRONT SECURITY FOR SHAREPOINT REQUIREMENTS INSTALLATION CON? GURING THE FOREFRONT SERVER SECURITY ADMINISTRATOR FOR SHAREPOINT REAL-TIME SCAN JOB MANUAL SCAN JOB FILTER LIST SCHEDULE JOB CHAPTER 7 MANAGING AND MAINTAINING MICROSOFT FOREFRONT SERVERS IMPLEMENTING A BACKUP STRATEGY UTILIZING THE MICROSOFT FSSMC MAIN CONSOLE PAGE TRAF? C SUMMARY VIRUS STATISTICS SPAM STATISTICS FILTER STATISTICS TOP 5 VIRUSES MOST ACTIVE SERVERS ADMINISTRATION USERS ADDING/REMOVING USERS SERVERS ADDING/REMOVING SERVERS SERVER GROUPS GLOBAL CON? GURATION JOB MANAGEMENT PACKAGES JOBS QUARANTINE MANAGER DETECTIONS SMTP TRAF? C ENGINE VERSIONS ALERT MANAGEMENT ALERTS EVENT LOGS ALERT LOGS NOTI? CATION LOGS CHAPTER 8 USING INTELLIGENT APPLICATION GATEWAY 2007 THE HISTORY OF SSL VPNS IMPLEMENTING AN INTELLIGENT APPLICATION GATEWAY 2007 CON? GURING THE WHALE INTELLIGENT COMMUNICATION APPLICATION GATEWAY 2007 CON? GURATION PAGE APPLICATION ACCESS PORTAL EXTERNAL WEB SITE INITIAL INTERNAL APPLICATION SECURITY AND NETWORKING ATTACHMENT WIPER APPLICATIONS LIMITING APPLICATIONS ON SUBNETS CREATING A TRUNK BASIC TRUNK PORTAL TRUNK WEBMAIL TRUNK REDIRECT HTTP TO HTTPS TRUCK ACTIVATING AN IAG CON? GURATION PASSPHRASE INTERNET INFORMATION SERVICES MANAGER VIEWING REMOTE COMPUTER CERTI? CATE CON? GURING ISA SERVER TO ALLOW COMMUNICATION BETWEEN THE TWO SERVERS IAG FIREWALL RULES (13) PORTAL TRUNK CON? GURATION RULES (2) UTILIZING THE WHALE COMMUNICATION INTELLIGENT APPLICATION GATEWAY TOOLS WHALE COMMUNICATION INTELLIGENT APPLICATION GATEWAY WEB PORTAL DE? NED APPLICATIONS CREDENTIALS MANAGEMENT SYSTEM INFORMATION ACTIVITY EMAIL SYSTEM ADMINISTRATOR WHALE COMMUNICATION INTELLIGENT APPLICATION GATEWAY EDITOR WHALE COMMUNICATION INTELLIGENT APPLICATION GATEWAY SERVICE POLICY MANAGER WHALE COMMUNICATION INTELLIGENT APPLICATION WEB MONITOR CREATING AND MANAGING INTELLIGENT APPLICATION GATEWAY ENDPOINT POLICIES CHAPTER 9 USING OUTLOOK WEB ACCESS THROUGH THE INTELLIGENT APPLICATION GATEWAY THE IMPORTANCE OF SECURING OUTLOOK WEB ACCESS THE SECURITY PROBLEM THE SECURITY SOLUTION SECURING YOUR OWA CONNECTION PUBLISHING OUTLOOK WEB ACCESS IN THE INTERNET APPLICATION GATEWAY ADDING OWA TO THE IAG (PORTAL) IAG 2007 SERVER ROLES ACTIVATING THE CON? GURATION CLIENT TO CONNECT TO THE IAG IAG PORTAL WEB REDIRECT THE TRUNK ON SRV1 “CLIENT” TO CONNECT TO THE IAG EXAMINING THE RULES ADDED TO THE ISA CON? GURATION ISA RULES SECURING THE OUTLOOK WEB ACCESS INTERFACE IAG SERVER CHAPTER 10 CON? GURING VIRTUAL PRIVATE NETWORK TRAF? C THROUGH THE INTELLIGENT APPLICATION GATEWAY SETTING UP THE NETWORK CONNECTION SERVER NETWORK SEGMENT IP PROVISIONING ACCESS CONTROL ADDITIONAL NETWORKS ADDING THE APPLICATION CONNECTING THROUGH THE VIRTUAL PRIVATE NETWORK CHAPTER 11 CON? GURING MICROSOFT INTERNET SECURITY AND ACCELERATION SERVER 2006 INSTALLING MICROSOFT INTERNET SECURITY AND ACCELERATION SERVER 2006 PRELIMINARY CON? GURATION OF WINDOWS SERVER 2003 HARDWARE CONSIDERATIONS CON? GURING TCP/IP SETTINGS DOMAIN MEMBERSHIP SYSTEM HARDENING INSTALLATION OF ISA SERVER 2006 CON? GURING ISA SERVER 2006 CON? GURATION NETWORKS NETWORK SETS NETWORK RULES WEB CHAINING CACHE ADD-INS GENERAL SPECIFY RADIUS AND LDAP SERVERS ENABLING INTRUSION DETECTION AND DNS ATTACK DETECTION CON? GURING IP PROTECTION CON? GURING FLOOD MITIGATION SERVICES FIREWALL POLICY VIRTUAL PRIVATE NETWORKS MONITORING ISA SERVER 2006 SESSIONS SERVICES CONNECTIVITY VERI? ERS CHAPTER 12 MICROSOFT INTERNET SECURITY AND ACCELERATION 2006 SERVER PUBLISHING PUBLISHING SERVERS BEHIND A MICROSOFT INTERNET SECURITY AND ACCELERATION 2006 SERVER FIREWALL BASICS OF PUBLISHING SERVER PUBLISHING RULE WEB PUBLISHING RULE NETWORK CON? GURATION AND NAME RESOLUTION FOR PUBLISHING CON? GURING THE WEB LISTENER EXERCISE: CREATING A WEB LISTENER CON? GURING PUBLISHING HTTP FILTERING MAXIMUM HEADER LENGTH MAXIMUM PAYLOAD LENGTH MAXIMUM URL LENGTH MAXIMUM QUERY LENGTH VERIFY NORMALIZATION BLOCK HIGH-BIT CHARACTERS BLOCK REQUEST CONTAINING A WINDOWS EXECUTABLE HTTP METHOD FILE EXTENSION BLOCK REQUESTS CONTAINING AMBIGUOUS EXTENSIONS HTTP HEADER SERVER HEADER REWRITE VIA HEADER REWRITE SPECI? C HTTP HEADER VALUE IN REQUEST OR RESPONSE PATH MAPPING LINK TRANSLATION EXERCISE: CON? GURE WEB PUBLISHING RULE PUBLISHING EXCHANGE WEB CLIENT ACCESS PUBLISHING SHAREPOINT SITES PUBLISHING A WEB FARM PUBLISHING NON-WEB SERVER PROTOCOLS EXERCISE: PUBLISHING TERMINAL SERVICES PUBLISHING MAIL SERVERS TROUBLESHOOTING PUBLISHING SERVERS BEHIND A MICROSOFT INTERNET SECURITY AND ACCELERATION 2006 SERVER FIREWALL CHAPTER 13 MANAGING ISA 2006 SERVER CONNECTIONS BETWEEN SITES VPN PROTOCOLS: ADVANTAGES AND DISADVANTAGES ADVANTAGES OF IPSEC TUNNELING MODE DISADVANTAGES OF IPSEC TUNNELING MODE ADVANTAGES OF L2TP/IPSEC DISADVANTAGES OF L2TP/IPSEC ADVANTAGES OF PPTP DISADVANTAGES OF PPTP CONNECTING TWO ISA 2006 SERVERS ON DIFFERENT PHYSICAL SITES CREATING AN ACCESS RULE DYNAMIC HOST CON? GURATION PROTOCOL (DHCP) CON? GURATION STATIC ADDRESS POOL VPN DIAL-IN ACCOUNT AT THE MAIN OF? CE BRANCH CON? GURATION VPN DIAL-IN ACCOUNT AT THE BRANCH OF? CE TROUBLESHOOTING CONNECTIONS BETWEEN SITES VERIFYING CONNECTIVITY CHAPTER 14 PROXY FUNCTIONS OF MICROSOFT INTERNET SECURITY AND ACCELERATION SERVER 2006 USING MICROSOFT INTERNET SECURITY AND ACCELERATION AS A PROXY SERVER CON? GURING INTERNET SECURITY AND ACCELERATION EXERCISE: CREATING A CACHE RULE SCHEDULED CONTENT DOWNLOAD EXERCISE: CREATE CONTENT DOWNLOAD RULE CACHING IN MICROSOFT INTERNET SECURITY AND ACCELERATION SERVER 2006 ENTERPRISE EDITION CON? GURING MICROSOFT INTERNET SECURITY AND ACCELERATION TO CACHE BITS CONTENT MICROSOFT UPDATE CACHE RULE USING THE DIFFERENTIATED SERVICES ON MICROSOFT INTERNET SECURITY AND ACCELERATION 2006 TO REGULATE TRAF? C