Sikkerhedskampagne for mindre virksomheder

Præsentationer af emnet: "Sikkerhedskampagne for mindre virksomheder"— Præsentationens transcript:

1 Sikkerhedskampagne for mindre virksomheder
Århus 5. April 2006 Sikkerhedskampagne for mindre virksomheder Rico Raja Jyskpc.dk AS Community:

2 Agenda Baggrunden for dette initiativ
Salg af Small Business Server 2003 Hvad ligger bag det anbefalede to timers sundhedstjek? Hvad er gode emner i relation til en behovsanalyse? Andre redskaber du kan anvende i relation til et sundhedstjek af virksomhedens IT miljø

3 Baggrunden for dette initiativ
4/3/2017 Baggrunden for dette initiativ Fokus for mindre virksomheder er [stadig] deres forretning, ikke IT Kompleksitet versus omkostninger Stigende tillid til teknologien Stigende tillid til leverandører af teknologien Vi må aldrig glemme de basale krav Backup og reetablering er stadig øverst på listen over IT relaterede fokusområder for mindre virksomheder 43% af mindre virksomheder¹ … og sikring af data 30% af mindre virksomheder¹ Ekspertise i virksomheden er begrænset IT outsources til Jer! Daglige drift skal være enkel Backup and recovery – SBS Backup Solution Security of data – Built on WS03 foundation, ISA Server? Focused on their business, not IT - IMPROVEMENT EXAMPLES No dedicated IT staff - IMPROVEMENT EXAMPLES

4 Baggrunden for dette initiativ
Funktionalitet Virksomhed Forretningsløsning ? Rydde vejen for en mere interessant diskussion af formålet med virksomhedens IT Nu og på længere sigt Få taget tyren ved hornene mht. sikkerhed Få samtidig afdækket hvor virksomheden kan få øget værdi hurtigt Samarbejde Produktivitet ? ? Mobilitet E-handel ? ? Relationelt lager/datastyring ? Integreret administration ? Integreret udviklingsmiljø ? Terminal Services ? Applikations Services ? Kommunikations Services ? Web Services ? Fil- og Print Services ? Netværksadgangsservices ? Sikkerheds Services ? OS ?

5 Agenda Baggrunden for dette initiativ
Salg af Small Business Server 2003 Hvad ligger bag det anbefalede to timers sundhedstjek? Hvad er gode emner i relation til en behovsanalyse? Andre redskaber du kan anvende i relation til et sundhedstjek af virksomhedens IT miljø

6 Hvor starter diskussionen
Hvor starter diskussionen? Dér hvor udfordringerne er, er dér I gerne vil være Mistede data Utilstrækkelig sikkerhed De funktionelle udfordringer Flere udgaver af samme dokument Adgang til informationer når man er ude af huset Finde hinandens informationer Køb af den samme hardware Ingen – eller utilstrækkelig – web tilstedeværelse

7 Ved at starte med det grundlæggende...
Generisk funktionalitet Kunden Hvad vil de med deres serverinfrastruktur? Nu På længere sigt Hvilke leverandører overvejer de? Microsoft Linux Novell, Oracle mfl. Hvordan vil/kan du levere løsningen? Microsoft har mange partnere Microsoft har leveret superstærke løsningsguides Du kan basere din løsning på disse Til gratis download Skamrost af IT professionelle Forretningsløsning ? Samarbejde Produktivitet ? ? Mobilitet E-handel ? ? Relationelt lager/datastyring ? Integreret administration ? Integreret udviklingsmiljø ? Programmerings ramme ? Applikations Services ? Media Services ? Web Services ? Fil- og Print Services ? Netværksadgangsservices ? Sikkerheds/Directory Services ? OS ?

8 ...vil kunden selv fuldføre ligningen!
4/3/2017 ...vil kunden selv fuldføre ligningen! Sikkerheds/Directory Services Netværksadgangsservices Fil- og Print Services Web Services Media Services Applikations Services Programmerings ramme Integreret udviklingsmiljø Integreret administration Relationelt lager/datastyring E-handel Produktivitet Mobilitet Samarbejde OS Forretningsløsning Microsoft platform Kunden ? Exchange, SPTS Office System ? ? ? Exchange 2003 CS2000 ? SQL Server ? SMS 2000, MOM ? Visual Studio.NET ? Kerberos Distributed File Service STS .NET Framework MSMQ Transaction Service ASP.NET Smart Card Windows Media Services IIS Active Directory PKI VPN RAS WMI ? ? ? ? ? Alt-i-én pakke Samme stærke fundamet Bygget til mindre virksomheder Meget for pengene ? ? ?

9 Nøglefunktionaliteter Hvad indeholder Small Business Server 2003
4/3/2017 Nøglefunktionaliteter Hvad indeholder Small Business Server 2003 Small Business Server 2003 funktionaliteter Integreret installation og konfiguration Fax Server og en lang række funktioner specielt til den mindre virksomhed Administration for hhv. kunde og leverandør Windows Server 2003 Active Directory; brugerdatabase der kontrollerer brugerrettigheder på netværket Automatisk installation og konfiguration af PC’ere på netværket Automatisk overvågning af serverens tilstand Indbygget backup og restore Indbygget applikations- og web server Sharepoint Services; Intranet løsning tilpasset til mindre virksomheder og lettilgængeligt intranet Sikker opkobling af hjemmearbejdsplads med indbygget VPN Server Sikkert trådløst netværk Indbygget firewall Exchange Server 2003 Medfølgende Outlook 2003 klient Adgang til via mobiltelefon (afh. af telefon) Udbygningsmuligheder med antivirus og spam Small Business Server 2003 Premium Edition Som ovenstående men med SQL Server 2000 Internet Security and Acceleration Server 2000 Slide Purpose: Establishes Small Business Server (SBS 2000 or SBS 2003) as the best choice for small-sized businesses seeking a first or essential server. Note to Speaker: Small Business Server 2000 retains position within Windows Server 2003 family as “first/essential” server for small-size businesses. Core Message: Small Business Server 2000 delivers the powerful Windows Server operating system and core Microsoft server functionality in an integrated, simplified solution, matching the unique needs of small-size businesses for an exceptional value. SBS 2000 will remain Microsoft recommended first/essential server after the Windows Server 2003 launch until the launch of SBS 2003 (H2 CY03). Script: Small Business Server 2000 is the ideal first or essential server solution for a small business because it is inherently designed to meet the unique requirements of the small business customer as well as the channel partners, like yourselves, who so often act as their outsourced IT staff. Moving from a peer to peer network, or no network at all, into server technology can be a daunting leap for a small business customer, especially if they are required to deploy multiple software applications across multiple server machines right from the start. Small Business Server eases small business customers into server based networking…delivering the right functionality in a simplified way at a price point that makes sense. Every small business should have a Small Business Server 2000 because it so ideally fits the needs of this customer space… Integrated, multi-function solution: SBS delivers an end-to end server solution out of the box that provides all of the core functionality a small business needs in a single networking solution. No other competitive offering even comes close to delivering the integration the Small Business Server provides. And this integration doesn’t end with the server components -- it extends all the way down to the clients. Just as our desktop products work hard to deliver a great client experience, so does Small Business Server as a server solution. Small Business Server doesn’t just put bits on the server…it extends the solution to deploying and configuring client machines onto the Small Business Server network all the way down to making sure that an end user’s experience as they log on to their Small Business Server network for the first time is a positive one. Simplified installation and management: Because Small Business Server is so tightly integrated and because of the known deployment scenario surrounding the product (i.e., Small Business Server must be the Domain Controller at the root of the Active Directory forest, trusts are disabled, all components install on a single machine, and max of 50 PCs), Microsoft is able to deliver all of the components and functionality in the solution in a highly simplified fashion, enabling a single, unified setup process across all servers components and even down to the client machines, as well as centralized management across all server components -- setting new standards for ease of installation, use, and administration. This ease of deployment and management can be positioned to your customers as yielding a lower TCO versus competitive offerings which require various solutions/applications to be pieced together and require higher maintenance over time. The right functionality: Small Business Server delivers the functionality small business customers today are demanding of a network solution…providing fully integrated solution for networking, , fax, database, and secure, shared Internet access – for an exceptional value. Install what you need at customers own pace: Small Business Server enables a graduated deployment, meaning the functionality in Small Business Server can be “turned on” as customers need it. You can introduce them to the wealth of functionality in Small Business Server at their own pace. You do not need to overwhelm your customer by installing everything all at once. This also helps you, as their technology provider, to build an ongoing relationship with your SBS customers as you deploy features for them over time, giving you multiple reasons to keep going back to that customer to perform services for them on an ongoing basis. Enables growth (not locked in): A customer’s SBS purchase is a long-term investment that allows them to grow and expand when/if their business needs demand it. Windows .NET Servers can be added into an existing SBS network as server technology needs expand – and we’ll discuss that a bit more in the next slide. Microsoft also offers a Small Business Server Migration path for customers who “outgrow” the limitations of Small Business Server. This path allows customers to technically migrate out of SBS with no loss on their initial financial investment. Built to run on a single server: All of this rich functionality is designed and rigorously tested to run together successfully on a single server machine, keeping complexity and server hardware investment to a minimum. Supports up to 50 PCs: A maximum of 50PCs can be connected on a Small Business Server network. This provides plenty of headroom for most small businesses to start with Small Business Server and grow with it if their business expands. Incredible Value: All of this rich functionality is priced to be an exceptional value: ERP of US$1499, which includes 5 Client Access Licenses. Even if a small business is not sure they need the full functionality of Small Business Server right at the start, it’s price makes it a highly compelling value for your cost-conscious small business customers. They should not compromise for “good enough” functionality when they can have the rich feature-set of Small Business Server for such a great value.

10 En klassisk salgsproces
4/3/2017 En klassisk salgsproces Identificér salgsmuligheder Kvalificere kunde Synliggøre/forstærke behov Håndtere indvendinger Identificere muligheder Kvalificere kunde Forstærke behov Imødekomme indvendinger

11 Migrering af den gamle base Hvorfor? Den kører jo meget godt
4/3/2017 Migrering af den gamle base Hvorfor? Den kører jo meget godt Ford Taunus 15M. 1970 Ford Mondeo 2, 145 HK, Topfart 215 Km/t Benzin Blyfri Oktan 95 3 punkts rulleseler + både for og bag 2 kreds bremser, ABS Bremse assistent Antiudskridningssystem (ESP) Laminerede ruder Airbags, både puder og gardiner Sikkerheds-ratstamme Forstærkninger i døre Deformerbare sikkerheds zoner Nakkestøtter 82 HK, Topfart 150 Km/t Benzin Blyholdig Oktan 98 3 punkts faste seler på forsæde 2 kreds bremser Lamineret forrude Ser vi på udviklingen af biler, vil samme forhold gøre sig gældende. Biler designet i 70’erne er simpelthen ikke udstyret med teknologier som biler udviklet i det 2100 århundrede. Trafikmønsteret i 70’erne var radikalt anderledes end det er i dag, og dette afspejler sig direkte over på såvel sikkerhedsudstyr som køre egenskaber. En lang række sikkerhedsudstyr som er standard i moderne biler var overhovedet ikke inde i betragtningerne i 70’erne, da trafikmønstret ikke nødvendiggjorde dette, samt at den teknologiske udvikling ikke var fremskredet nok. Andre dimensioner af forskellen mellem ovenstående biler er også forhold som driftsøkonomi og vedligeholdelse af bilerne. Biler i 70’erne brugte typisk blyholdig benzin og havde dermed en større miljømæssig påvirkning af miljøet end biler i dag, der bruger blyfri benzin. Samtidig er det også stadig svære at fremskaffe reservedele til ældre biler, hvorfor prisen på disse også er stigende, hvilket har en direkte effekt på driftsomkostningerne ved bilen. En lidt vovet analogi mellem biler og Windows platformen er at Windows NT 3.5x og 4.0 vil være at sammenligne med bilen fra 70’erne, mens Windows Server 2003 er at sammenligne med bilen anno Sagt på en anden måde er den nye platform designet på baggrund af den nuværende situation og forhold, hvilket vil sige at sikkerhed, pålidelighed, driftsstabilitet og økonomi er integreret som en naturlig del af platformen. LEAD: Men laver vi en analogi mellem en Ford Mondeo og Windows Server 2003, så må vi også sige at på trods af, at en Mondeo er en meget sikker bil så har den stadig ikke 5 stjerner i en crashtest; den kan blive bedre og det kan vi også.

12 Salg af sikkerhed handler om at reducere angrebsoverfladen
4/3/2017 Salg af sikkerhed handler om at reducere angrebsoverfladen Som tema i sig selv burde det være en primær motivator for migrering Secure by design, by default, by deployment Sikker web afvikling Flere ’airbags’ til administrator Services der kører med lavere rettigheder Services slukket per default Mindre angrebsoverflade

13 Når kunden har sagt ja Rørlægning er på plads
Leverance af den ønskede løsning Næste mulige skridt Database (C5 native -> SQL) Forretningsapplikationer Firewall Øget sikkerhed Website SQL Server 2000 ISA Server 2004

14 Agenda Baggrunden for dette initiativ
Salg af Small Business Server 2003 Hvad ligger bag det anbefalede to timers sundhedstjek? Hvad er gode emner i relation til en behovsanalyse? Andre redskaber du kan anvende i relation til et sundhedstjek af virksomhedens IT miljø

15 Sundhedstjek; hvad dækkes
Password Antivirus Backup UPS Firewall Fysisk sikring Trådløst Operativsystem Server Klient

16 Sundhedscheck - rapport

17 Sundhedscheck - anbefalinger
Hvor er der identificeret graverende forhold? Hvad bør udbedres? Hvad er en anslået pris? Gode estimater i bagagen er selvsagt altid en fordel

18 Agenda Baggrunden for dette initiativ
Salg af Small Business Server 2003 Hvad ligger bag det anbefalede to timers sundhedstjek? Hvad er gode emner i relation til en behovsanalyse? Andre redskaber du kan anvende i relation til et sundhedstjek af virksomhedens IT miljø

19 Behovsanalyse Mail Fjernopkobling
Central backup Kalender Fælles adressekartotek (medarbejdere, kunder, forretningsforbindelser mm.) Adgang fra forskellige steder Fjernopkobling Applikationer der anvender central database Intranet

20 Spørgsmål/svar mht. behovsanalyse
I mange tilfælde vil du have en erfaring og viden om tilgangen til mødet På områder hvor du ikke har spidskompetence har vi lavet en vejledning

21 Agenda Baggrunden for dette initiativ
Salg af Small Business Server 2003 Hvad ligger bag det anbefalede to timers sundhedstjek? Hvad er gode emner i relation til en behovsanalyse? Andre redskaber du kan anvende i relation til et sundhedstjek af virksomhedens IT miljø

22 Det handler om at sikre kundens systemer
Baseline assessment Bruger uddannelse Opdatering Teknologier (for udbedring af lokaliserede sårbarheder)

23 Eksempel på en tilgang for at foretage et sundhedstjek
4/3/2017 Eksempel på en tilgang for at foretage et sundhedstjek Vurdering Vurdere og værdifastsættelse af aktiver Identificere og prioritere risici Risiko måling; design af politikker Udvikling og implementering Teknikker til udbedring af risiko Fangst af viden om sikkerhed og sårbarhed Drift Re-vurdering af aktiver og sikkerheds risiko Stabilisér og udrulning af nye eller ændrede modtræk Security risk management discipline (SRMD) defines the three primary processes that a business needs to implement in order to become and stay secure. The three processes are: Assessment – This phase involves gathering relevant information from the organization’s environment to perform a security assessment. You need to capture enough data to effectively analyze the current state of the environment. Then determine how well protected the organization’s information assets are from potential threats. Create a security action plan; this plan is executed during the implementation process. Development and Implementation – This phase focuses on executing a security action plan to implement the recommended changes defined in the assessment. Additionally, a security risk contingency plan is developed. Operation – During this phase, modify and make updates to the environment as needed to keep it secure. Penetration testing and incident response strategies, which help solidify the objectives of implementing a security project in the organization, are carried out during operational processes. Auditing and monitoring activities are also carried out during the operational processes to keep the infrastructure intact and secure. Additional details of SRMD can be found in the Microsoft Solutions Guide for Securing Windows 2000 Server at God dybdegående guide: Microsoft Solutions Guide for Securing Windows 2003

24 Eksempel på en tilgang for at foretage et sundhedstjek – 2
4/3/2017 Prioritering af kundens aktiver (Skala 1 til 10) 1. Server leverer grundlæggende funktionalitet, men har ingen finansiel effekt på forretningen 3. Server har vigtig information, men data kan hurtigt og nemt reetableres 5. Server indeholder vigtige data, der vil tage noget tid at reetablere (2-5 timer) 8. Server indeholder information der er væsentlig I relation til virksomhedens forretningsmål. Tabet af udstyr/service vil have stor effekt for alle brugere 10.Server har en central betydning for virksomhedens forretning. Tabet af udstyr og data vil have direkte effekt på virksomhedens evne til at agere på markedet. Asset assessment is the value placed on information from the point of view of the parties involved and the effort it took to develop the information. Asset assessment also involves determining the value of a network service—for example, the value of a service that provides network users with outbound Internet access from the point of view of the parties that use that service, and what it would cost to re-create that service. Valuation is how much it costs to maintain an asset, what it would cost if it were lost or destroyed, and what benefit another party would gain by obtaining this information. The value of an asset should reflect all identifiable costs that would arise if there were an actual impairment of the asset. In determining asset priorities, either arbitrary values, as shown in the slide, or specific values, such as actual monetary cost, can be used. Organizations should use whichever scale is most appropriate to highlight the relative value of their assets.

25 Eksempel på en tilgang for at foretage et sundhedstjek – 3
4/3/2017 Eksempel på en tilgang for at foretage et sundhedstjek – 3 Damage Reproducibility Exploitability Affected Users Discoverability Sårbarhed = (Prioritet af aktiv*trusselsrangering) Security risk analysis is used to analyze the attacks, tools, methods, and techniques that might be used to exploit a potential vulnerability. Security risk analysis is a method of identifying risks and assessing the possible damage that could be caused. The result of the assessment can be used to justify security safeguards. A security risk analysis has three main goals: Identify risks, quantify the impact of potential threats, and provide an economic balance between the impact of the risk and the cost of the countermeasure. Information is collected to estimate the level of risk so that the team can make educated decisions around which security risks should receive the most remediation effort. This analysis is then used to prioritize security risks and enable the organization to commit resources to address the most critical security issues. When a threat has been identified, the threat needs to be ranked. One approach is DREAD. A rating of 1 through 10 is assigned in five areas: damage, reproducibility, exploitability, affected users, and discoverability. The ratings are averaged, which gives you an overall threat rank. The higher the rank, the more serious the threat. This ranking provides a view of the relative priority of each risk rather than an actual risk quantification. You can take this threat rank and multiply by a system’s criticality to give you a risk exposure for a system.

26 En ramme for at tilgå sikkerhed
4/3/2017 En ramme for at tilgå sikkerhed Defense in Depth anvender en lagdelt tilgang Du kan bruge modellen som et redskab til at afdække risici i dybden for din kunde Sammenhold det med din viden om tilgængelige redskaber i det pågældende lag To minimize the possibility of a successful attack against your organization, you need to maximize the layers of defense. Defending your organization in depth means that you use multiple layers of defense. If one layer is compromised, it does not necessarily mean that your entire organization is compromised. As a general guideline, design and build each layer of your security under the assumption that every layer has been breached. Take steps to protect the layer you are working on. In addition, there are many ways to protect each individual layer by using tools, technologies, policies, and best practices. For example: Policies, procedures, and awareness layer – Security education programs for users Physical security layer – Security guards, locks, and tracking devices Perimeter layer – Hardware and/or software firewalls, and creating virtual private networks with quarantine procedures Internet network layer – Network segmentation, IP Security (IPSec), and network intrusion detection systems Host layer – Server and client hardening practices, patch management tools, strong authentication methods, and host-based intrusion detection systems Application layer – Application hardening practices and antivirus software Data layer – Access control lists (ACLs) and encryption Politikker, procedurer og årvågenhed Fysisk sikkerhed Data ACL, kryptering Applikation Hardening af applikation, antivirus Hardening af OS, patch management, authentication, HIDS Host Interne netværk Netværkssegmenter, IPSec, NIDS Perimeter netværk Firewalls, VPN karantæne Vagter, låse, tracking enheder Bruger uddannelse

27 Baseline Security Analyzer
4/3/2017 Baseline Security Analyzer MSSecure.xml indeholder Navn på bulletin og ID nr. Versions-specifik information om opdateringer Version og checksum info Baseline Security Analyzer køres fra admin PC med angivet mål Microsoft Download Center MBSA henter opdateret MSSecure.xml MSSecure.xml Scanning af angivne mål mht. OS, OS komponenter og applikationer foretages Rapportering til admin PC, der samler information Krydstjek mod MSSecure.xml for at se om påkrævede opdateringer mangler MBSA Computer Genererer rapport på manglende opdateringer

28 Agenda Baggrunden for dette initiativ
Salg af Small Business Server 2003 Hvad ligger bag det anbefalede to timers sundhedstjek? Hvad er gode emner i relation til en behovsanalyse? Andre redskaber du kan anvende i relation til et sundhedstjek af virksomhedens IT miljø

29 Links og yderligere information
Generelt Danske sikkerhedssite: Windows XP og Windows Server Step-by-Step Guide to Securing Windows XP Professional in Small and Medium Businesses Windows XP Security Guide, Windows Server 2003 Security Guide Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP Netværk Sikring af perimeter netværk med firewalls; Microsoft Systems Architecture Perimeter Firewall Service Design for the CDC Scenario Sikre trådløse netværk med EAP og certifikater Securing Wireless LANs: A Windows Server 2003 Certificate Services Solution, at

30

31 4/3/2017