Microsoft Higher Education - Mid-Atlantic : Forefront Security

Forefront Security for SharePoint SP1 is Now Available

Kevin Dean — Thu, 23 Aug 2007 01:06:00 GMT

We are very happy to announce that Forefront Security for SharePoint with Service Pack 1 shipped on July 31^st and is available in the 11 supported languages (English, French, German, Italian, Japanese, Korean, Chinese (Simplified), Chinese (Traditional), Brazilian Portuguese, Spanish, and Russian).

Forefront Security for SharePoint with SP1 provides an improved user experience around file uploads, manual scanning, keyword filtering, and program administration. At the same time, SP1 addresses critical deployment blockers that customers are facing today with the RTM version of Forefront Security for SharePoint.

Service Pack 1 contains the following features/fixes:

1. Impersonation Fix

Forefront only gives certain groups permission to access the Forefront registry. The accounts used to run the SharePoint application pools are in one of these groups. There is a bug in SharePoint which sometimes results in the worker process impersonating SharePoint’s regular users, instead of the accounts from the application pools. The regular users do not have permission to access the Forefront registry and as a result, Forefront’s VSAPI hooking dll Initialize will fail. When this happens, all the files will be marked as infected with “” virus.

The fix included in this build will ensure that Forefront will impersonate the SharePoint application pool credentials to run the process, and then revert back to the original user credentials before returning the call. If the user has SharePoint’s fix for this problem, the Forefront patch will be redundant and not used.

2. File Size Fix

The maximum file size is supposed to be 2GB, but the RTM version released restricted the maximum size to 128Mb. The Service Pack has the fix to allow files up to 2GB.

3. Manual Scan Fix

Currently, Manual scan can no longer disable VSAPI scanning, thus triggering a Real-time scan instead. This causes a number of problems – the store cannot be cleaned effectively, content that is flagged as infected cannot be retrieved and cleaned, and content filtering cannot be applied. The fix will allow manual scan to disable VSAPI so that it is able to scan and clean content effectively.

4. Crash Fix

Changes to the SharePoint Central Administration’s AV settings can sometimes cause SharePoint to crash, leaving the system in a bad state. The user will then have to manually recycle services to set the system right. This fix for this is included in this release.

5. Non-ASCII Keyword Filtering Fix

Non-ASCII keywords were not being detected in Office 2007 documents. The fix will ensure that non-ASCII keywords will be correctly detected in Office 2007 documents.

6. Added Soft Block for Installing FSSP on a Box that has Exchange

Forefront Security for SharePoint does not support having Exchange Server installed on the same server. The product will install, but not operate properly, thus creating a supportability issue. To address this, the user will be shown a message informing them that installing FSSP on a server containing Exchange is not a supported scenario as it could cause adverse side effects. At the same time, it will ask the user whether they wish to continue with the installation.

7. STSADM Fix

The STSAdm utility would hang on an Import or export because Forefront was not releasing threads in a manner which STSADM was able to handle properly. We have since fixed this to ensure that the threads are released in a proper manner. As part of this fix we changed the default behavior of our setup to create the LegacyScanAccount key. This key has to be created and set to allow the scanning processes to run as ‘System’, instead of “Network Service”. The issue is that, when our scanning processes run as “Network Service”, Forefront does not have the permissions to scan files presented by 3^rd party applications, like STSADM. This results in “Access denied” errors being generated when the external application tries to communicate with Forefront. When the key is set, the scanning processes will run as “System”, thus providing Forefront with the privileges necessary to scan the files from 3^rd party applications. The key, which has to be created under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Forefront Server Security\SharePoint, will be created during install so as to ensure that customers do not face any additional issues with the STSAdm utility.

8. Removed CA InoculateIT Engine due to CA Engine Consolidation

Computer Associates (CA) recently combined the CA InoculateIT and the CA Vet engines into one engine. As a result, CA will no longer offer support for the CA InoculateIT engine.

Download Forefront Security for SharePoint with Service Pack 1

http://www.microsoft.com/downloads/details.aspx?FamilyId=E06453B8-B2DD-4177-969C-2F89AA841E11

How Microsoft fights off 100,000 attacks per month

Kevin Dean — Mon, 11 Dec 2006 05:32:22 GMT

This is an interesting ComputerWorld article detailing our remote access and telework strategy. This article is a quick read and explains the various technologies we use (VPN/PKI/IPSec/Quarantine/RPC-HTTP/LCS/SharePoint) at a higher level.

Here's what Microsoft does to protect itself from the continuous onslaught

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005756&pageNumber=1

Forefront Client Security Public Beta!

Kevin Dean — Thu, 16 Nov 2006 03:28:00 GMT

Forefront Client Security Public Beta – Released!

Yesterday at IT Forum in Barcelona, we released the public beta of Forefront Client Security!

The Microsoft Forefront comprehensive line of business security products provides greater protection and control through integration with your existing IT infrastructure and through simplified deployment, management, and analysis. Forefront is a comprehensive solution that helps provide protection for the client operating system, application servers, and the network edge.

I encourage you to take a ‘test drive’ of this product and check it out, even if you are using another anti-virus product today.

Kevin

Windows Defender has been released to the web!

Kevin Dean — Wed, 25 Oct 2006 06:41:00 GMT

Microsoft Defender (formerly Microsoft Antispyware beta) has Released! This is a consumer product, there are no plans for making this product Enterprise ready for centralized simplified administration, update distribution, or assessment scanning. For an Enterprise ready solution see below regarding Microsoft Forefront Client Security. This is very good information to pass to your employees and customers as they have personal systems that often have access to your production networks.

This release includes enhanced features that reflect ongoing input from customers, as well as Microsoft’s growing understanding of the malicious software landscape.

Specific features of Windows Defender include:

· A redesigned and simplified user interface – Incorporating feedback from our customers, the Windows Defender UI has been redesigned to make common tasks easier to accomplish with a warning system that adapts alert levels according to the severity of a threat so that it is less intrusive overall, but still ensures the user does not miss the most urgent alerts.

· Improved detection and removal – Based on a new engine, Windows Defender is able to detect and remove more threats posed by spyware and other potentially unwanted software. Real Time Protection has also been enhanced to better monitor key points in the operating system for changes.

· Protection for all users – Windows Defender can be run by all users on a computer with or without administrative privileges. This ensures that all users on a computer are protected by Windows Defender.

· Support for 64-bit platforms, accessibility and localization - Windows Defender supports accessibility and 64-bit platforms. Microsoft will release localized versions including German and Japanese soon after the availability of the English versions. Please be sure to use WindowsDefenderX64.msi for 64-bit platforms.

· Delta definition updates - Windows Defender now downloads smaller delta definition updates when possible which reduces the time required to download and install definition updates. Customers can expect shorter download times when updating their definition updates.

· Free Limited Support - As a part of our commitment to the security of our customers, free support for installation, configuration, definition update, detection and removal errors will be available for a limited time after download and installation. Please refer to the Windows Defender support policy for more information.

· WGA enforcement - There are significant risks to running non-genuine Windows. Only genuine Windows customers can receive product downloads, Windows updates and special offers. Windows Defender will validate that your copy of Windows is genuine before installation. Furthermore, Windows Defender will only remove Severe threats for machines that are not genuine. Low, Medium and High threats will be detected, but not removed unless your copy of Windows is genuine. For more information, please visit http://www.microsoft.com/genuine

Important Notes

· Windows Defender no longer supports Windows 2000 as it will be out of mainstream support in October 2006. Please refer to the support lifecycle website for more information.

· Access to Newsgroups:
In addition to phone support we also have newsgroups to help get your questions answered.

For Additional Information:
Please see the Release Notes to learn more about known issues with Windows Defender.

To Download, go to: http://www.microsoft.com/downloads/details.aspx?FamilyId=435BFCE7-DA2B-4A6A-AFA4-F7F14E605A0D&displaylang=en

To download the x64 version: http://www.microsoft.com/downloads/details.aspx?FamilyId=61F0C114-6FFE-4FAD-8CA5-74F236E9283B&displaylang=en

Microsoft Forefront Client Security

Features that are required by Enterprises, such as centralized simplified administration, update distribution, or assessment scanning, are being designed into Microsoft Forefront Client Security <http://www.microsoft.com/forefront/clientsecurity/default.mspx> (currently in development - public beta coming soon).

Microsoft Launches Forefront Security for SharePoint Beta

Kevin Dean — Fri, 29 Sep 2006 06:32:00 GMT

REDMOND, Wash. — Sept. 28, 2006 — Microsoft Corp. today is launching the public beta of Forefront Security for SharePoint^® (http://www.microsoft.com/forefront). This latestrelease of Microsoft^® Forefront security products for businesses is based on Antigen for SharePoint Server, the multi-engine security solution acquired by Microsoft as part of the acquisition of Sybari Software Inc. in 2005.

Forefront Security for SharePoint is optimized to provide advanced protection for Microsoft Office SharePoint Server 2007 and Windows^® SharePoint Services 3.0. Microsoft SharePoint products and technologies facilitate easy collaboration across an organization, connecting people, processes and systems within and beyond organizational boundaries. Forefront Security for SharePoint uses the combined power of multiple antivirus engines from leading security providers to protect against viruses, unwanted files and inappropriate content.

“As business customers use collaboration software to connect internal users, customers and partners in an increasing variety of ways, they want to maintain the highest level of protection for critical business information,” said Margaret Arakawa, senior director of Security and Access Product Marketing at Microsoft. “Forefront Security for SharePoint facilitates these new collaboration scenarios by providing a layer of advanced protection against the rapidly evolving threat landscape.”

Microsoft Forefront Security for SharePoint delivers the following:

· Protection against the latest threats. Forefront Security for SharePoint simultaneously utilizes up to five antivirus engines from leading security vendors to provide customers with increased protection against malware threats, inappropriate content and dangerous files types. This latest release includes the new Microsoft Antivirus engine.

Integration to help optimize server performance.: Integration with Microsoft Office SharePoint Server 2007 and Windows SharePoint Services 3.0, as well as scanning innovations and performance controls, help ensure optimal collaboration server performance.
Simplified management control.: Forefront Security for SharePoint provides centralized management control to help ensure organizations can simply and cost-effectively deploy, manage and maintain the security of their collaboration servers.

Product Availability
The launch of Forefront Security for SharePoint will coincide with the general availability of Microsoft Office SharePoint Server 2007 and Windows SharePoint Services 3.0, which are scheduled to be available to businesses by the end of 2006 and generally available in early 2007. It will be available through Microsoft’s global channel of Security Solutions Competency partners. Companies can download the beta release at http://www.microsoft.com/forefront.