Microsoft Forefront Server Security 2010

[Spy$Eyes]

Microsoft Forefront Server Protection includes a suite of server security products. These Forefront solutions is essentially the protection of Exchange, SharePoint and Office Communication Server against attacks such as viruses or worms. The Forefront products are divided into three groups. The Edge-Security is to protect the networks on the border between the Internet and the LAN. It is by the Threat Management Gateway and Unified Access Gateway is formed. A second group is the protection of the terminals by products such as firewalls or virus scanners. The third group is the considered server protection tools formed. In the Forefront Server Microsoft Protection combines the tools to protect the Exchange server, the SharePoint Server and Office Communication Server. The protection helps against attacks such as viruses, worms and other malware, or the e-mails will be introduced with documents.

Forefront Server Protection is more than a scanner for attacker after virus or spyware mail or documents in research. The tool is rather an execution environment scan engines for embedded. The scan engines are ultimately doing the work. In the provision of these engines, Microsoft is not petty and grabs as many as five different scanners in the Protection Suite. Currently, these are the products of the company Norman, VirusBuster and Kaspersky as well as Microsoft's own anti-virus engine. The engines are therefore all but one third party. Microsoft's goal here is in the best possible recognition rate. This is certainly true, for two different engines, so they serve their purpose in principle, a higher detection rate than the scanning of a single manufacturer. For this alone speaks the statistical probability.

[Spy$Eyes]

Since version Exchange 2007 , the Exchange feature roles are distributed on several. The scan engines are then in turn use to these respective servers. What would like to use by the five engines offered the user the process is up to it. The engines can be used in parallel. During the passage of mail through the scan engines that are supplied with the information collected, perform, as if the emails are already scanned and the results have come to light here. Usually it will not be useful to investigate a mail twice in succession by the same scanner, because the result will usually be the same. This can mean that on the first two servers, the Edge Transport and Hub Transport, two different engines are used and on the server with the Mailbox role of the remaining fifth scan engine. In general, you will be satisfied but with fewer scan passes. Because ultimately this issue depends also on the question of the server performance or the delay that one would accept the mail exchange.

The settings of the engines and the hit rate achieved are highly configurable. Microsoft allows a match between two aspects: the greatest possible safety and a reasonable scan duration. Optimum security is achieved when each of the five engines, email investigated for attackers. Optimum maturity is achieved, however, if only one engine, the Mail on attack code scanner. In between, three other steps are adjustable. Each scan engine can be configured and set up separately. The scan engines are, as already mentioned, each directly from the manufacturers. Forefront Server Protection integrates these only in a group. All scanners are variants that are identified by examining the signatures the attacker. They shall have signature files are placed to the side. These viruses signatures have to be tracked regularly. This is done directly and automatically by Forefront. It invites Forefront Server Protection these signatures from the Microsoft Web site. Microsoft in turn, refers them from the manufacturers of the actual scanner and places it after a test available for download.

[Spy$Eyes]

The examination of the data exchange can take place either online or offline. In the online study, for example, a document, if it is on the server or collected is stored on attacker analyzed directly, while in the offline search for potential attackers the directories or mailboxes will be scanned periodically. The scope of the mail survey among all elements of the e-mail, including header, subject, sender, file content and the data path of the mail. Object and purpose of the security system is the identification and removal of attackers in e-mails or documents between the user and the exchange - or SharePoint - server to be replaced. What exactly should this happen, can set the user in advance. This can, for example, the distance of the attacker or the filing of a message to be in quarantine. The chronologically last module of Forefront relates the reporting. In this report, the system volume and accumulation of the attacker on the actions or other measures. The new features of the current version of the Forefront Server Protection includes functions for the fight against spyware and spam function , including filters for backscatter . This includes the support of Exchange 2010. Furthermore, there are now links to the PowerShell to script-driven execution of tasks. In addition, Microsoft has missed the security system, a new user interface. The overall management of Forefront is now in a dashboard. Herein, the user can make a quick overview of the security situation. By integrating with System Center Operations Manager can then also exchange state information. To install the modules supports the new version now also the techniques of the MSI installer.