Presentation for SecurEBiz CxO Security Summit

1
Presentation forSecurE-Biz CxO Security Summit

• Carolyn Brubaker
• eGovernment Federal Manager
• Microsoft Corporation

2
Principals and Goals of FISMA

• Years of audit and analysis yielded important
  lessons
• Authority of public law creates compelling
  mandate for IT security
• Recognizes the challenges of IT security at an
  enterprise level
• Addresses historically weak areas of IT security
• Mandates IT security as a lifecycle process
• Empowers OMB, NIST, and others to describe how
  to secure systems across the enterprise

3
Enterprise Security Compliance

• Asset and inventory management Helping agencies
  define inventories of Microsoft and related
  assets
• Working with key FISMA partners to help agencies
  implement security plans for Microsoft security
  targets
• Assisting agencies through cyber-security
  education awareness campaigns

4
Patch Management Strategies

• Streamlining Patch Management Processes and
  Incident Response Practices
• Better patch delivery schedules and systems, and
  coordinated responses to vulnerability exploits.
• Enhancing Patch Management Tools
• Standardizing our testing processes
• Conducting a formal after-action review by the
  Microsoft Security Response Center
• Standardizing our patches operation and
  standardizing the technologies they use, to
  provide users with a consistent, simpler patch
  experience.
• Providing a consistent patch release schedule
• Reducing the size of the patches whenever
  possible to make it easier to distribute patches
  across low-bandwidth networks.

5
Microsoft Security Response Center and Emergency

• Communication
• Coordinating the investigation of reported
  vulnerabilities, the development of patches, and,
  together with our field teams, our customer
  outreach efforts.
• Microsoft communicates with its customers through
  field bulletins, email outreach to more than one
  million subscribers, webcasts, outreach to the
  media and industry, and coordination with
  government agencies.
• Federal, Security Quick Reference Cards
• Microsofts Anti-Virus Rewards Program encouraged
  individuals to provide information to law
  enforcement that contributed to the arrest of the
  Sasser author.

6
Key Links to Learn More

• Improving Your Computers Defenses
• - Updating your Microsoft Software
• http//www.microsoft.com/security/articles/swupdat
  es.asp
• - Backing Up Computer Files
• http//www.microsoft.com/security/articles/backup.
  asp
• - Computer Maintenance Tips
• http//www.microsoft.com/security/articles/mainten
  ance.asp
• - Protect Your PC
• http//www.microsoft.com/security/protect/
• - Turning On Internet Connection Firewall
• http//www.microsoft.com/security/articles/use_icf
  .asp