1. Trust, Security, and ResiliencyEmpowering the Information Society Angela McKay Senior Security Strategist Lead Global Security Strategy and Diplomacy Trustworthy Computing

2. Understanding the Cyber Threat Challenges Many malicious actors Similar techniques Many motives Shared integrated domain Consequences hard to predict Worst case scenarios alarming Attribution

3. Cyber Threat Categories & Solutions Economic Espionage Cybercrime Cyber Warfare Military Espionage www.microsoft.com/downloadRethinking the Cyber Threat by Scott Charney

4. Trust Trust in the Info Society Reputation Establishment Mechanisms to uniquely identify, authenticate, and establish trust Revocation Mechanisms for revoking claims Identity Minimal Disclosure Mechanisms to limit information revealed to only what is essential for the transaction Broker-mediated Disclosure Mechanisms enabling trusted 3rd-parties to minimize data shared Privacy

5. Trust Enabling Interoperability Microsoft has released portions of the U-Prove technology to the open source community, customers, developers and the industry, in order to gather feedback. The following are available now: Two specifications published under the Microsoft Open Specification Promise, making the technology and guidance available to a broad audience of commercial and open source developers Open source software developer kits in C# and Java software developer kits available under the Berkley Software Distribution license A Community Technology Preview of U-Prove, providing integration with Active Directory Federation Services 2.0, Windows Identity Foundation and Windows CardSpace v2

6. Security Exploit Economics

7. Security Decreasing Attacker ROI The Microsoft Security Development Lifecycle - Simplified www.microsoft.com/security/sdl 7

9. Appropriate solution is provided to customers, such as a security update, tool or fix

10. Conduct internal process reviews and gather lessons learned

11. Assess the situation and the technical information available

12. Start workingon solution

13. Communicate initial guidance and workarounds to customers, partners and press

14. Notify and inform field support

15. Convene and evaluate severity

16. Mobilize security response teams and support groups into two main groups:

17. Emergency Engineering Team

18. Emergency Communications Team

19. Monitor customer support and press

20. Observe environment to detect any potential issues

21. Leverage existing relationships with:

22. Partners

23. Security researchers and finders

24. Monitor customer requests and press inquirieswww.microsoft.com/msrc

25. Resiliency Partnering for Resilience Media Emergency Responders Government Private Sector & NGO’s

26. Resiliency Microsoft Programs Training - Security Cooperation Program (SCP) Rapid Response Communications – SCPCert Defensive Security Information – Defensive Information Sharing Program (DISP) Policy Guidance – Critical Infrastructure Partner Program www.microsoft.com/industry/publicsector/government/programs/default.mspx

28. Increase the costs for cyber attackers

29. Build more collaborative security relationships to mitigate riskCalls To Action

30. © 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.