Exchange Connections 2006 - Florida and France

Currently, I am working on a full-day session for the Exchange Connections conferences in Orlando (April 13) and in France (Nice) on April 24. The session is called Security for Exchange: Assessment, Auditing, and Hardening

As I have started adding content to this session, I realized that I'm pretty much putting together an outline of how I do a Exchange Server Security Audit for which I normally charge a minimum of $4,000 (well, THAT includes a final report, too). There should still be spaces available for both the session in Nice and in Orlando. Topics include:

• Best practices for Exchange administration with security and stability in mind
• How to implement auditing of Exchange to learn the most about typical activities and to diagnose potential intrusions.
• The Exchange antivirus API, virus detection methodologies, multi-layer virus detection, and some common approaches to preventing viruses from disrupting a user’s daily routine.
• Real-world solutions for fighting spam including multiple approaches to content inspection, spam detection, and preventing false positives. Approaches such as white-listing, grey listing, black-listing, sender address verification technologies, Sender Id (SPF), and Domain Keys will be covered.
• Using a Managed Provider for inbound SMTP message hygiene.
• Discuss the top antivirus and anti-spam 3rd party and Microsoft solutions on the market and the pros and cons of each.
• How to most securely provide Exchange services to users outside of your corporate network whether they use the Outlook client, Outlook Web Access, mobile devices, or a POP3/IMAP4 client.
• Understanding PKI and S/MIME for providing end-to-end protection of e-mail content.
• Examining Enterprise Rights Management for use with messaging systems.
• Best practices for Exchange server security and message hygiene

I am working on a series of checklists that will make this process easy to go back to your own servers and confirm that you are following best practices.