Kurt Shintaku's Blog

Personally, I’m sort of on a kick to help amplify coverage of any Microsoft event that has objective reporting.  So these are a few sites that I think are doing a good job of live blogging/covering the BUILD 2013 Conference going on right now in San Francisco sans the snark. 

Peeps listed below?  You’re doin’ it right!

• The Verge – Tom Warren
  “Live from the Microsoft Build 2013 keynote”
  http://live.theverge.com/live-microsoft-build-2013/
• Windows Phone Central – Daniel Rubino, Sam Sabri
  “Microsoft Build 2013 Keynote Live blog”
  http://www.wpcentral.com/build-2013-keynote-live-blog
• Tom’s Hardware – Marcus Yam
  “Microsoft Build 2013 Keynote Day 1 Live Blog”
  http://new.livestream.com/toms-live/microsoft-build-2013-day-1
• LifeHacker – Angus Kidman
  “Build 2013 Live Blog: All The Windows 8.1 News”
  http://www.lifehacker.com.au/2013/06/build-2013-live-blog-all-the-windows-8-1-news/
• MarketWatch – Rex Crum
  “Recap: Microsoft’s Build conference keynote”
  http://blogs.marketwatch.com/specialreport/2013/06/26/live-blog-microsofts-build-conference-keynote/

YAY!  ABC News just launched on Windows Phone!

This app provides the ABC News experience beyond what the web alone provides by not just formatting the content for your Windows Phone’s screen and eliminating advertising (except for ABC’s own show ads) but also providing:

• Award-winning coverage in story, video and slideshow formats
• Live video & blogs for key events – including the Hourly News Pop, a video summary of up to the minute news published every hour
• Trending stories to see what everyone is talking about
• Breaking news alerts (Notifications on your Windows Phone)
• Pin your favorite shows and sections for easy access:
• Good Morning America
• World News
• Nightline
• 20/20
• This Week with George Stephanopoulos
• U.S., International, Politics, Investigative, Health, Entertainment, Money, Technology, Sports and Travel
• Tap & Share or use SMS, Facebook, Twitter or email

The live video is cool, especially the Hourly News Pop.  Note: I don’t know that the app has listed in the on-Windows-Phone app directory yet so load the app from the link below.

• DOWNLOAD: “ABC News” for Windows Phone
  http://www.windowsphone.com/en-us/store/app/abc-news/02307067-9b8b-44c6-b2ce-500810da63ff

Welcome to Build Week
This week at San Francisco’s Moscone Center we will host developers and press from around the world for three days of immersive content, hackathons and demos during our annual Build Developer Conference. It all begins at 9:00 am PDT on June 26^th.

Microsoft’s senior executives and top technical leaders will tell the Microsoft Platform Story through keynotes, supported with some incredible Microsoft product news, partner app announcements and compelling demos to show developers what they can do on our platform. We’ll go to the bare metal with over 160 deep technical sessions and around-the-clock hackathons. All of this delivered by the Microsoft Engineers and Evangelists behind our products. 

Get Involved and tune in…
If you are not attending Build:

• Our Channel 9 Community will broadcast keynotes, top sessions and interviews live throughout the event
• Developers and other customers will be able to submit their questions online.
• Updates and announcements can be found on the Microsoft News Center.
• All remaining sessions will be made available on-demand within about 24 hours of presentation time.

• WEBCAST: BUILD 2013 keynote & key sessions broadcast, June 26th, 9:00AM PDT
  http://channel9.msdn.com/Events/Build/2013

Cloud Spectator, an independent research organization that monitors IaaS solution providers, recently ran tests across 5 major Virtual Machine hosters/IaaS providers.  Take a look at the comparisons of vendors for the following categories in this research report, published June 5th, 2013:

• Performance
• Price/Performance
• CloudSpec benchmark

Excerpt:

• “On average, the highest-performance provider over the test period is Windows Azure, and the lowest-performance provider is Amazon EC2. The difference in performance: Windows Azure scores 3 times higher than Amazon EC2 on average.”
• “Windows Azure, the highest-value provider in this scenario, provides 5x more value than on average throughout the 5-day test period than the lowest-value provider, Rackspace.”

This is extremely telling.  And now, software developers with MSDN subscriptions can get access to the highest performing IaaS cloud solution on the market at no additional cost to them using their MSDN-granted Azure credits.

• RESEARCH: Cloud Server Performance: A Comparative Analysis of 5 Large Cloud IaaS Providers (.PDF)
  http://www.cloudspectator.com/cloud-server-performance-a-comparative-analysis-of-5-large-cloud-iaas-providers-3/

Ignite Online provides technical training for IT Professionals on the new Exchange, Lync, Office and Office 365. These guides feature new product capabilities and cover topics such as design, deployment and management of these technologies.

• Office 2013
• Office 365
• Exchange Server 2013
• Lync Server 2013

TRAINING: “Ignite Online” for Office & IT Professionals
http://officeignitelabs.cloudguides.com/

Just released:  The Enhanced Mitigation Experience Toolkit 4.0.

The Enhanced Mitigation Experience Toolkit (EMET) is designed to help prevent hackers from gaining access to your system.

Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of security updates. For users who get attacked before the latest updates have been applied or who get attacked before an update is even available, the results can be devastating: malware, loss of PII, etc.

Security mitigation technologies are designed to make it more difficult for an attacker to exploit vulnerabilities in a given piece of software. EMET allows users to manage these technologies on their system and provides several unique benefits:

1. No source code needed: Until now, several of the available mitigations (such as Data Execution Prevention) have required for an application to be manually opted in and recompiled. EMET changes this by allowing a user to opt in applications without recompilation. This is especially handy for deploying mitigations on software that was written before the mitigations were available and when source code is not available.
2. Highly configurable: EMET provides a higher degree of granularity by allowing mitigations to be individually applied on a per process basis. There is no need to enable an entire product or suite of applications. This is helpful in situations where a process is not compatible with a particular mitigation technology. When that happens, a user can simply turn that mitigation off for that process.
3. Helps harden legacy applications: It’s not uncommon to have a hard dependency on old legacy software that cannot easily be rewritten and needs to be phased out slowly. Unfortunately, this can easily pose a security risk as legacy software is notorious for having security vulnerabilities. While the real solution to this is migrating away from the legacy software, EMET can help manage the risk while this is occurring by making it harder to hackers to exploit vulnerabilities in the legacy software.
4. Ease of use: The policy for system wide mitigations can be seen and configured with EMET’s graphical user interface. There is no need to locate up and decipher registry keys or run platform dependent utilities. With EMET you can adjust setting with a single consistent interface regardless of the underlying platform.
5. Ease of deploy: EMET comes with built-in support for enterprise deployment and configuration technologies. This enables administrators to use Group Policy or System Center Configuration Manager to deploy, configure and monitor EMET installations across the enterprise environment.
6. Ongoing improvement: EMET is a living tool designed to be updated as new mitigation technologies become available. This provides a chance for users to try out and benefit from cutting edge mitigations. The release cycle for EMET is also not tied to any product. EMET updates can be made dynamically as soon as new mitigations are ready

The toolkit includes several pseudo mitigation technologies aimed at disrupting current exploit techniques. These pseudo mitigations are not robust enough to stop future exploit techniques, but can help prevent users from being compromised by many of the exploits currently in use. The mitigations are also designed so that they can be easily updated as attackers start using new exploit techniques.

Below is a summary of the features and changes that are included with the EMET 4.0 release:

• Certificate Trust: considering the raise of PKI-related attacks, we decided to implement a configurable SSL Certificate Pinning to try to detect Man in the Middle attacks that leverage SSL/TLS certificates. The Certificate Trust feature in EMET is rule-based and allows to pin a specific SSL/TLS certificate to a trusted Root Certificate Authority.
• ROP mitigations and hardening: in the last Technical Preview release of EMET, we introduced some mitigations to try to stop ROP-based attacks by implementing some of the winner ideas of the BlueHat Prize contest. With this new EMET release we hardened the ROP and other mitigations to detect and stop novel attack techniques.
• Early Warning Program: this feature will allow EMET to send contextual data back to Microsoft, through the standard Windows Error Reporting channel, every time that an exploit has been detected and stopped. We are adding this feature to help us respond to new 0day exploits as soon as possible.
• Audit mode: if an exploit is detected, EMET will not terminate the attacked process but it will just report the attack and let the process continue. This mode is only applicable to certain mitigations, for example the anti-ROP ones, that detect the attack when the process is not already in a crashed state. This feature is useful for enterprise customers for testing purposes and to spot false-positives and app-compat problems without compromising the user experience.

EMET 4.0 also includes bug fixes and UI changes to improve the overall user experience. Also, at the end of the installation, EMET will offer the user to automatically apply recommended settings to protect Internet Explorer, Microsoft Office, Adobe Acrobat/Reader, and Oracle Java, as well as a pre-defined set of rules for the Certificate Trust feature that will monitor the main Microsoft and other popular online services. More information are available in the User Guide, available in the EMET installation folder.

Please remember that EMET 4.0 requires .NET Framework 4, and in order to protect Internet Explorer 10 on Windows 8 you need to install KB2790907 – a mandatory AppCompat update that has been released on March 12th.

• DOWNLOAD: Enhanced Mitigation Experience Toolkit 4.0
  http://www.microsoft.com/en-us/download/details.aspx?id=39273
• BLOG ANNOUNCEMENT: Now Available: Enhanced Mitigation Experience Toolkit (EMET) Version 4.0
  http://blogs.technet.com/b/security/archive/2013/06/17/now-available-enhanced-mitigation-experience-toolkit-emet-version-4-0.aspx?Redirected=true

Scott Guthrie posted the details of a ridiculous new offer we’re making for MSDN Subscribers, in addition to some amazing discounted rates for Windows Azure:

We are making the above discounted rates even more compelling by also giving every MSDN subscriber up to $150 per month of monetary credits that can be used to run any Windows Azure resource for Dev/Test purposes.  MSDN Professional Subscribers will be provided with $50/month, MSDN Premium Subscribers with $100/month, and MSDN Ultimate Subscribers with $150/month.

These monetary credits can be applied towards any Windows Azure resource being used for Dev/Test purposes.  This includes: Virtual Machines (both Windows and Linux), SQL Databases, Cloud Services, Web Sites, Mobile Services, Hadoop Clusters, BizTalk Services, Storage, Media and more.  The previous per-unit restrictions in place with the old MSDN offer are also being removed – instead you now have a monetary credit that can be applied and mixed/matched on resources however you want.

Below are just a few examples of how a MSDN Premium customer (who will now gets $100/month of credits with their MSDN subscription) could use the monetary credit:

1) A MSDN Premium subscriber can now run 3 Windows Server VMs for 16 hours a day (at 6 cents/hr) every day of the month.  And he or she can run SQL Server Enterprise, BizTalk Server, or SharePoint Server in them using their MSDN use-rights at no additional charge.  And if they ran these 3 VMs for 16 hours a day for 31 days in the month they’d still have $10.32 in credit left over to spend on something else! 🙂

2) Alternatively the $100/month credit could be applied towards spinning up 80 Windows Server VMs (with SQL, BizTalk, SharePoint, etc) to use in a load-test for 20 hours

3) Or the $100 credit could be used to spin up 50 Hadoop cluster nodes for 10 hours of a dev/test MapReduce run

4) Or the $100 credit could be used to dev/test 100 web-sites with a SQL Database

The above examples provide just a flavor of the different options now available with this program.  The great thing about the monetary credits is that you can use them with any Windows Azure resource – so you have the flexibility to apply them in whatever combination you want.  The credits themselves reset every month (meaning if you are a MSDN Premium customer the credits will reset to $100/month every month).  So every month you also have the opportunity to change how you allocate them however you want. 

You can optionally choose to pay additional money on top of the monetary credit (meaning if you need $200 of resources in a month, the MSDN Premium Monetary Credit will cover the first $100 of usage and then you can pay the rest).  Note that any overages will still take advantage of the MSDN Discount Rate (meaning the VMs will only be charged at 6 cents/hr) so you still benefit from a major price discount on that as well. 

By default we enable a “spending limit of $0” on MSDN based subscriptions to ensure that customers are never accidentally billed for usage above their MSDN credits.  You can turn this of if you want to use more resources than the built-in credits support and pay for overages.

Read more about the offers & discounts at Scott’s blog at:

• SCOTT GUTHRIE’S BLOG: Windows Azure: Announcing Major Improvements for Dev/Test in the Cloud
  http://weblogs.asp.net/scottgu/archive/2013/06/03/windows-azure-announcing-major-improvements-for-dev-test-in-the-cloud.aspx

We have a new security video resource called the Targeted Attacks Video Series  on Advanced Persistent Threats (APTs), or what we at Microsoft call Targeted Attacks by Determined Human Adversaries. These five short informational videos summarizes three security whitepapers, Determined Adversaries and Targeted Attacks, Mitigating Pass-the-Hash (PtH) Attacks and Other Credential Theft Techniques, and Best Practices for Securing Active Directory. The five short videos are:

1. Introduction to Determined Adversaries and Targeted Attacks: Tim Rains, Director, Microsoft Trustworthy Computing, provides background information on these types of attacks and set the context for the rest of the video series.
2. Mitigating Pass-the-Hash Attacks: Patrick Jungles, Security Program Manager, Trustworthy Computing, explains what a Pass-the-Hash attack is and some tested mitigations to help manage the risk associated with credential theft attacks.
3. Anatomy of a Cyber-attack Part 1: Sean Finnegan, CTO of the Microsoft Consulting Services Cybersecurity Practice, walks through a typical targeted attack, step by step, describing how attackers perpetrate these attacks.
4. Anatomy of a Cyber-attack Part 2: Sean Finnegan finishes his briefing on how determined adversaries commit targeted attacks.
5. Importance of Securing Active Directory: Bret Arsenault, Microsoft CISO, discusses the importance of protecting your Active Directory in the context of target attacks.

To learn more, I recommend you read the blog post on Targeted Attacks Video Series, written by Tim Rains, that summarizes the video series and the whitepapers.  I encourage you to view the series and share it with any of your peers you may think would benefit.  

—————————-
[horribly plagiarized from my coworker, Mark McReynolds, who’s incidentally probably lifted a few blog pages here and there from me anyway so I’m feeling a guilty but not too guilty]

We recently published a ton of eBooks and guides for architects of SharePoint Server 2013 solutions.  Take a look:

Test Lab Guides:

• Test Lab Guide: eBook for SharePoint Server 2013 Intranet and Team Sites
  Download this free ebook to learn how to create a test lab containing intranet and team sites in a SharePoint Server 2013 three-tier farm.
• Test Lab Guide: Demonstrate Permissions with SharePoint Server 2013
  This paper provides a brief introduction to SharePoint Server 2013 and illustrates how to configure permissions.
• Test Lab Guide: Configure eDiscovery for SharePoint Server 2013
  This paper contains a brief introduction to the eDiscovery features in SharePoint Server 2013 and step-by-step instructions for how to configure eDiscovery.

Additional documentation for SharePoint Server 2013:

• Authentication in SharePoint 2013
  This model summarizes the types of authentication that are available in SharePoint 2013.
• Reimagine SharePoint Development Guidance
  These downloads provide guidance on how to migrate legacy full-trust code solutions to apps and the cloud app model.

The Microsoft SQL Server 2012 System Views Map shows the key system views included in Microsoft SQL Server 2012, and the relationships between them.

The map is similar to the prior versions of Microsoft SQL Server System Views Maps and includes updates for the Microsoft SQL Server 2012. Note that not all possible relationships are shown.

• DOWNLOAD: SQL Server 2012 System Views Map (1.4MB)
  http://www.microsoft.com/en-us/download/details.aspx?id=39083