Topic Last Modified: 2011-05-02
Microsoft Lync Server 2010 includes the following security enhancements:
- Planning and design tools Lync Server
2010 provides two tools to facilitate planning and design and to
reduce the chance of misconfiguring Lync Server components. You can
use the Planning Tool to automate much of the topology design
process. You can export the results from the Planning Tool to
Topology Builder, which is the tool that is required to install
each Lync Server 2010 server. Topology Builder stores all
configuration information in the Central Management store. For
details about these tools, see Beginning the Planning
Process in the Planning documentation.
- Central Management store. With Lync Server 2010,
configuration data about servers and services is moved to the
Central Management store. The Central Management store provides a
robust, schematized storage of the data needed to define, set up,
maintain, administer, describe, and operate a Lync Server
deployment. It also validates the data to ensure configuration
consistency. All changes to this configuration data happen at the
Central Management store, eliminating “out-of-sync” issues.
Read-only copies of the data are replicated to all servers in the
topology, including Edge Servers and Survivable Branch Appliances.
Replication is managed by a service that is, by default, run under
the context of the Network service, reducing the rights and
permissions to that of a simple user on the computer. For details,
see New Central
Management Store in the Getting Started documentation.
- Windows PowerShell-based management and Web-based management
interface Lync Server 2010 provides a powerful
management interface, built on the Windows PowerShell command line
interface. It includes cmdlets for managing security, and Windows
PowerShell security features are enabled by default so that users
cannot easily or unknowingly run scripts. This means that the
software defaults are set to automatically help maximize security
and reduce the avenues of attack. For details about Windows
PowerShell management support in Lync Server 2010, see Windows PowerShell and
Lync Server Management Tools.
- Role-based access control
(RBAC) Microsoft Lync Server 2010 introduces
role-based access control (RBAC) to enable you to delegate
administrative tasks while maintaining high standards for security.
You can use RBAC to follow the principle of "least privilege," in
which users are given only the administrative rights that their
jobs require. For details, see Role-Based Access
- Network address translation (NAT) Lync
Server 2010 does not support the use of network address translation
(NAT) on the internal interface of the Edge Server, but it does
support placing the external interface of the Access Edge service,
Web Conferencing Edge service, and A/V Edge service behind a router
or firewall that performs network address translation (NAT) for
both single and scaled consolidated Edge Server topologies.
Multiple Edge Servers behind a hardware load balancer cannot use
NAT. If multiple Edge Servers use NAT on their external interfaces,
Domain Name System (DNS) load balancing is required. In turn, using
DNS load balancing allows you to reduce the number of public IP
addresses per Edge Server in an Edge pool. For details, see
- Port requirements
Note: If you federate with enterprises that have a Microsoft Office Communications Server 2007 deployment and you need to use audio/video between your enterprise and the federated enterprise, the port requirements will be those for the older version of the Edge Servers that are deployed. For example, the port ranges required for those older versions must be opened for both enterprises until the federated partner upgrades its Edge Servers to Lync Server 2010. At that time, the port requirements can be reviewed and reduced according to the new configuration.
- Simplified certificates for Edge
Servers The Deployment Wizard can
automatically populate subject names (SNs) and subject alternate
names (SANs), reducing the possibility of including unnecessary and
potentially unsecure entries.
A complete list and discussion of the new features in Lync Server 2010 and Microsoft Lync 2010 can be found in the Getting Started documentation.
Trustworthy by Design
Lync Server 2010 is designed and developed in compliance with the Microsoft Trustworthy Computing Security Development Lifecycle (SDL), which is described at http://go.microsoft.com/fwlink/?linkid=68761. The first step in creating a more secure unified communications system was to design threat models and test each feature as it was designed. Multiple security-related improvements were built into the coding process and practices. Build-time tools detect buffer overruns and other potential security threats before the code is checked in to the final product. Of course, it is impossible to design against all unknown security threats. No system can guarantee complete security. However, because product development embraced secure design principles from the start, Lync Server 2010 incorporates industry standard security technologies as a fundamental part of its architecture.
Trustworthy by Default
Network communications in Lync Server 2010 are encrypted by default. By requiring all servers to use certificates and by using Kerberos authentication, TLS, Secure Real-Time Transport Protocol (SRTP), and other industry-standard encryption techniques, including 128-bit Advanced Encryption Standard (AES) encryption, virtually all Lync Server data is protected on the network. In addition, role-based access control makes it possible to deploy Lync Server 2010 servers so that each server role runs only the services, and has only the permissions related to those services, that are appropriate for the server role.
Trustworthy by Deployment
Not only this security documentation, but all the Lync Server 2010 documentation includes best practices and recommendations to help you determine and configure the optimal security levels for your deployment and assess the security risks of activating nondefault options.