Category: Trends

To put it plainly, 2009 was the year of IT outsourcing deal renegotiation.

“One of the dominant features of the outsourcing market over the last 12 to 15 months has been the emphasis on cost above all else,” noted research firm Morrison & Foerster in a report on IT outsourcing trends in January.

The difference is that during the boom years of 2002-2008, cost was often down-played by customers and, instead, emphasis was placed on other business benefits such as transformation, concentrating on core competencies, and speed to market.

The analysts explained that this is why so many outsourcing contracts were renegotiated in 2009, with suppliers asked to share some of the pain of their customers.

Morrison & Foerster noted that economists are now talking about a “LUV” recovery from the recession, with the letters representing the “shape” of the recovery: a very slow L-shaped recovery for Western Europe; a slower U-shaped recovery for North America; and a rapid V-shaped recovery for Brazil, Russia, India, China and other emerging economies… In turn, that means service providers will have to carefully consider how to price new transactions in light of the “twin threats of cloud computing and continuing labor cost arbitrage.”

And, if parts of the world economy move at different speeds over the next 12 months, Morrison & Foerster said service providers will need to consider more varied pricing strategies. Flexibility will be the watchword in outsourcing deals in 2010, according to Morrison & Foerster.

“In 2010, we see a continuation of the trend for shorter deals, shorter procurement processes, and an emphasis on making things work rather than engaging in complex strategies,” the analysts said.

This is likely to lead many firms to take their IT services procurement in-house—so-called DIY sourcing.

“While the DIY approach will often result in short-term transactional cost savings, inexperienced purchasers of outsourcing services usually suffer longer-term losses because they fail to identify many of the key components for long-term success.”

For example, with the increased focus on costs, buyers will try and save on governance costs and overlook necessary governance functions. Particularly when customers engage in multisourcing transactions, heightened attention to governance processes is critical.

As the recovery gets underway, banks and insurance companies — which were among the hardest hit verticals of the recession and which put more deals on hold in 2009 than other sectors — are likely to come back to the fold in 2010, particularly toward the second half, according to Morrison & Foerster.

Cloud computing is likely to take center stage in IT outsourcing in 2010, according to experts. At the very least, the dramatically lowered cost of cloud providers will become a lever for customers to use in negotiations with their traditional sourcing providers.

http://itmanagement.earthweb.com/features/article.php/3885751/IT-Outsourcing-Trends-Slow-Growth-Cloud-Computing

“The need for compliance really drove widespread deployment of log management — SIEM tools went everywhere,” says Sam Curry, technology chief marketing officer at RSA. “I think we’re seeing a real shift here, and it may be happening first at small and medium-sized companies because their compliance process is less complex than those at larger enterprises.

“These are categories in which people are actually getting things done, not just marking a checkbox on a form to say they’re doing it,” the SANS study says.

In the RSA study, 89 percent of respondents said the primary use for their SIEM tools is for security operations functions, compared with 54 percent who cited compliance. Moreover, the survey reported that as many as 66 percent of those surveyed ranked real-time monitoring as most important when evaluating a SIEM vendor.

Because of their size, SMBs might be quicker to take advantage of the automated operations capabilities of SIEM and log management tools, Gottlieb says. “They’re going to be quicker to ask for more automation.”

“Most SIEM products require months of tuning after the initial installation — there is no such thing as a fully functional SIEM right after installation,” said security consultant Eugene Schultz in a blog.

But companies that have already purchased and implemented SIEM and log management tools are finding them increasingly useful in the growing tasks of incident response and forensics, Curry says.

http://www.darkreading.com/security/management/showArticle.jhtml?articleID=225300198&cid=RSSfeed

The rampant use of default passwords within live database environments continues to plague the security of enterprise data, researchers say. “It’s a problem that has been around for a long, long time,” says Alex Rothacker, manager of Team SHATTER, Application Security Inc.’s research arm. “A lot of default passwords out there get installed when you deploy a database, you install an add-on to it, or even if you install a third-party application that uses the database.” As he puts it, the problem of default passwords lingering in the wild has built up during the years as a result of cumulative errors by both vendors and database administrators.

In the past, the majority of vendors had no compunction about pushing out installers that automatically created default accounts to expedite the deployment of new databases, add-ons, or applications on top of the database.

Rothacker says the situation on the vendor front has improved considerably in recent years, but default passwords continue to be a problem for a number of reasons.

Organizations that choose to skip such a review could be leaving themselves at serious risk, says Rich Mogull of Securosis.

Team SHATTER last week launched a series of week-long database vulnerability-a-day awareness campaigns to draw attention to a wide range of database deployment deficiencies in the enterprise.

http://www.darkreading.com/database_security/security/app-security/showArticle.jhtml?articleID=225200102&cid=RSSfeed

“The Green Grid is working with organizations around the world to develop a clear and well-defined language for the way we communicate about energy efficiency metrics, which will give us a common measuring stick for all data centers regardless of their location,” said Tom Brey, an IBM employee who is secretary of The Green Grid, in a statement.

PUE, which was developed by the Green Grid, divides the total energy consumed by a data center by the amount of energy used to power the IT equipment. It has emerged as the most popular metric for measuring data center efficiency, and some large companies, notably Microsoft and Google, have been publishing PUE numbers as a way to show off the efficiency of their newest facilities.

“A global task force with representatives from each of the above mentioned organizations will continue to move this initiative forward and reconvene later this year to evaluate progress,” the Green Grid says in the statement.

In January representatives from the EPA met with several data center industry groups from the U.S., including 7×24 Exchange and ASHRAE (The American Society of Heating, Refrigerating and Air-Conditioning Engineers).

Rising energy costs and the amount of powerful IT equipment that has been added to data centers in recent years has made them a cost center on the radar of senior executives.

http://www.computerworld.com/s/article/9174701/US_Europe_Japan_agree_on_data_center_efficiency_metric?source=rss_news

“The degree of failure to meet acceptable standards on first submission is astounding — and this is coming from folks who care enough to submit their software to our [application security testing] services,” says Roger Oberg, senior vice president of marketing for Veracode.

The data for Veracode’s State of Software Security Report comes from a combination of static, dynamic, and manual testing of all types of software across multiple programming languages — everything from non-Web and Web applications to components and shared libraries. Veracode tests commercial, internally developed, open-source, and outsourced applications, all of which were represented in its findings.

And nearly 90 percent of internally developed applications contained vulnerabilities in the SANS Top 25 and OWASP Top 10 lists of most common programming errors and flaws in the first round of tests, Oberg says.

Despite the relatively gloomy picture of developers still missing the mark initially on security, there were some bright spots in the report: Open-source software isn’t as risky as you’d think, and financial services organizations and government agencies tend to have more secure applications from the get-go; more than half of their apps passed as acceptable in the first submission to testing, according to Veracode’s report.

And it was the quickest to remediate any flaws: “It took about 30 days to remediate open-source software, and much longer for commercial and internal projects,” he says.

“There’s been intense focus on cross-site scripting, and there are lots of different libraries and utilities available to eliminate it, but it’s still extremely prevalent,” says Chris Eng, director of security research for Veracode. Eng says it’s likely due to a lack of education on how to quell XSS, plus it’s not uncommon to find 100 XSS bugs in one application.

http://www.darkreading.com/vulnerability_management/security/app-security/showArticle.jhtml?articleID=223100875&cid=RSSfeed

The devices typically include a scanner, transmitter, camera, and, most recently, Bluetooth- or wireless-enabled links that shoot the stolen data back to the bad guys.

A similar attack occurred with a rigged ATM machine last year in Las Vegas during the Defcon hacker show: Security researcher Chris Paget lost $200 to an ATM machine in the Rio All-Suite Hotel & Casino that appeared to be operating normally, but failed to spit out cash.

The U.S. Secret Service was investigating the incident, and it was unclear whether the machine was outfitted internally with a skimming device or had been tampered with for someone to grab the cash withdrawals at a later time.

Bruce Schneier, CTO for BT Counterpane and author of the Schneier on Security blog, says attackers in Europe are also moving skimming devices inside gas pumps as a way to avoid detection.

Troy Arnold from the Sandy police department told a local news outlets that the device in the 7-Eleven gas pump was the size of a cellular phone SIM card and was affixed to the card reader inside the pump.

“It’s a small device — Bluetooth, the size of a SIM card — that is attached to the actual credit card reader.

Back in December, a similar spree occurred in the Sacramento, Calif., area, where gas pumps at an AM/PM convenience store were outfitted with card skimmers, transmitters, and small cameras that siphon victims’ debit card data.

http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=223100233&cid=RSSfeed

[Link to an article showing a typical ATM skimmer setup: http://www.snopes.com/fraud/atm/atmcamera.asp. But remember all they really need, is the skimmer to be installed and a good camera!]