Security Event Management Projected To Hit $430 Million By 2008

Posted on by admini

The $90 million SEM market could also could witness as much as 50 percent market consolidation in 2004.
The report, “Security Event Management Systems Defend Against Information and Regulatory Overload,” said that as security becomes a greater concern for network administrators, SEM systems that enable them to identify, manage and respond to virus and hacker threats are becoming more prevalent.

The $90 million SEM market also could witness as much as 50 percent market consolidation in 2004, said report author Phebe Waterfield. “Integrating a systems management solution with risk management has the potential to revolutionize the way enterprises manage security risks,” Waterfield added.

SEM systems burst onto the scene in the late 1990s, when security vendors created them to help network administrators cope with information overload generated by security devices.

More info: [url=http://www.securitypipeline.com/news/showArticle.jhtml;jsessionid=13LHM1WGIKYFKQSNDBGCKHY?articleId=17000228]http://www.securitypipeline.com/news/showArticle.jhtml;jsessionid=13LHM1WGIKYFKQSNDBGCKHY?articleId=17000228[/url]

Read more

IPv6 fears seen unfounded

Posted on by admini

These findings run counter to longstanding conventional wisdom from the Internet engineering community, which for years has warned ISPs and corporate network managers about the need to prepare for a time-consuming and expensive upgrade to IPv6.

The U.S. Department of Defense and several universities reported positive feedback about their IPv6 deployments at the U.S. IPv6 Summit 2003, held last week in Arlington, Va.

The Internet Engineering Task Force (IETF) has worked on IPv6 since 1992. While the transition to IPv6 has taken longer than advocates expected, that pace appears to have generated an unintended benefit: Now that users want to deploy IPv6, it’s already bundled in the hardware and software they need to buy in the course of normal infrastructure upgrades. IPv6 promises easier administration, tighter security, greater mobility and an enhanced addressing scheme over IPv4, the Internet’s current protocol.

All the major router manufacturers – including Cisco, Juniper, Foundry Networks and Extreme Networks – support IPv6.

We need the major business applications such as Oracle, PeopleSoft and SAP to support IPv6.” These applications are coming, as evidenced by Oracle executives unveiling their IPv6 road map at the IPv6 Summit last week.

IPv6 and IPv4 will coexist for many years because most companies replace desktops, servers and network gear every few years.

Early adopters say that because IPv6 comes bundled with network hardware and software, deployment costs are low.

More info: [url=http://seclists.org/lists/isn/2003/Dec/0064.html]http://seclists.org/lists/isn/2003/Dec/0064.html[/url]

Read more

Don’t leave holes in your patching policies

Posted on by admini

Bugs are an inevitable problem in a sector where companies are driven by shareholders to rush out equipment before it is ready.

From a security perspective, this presents users with a huge problem. Empirical evidence suggests that the average device – whether it is a perimeter network resource such as a firewall or router, or a core device such as a server – has more holes in it than a piece of Gruyere.

One of the rarest but most devastating security vulnerabilities in host computers is the buffer overflow error, said Gary Jones, professional services manager of security consultancy MIS Corporate Defence Solutions.

The problem is that too many companies are not implementing patches in a structured way. “If you are running a corporate database, you cannot just slap on a patch when it is released,” he said. “You need some form of development environment and the patch must be tested first.”

Companies must also react to critical patches. If another aggressive internet worm appears, companies must be aware of it before they read about it in the press and they must be able to implement a patch quickly.

One solution is to have an employee checking newsgroups, supplier sites and bulletins to pick up on patches before the hackers do. Unfortunately, many companies are not in a position to pay this extra salary.

Common sense plays a big part in locking down your network vulnerabilities, but resources are also an important factor.

Virtual patching, where an intrusion dection system dynamically configures against threats, is the way on insuring against unknown vulnerabilities.

More info: [url=http://www.computerweekly.co.uk/articles/article.asp?liArticleID=127212&liArticleTypeID=20&liCategoryID=1&liChannelID=7&liFlavourID=1&sSearch=&nPage=1]http://www.computerweekly.co.uk/articles/article.asp?liArticleID=127212&liArticleTypeID=20&liCategoryID=1&liChannelID=7&liFlavourID=1&sSearch=&nPage=1[/url]

Read more

EMC acquires server specialist VMware

Posted on by admini

The move will help EMC reach further into the world of utility computing, a trend sweeping the industry as companies search for ways to make information technology easier to manage and more efficiently used, the Hopkinton, Mass.-based company said. Today, EMC is accelerating the convergence of these two worlds,” he said in a statement.

The acquisition indicates that EMC, which already has a major presence in large corporations, is trying to expand into the same advanced systems management area targeted by IBM, HP, Sun Microsystems, Microsoft and others.

VMware’s software lets a single server run multiple operating systems simultaneously on different “virtual machines,” a technology well developed in expensive mainframe computers, maturing in Unix servers, and now arriving in lower-priced machines based on Intel processors.

IBM’s and HP’s comfort working with a neutral start-up may not carry over to EMC, a competitor in the storage domain, Haff said.

More info: [url=http://zdnet.com.com/2100-1104_2-5124506.html]http://zdnet.com.com/2100-1104_2-5124506.html[/url]

Read more

Financial Security info center gets $2 million

Posted on by admini

The center is one of many that industries and their government liaisons formed since 1998 to share vulnerability information and alerts when incidents occur that affect critical infrastructure, such as telecommunications and banking.

Money from Treasury will allow the center to expand to serve the entire financial industry, department officials said. By the end of fiscal 2005, officials expect that the center will be funded entirely by membership fees, which range from $750 to $50,000 per year. Upgrades include:
* Enhancing the network so it can serve more than 30,000 institutions.
* A secure forum for real-time information sharing.
* Physical data threats to the cyberthreat information.
* Web-based warnings and alerts service
* Setting more than 16 performance metrics
More info: [url=http://www.fcw.com/fcw/articles/2003/1208/web-fsisac-12-10-03.asp]http://www.fcw.com/fcw/articles/2003/1208/web-fsisac-12-10-03.asp[/url]

Read more