Month: September 2006

SAP Pushes Compliance as Strategy

Posted on by admini

Doug Merritt, executive vice president and general manager of suite optimization products and technology at SAP, said that consultants in the compliance arena, regulatory bodies and other vendors will also be able to contribute to this repository. “It allows companies to manage hugely heterogeneous landscapes,” noted Merritt. Merritt said the solution will help risk managers and business owners identify financial, legal and operational risks, analyze business opportunities in light of these risks, and develop appropriate responses.

The key to all three solutions, the company said, is that they give line-of-business executives greater visibility of how governance and risk-management policies are implemented and followed in the course of doing business. Effective GRC management can do more than ensure that companies are in compliance with Sarbanes-Oxley and other regulations, said Merritt. “GRC is more business-driven than just keeping the CEO out of jail,” said Merritt in response to a question from internetnews.com during a conference call this week. “Understanding the relative risks and rewards of different activities is as critical or more critical than regulatory reporting,” he said.

Amit Chatterjee, senior vice president of the risk and compliance management unit at SAP, said that whatever can be monitored can be managed.

SAP GRC Repository and SAP GRC Process Control will be generally available Nov. 30. Other solutions, particularly those pertinent to industry verticals, will become part of the new solution during the second quarter of next year.

SAP also announced that it is bringing these products to market jointly with networking solutions vendor Cisco Systems (Quote, Chart).

http://www.internetnews.com/ent-news/article.php/3630606

Read more

Winning the Compliance Game

Posted on by admini

Auditing woes mostly stem from improperly securing user machines and servers, according to the council’s findings. “The problems being flagged in audits are in user and access controls on PCs and laptops, audit reporting and problems in configuration change management,” Hurley says.

Those with poor audits are spending 43 percent of their IT budget on security equipment and software for IT compliance and those with successful audits, 52 percent. “They are taking money out of labor and putting it into automating the processes” such as measurement and monitoring IT compliance across the board, Hurley says.

“The organizations [surveyed] doing continuous monitoring had the least number of audit deficiencies.”

Meanwhile, security firms that perform vulnerability assessments and penetration testing say regulatory compliance is driving much of their business today. Steve Stasiukonis, vice president and founder of Secure Network Technologies, says regulatory compliance pressures from SOX and HIPAA, for instance, are one of the main reasons his clients hire him.

http://www.darkreading.com/document.asp?doc_id=103041&WT.svl=news2_5

Read more

Cisco, Microsoft Reveal Long-Awaited Network Access Control Plans

Posted on by admini

But the need for network access control won’t wait that long, so businesses will have to continue to control network access using technology already available in some of Cisco’s products and through other security vendors.

By year’s end, Cisco and Microsoft will offer a limited beta program–with no more than three mutual customers–to gain a more realistic understanding of how their access control technologies will work together. As these beta testers will soon find out, combined network access protection and network access control consists of several client-side software applications that check and communicate the health of laptops, desktops, and other devices attempting to connect into a given network.

On the network side, Cisco routers and switches, Cisco Secure Access Control Server, Microsoft Network Policy Server, and policy servers from other vendors work together to give the thumbs up or thumbs down to any device seeking to connect.

Cisco and Microsoft have cross-licensed the Cisco NAC and Microsoft NAP protocols used to communicate information between clients and networks to help ensure their products continue to work together.

A Forrester Research study of 149 technology decision makers at North American companies found that while more than one-third plan to adopt some type of network access control this year, the rest cite cost and manageability as obstacles to deployment.

http://www.informationweek.com/news/showArticle.jhtml?articleID=192501974

Read more

Researchers Challenge DOS Attack Data

Posted on by admini

But because this measurement technique assumes the DOS attack was launched through spoofed IP addresses, it doesn’t account for DOS attacks launched via botnets, which have become a much more attractive vector for attackers, the research team said.

The new study combines traditional indirect measurement of backscatter with direct measurement of Netflow and alarms from a commercial DOS detection system.

http://www.darkreading.com/document.asp?doc_id=103049&WT.svl=news2_3

Read more

Network security sales top $1.1 billion in 2Q06

Posted on by admini

2Q06 Highlights
– Cisco continues to lead in worldwide network security appliance and software sales, with 36% of total revenue, a position they have more or less maintained since 2002
– Juniper passes Check Point and is now in second place for worldwide revenue at 10%
-Check Point is now third for worldwide revenue at 9%
-Integrated security appliances and software make up 85% of worldwide network security revenue, IDS/IPS 15

http://www.infonetics.com/resources/purple.shtml?ms06.sec.2q06.nr.shtml

Read more

IPS Technology: Ready for Overhaul

Posted on by admini

“It gave you a device to protect your vulnerable systems behind the network from SQL Slammer, Blaster, etc.,” says Richard Stiennon, president of IT-Harvest. But major worm infestations aren’t the problem any more: “The trouble is what we’ve really been doing for the last four years is vulnerability and patch management. “The driver for IPS hasn’t really been there.”

In some cases, the technology is being integrated into hardware and services; in other cases, it is evolving to offer new capabilities.

Arbor Networks’ Morville says service providers and managed security service providers meanwhile are already delivering firewall and IPS-based services, and that trend of blended security services will “accelerate” over the next few years.

Switches, too, are already coming with some IPS technology: Cisco, for instance, sells blades for its Catalyst switches with IPS functionality.

What about the signature-based limitations of IPSes? IPS will also converge with anomaly detection and other features that expand its inspection capabilities beyond known threats, experts say. Rate-based anomaly detection, such as spotting a traffic flood, makes sense at the perimeter, Morville says. And behavioral anomaly detection — where you’re looking for individual people or hosts acting outside the norm — is best for the internal network, he says.

Some experts envision IPSes deploying virtual machine technology — as FireEye’s does with its network access control (NAC) appliance –where virtual machines run copies of incoming traffic to see if it’s legit, rather than just using signatures. The trick with a beefed-up IPS is getting good performance, though: Hardware would have to catch up to make it viable, especially if virtual machine-based features are added, says John Pescatore, a vice president with Gartner.

http://www.darkreading.com/document.asp?doc_id=102608&WT.svl=news1_3

Read more