Author: admini

Best Practices For Oracle And Database Patching

Posted on by admini

“I find it funny that there are patches everywhere else that are applied on a regular basis to machines like desktops and so on, but it is still not a general practice for the databases,” says Michelle Malcher, director of education for IOUG and a DBA and team lead at a Chicago-based financial firm.

She recommends garnering executive buy-in with cooperation of DBAs and security team: Many DBAs are up against the wall with diminishing maintenance windows and uptime demands by management and application owners that make it near impossible for them to meet and still apply patches on schedule.

“Honestly, the first step is not to necessarily install all of the components of the Oracle database if you’re only using specific components,” Malcher says.

http://www.darkreading.com/database_security/security/app-security/showArticle.jhtml?articleID=227701320&cid=RSSfeed

Read more

LogLogic Releases Industry’s First Full Service Virtual SIEM Appliance

Posted on by admini

“Virtualization is a reality for many businesses that are looking to drive efficiencies throughout their organizations, or that have space-constrained or widely-distributed IT environments,” said LogLogic CEO Guy Churchward.

With the release of LogLogic’s MX Virtual, we enable companies to lower their operational costs, while leveraging the full power of our IT data management technology anywhere in the world.” The MX Virtual also lowers the cost of entry for the smaller companies, those with security or PCI compliance needs but have very few servers or monitoring points.

It is also perfectly suited for cloud providers who wish to offer logging-as-a-service, or PCI-as-a-Service in the cloud.

In June 2010, LogLogic released a Tech Preview of its virtual appliance, which was downloaded by thousands of users from across the world.

http://newsblaze.com/story/2010101206463400001.bw/topstory.html

Read more

Symantec adds service-level templates to Storage Foundation

Posted on by admini

Niraj Zaveri, a Symantec senior product marketing manager, said system administrators typically have to provision storage to a host application server, then map those servers back to application requirements in a database, then create a storage volume or file system for it on an storage area network (SAN) or network-attached storage (NAS) system. “The point is that you can now just define the set of storage services available to your applications,” he said. “This automates the identification of storage devices matching the storage services … The new functionality in Veritas Operations Manager bridges the gap between server, database and storage administrators to increase storage utilization, scale operations, maintain compliance and ensure uptime and availability across Unix, Linux, Windows and VMware environments.”

That tool is a set of built-in reports to automatically identify under-utilized storage resources, tracking utilization within database files and mapping that to disks and RAID groups in storage arrays.

http://www.computerworld.com/s/article/9190458/Symantec_adds_service_level_templates_to_Storage_Foundation?source=CTWNLE_nlt_dailyam_2010-10-12

Read more

Interest Growing in Private Cloud Computing

Posted on by admini

“Customers are quickly moving beyond the core hypervisor and focusing on mobility, self-provisioning, and metering and chargeback capabilities,” said Matt Eastwood, group vice president of Enterprise Platforms at IDC. Eastwood, along with a host of analysts, pundits and vendors, have a name for these next-generation virtualization deployments: the private cloud.

Settling on a precise definition of the term isn’t easy, since the term “cloud,” on its own, remains rather nebulous, but for the purposes of initiating a discussion, let’s say that the private cloud boils down to a set of scalable, dynamically provisioned, IT services which, unlike the public cloud, are hosted within an organization’s corporate data center.

All the elasticity and convenience of a public cloud service, with the same option to go hug your servers that IT admins have always had—or so the sales pitch goes.

CA Technologies swept up a bunch of startups and recently released CA 3Tera AppLogic 2.9, a turnkey platform that facilitates the rapid delivery of application-centric public and private clouds.

And CA is far from alone: A broad swath of vendors, from server manufacturers on up has some product targeted at building and/or maintaining the private cloud.

At this year’s VMworld, VMware announced a slew of products to enhance vSphere with private cloud functionality, such as support for pooling virtual infrastructure resources for delivery as catalog-based services, and for chargeback models to measure and assign costs of virtual machines.

Amazon EC2 or Salesforce.com weren’t built in a day, and companies that are in the business of providing utility compute services as their core business will always boast more resources, know-how and sheer scale than will be available to any single private enterprise.

With that said, there’s value in maintaining your own private IT resources that’s not easily obtained from the public cloud, particularly where security, compliance and legal discovery are concerned.

What’s more, a lack for public cloud-size scale doesn’t mean that organizations can’t derive real benefits from organizing your infrastructure into a more cloud-like form.

For enterprises already embracing x86 server consolidation to boost utilization and agility, combining multiple departmental virtual server farms into a single private cloud can, if executed well, lead to more efficient use of these resources.

“It isn’t necessarily that public cloud services are insecure by nature, but rather that they are not under a company’s direct control,” said Scott Crenshaw, vice president and general manager of the Cloud at Red Hat.

According to Eric Chiu, president and CEO of Hytrust, “the challenge becomes how to thrive in a multitenancy environment while preserving VM and data segregation as well as separation of duties.”

Assess the current regulatory environment and make sure that you can build a private cloud that is compliant today and hopefully in the future, or at least be updated when future changes occur.

Organizations must demonstrate compliance with regulatory requirements such as HIPAA (Health Insurance Portability and Accountability Act), Sarbanes-Oxley Act and PCI, even as these regulations change.

Managing virtual sprawl is one thing, but building a secure environment that preserves security controls over applications, data, personnel and the virtual machines is another.

“Many enterprises realize one day that they have terabytes or petabytes of files and they literally have no idea what is in them,” said to Steve Akers, CTO and founder of Digital Reef, a company that provides e-discovery and governance solutions.

Several current initiatives offer on-premise, cloud-like options for customers that entail the possibility of tapping a hybrid model in the future—you organize your internal stuff in a cloud-like way, you get more flexibility internally, and you get the option of hitting up public cloud resources to solve that elusive scale or capacity bursting bit of the equation when you need it and when you’re comfortable with it.

A DMTF (Desktop Management Task Force) initiative, OVF promises to facilitate portable VM packaging, among other things, but difficulties regarding portability of VM’s remain.

Read more

Most large companies hit by hack attacks, survey shows

Posted on by admini

Fourteen percent of those surveyed attributed their intrusion problem to “hacker/network attack,” 12% cited “lack of adequate security policies/measures,” 10% said “employee Web usage,” 9% pointed to “virus/malware/spyware,” 8% faulted other employee carelessness, negligence,” 6% said “unauthorized access by current/former employees,” 5% blamed “weak passwords,” 5% thought it was because of “lack of software updates,” and 5% simply said “software security flaw/bug.”

About half of respondents said their organizations have a formal security audit by an outside organization at least once a year, up from 35% in 2009. Forty-seven percent felt internal audits helped identify security problems, but 30% said the audit didn’t go far enough and 40% felt the audits should occur more frequently.

http://www.computerworld.com/s/article/9190559/Most_large_companies_hit_by_hack_attacks_survey_shows?source=CTWNLE_nlt_dailyam_2010-10-12

Read more

Six Tips For Application Security Monitoring Success

Posted on by admini

“PCI has driven a good ecosystem in the log management space, so the back-end technology is there,” says Gunnar Peterson, contributing analyst for Securosis and managing partner of Arctec Group.

The trick is figuring out the right technologies to act as the sensors feeding data into that SIEM system and developing a sound means of implementation. Peterson says technologies such as Web application firewalls and XML security gateways should play a more prominent role in application-layer activity that has thus far been difficult for many organizations to track. “Those can play a pretty important role because they are outside of the application so the security teams don’t have to necessarily get involved with the application build process as much,” he says. “But at the same time to support something that’s going to be useful you have to be down at the message data level.”

As for best practices, Peterson says it varies by industry — but he has some suggestions for any organization to get started.

You can’t count on port numbers to identify applications. As House points out, applications such as BitTorrent and Skype hide in HTTP traffic specifically to elude security controls. “A monitoring solution that just classifies traffic on port 80 as HTTP is potentially exposing the organization to infected content online, especially pirated software and media files with embedded malware,” he warns.

Peterson says organizations need to leverage standards, such as CEE, which is being pushed by Mitre, or XDAS, which the OpenGroup is supporting, to help the front-end monitoring solutions “talk” with the back-end log management systems and enable you to fine-tune the data that makes it into the hands of the incident response team. “To mitigate this threat, an application monitoring solution needs to be able to identify and control both the content and the applications that are part of social networking sites,” he says. “Developers and security architects should spend time with those incident response teams just as if they were your business user — because, in fact, they are your business user — and interview them,” he says.

http://www.darkreading.com/security_monitoring/security/management/showArticle.jhtml?articleID=227701138

Read more