Author: admini

EMC Announces Cloud Storage Networking Strategy

Posted on by admini

At the EMC World 2010 show here May 10, EMC officials announced a converged networking strategy aimed at data centers. The strategy includes expanded networking services, analysis tools for assessing converged networking efforts, and extended reseller agreements with Brocade and Cisco Systems.

In a question-and-answer session with reporters and analysts after his keynote address at the show, EMC CEO Joe Tucci said that as enterprises grow the use of data center virtualization technologies and start their migration to private cloud computing environments, demand for converged networks will increase. In a federated environment, Tucci said, multiple data centers will be viewed as a single pool of resources, and IT administrators will be looking to move workloads and stored data around that pool.

Those services include network assessment, planning and implementation, with support for a number of protocols, from FCoE (Fibre Channel over Ethernet), CEE (Converged Enhanced Ethernet), iSCSI and NAS (network-attached storage).

In the third quarter, EMC also will start selling 10 Gigabit Ethernet switches from Brocade and Cisco, among other networking vendors.

In a report issued May 10, Charles King, an analyst with Pund-IT Research, said EMC’s SAN (storage-area network) experience and its partnerships with the likes of Cisco and Brocade puts it in a good position to help enterprises in their push for more converged networking environments.

http://www.eweek.com/c/a/Enterprise-Networking/EMC-Networking-Strategy-Includes-Cisco-Brocade-Partnerships-147031/

Read more

Accuvant Unveils New Data-Centric Security Framework

Posted on by admini

The framework consists of five steps that begin with data ownership and classification and end with a clear and effective data protection program that enables incidents and breaches to be properly handled.

“The first step of Accuvant’s Data-Centric Security Framework is to understand and inventory our clients’ sensitive data handling and critical system ownership.

From this, we can determine the effectiveness of the current security program and system controls, and recommend the services and technologies that should be implemented to close the gap to get them where they need to be,” said Doug Landoll, director for Accuvant’s Risk and Compliance Management team.

“Defining what sensitive information exists, where it resides and how it must be protected is the underlying principle of Accuvant’s Data-Centric Security Framework, and ensures that our clients can make the most efficient use of their security dollars.”

Accuvant’s Data-Centric Security Framework is a departure from traditional DLP projects in that most are centered on the technology and assume that the organization has already defined its data, developed policies and put critical controls in place. Accuvant’s Data-Centric Security Framework turns this concept on its head and instead focuses on the sensitive data first, with a review of the existing controls and pragmatic use of available DLP tools and technology thereafter.

Step 2 – Locate: This step is for organizations that want to discover the location of all in-scope sensitive data assets, such as credit card data.

http://www.darkreading.com/security/management/showArticle.jhtml?articleID=224900104

Read more

Cloud computing risks outweigh benefits, survey finds

Posted on by admini

Business leaders at enterprises have been moving the organization to cloud computing to cut costs by outsourcing the management of IT infrastructure.

The down economy has driven many firms to consider cloud-based services, including utility-type computing offered by Amazon’s EC2 utility service and Microsoft’s Azure cloud computing platform.

The risks identified included the ability of hackers to infiltrate cloud computing platforms and use the cloud infrastructure to attack other machines as well as insecure application programming interfaces (APIs) that can leave holes that lead to data leakage. Robert Stroud, vice president of ISACA, said the survey results shouldn’t be surprising given that IT professionals, especially members of ISACA, take a cautious approach to new technologies and carefully measure cloud computing risks, he said. “A good training regime and process automation can go a long way towards making risk a consideration, but also making it be accepted,” said Stroud, vice president of IT service management strategy at New York-based CA Inc. said.

Only 10% of respondents’ organizations plan to use cloud computing for mission-critical IT services and one in four (26%) do not plan to use it for any IT services.

“For mission critical data we’re just starting on that journey,” Stroud said.

Regulations, standards obstruct cloud adoption Compliance is a major hindrance causing enterprises to take a slow approach to many cloud-based projects, said Jim Reavis, co-founder and executive director of the Cloud Security Alliance. About half of those surveyed said IT risk and compliance related projects will receive roughly the same investment in 2010 as in 2009. For example, the group has worked with the PCI Security Standards Council to develop a framework — a cloud controls matrix — to determine a reasonable set of controls that a cloud-based provider must implement versus the controls that must be implemented by the enterprise.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1508319,00.html?track=sy160&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+techtarget%2FSearchsecurity%2FSecurityWire+%28SearchSecurity+%3A+Security+Wire+Daily+News%29

Read more

Outsourced security extends to wealth of services, study finds

Posted on by admini

“Companies are finding that the frequency and sophistication of threats is out of control for them to handle internally and they’re looking for service providers with competency to be able to handle that for them,” Kark said.

In the recent Forrester report: “Market Overview: Managed Security Services,” Kark lays out ways the broad industry is shaping out and what companies should look for in a service provider. To do that, companies need to evaluate a number of different kinds of MSSPs, from telecommunications providers that bundle security with their services, to value-added resellers and system integrators that provide a mixture of services.

Robert T. Ferrilli, president and CEO of the Ferrilli Information Group, turned over nearly all his systems to managed service providers when the company’s Exchange server went down unexpectedly while he was on a business trip. The firm, which provides business applications for universities and colleges, has a team of 20 developers spread out across the United States.

Many firms have a suite of services and are happy to sell everything they offer, but enterprises with a solid set of priorities of what they want to gain from a MSSP will be able to better evaluate what partner is right for them, Kark said. Instead of just gaining Web filtering or email protection, enterprises are seeking guidance from their MSSPs on security related issues, forcing some firms to invest in creating consulting services divisions. According to Kark, content security in the form of email and Web content filtering still has the most market penetration, but other technologies are quickly gaining ground.

Companies are outsourcing log management and event correlation and analysis services as well as distributed denial-of-service (DDoS) protection services. The growth of cloud computing, with more company data spread out beyond the company walls, has forced some firms to seek out specialized security providers.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1508261,00.html?track=sy160&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+techtarget%2FSearchsecurity%2FSecurityWire+%28SearchSecurity+%3A+Security+Wire+Daily+News%29

Read more

Researchers expose complex cyber espionage network

Posted on by admini

Shadows in the Cloud documents a complex ecosystem of cyber espionage that systematically compromised government, business, academic, and other computer network systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries. The report also contains an analysis of data which were stolen from politically sensitive targets and recovered during the course of the investigation.

Recovery and analysis of exfiltrated data, including one document that appears to be encrypted diplomatic correspondence, two documents marked “SECRET”, six as “RESTRICTED”, and five as “CONFIDENTIAL”. These documents are identified as belonging to the Indian government. However, we do not have direct evidence that they were stolen from Indian government computers and they may have been compromised as a result of being copied onto personal computers.

Just like the majority of targeted malware attacks, this one was also relying on client-side exploits (Report: Malicious PDF files comprised 80 percent of all exploits for 2009) served through different file types (PDF, PPT, DOC) using a relevant topic of interest to Indian and Tibetan communities, which were then spamvertised to the victims of interest.

What’s particularly interesting about the cyber espionage facilitating network in question, is the mix of legitimate and purely malicious infrastructure in an attempt to not only increase the life cycle of the campaign, but also, to make it harder for network administrators to detect the malicious use of popular free email service providers, as well as social networks. In fact, in 2009 cybercriminals continued demonstrating their interest in abusing legitimate services such as Twitter, Google Groups, Facebook as command and control servers, as well as Amazon’s EC2 as a backend.

Moreover, although the report is logically emphasizing on the actual attack vectors used in this particular cyber espionage network, there’s another attack vector that’s been trending over the past few years, having an identical cyber espionage potential to the targeted attacks in general.

http://blogs.zdnet.com/security/?p=6042

Read more

Microsoft Cyber Security Survey Finds Businesses’ Most Valuable Data at Risk

Posted on by admini

For instance, decision makers should identify which information is the most valuable.

Another smart move would be to “create a ‘risk register’ of data security risks [that] divides the risks your firm faces into two categories: compliance risks and misuse of secrets.”

The survey, which was carried out in November and December, polled 163 U.S.-based companies and 102 European companies, as well as 40 based in Australia and New Zealand.

http://www.esecurityplanet.com/trends/article.php/3874791/Microsoft-Cyber-Security-Survey-Finds-Businesses-Most-Valuable-Data-at-Risk.htm

Read more