Tag: Enterprise Security

Mobile Device Complexity Driving New Thinking

by Jeremiah Caron, posted in IT Leader
J. Caron
J. Caron

Summary Bullets:                

  • The chasm between IT and network management is clear when looking at the issue of mobility solutions
  • Network service providers are investing heavily in mobility solutions, however, which may change perceptions going forward

Two weeks ago in this blog I wrote about the chasm that still exists between IT and networking considerations in business environments, and a recent study just published by Current Analysis on mobile device management and consumerization provides yet further evidence of this fact. Mobility is now a way of life for IT managers, not an overlay solution. Due to clear business drivers, mobility is being horizontally deployed and supported in organizations – no longer simply on a department-by-department basis. And we all know that the sheer number and types of devices used to support mobility in business have risen exponentially in the past two or three years, thanks to consumerization. But when we asked approximately 600 technology managers in the U.S and Europe what suppliers they will look to for help with the inherent management challenges presented by this mobility phenomenon, very few indicated faith in their network suppliers. They ranked technology suppliers, integrators and even the device manufacturers themselves over their network and connectivity partners. Continue reading “Mobile Device Complexity Driving New Thinking” →

APTs Require Greater Awareness of Network Activity

by , posted in Secure
P. Musich
P. Musich

Summary Bullets:         

  • Investigate network forensics and anomaly detection to gain better insight into network activity and ferret out APTs.
  • Work more closely with network operations to better understand network behavior and share insights for faster resolution of low-and-slow breaches.

 As security groups come to the realization that advanced (or adaptive) persistent threats (APTs) are becoming an unfortunate fact of life, they may turn to additional tools that provide better visibility into what is actually happening on the network.  Survey after survey into security practices within organizations concludes that, more often than not, security pros have little visibility and/or understanding into what is actually taking place on the corporate network.  Even those security groups that employ SIEM tools have a limited view into events taking place on the network.  Log files and security events only provide a small glimpse into what is taking place, because they lack context.  Still, that has not dampened the security industry’s enthusiasm for SIEM technology.  In the same week in early October, McAfee announced its acquisition of SIEM provider NitroSecurity, while IBM acquired Q1 Labs.  Those acquisitions followed HP’s acquisition of SIEM market leader ArcSight by about a year.

Continue reading “APTs Require Greater Awareness of Network Activity” →

40GbE Price Erosion to Dictate Data Center Architectures

by , posted in Network
M. Spanbauer
M. Spanbauer

Summary Bullets:

  • Since the advent of networking, customers have always weighed the cost of throughput vs. the effort of traffic optimization, creating a pendulum effect.
  • The market has reached a point where both sophisticated traffic management and performance are required.

In the modern enterprise, the average IT manager has many goals, but a few in particular have been coming up frequently: alignment of the function with business needs (IT acting as a business partner); agile application and solutions deployment; and an infrastructure that will scale and grow with the customer over time.

Continue reading “40GbE Price Erosion to Dictate Data Center Architectures” →

Ouch, Quarterly Financial Reports Highlight Managed Service Quality Issues

by , posted in Secure
B. Ostergaard
B. Ostergaard

Summary Bullets:

  • MSSPs are having to invest more in improving their service quality, as customers get more critical
  • The solution could be better overall customer support and more security outsourcing

Reviewing the latest Q3 2011 financial performance metrics, a common trait is emerging: many service providers (carriers like Verizon and IT service providers like T-Systems) are investing a lot of their revenues into improving the quality of their managed service delivery – which has put a dent in Q3 profits. Some are making the investments defensively because customers are complaining; others are doing it proactively to avoid future grief. Continue reading “Ouch, Quarterly Financial Reports Highlight Managed Service Quality Issues” →

Network Equipment Vendors Well Positioned in Mobility Deals

by , posted in Mobilize
A. Braunberg
A. Braunberg

Summary Bullets

  • Network equipment vendors are well positioned to be preferred providers of enterprise mobility solutions.
  • These vendors should not ignore a place on mobile endpoints, however and should deliver secure connectivity, management and security.

I introduced a few data points from Current Analysis’ recent Mobility Survey in my last mobility blog post post (see “Addressing the Adoption of Tablets and Smartphones in the Enterprise,” October 27, 2011). The takeaway from that post was that enterprises are strongly inclined to purchase tablets and smartphones for employees to use at work and that these organizations want to manage those devices. That data leads to an obvious follow up: what vendors benefit from enterprise purchase of these devices? Continue reading “Network Equipment Vendors Well Positioned in Mobility Deals” →

Make Educating End Users about Policies and Threats Part of Your Defense

by , posted in Secure
P. Musich
P. Musich

Summary Bullets:

  • Educate end users on the reasons behind corporate security policies and the nature of social engineering to help reduce risky behavior.
  • Ensure end users understand corporate policies around the use of personal smartphones and tablets for accessing corporate resources.

With this year’s huge rise in the awareness of advanced persistent threats (APTs), now would be a good time to focus on educating employees not only about corporate policies and government mandates, but also about the growing risk that these APTs pose to the organization.  By educating end users about the reasons behind the policies, as well as the nature of such attacks, security professionals can get better buy-in from those end users, increasing the likelihood of changing risky end user behavior.  Given the focus of these APTs on gaining entry through more sophisticated spear phishing attempts, encouraging a heightened vigilance among end users could be an additional tool in the security practitioner’s toolbox.  With attackers’ proclivity for identifying users within the organization which have the credentials to access systems with sensitive data, and then sending e-mails that appear to be legitimate and contain links to sites with malicious code or attached documents infected with malware, end users become the weak link in the chain of trust.  In addition, the combination of the growing BYOD phenomenon and the upcoming Christmas shopping season makes this an ideal time to remind end users of the dangers of careless Internet usage as well as corporate policies regarding smartphones and tablets.

Continue reading “Make Educating End Users about Policies and Threats Part of Your Defense” →

KISS Your Security Measures

by , posted in Secure
B. Ostergaard
B. Ostergaard

Summary Bullets:

  • Pay attention to basic security procedures and attitudes
  • Explore quantifying the risk from an insurance perspective

Most attacks on most networks could be defeated with just four key strategies according to this year’s winner of the SANS Institute 2011 US National Cybersecurity Innovation Award – Australia’s Defence Signals Directorate: patching applications and always using the latest version of the software, keeping operating systems patched; keeping admin rights under strict control (and forbidding the use of administrative accounts for e-mail and browsing); and whitelisting applications. The basis of these recommendations is that security is a behavioral problem, not a technical problem.  In other words, if users don’t have the basic security procedures and the right attitude, no amount of technology investment is going to create the needed security. Continue reading “KISS Your Security Measures” →

The Mystifying Struggle to Mix Enterprise and SP Infrastructure

by Jeremiah Caron, posted in IT Leader
J. Caron
J. Caron

Summary Bullets:

  • The “golden thread” linking carrier infrastructure and enterprise CPE for managed services is a myth.
  • There should be added value, but most suppliers have failed to deliver it.

It seems to be such a straightforward, simple proposition. Service providers build managed network and application solutions using a certain supplier’s infrastructure, and the resultant service is terminated elegantly and powerfully with enterprise premises infrastructure from the same supplier. Goodness flows liberally in this setup, through supplier-specific value-add features, increased manageability and better security. The evidence suggests, however, that this rarely happens. The managed services golden thread is a myth. Continue reading “The Mystifying Struggle to Mix Enterprise and SP Infrastructure” →

Intel’s Hardware-Assisted Security

by , posted in Secure
A. Braunberg
A. Braunberg

Summary Bullets:

  • ‘Hardware-assisted security’ is Intel’s preferred phrase to describe how security features in its silicon can be used to deliver additional functionality to new or enhanced software-based threat protection products.
  • McAfee has been working hard to make Intel’s vision a reality, first with last month’s DeepSAFE announcement and then this week with the first look at Deep Defender and Deep Commander.

Last month, Intel and McAfee made a bit of a stir with their announcement of DeepSAFE technology that provides a foundational element for McAfee software to leverage security features in Intel silicon.  DeepSAFE is important to Intel, because it helps to justify the McAfee acquisition.  It got the market’s attention, because the technology was described repeatedly as “game-changing.”  Well, fast forward to this week and Intel/McAfee have released the first products that build on the DeepSAFE technology: Deep Defender and Deep Control.  Deep Defender monitors system activity (i.e., CPU and memory) to detect and block rootkits.  Deep Control is a plug-in for McAfee’s ePO management system that leverages Intel’s Active Management Technology to allow some very cool remote management and update capabilities on devices running Intel Core i5 vPro and Core i7 vPro processors.

Continue reading “Intel’s Hardware-Assisted Security” →

New Developments in BYOD: How to Keep IT and Employees Happy at the Same Time

by Kitty Weldon, posted in Mobilize
K. Weldon
K. Weldon

Summary Bullets:

  • The current generation of solutions for dealing with use of personal mobile devices in the enterprise have been an unsatisfactory compromise between IT control and employee flexibility
  • A new generation of technologies is poised to solve the problem of dual personas with less complexity and more flexibility for both the business and the employee

Enterprises are changing their minds about allowing employees to bring in their own mobile devices to work, because it’s actually a huge money-saver. Why shell out scarce dollars for new corporate-owned cell phones when employees are already buying the latest devices? Corporate-liable ownership is starting to go the way of company cars and even company-owned laptops. The problem is that smartphones are now frighteningly capable computers that can access internal corporate information behind the firewall, can store confidential emails, documents and customer data, surf the internet, become virus-ridden, and are much more likely than laptops to be left in a taxicab (or a bar). Continue reading “New Developments in BYOD: How to Keep IT and Employees Happy at the Same Time” →