Cerberus says GMAC may face difficulty: report
506657
GMAC LLC, the auto and mortgage lender  controlled by Cerberus Capital Management LP , may face  "substantial difficulty" if credit markets do not improve,  Cerberus founder Stephen Feinberg wrote in a January letter to  investors, Bloomberg News reported on Thursday.
289303
(InfoWorld) - The Department of Homeland Securityâs Computer Emergency Readiness Team (US-CERT) raised a few eyebrows in late November when it sent a warning out to U.S. banks and financial institutions about a possible cyber attack by Islamic militants. The alert, dated Nov. 30, was triggered by a posting on what the DHS considered an Islamic jihadi Web site calling for hackers to attack U.S. financial and banking Web sites, apparently to protest the detention of Muslims at Guantanamo Bay, Cuba. However, the warning was heavily qualified, with DHS calling the threat âmore aspirational than operational.â Financial firms downplayed the danger, too. One security executive at a major brokerage told InfoWorld that the warning was a ânon-event.â But could repeated warnings about such non-events eventually make critical infrastructure owners deaf to DHSâs warnings? InfoWorld Senior Editor Paul F. Roberts recently chatted with John Carlson, senior director of security and risk Assessment at BITS, a financial-services industry consortium focused on security, fraud, and risk management, about the DHS warning and state of the public-private partnership on cybersecurity. InfoWorld: Iâm guessing that your members received the US-CERT warning about the cyber terrorist attack? John Carlson: There were two messages sent: the first was [Nov. 30]; then a second revision came out [Dec. 1]. The gist of it was that these reports were not corroborated. IW: What was the reaction of BITS members to the warning? JC: Our members have an âall hazardsâ approach to business-continuity planning. Theyâve got well-developed approaches that have been bolstered since 9/11. In response to new regulatory requirements, firms have done a lot to improve backup, theyâve done tests with the various exchanges. Theyâre also working in closer harmony with the federal government to share information on threats and vulnerabilities. I think thereâs a spirit of appreciation that the government is willing to share information with the financial services industry. The firms take that information into account in responding and activating their business continuity plans. IW: How do your members apply information like this that comes from DHS? JC: Iâm not sure I can give a blanket answer. Each firm has its own mechanisms for gathering information. Risk-management professionals at these firms read the paper and understand the military conflicts and theyâre mindful of that. They take it into account when they have employees traveling. Theyâll monitor where they are. With the [bird flu] pandemic issue, firms were monitoring that closely and trying to figure out what impact it would have on their organizations. IW: Is there a danger from these warnings of creating a âBoy Who Cried Wolfâ situation, where firms begin to disregard the warnings? JC: Thereâs always a concern about the crying-wolf syndrome. But our firms appreciate getting the information even if itâs not corroborated. A continuous flow of information helps build trust between the private and public sectors. IW: Was this warning about the jihadist threat something that your members see all the time, or was this an unusual kind of warning from DHS? JC: I think the warning came across the transom at a high level [saying] âpay attention to this.â So it was different from what we normally get. Weâre getting a steady stream of information on threats and vulnerabilities and a range of things. For example, if thereâs a known virus thatâs being perpetrated in [the United States] or against a financial institution. Weâre also getting information on political changes around the world. IW: Do you think DHS has its arms around the cybersecurity problem? JC: My personal opinion is that the government has some capabilities, but not all capabilities. In general, our firms would like more information, but there are many reasons why if (the government) has the information they donât provide it. But itâs a touchy question. People have lots of different views. Â  IW: Do you feel like your members are getting all the information they need? JC: Thereâs some filtering, but I donât have information to compare or validate what the filter is. We talk about issues through coordinating councils that meet quarterly. Itâs a two way conversation.Â
416394
Firm may be facing greater difficulties than previously thought in getting hold of chips to power its high-end PCs.
670395
(InfoWorld) - Trying to lock down your company's applications and protect your systems from attack? If so, security scanners and source-code analysis tools are not up to the job -- despite vendor claims to the contrary. "There's an awful lot of marketing spiel, people introducing technology tools that are sold as silver bullets," said Mark Curphey, vice president of professional services at McAfee's Foundstone division, in an interview. "The reality is, in a large enterprise, those things generally don't work." "Technology is increasing at such a fast and crazy pace, but security technology isn't keeping up with it. With application security it's even worse," Curphey said. Security tools, such as code scanners, are able to detect just 1 percent to 2 percent of vulnerabilities in an application, leaving "gaping holes" behind, he said. Curphey, who has worked on security for U.S. financial institutions, is speaking this week at the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia. Software vendors and companies must get back to basics to secure their applications. "What the smart banks are doing about this is they're building security into their development life cycles and that's exactly what Microsoft has done," he said. Since being hit by a series of high-profile vulnerabilities in its software, Microsoft hasÂ significantly improved the securityÂ of the software it produces, resulting in fewer critical vulnerabilities being reported. "Microsoft are going to be the security vendor of choice in the next couple of years," Curphey said. "There's been a phenomenal turnaround in that company." While a company's IT systems may never be perfectly secure, IT managers should be able to identify and mitigate risks. "At the end of the day, security is about building something that's secure enough to do business on," Curphey said. To help protect their systems, companies need to be sure they are hiring IT staff with the right set of technical skills, setting business processes that determine how to respond to attacks on the system, and providing staff with the tools they need to respond when attacks happen, he said. HITB runs through Thursday, Sept. 21.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
372065
General Motors Corp.  Chief  Financial Officer Fritz Henderson said on Thursday it is  "feasible" but "would be tight" for the auto maker to hammer  out a deal with Delphi Corp. by the end of the first quarter of  2007, the Wall Street Journal reported on its Web site.
622667
(InfoWorld) - While many IT shops see virtualization as a question of adopting EMC's VMware on servers running Windows or Linux, Nationwide Insurance has adopted the technology for both x86-based and mainframe-hosted servers. After all, notes Buzz Woeckener, the company's zLinux/Unix server manager, virtualization was invented for mainframes. On the x86 server side, Nationwide reached 5,000 servers two years ago, running all sorts of departmental applications, notes Scott Miggo, vice president of technology solutions. "We were growing at a steady pace, so we wanted to control the server space and the costs for new development," he says. "A lot of our servers had only a 10 percent utilization rate," he notes, wasting much of the server capacity. Roughly half are production application servers and half are test-and-development servers. Today, there are 3,500 physical servers in operation but still 5,000 instances under management. The VMware servers typically host a dozen instances per physical server. "We assume every new server or application can be virtualized," Miggo says. He expects to have more than 1,000 virtual servers running on 89 physical servers by 2009. His team works to tweak I/O requirements or settings for virtual servers that may have trouble supporting I/O needs in their default state, and it works with vendors to support VMs where possible, before falling back to dedicated servers. Lotus Notes and database applications are examples of where the I/O requirements make virtualization not an option. Although it's easier to deploy servers in a virtual environment by using predefined images, "our staffing has stayed pretty much the same," Miggo says, because the same number of servers must still be monitored. The slight reduction in management overhead is offset by the need for VMware experts to manage the VMware environment, in addition to the server instances. And Nationwide learned the hard way that it needs to monitor both its virtual and physical servers, then correlate the two to identify potential trouble spots, Miggo says. Not doing so can make diagnosis hard, since a VM issue may be caused by a physical issue that a server monitor application running in only the VM won't detect. There's also more overhead needed for Miggo's shared-services group to coordinate all users (such as developers and application managers) of a physical server, as changes to the physical server could affect them all -- and because adjustments to one VM's application mix could affect I/O and other physical server performance characteristics. "We now have to coordinate with 12 users," Miggo says. "People were used to having their own boxes and doing their own thing. Now they're more tightly controlled, which they don't like. But they have to follow control processes like code management and release management since what they do could affect others," he notes. The use of EMC's VMotion software to load-balance and failover VMs across physical servers might reduce management, but the insurer is still exploring that technology. One barrier: Its requirement that all server instances run on physical servers with the same CPU family, requiring a consistent server pool to be in place. Nationwide runs its Web servers in a zLinux environment on IBM zSeries mainframes, supporting 650 guest operating systems (VMs) today, with space for another 650 before additional hardware frames would be needed. Often, using z/VM to support the virtualized Web servers requires a different strategy than using VMware to support virtualized Windows servers, Woeckener notes. For example, you might add memory, CPUs, or network cards to increase I/O on a VMware server. On a zSeries, the CPUs just handle executables, offloading physical I/O (such as network bandwidth and resource scheduling) to dedicated processors, so you don't need to worry about performance-sapping overhead incurred by server resource management. Another difference: Increasing heap size can improve performance in a Windows application but also degrade it in a zLinux application, Woeckener says. That's because Linux steals resources wherever it can find them, so any extra heap space is used by Linux for its own purposes, degrading application performance. When the heap size is reduced, Linux seeks resources elsewhere, giving the full heap to the application and improving performance. In both the VMware and z/VM environments, the ease of deploying new virtual servers has led Nationwide to align demand with real needs, as well as to encourage the use of VMs rather than physical servers. Virtual Windows servers cost a requestor $750 per month versus $2,000 per month for a physical server. And zLinux VMs add a per-MIP rate for weekday usage exceeding 15 MIPs. This overage charge steers batch processing to overnight and weekend periods, when overall demand is less, and forces developers of applications in use during the business day to optimize for performance, saving datacenter resources at the same time. Virtualization special report Case study: Credit Suisse Case study: Purdue University Case study: Stonebridge Bank Case study: Transplace
245817
Get There | Federal transit administrator express concerns that could threaten proposed Metro line.
312156
MacCentral - Analysts from Prudential Equity Group and UBS have warned over the past two days that longer than expected G5 delays from IBM Corp. is the near-term "key risk" for Apple Computer Inc. Both firms are concerned the delays could be longer than originally expected.
453848
Leveraging its October 2007 purchase of Berkeley Data Systems [BDS], EMC announced this week that it will offer an enterprise backup and recovery solution, MozyEnterprise, over a hosted SaaS platform for desktops, laptops, and remote servers.The service will become part of EMC's Fortress hosted services and will offer RSA-level security, a capability that was not available when the product was owned by BDS and marketed as Mozy Professional. The solution includes integrated key management, authentication and authorization security. Over time, EMC will offer other SaaS solutions, according to officials.The EMC solution will compete directly with Iron Mountain's DataDefense backup and recovery SaaS service. However, EMC lacks a key capability that Iron Mountain offers, according to Adam Couture, a principal analyst with Gartner. "DataDefense encrypts everything on the laptop," said Couture. "MozyEnterprise does not have this capability."An EMC spokesperson confirmed this, saying that data is encrypted once it leaves the laptop or desktop and is stored by EMC.The company will either have to develop the encryption capability on its own or partner with another company in order to be competitive, but the fact that GE used Mozy Professional before the acquisition and is apparently staying with the product from EMC gives EMC enterprise credibility, he added.Pricing for a desktop/laptop is $5.25 per month per desktop/laptop plus $0.70 per gigabyte protected. Windows server pricing is $9.25 per month per supported Windows server plus $2.35 per month per gigabyte protected.
313379
IT&#39;S MYSTIC MEG, the Gartner Group is predicting that system downtime will increase from five per cent this year to 15 per cent in 2008 due to security holes.
749556
According to a new Burton Group report, Google&#39;s hosted applications are not ready for the big leagues, but at least one analyst is countering that the report is overly pessimistic.
463648
Resellers are expressing doubts over the move, saying they might go elsewhere if they can't get the IBM badge.
264803
The Massachusetts Institute of Technology (MIT) has warned of security vulnerabilities in its implementation of Kerberos that could allow attackers free access to protected systems. Users of MIT Kerberos 5 are urged to apply patches immediately.
318831
(InfoWorld) - The communications network used to transmit medical data for the U.S. government's Medicare and Medicaid programs has security vulnerabilities that could expose patients' medical data and other personal information, according to a report released Tuesday. The report, released by the U.S. Government Accountability Office (GAO), identified 47 weaknesses in the way the U.S. Centers for Medicare and Medicaid Services' (CMS) used a WAN (wide-area network) operated by an unnamed contractor. CMS uses the network to transmit claims data -- including patient names, dates of birth, Social Security numbers, addresses and medical information -- to health-care facilities, contractors, financial institutions, and state Medicaid offices. "A security breach in this communication network could lead to interruptions in the processing of medical claims or to unauthorized access to personally identifiable medical data, seriously diminishing the public's trust in CMS's ability to protect the sensitive beneficiary data it is entrusted with," the GAO said in the report. GAO, in its review of CMS security procedures early this year, found that the agency and contractor did not use adequate identification and authentication controls for access to the network, did not restrict user access to only those programs and files workers need, did not close off all access from the private network to the Internet and did not consistently encrypt sensitive data. CMS did not always ensure security policies it has in place, GAO said. "CMS did not always ensure that its contractor effectively implemented controls designed to prevent, limit, and detect electronic access to sensitive computing resources and to devices used to support the communication network," the GAO said. GAO gave CMS an early copy of the report, and Dr. Mark McClellan, CMS administrator, said in a July 10 letter the agency took quick action to fix the problems. CMS, working with its contractor, had fixed 22 of the 47 vulnerabilities identified by the July letter, and an additional 14 were scheduled to be fixed within weeks. The final 11 vulnerabilities were "somewhat more complex" and were scheduled to be fixed by Jan. 7, he wrote. "We are taking further steps to assure that none result in actual security breaches," McClellan added. "We have been proactive in our oversight of the network but are taking further steps to enhance security." GAO does not typically name contractors in its reports because its focus is on agency performance, a GAO spokesman said. A CMS spokesman said he did not know which contractor was involved in the network targeted by the GAO report. CMS uses multiple contractors, he said. The Medicare program is the nation's largest health-insurance program, covering 42 million U.S. citizens.
346455
One security firm says Vista is vulnerable to current threats; another isn't so sure.
51333
A GoDaddy.com Inc. customer is seriously concerned that this domain registrar and hosting company may not be ready for the switch to Daylight Saving Time (DST) on Sunday.
724507
(InfoWorld) - Much as the ubiquity of Microsoft's Windows operating system and Office productivity tools has made the software giant a focal point of security research, search giant Google is facing new scrutiny as it diversifies its products and moves further into the business environment. In a report to be published on July 16, researchers at Ponemon Institute will detail their findings about existing concerns among IT professionals regarding the overall security of Google Desktop, the company's PC search utility, specifically within the confines of business operations. And while the research revolves around the only significant security flaw to be unearthed in the program thus far -- a cross site scripting vulnerability reported and subsequently patched by Google in February -- authors of the report contend that their work illustrates a growing level of concern over the massive company's rapidly-expanding footprint. Google Desktop marries PC and Web-based technologies in a similar manner as many other products the company has launched in the last several years, such as its Google Apps document system, which competes directly with Microsoft Office. If the company is to succeed in its plans to replace Office with Google Apps and drive other applications like Desktop further into businesses, Ponemon researchers said, the company must be ready to face a wave of inquisition over the potential security impact those products will have. In the Ponemon survey of more than 600 IT security specialists who indicated that they were familiar with the Google Desktop vulnerability, an overwhelming 71 percent said that they believe that the product likely harbors other security flaws. The results gathered by Ponemon -- an Elk Rapids, Mich.-based firm that has gained acclaim in recent years for its studies regarding the cost and causes of data breaches -- illustrate the growing apprehension among businesses about the security implications of Google's applications, said Dr. Larry Ponemon, the research company's founder and chairman. Google has moved to bolster its security skills via recent acquisitions of software makers GreenBorder Technologies and Postini and has sought to become a thought leader via its sponsorship of malware research projects like Stopbadware.org. However, the company must prepare itself to face the daily assault from hackers and researchers previously reserved for Microsoft and other industry bellwethers if it succeeds in becoming a more central provider of business IT products, according to the expert. "Google has a huge bull's eye on its back because of its position in the market and everything it wants to become, specifically to businesses," said Ponemon. "These recent acquisitions may point to steps to try and make it safer to use their applications, but it's likely that they will become a victim of their success as more hackers and researchers focus their efforts on finding flaws in its products." In addition to existing concerns among the general public regarding the amount of data retained by search engine providers about people's individual Web queries, products like Desktop and Google Apps are raising significant questions among business users about the ability for the company to keep hackers from finding a way to break in and use the tools to steal sensitive corporate data, he said. Another finding of the report was that 81 percent of respondents familiar with the Desktop cross site scripting security problem said that they do not feel that users who have sensitive data on their computers should utilize functions of the program that allow them to run remote queries on their machines. Such data provides evidence of the growing fear of Google's plans to foster "deep integration" between desktop and Web-based tools, the researcher said. "Based on the people we talk to in the world of security, many believe that Google's products could present a serious risk; that if someone can get in, they can find a lot of sensitive data very quickly," Ponemon said. "Google is becoming such a major presence on so many computers that if people are looking for attack vectors that can get them the most information, Google has become an attractive target." While conceding that Google has encountered very few serious security issues in its products, especially when compared to other major IT companies like Microsoft, the researcher said that concerns about the search giant's technologies are nonetheless going to increase if more business users begin working with its tools. Ponemon denied that his company was attempting to "lead witnesses" with the Google survey by reminding them of the Desktop vulnerability before posing its questions. "To Google's credit, they haven't had many major security problems, but people clearly believe that they may still be vulnerable and that the bad guys will eventually find a way to break in," Ponemon said. "People are scared because they are wondering if this is just the tip of the iceberg in terms of bugs and if the bad guys really are ramping-up their activities around attacking Google products in general." Google representatives complained that the Ponemon report was too narrow and suggestive in trying to provoke people's concerns about their company's overall security standing. Executives with the company said that the search giant is working as hard as it can to ensure that there are no problems in either its existing or future technologies. The firm has long considered its ability to foster trust among users regarding the privacy of their search habits as key to its overall success, said Douglas Merrill, Google's CIO and vice president of engineering. "Search is the oxygen of today's information economy, but we don't believe that search works without users trusting in us to protect their information, so we're focused constantly on improving security and privacy and have been since day one," Merrill said. "That was long before Desktop or our other forays into the enterprise, and it continues with Google Apps; we run our own business on these applications, and I wouldn't be able to recommend them to other CIOs if I didn't know that they were truly secure." Merrill said that Google engages in rigorous examination of the underlying code in its products to eliminate potential vulnerabilities both during their production and after the tools have gone live. He said that by fostering open communication with security researchers, white hat hackers, and other technology providers and encouraging responsible disclosure of any problems, the company has been able to head off attacks that could be aimed at its products. Google currently employs over 1,000 engineers whose sole responsibility is to test for holes in its software and has built proprietary code-scanning tools, he said while acknowledging that the threat of attacks is a reality that no firm can write off in today's environment. "The reality of the world is that Web applications have a larger attack surface and that client-based technologies have been around a lot longer and still struggle with security issues, but we have a big advantage in that if a problem is found, we can fix it right away on our servers versus trying to send patches out to all of our users," Merrill said. "That doesn't mean we will find all the issues. Security is a constantly changing field, but we're happy with the progress we've made." Merrill contends that Google's products actually represent a significant advantage over other technologies in terms of security and that they have proven useful in helping companies solve and locate data management problems. Google's Search Appliances and Desktop products are useful in helping companies find data that may be stored or used improperly within corporate systems, for instance, and its Apps tools require users to authenticate themselves before they are given access to shared documents, adding a new layer of protection to collaborative business efforts, he said. Through its Google Security Blog and participation in Stopbadware.org -- a malware research effort launched in cooperation with experts at Harvard University Law School, among others -- the CIO said that the company is keeping customers informed of its ongoing work and staying abreast of the latest attack methods. "As companies get more widely-known they provide a larger attack surface, but we hope we will continue to maintain our close relationships with security researchers, and we will continue to invest in research and development to protect data as our tools get more popular," Merrill said. "We don't feel that the published risks have been too severe, but we will continue to focus on finding and fixing any problems." Industry analysts agreed that Google has done well thus far in protecting its users from major product vulnerabilities and attacks but observed that the company must learn from the mistakes of companies such as Microsoft if it is to retain its positive image. Google is in the same position of any dominant technology provider in terms of potential attack and will need to remain open to criticism and stay aggressive in quashing potential problems if it is to maintain that standing, said Paul Stamp, analyst for Forrester Research. "Google has to learn from Microsoft's mistake of avoiding talk about security issues based on the idea that it will embolden the people trying to take advantage of any vulnerabilities," Stamp said. "If they think that there aren't people out there who know their products as well as they do or who can't exploit any existing problems, that would be a mistake." The analyst lauded Merrill's pledge to remain open about potential security issues and to court the help of researchers versus making them feel like adversaries. "Google needs to be transparent and be forward-thinking and use the community to find bugs before even they can find them for themselves," said Stamp. "It's a matter of saying, 'These are the types of attacks we expect to see,' and challenging the research community to go find the bugs first."