Tivoli integrates compliance management
373746
Automated tool contrast policies with behaviour IBM has finally finished digesting Consul InSight, the risk management software that it bought last December, and has re-released it in expanded form as Tivoli Compliance Insight Manager.â¦
260583
Societa' rilevata e' specializzata nelle soluzioni software
91276
(InfoWorld) - IBM plans to acquire privately held Consul Risk Management to enhance the compliance and security auditing capabilities of its Tivoli systems management software family. IBM said Tuesday it expects to close its purchase of Consul in the first quarter of 2007. At that point, Consul will become part of IBM's Tivoli Software business unit. IBM didn't provide any financial details on the proposed transaction. Consul's software lets customers track, report and investigate unauthorized access of corporate information by their employees. The company has two main software suites -- InSight, which focuses on the needs of enterprise users and zSecure, which targets mainframe users. The breadth of coverage of both distributed and mainframe systems appealed to IBM, according to Joe Anthony, the company's program director for Tivoli Integrated Identity Management. "It offers a lot of very good value and is very unique," he said. Some of IBM's customers are particularly keen to use their mainframes as security hubs so the addition of Consul's zSecure will likely prove appealing to them, he added. Aside from Consul's support of IBM's System z mainframes, the companies previously had no formal relationship. Although some industry analysts have put Tivoli Security Operations Manager, which debuted in July, and Consul's InSight in the same security information management category, Anthony doesn't see them as competing products. "Once you drill down, in terms of what they have, there's very minor overlap with Tivoli," he said. IBM plans to provide details on a road map for Consul's software when it closes the acquisition next year. The vendor hopes to quickly integrate the technologies with Tivoli. "They should dovetail nicely together," Anthony said. Acquiring Consul will complement the security management functionality IBM has within Tivoli software and the technology it gained from itsÂ $1.3 billion acquisitionÂ of Internet Security Systems, which closed in October, he added. Consul will help Tivoli define and flag what customers determine to be "acceptable use" of their data by those permitted to view that information, Anthony said. "We were definitely not as deep in that area," he added. "Consul is much more thorough." For instance, a bank may allow tellers to access customer information, Anthony said. Using the Consul software, the financial institution can track user behavior in accessing that data so it could be alerted that an individual teller was viewing 800 customer records per day when his or her peers were only examining 200 records. IBM's plans to retain Consul's 89 worldwide staff and to keep both of the company's laboratories operational. Consul has dual headquarters in Herndon, Virginia, and in Delft in The Netherlands. Consul, which celebrated its 20th anniversary in September, has about 350 customers, including Hanes, Fidelity Bank, Ford, Kroger, and Office Depot, many of whom are also Tivoli customers. Â
289698
Oracle has released tools using technology acquired with Stellent that can automate compliance with government regulations such as the Sarbanes-Oxley Act.
690577
TechWeb - The software offers enhanced database integration, security, and standards compliance.
262842
Indiscrezioni stampa su contatti per integrazione con Bper
92649
InfoWorld - Enterprise software takes an evolutionary step forward as Edge Dynamics and Tibco Software develop software that combines elements of both ERP and BI applications.
502612
A beta version of its next-generation Total Protection 2.0 consumer security software.
576784
La societa' di software lo registra nel quarto semestre 2007
556875
IBM plans to acquire Consul Risk Management to deepen the auditing and compliance functionality of IBM's Tivoli systems management software.
441317
L'amministratore delegato intervenuto a convegno Slp-Cisl
331275
Accela, Inc., the leading provider of government enterprise management software solutions, announced the Tahoe Regional Planning Agency (TRPA) has selected Accela Automation(R) as the agency's new permit and land management solution.
512510
Delivering on a promise made earlier this year, SAP has unveiled the first set of products to help businesses meet their compliance requirements, in addition to announcing a marketing agreement with Cisco Systems.
375593
IBM has established a new technology centre in the Washingon DC to help IT departments to better define their Tivoli-based infrastructure management strategies.
483736
No one in the business world wants to be held responsible for a breach of sensitive corporate information, but gaining the level of support necessary to allow DLP (data leakage prevention) technology to work effectively remains tricky, customers and vendors confirm.Unlike traditional security technologies that have operated largely within the confines of IT departments and network management teams, DLP projects must include participation from almost every corner of the organizational chart to succeed, according to experts who have worked with the tools.From all the different business units that need access to protected information to human resources departments tasked with following up on potential violations to the highest levels of business management, the issue of data leakage is so pervasive that nearly everyone in a company needs to be involved on some level for critical content to stay under wraps.For DLP technology to have its intended effect, every employee needs to be continually educated about company policies that must be policed aggressively and attached to real consequences for violators, customers said. Simply throwing products at the problem won't work, they claim, because DLP is as much about building policies as it is about embedding IT controls."We have HIPPA considerations to uphold, we don't want to be in newspaper, and we don't want to be embarrassed in today's world for having exposed data accidentally or otherwise -- but it's not an overnight process," said Charles Hibnick, chief systems security architect at AvMed, a large HMO in Florida. "Even though we've been working with compliance regulations for years, embracing DLP is still a cultural change that demands involvement from a lot of people to work."As part of its effort to roll out its DLP program around technology provided by Palisade Systems, AvMed was forced to create a corporate steering committee that included everyone from C-level executives to its HR and compliance officials and even its external legal counsel.If a business is attempting to create a system where employees are expected to follow specific data-handling rules and be held accountable to real penalties when they have violations, all of those parties must be involved, Hibnick contends. "We in IT had to hook up with HR and compliance to make sure that our plans specifically included a review of how the DLP product would be used and ensure that they were buying into the process," he said. "Then the HR director had to communicate with our external counsel to make sure that we were within our appropriate boundaries with everything that we wanted to do and then run it all by the board."Once the plan had been established and the technology's use was approved, one of AvMed's most visible business vice presidents authored a letter to all of the company's employees informing them of the new policies and how they might be punished for multiple infractions, such as sending out sensitive data repeatedly in unencrypted e-mails.The letter was received by employees with some level of concern over "big brother" type monitoring of their work, but making its policies and penalties clear has been key to AvMed's success in keeping its data better protected, Hibnick maintains."You'll always get feedback from users, but when you have senior executives including the CIO saying this work needs to get done, you're not going to get a lot of kickback," he said. "I'd say the two most important pieces of doing this right are aligning the right team to drive it from the top down and making sure that everyone reads that letter and understands the role they play in helping us protect the data."DLP's cooperation requirement in the real world Since getting its system up-and-running and ensuring that employees knew what was happening over one year ago, the company has experienced only a dozen or so incidents that forced it to warn individual users or send reports to those workers' department heads, the IT leader said.Even vendor representatives, such as Palisade Chief Executive Kurt Shedenhelm, concede that the challenging politics of a DLP project often outweigh the technical issues that come into play when working out all the complex data-handling rules that his company's systems are employed to enforce.Some companies struggle to achieve the right level of executive buy-in to force business unit leaders to play ball, while others don't go to great enough lengths to ensure that workers have been sufficiently re-trained to understand new policies, he said. "This issue of internal politics, of who is responsible for protecting the data, who is responsible for educating the end-user, and who is ultimately responsible for enforcement, that's actually the hard part," Shedenhelm said. "In a lot of companies, I think you might find that it's hard to get the business units, HR, and IT people that need to be involved on the same page, but you can't really do DLP without that."In some companies, especially large enterprises, multiple DLP projects may only be put under the domain of IT security and compliance teams, making it harder for those groups to keep their efforts in step without overwhelming end-users.From the issues relating to which business units ultimately maintain responsibility for specific sets of data and who is tasked with enforcing policies, things can get too complex very quickly, he said. "In larger enterprises, where you often have multiple projects looking at DLP from perspectives of intellectual property, compliance, and customer data and information spanning multiple business units, that's where you run into problems," said Shedenhelm. "One of the biggest issues we see is with trouble discerning who is ultimately responsible for handling violations; sadly, in some cases, people clearly don't want to know if violations are occurring on the business side, because then they will be forced to respond."Other experts agreed that the size of an organization often plays directly into its ability to make DLP work with issues of enforcement standing as central disputes.A tug-of-war can break out between security teams tasked with enforcing DLP and those business unit that want unfettered access to data to help do their jobs, according to some industry players. "That's one of the big problems with DLP in general -- organizations are often quite hesitant in enforcing policies, especially when it comes to any notion of blocking secure content and getting in the way of the business," said Uzi Yair, CEO of DLP vendor GTB Technologies. "Businesses want people to be able do their work and don't want interference, but on the other hand, they know they need to weigh that against any loss, which could cost an organization a lot of money these days," he said. "I think it's always going to be about this tradeoff, enforcement versus the fear of slowing down business opportunities, but people need to understand that they all play a certain role."
692487
IBM on Wednesday released the 5.0 version of its Tivoli Identity Manager (TIM) software, in what the company called the product&#39;s first major update in more than 2.5 years.TIM 5.0 is used to manage user access rights and password information. It automates new account setups, offers users the ability to reset their passwords without an assist from a help-desk employee, and monitors for unauthorized changes.A major focus of the update is speeding up deployment. The product features a range of guidelines, wizards, and templates that can cut deployment times in half, claimed Joe Anthony, program director of identity management for Tivoli.However, administrators who desire the most fine-grained control over user access will still have it, according to Anthony. &quot;We did not take those capabilities away from the administrator. If in a given area they need more capabilities, it is very easy to gain access to those capabilities,&quot; he said.Matt Hickmott of Watson SCS, an identity- and access-management consultancy based in Tampa, Fla., was a beta tester on the 5.0 release. &quot;I think the new functionality is very good,&quot; he said.IBM&#39;s claim about reduced deployment time rings true, according to Hickmott. &quot;It&#39;s probably about half. A lot of the customizations you used to do are already built in,&quot; he said.Hickmott did single out one area of weakness, noting that the product&#39;s self-service user interface resides on the TIM 5.0 server. &quot;Ideally, you&#39;d have that outside TIM so people don&#39;t have access,&quot; he said.Pricing for TIM 5.0 varies depending on the number of users managed or on a per-processor basis, with prices starting at about $10,000 per company installation, a company spokesman said.
388261
(InfoWorld) - An overwhelming percentage of businesses still fall far short in their efforts to comply with industry data-handling regulations and reduce their likelihood of experiencing a serious leakage incident, according to a new survey. In a report to be published by the IT Policy Compliance Group on July 18, the consortium of IT compliance and security experts concludes that some 90 percent of all businesses still do not have sufficient policies in place to meet data governance regulations and adequately limit the risk of a breach. In the survey of 475 companies, a third of whom reported revenues of more than $1 billion last year, the industry group found that an overwhelming majority of the firms expect to deal with at least six business disruptions related to major data incidents per year along with five or more instances of information loss or theft. While businesses continue to invest policy enforcement software, and other technologies aimed at helping them meet data-handling regulations, said James Hurley, managing director of IT Policy Compliance Group, most are still struggling to fill all the gaps left in their systems that leave them open to potential incidents. Hurley is also a senior research manager at security software maker Symantec, a member of the compliance policy think tank, along with such organizations as the Computer Security Institute, Institute of Internal Auditors, ISACA, and IT Governance Institute. Along with well-known federal guidelines, such as the Sarbanes-Oxley Act, many companies are having trouble responding to new statewide data protection measures crafted after the California 1386 bill, which requires businesses to make public notice of severe data incidents, he said. "When it comes to protecting data, a lot of organizations still find information all over the place that they may not even have control over," Hurley said. "People are finally discovering this is a difficult problem and that the controls they thought they have in place may not be adequate; that they need to rethink those controls and find out where the data inventory actually is because in most organizations, it's not under control." In addition to gauging what percentage of companies remain at risk for a data breach, the survey also attempted to measure the impact of such an event on the average company. Based on its respondents' replies, businesses that are forced to report major incidents publicly can expect to experience an 8 percent loss of their stock price and an equal 8 percent of their customers. Companies can also expect to report an 8 percent falloff in their quarterly revenue along with additional costs for litigation, customer notification, and subsequent settlements averaging $100 per each record they lose. In a nod to the increased challenge of meeting regulations and lowering data leakage within enterprises, the report concludes that larger companies are more likely to have incidents, based on its research. Organizations with less than 1,000 workers average roughly 8 percent in revenue and customer losses per event, whereas companies with more than 100,000 employees can expect to lose 12 percent of their sales and clientele. While some researchers have tried previously to divine the overall expense of having a major data breach, such as the one reported by retailer TJX Companies in early 2007, it has been hard to guess just how much such an event truly costs said Mike Money, associate director at Protiviti, an auditing services specialist that is also participating in the consortium. "We finally have some data on this because of the state laws that have gone into effect, so hopefully some companies see this report and understand the extent of the problem," Money said. "People are finally starting to focus on the issue because they see the newspaper headlines every day, and until you've been through one of these types of events, it's hard to understand all the implications." Unsurprisingly, the report also finds that companies that allocate the highest budgets for compliance automation technologies are faring better in their efforts than those who spend less on the issue. In a shift from previous studies completed by IT Policy Compliance Group, however, it appears that most organizations are realizing they need to adjust their budgets to account for the tools, Hurley said. "The difference is that these state regulations have put this on the front of the radar screen, and they are realizing that they need to spend money to solve security problems that benefit compliance goals," said Hurley. "There's a clear linkage between having better controls and experiencing fewer data losses and business disruptions, as obvious as that may seem."