Small Vendors Issue Security Challenge To Large Competitors
522524
Four vendors of application security products have created an alliance to challenge the ability of large-scale vendors--such as Check Point Software Technologies, Cisco Systems, Juniper Networks
536795
The rise of customized malware is forcing security software vendors to change their tactics quickly and begin using customers' machines as their initial line of threat detection intelligence, according to a new report from Yankee Group.Echoing recent comments made by industry leaders like Symantec -- which is considering white-listing techniques, among many other emerging plans, to thwart the trend toward so-called server-side polymorphism -- Yankee Group Analyst Andrew Jaquith writes in a new research note that "herd intelligence" will be one of the most effective ways for vendors to detect and address increasingly customized threats.By turning their customers' endpoint devices into malware collectors that can funnel information about new attacks back into their global networks of threat sensors and scanning technologies, Jaquith said, security applications vendors may make faster progress in stemming the tide of lower profile, smaller volume threats.As malware authors have begun enlisting more malware toolkits and other technological means to create a greater number of attack variants than can be found and processed by honeypots and signature-based security software tools, the analyst said, it will become vital for vendors to aggregate threat data using customers' computers.Some smaller vendors, including ESET, Panda Security, Prevx, and Sana Security, have already begun working in such a fashion, turning their deployed endpoints into collectors.Larger vendors looking to add that type of technology to their pallets could seek to acquire one of those vendors, Sana in particular, to advance their plans more rapidly, Jaquith contends.The idea is simple, according to the analyst. If attackers are going to attempt to create different attacks for nearly every individual user, then security software vendors must use their customers' machines as their eyes and ears for discovering and addressing those variants.On the flip side, as the vendors amass information about new attacks, they can simultaneously help other customers determine whether new applications or Web sites are dangerous or safe to use, the analyst said."When an unknown binary attempts to execute, the client-side agent sends detailed telemetry information to a remote centralized server and asks whether it is good, bad, or unknown," said Jaquith. "The server makes a disposition decision based on all the collective history accumulated by the herd. By pooling information about all executing programs across its installed base, the herd makes smarter decisions and can confer immunity faster to new variants."As part of the effort, security vendors may also need to begin sharing more of that information with their rivals to create a larger network effect for thwarting malware on a global basis, according to the expert.It may be hard to convince rival vendors to work together because of the perception that it could lessen differentiation between their respective products and services, but if the process clearly aids on the process of quelling the rising tide of new malware strains, the software makers may have little choice other than to partner, he said."By turning every endpoint into a malware collector, the herd network effectively turns into a giant honeypot that can see more than existing monitoring networks," said Jaquith. "Scale enables the herd to counter malware authors' strategy of spraying huge volumes of unique malware samples with, in essence, an Internet-sized sensor network."Herd intelligence is not without its downsides However, despite the advantages of moving to a herd mentality model, the expert recognizes that there might be significant obstacles for vendors to overcome in making such a transition -- including the cost of shifting away form their existing malware signature creation and distribution methodology.Among the biggest issues for anti-malware vendors to consider is the issue of false positives as many legitimate or nefarious programs may be misclassified by one vendor or the other, and behavior detection-based tools will still be needed to keep an eye out for sites and applications that have been compromised.Customers may represent another hurdle, Jaquith said, as not all companies will initially be comfortable with sharing the necessary level of access with vendors, and some may fear that such a system could offer new opportunities for data loss. Prevx, for one, is already dealing with the issue of privacy by guaranteeing that the only information being sent over its pipelines from customer PCs is related to executable files.An even larger problem could be the "data glut" generated by the herd anti-malware networks."Telemetric data provided by herd endpoints will be substantial," said Jaquith. "Anti-malware vendors will need to spend significant millions of dollars of capital to create scalable infrastructures to collect, process, and store data furnished by endpoints."The white lists of legitimate applications maintained by anti-virus vendors will also need to be updated frequently to address the release of approved programs and patches, a process that will require even additional levels of cooperation between many different types of software makers, he said.Along similar lines, Symantec researchers recently detailed a new program through which they are gathering detailed information about software applications installed onto the computers of customers using its desktop anti-malware suite.Using an opt-out participation model, the experiment studies the behavior and distribution details of individual programs to help make recommendations to users about which programs they decide to install or avoid."Right now, this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it versus what it does," said Carey Nachenberg, a senior member of Symantec's Security Research team."We're hoping to get more clarity through the large base of users we have," he said. "By collecting this data, we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."
320458
Web servers may be vulnerable to attack, security company warns.
99945
Attackers could use hole in small-business software to trick personal information out of people.
356771
While corporations are monitoring ports and using advanced security tools to fend off infection and attack, home users -- who have less technical sophistication -- are left more susceptible, sometimes
622018
Security technologies delivered via the SaaS (software-as-a-service) business model may still be in their nascent stage, but some early adopters are already piecing together multiple offerings to outsource a significant portion of their IT systems defense infrastructure.
256536
InfoWorld - Four security software rivals are have teamed up to set a baseline standard for application security firewalls, challenging others in the industry to join them.
576245
Security experts who study online financial fraud sayÃÂ criminals increasingly are targeting small, commercial Web sites, where anti-hacking measures can be weaker than those employed at larger sites.
166578
Webroot has launched a software-as-a-service e-mail security offering designed for small and midsize businesses.
679573
The importance these days of protecting your business from security threats is clear. But how to do it well often remains a vexing problem. Major IT vendors have faced this challenge like everyone else -- but with a twist. As providers of security technology and IT systems vulnerable to threats, they've had to stay a step ahead of everyone else. That's why CIOs of technology stalwarts IBM and Intel and security technology provider Symantec have taken on security management as one of their key functions. All three companies have shared their lessons learned with InfoWorld.These CIOs have had to do more than take on the usual responsibility for driving their respective companies' efforts to defend their infrastructure, employees, and corporate reputations from any fallout related to data breaches or compliance violations. They've also had to be the in-house beta testers for a generation of new technologies their organizations hope to sell to customers. This balancing act demands more of their time and energy now than at any other point in their careers, all of the executives said.Security affects all of it "When I look at the risks here at Symantec, I know that we have to maintain a multilayered approach to protecting our IT assets: our ERP data, intellectual property, customer data, and personnel data. Managing the risk around all of that is a significant responsibility for me and my team," said David Thompson, CIO at Symantec."We have multiple large pools of information that are critical to our organization, and we're seeing more of that data move further toward the boundaries, toward the end points," he said. "My job is getting more data into the hands of our business units, but that creates a lot of risk in terms of where it goes, who has access to it, and what they are using it for, along with the risk of it being exposed."Even Thompson, who ranks his ability to "eat Symantec's own cooking" -- or use all of its security and compliance technologies -- as a huge advantage compared to CIOs working in other firms, admits that trying to keep up with all of the threats and regulations, as well as all the new products, is an effort that can become all-consuming.The key to staying ahead of the attacks and laws, while not spending too much of his time focused on security, is delegating to a strong team of experts and prioritizing which projects to tackle based on their criticality to Symantec's business. "As a business leader and IT executive, if you take the view of trying to fix everything, you'll never sleep a wink. You have to assess risks, and just as we'll never be able to completely secure our borders in the United States, you have to prioritize efforts to reduce risk as much as possible," Thompson said. "CIOs themselves must have a team that can help carry a good portion of the load so that they can stay focused on business relationships, clearing roadblocks, and being the public face of that team."Among the most critical roles that any CIO or technology executive must play in aiding the efforts of their security staff is to drive high-level assessments of risk and figure out how their companies must strategize to complete projects that address the most significant threats and compliance regulations, Thompson contended. The most effective strategy, he noted, is to determine which projects most readily address specific threats or government requirements and focus on them, he said. Otherwise, a broad-brush approach to security will lead to unnecessary complexity and eat up all of your time. Thompson also noted that even with the latest security technology available to him, the security strategy is more important than just having good security tools.At IBM, CIO Mark Hennessy also stressed the importance of delegating to his team of security experts and of conducting near-constant risk assessment. But even with that delegation, security remains a top focus for him, he said. "The world is changing, and there are a lot of new realities around security to address. Fostering stronger security across the board is a core tenet, as it helps to bring more value to everything we do," he said. "We want to make our employees more comfortable and more productive, and drive greater success for the clients we serve, so it's something we constantly need to remain focused on," he added.The security-vs.-complexity challenge Malcolm Harkins, general manager of Intel's Information Risk and Security unit, works directly with the chip giant's CIO Douglas Busch on issues of internal operational security and compliance. Harkins said that one of the biggest challenges that organizations such as Intel face is the process of improving security in the face of rapidly advancing IT complexity.On top of that, ongoing efforts to lower the total cost of securing a company the size of Intel -- while keeping up with emerging threats and regulations -- is driving the firm to seek greater standardization in some areas, and to integrate larger groups of technologies in others. "We currently have over 40 individual security software and hardware providers that we are doing business with, and that's a lot of different pieces to have to integrate," Harkins said. "It's almost crazy from an IT standpoint, so we want to employ greater levels of standardization to help us with issues of consistency; we'll always have a very heterogeneous environment, but we really need a more consistent set of tools. The more standardization you have, the easier it is to make things more secure."One of the most crucial steps any company can take in terms of improving its security is driving understanding of the attacks and laws across their highest executive ranks and ensuring that leaders who become involved in matters of security maintain realistic goals and objectives, Harkins said.But that does not mean being heavy-handed in terms of the security levels demand, he noted. C-level executives who take an extremely conservative approach and desire to aggressively lock down all their IT systems may in fact do more harm than good, he said. "Some companies believe that by severely limiting the use of technologies that pose risks, they are improving their defenses, but the truth is they may just be creating a false sense of security," Harkins said."In reality, they are limiting the ability of their business to operate effectively and are increasing risk by creating barriers and policies that can't be enforced practically," he said. In IT, "you have to work with [C-suite] to change their approach from one that is focused on responding to fears to one that is focused on key controls that solve real problems. You have to have executive buy-in, but by taking the wider approach of considering legal, compliance, and security issues together, you will end up with stronger protection, lower costs, and less complexity."
132397
A new small-business community Web site and security software are part of IBM's push to make its mainframes more attractive to the SMB crowd.
416880
VeriSign and RSA Security intro security tools that could help combat the upswing in E-commerce threats. By Thomas Claburn. It&#39;s hard to say what&#39;s growing faster, security threats or security solutions.
147101
Established security players profit from the rush to look for bad things in luggage and spot faces of evil-doers in crowds -- without real technology breakthroughs. But some little guys with the right products may get in on the homeland-security market, as well.
594727
As malware threats and regulatory compliance demands continue to grow more complex, IT will become increasingly dependent on SaaS (software as a service) offerings that let them respond to problems faster while also saving money, according to top executives at the world's largest anti-malware vendors.
607967
Two boxes bundling managed security service with SMB-level firewall/router/gateways and DSL have appeal to smaller businesses and admins managing remote users, but our testing raised questions.
136110
Microsoft (Nasdaq: MSFT), eBay (Nasdaq: EBAY), and  Visa International have banded together in an attempt to combat phishing attacks.
670277
Cost, different standards remain the key challenges in the fight to craft an antispam plan.