HP's focus on security strategy, not security products
162870
HP will focus its efforts on security services, security management integration, data security and the intersection of security and corporate governance.
507013
Hewlett-Packard Co. plans to deliver by the end of the year a new vulnerability service designed to help companies proactively detect and fix flaws that could be used in a malicious attacks.
91417
Hewlett Packard's acquisition of Web applications security specialist SPI Dynamics on June 19 illustrates a growing demand among enterprise customers to have vulnerability-scanning tools integrated into their software development platforms.
656468
com October 1, 2004, 4:25 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
710256
CNET News.com's Charles Cooper writes that HP's "non-denial denial" was a missed opportunity to make a grander statement about privacy.
533752
Microsoft wants to sell Web sites and businesses on security checks of customer PCs. That may not go over so well.
679573
The importance these days of protecting your business from security threats is clear. But how to do it well often remains a vexing problem. Major IT vendors have faced this challenge like everyone else -- but with a twist. As providers of security technology and IT systems vulnerable to threats, they've had to stay a step ahead of everyone else. That's why CIOs of technology stalwarts IBM and Intel and security technology provider Symantec have taken on security management as one of their key functions. All three companies have shared their lessons learned with InfoWorld.These CIOs have had to do more than take on the usual responsibility for driving their respective companies' efforts to defend their infrastructure, employees, and corporate reputations from any fallout related to data breaches or compliance violations. They've also had to be the in-house beta testers for a generation of new technologies their organizations hope to sell to customers. This balancing act demands more of their time and energy now than at any other point in their careers, all of the executives said.Security affects all of it "When I look at the risks here at Symantec, I know that we have to maintain a multilayered approach to protecting our IT assets: our ERP data, intellectual property, customer data, and personnel data. Managing the risk around all of that is a significant responsibility for me and my team," said David Thompson, CIO at Symantec."We have multiple large pools of information that are critical to our organization, and we're seeing more of that data move further toward the boundaries, toward the end points," he said. "My job is getting more data into the hands of our business units, but that creates a lot of risk in terms of where it goes, who has access to it, and what they are using it for, along with the risk of it being exposed."Even Thompson, who ranks his ability to "eat Symantec's own cooking" -- or use all of its security and compliance technologies -- as a huge advantage compared to CIOs working in other firms, admits that trying to keep up with all of the threats and regulations, as well as all the new products, is an effort that can become all-consuming.The key to staying ahead of the attacks and laws, while not spending too much of his time focused on security, is delegating to a strong team of experts and prioritizing which projects to tackle based on their criticality to Symantec's business. "As a business leader and IT executive, if you take the view of trying to fix everything, you'll never sleep a wink. You have to assess risks, and just as we'll never be able to completely secure our borders in the United States, you have to prioritize efforts to reduce risk as much as possible," Thompson said. "CIOs themselves must have a team that can help carry a good portion of the load so that they can stay focused on business relationships, clearing roadblocks, and being the public face of that team."Among the most critical roles that any CIO or technology executive must play in aiding the efforts of their security staff is to drive high-level assessments of risk and figure out how their companies must strategize to complete projects that address the most significant threats and compliance regulations, Thompson contended. The most effective strategy, he noted, is to determine which projects most readily address specific threats or government requirements and focus on them, he said. Otherwise, a broad-brush approach to security will lead to unnecessary complexity and eat up all of your time. Thompson also noted that even with the latest security technology available to him, the security strategy is more important than just having good security tools.At IBM, CIO Mark Hennessy also stressed the importance of delegating to his team of security experts and of conducting near-constant risk assessment. But even with that delegation, security remains a top focus for him, he said. "The world is changing, and there are a lot of new realities around security to address. Fostering stronger security across the board is a core tenet, as it helps to bring more value to everything we do," he said. "We want to make our employees more comfortable and more productive, and drive greater success for the clients we serve, so it's something we constantly need to remain focused on," he added.The security-vs.-complexity challenge Malcolm Harkins, general manager of Intel's Information Risk and Security unit, works directly with the chip giant's CIO Douglas Busch on issues of internal operational security and compliance. Harkins said that one of the biggest challenges that organizations such as Intel face is the process of improving security in the face of rapidly advancing IT complexity.On top of that, ongoing efforts to lower the total cost of securing a company the size of Intel -- while keeping up with emerging threats and regulations -- is driving the firm to seek greater standardization in some areas, and to integrate larger groups of technologies in others. "We currently have over 40 individual security software and hardware providers that we are doing business with, and that's a lot of different pieces to have to integrate," Harkins said. "It's almost crazy from an IT standpoint, so we want to employ greater levels of standardization to help us with issues of consistency; we'll always have a very heterogeneous environment, but we really need a more consistent set of tools. The more standardization you have, the easier it is to make things more secure."One of the most crucial steps any company can take in terms of improving its security is driving understanding of the attacks and laws across their highest executive ranks and ensuring that leaders who become involved in matters of security maintain realistic goals and objectives, Harkins said.But that does not mean being heavy-handed in terms of the security levels demand, he noted. C-level executives who take an extremely conservative approach and desire to aggressively lock down all their IT systems may in fact do more harm than good, he said. "Some companies believe that by severely limiting the use of technologies that pose risks, they are improving their defenses, but the truth is they may just be creating a false sense of security," Harkins said."In reality, they are limiting the ability of their business to operate effectively and are increasing risk by creating barriers and policies that can't be enforced practically," he said. In IT, "you have to work with [C-suite] to change their approach from one that is focused on responding to fears to one that is focused on key controls that solve real problems. You have to have executive buy-in, but by taking the wider approach of considering legal, compliance, and security issues together, you will end up with stronger protection, lower costs, and less complexity."
527702
Plus: Google apps for your site, and HP's pretexting debacle.
242229
The need to defend networked electronic gear like PDAs and smart phones will drive anti-virus defenses away from the signature-based techniques of today and toward next-generation behavioral-based tactics.
266836
Across the security industry, experts are encouraging businesses to abandon piecemeal IT systems and data-defense efforts in favor of overarching risk management strategies.According to some customers, consultants, and vendors, the strategy is starting to prove particularly helpful in addressing issues of identity management and access control.Long identified by industry analysts as an area where businesses often end up "chasing rainbows" and getting involved in never-ending projects, experts contend that by adopting a risk-based model to drive identity management, customers' goals are actually being realized."When developing our architecture, it became very clear that one of the processes that was important to tackle before starting to change things in one region or business unit was to do risk assessment and integrate all the subjects related to access control," said Paulo Martins, enterprise identity and access manager at financial services giant ABN AMRO.In 2006, the banking company made a decision to rework its identity infrastructure as part of an effort to make access control an even more central focus of its enterprise security strategy.Rather than simply looking for a new technology to improve its standing, ABN AMRO found that by getting a fix on the areas of its business where controlling access to sensitive data was most crucial -- and then assessing the varying levels of efficacy within its existing operations -- it found a way to move its project forward faster and with a greater sense of direction."As companies get larger and the numbers of applications increase, and they grow through mergers and acquisitions, they find that they have different levels of maturity related to identity and access," said Martins. "We built our strategy considering all of these things. The first year was dedicated to process and access control reviews; the second year involved implementation of those processes and use of risk analysis for critical applications."Among the most valuable topics that ABN AMRO was led to consider as part of its process, he said, was where it made sense to automate identity-based control for its applications and where it did not.By gauging the number of users and criticality of the data involved in each area of its business, the company was able to set its priorities and get controls in place where the risk of information loss was most widespread or severe, said Martins.Using risk management to prioritize security As part of its project, ABN AMRO brought in consultants from PricewaterhouseCoopers (PwC) to help map out its areas of need and define where its greatest data and identity risks lay.Jerry Lewis, a principal and national identity management leader at PwC, said that his company is advising more customers to tackle their projects using a risk management strategy because it allows them to refine their plans and improve their security standing with greater alacrity."We're definitely seeing risk management becoming the next real extension of identity management," Lewis said. "Most large companies we see have spent a lot of time and money putting solutions into place to drive various requirements -- such as in addressing compliance regulations -- and once they have the infrastructure installed, they realize that they need to use more of a risk-based approach."Lewis said that more customers than ever are starting to adopt the risk-based identity management approach to get a better fix on handling applications and systems access from an enterprise-wide manner.Those companies' immediate goals tend to revolve around their desire to improve identity management reporting capabilities, and to create dashboards that garner metrics related to potential compliance audits, he said."People are looking at this issue from more of a broad perspective, based on regulatory drivers, and focused on very specific applications or needs," Lewis said."Doing so, these companies are able to take a step back and find out what they really need to address first," he said. "They want the company-wide view, but they're also realizing that they typically can't have a complete end-to-end solution across the organization that is one size fits all and that they need use this risk-based approach."As a result of the success that companies are having using the strategy, the consultant said that more customers have earmarked funds to buy products that apply the risk-based approach to identity during 2008.One of the vendors PwC works with in the space, and the software provider to ABN AMRO, is SailPoint, a startup founded in 2005 whose products are focused squarely on identity auditing and analytics as well as policy enforcement and the creation of automated controls.SailPoint executives said that customers are looking for a new generation of identity management tools that address the issues that will help them pass audits and give them more of a top-down view into where their organizations stand in terms of securing access."People began getting pressured to address issues of compliance and audit around Sarbanes-Oxley, but traditional identity tools were not designed to solve those problems, they were mostly about improving operational efficiency, and people have been stretching those technologies to do things they weren't designed to do," said Mark McClain, chief executive and founder of SailPoint."Most of these systems were initially designed to set up accounts and do password resets, but with compliance needs, it has to become more about governance and risk assessment," he said. "Customers are frustrated because they've spent all this money dealing with the terms of the regulatory audits, yet the breaches have continued because they haven't been able to address the real risks."
443241
Hewlett-Packard bolstered its security portfolio Tuesday, announcing availability of an identity management product for enterprises and a security management initiative for small and midsize businesses.
217789
HP&#39;s Virus Throttler technology, due early next year, won&#39;t be the killer app, the &quot;silver bullet,&quot; that will stop viruses in their tracks, Tony Redmond, vice president and chief technology officer of HP Services, cautioned Tuesday at HP&#39;s security event
986
While many companies compete in the IT security business, IBM is differentiating itself by going beyond the worm of the day to include peripheral threats to a company&#39;s IT environment.
742136
Hewlett-Packard has dropped plans to beef up its HP-UX operating system with new high availability and clustering technology it obtained in its 2002 acquisition of Compaq. The company will instead shift its development focus to new areas, as it attempts to convince customers that there is still life in its venerable Unix operating system.
459336
(InfoWorld) - Hewlett-Packard Co. (HP) is using streamlined IT management as a sales pitch for its latest line of PCs, including the first desktops to use Intel Corp.'s vPro technology bundle. A computer running the vPro bundle uses software and hardware -- including Intel's new "Conroe" Core 2 Duo processor -- to automate some aspects of IT management and network security. Intel plans to formally announce the platform Thursday, as Gateway Inc. and Lenovo Group Ltd. also start sellingÂ vPro-enabled desktops. HP got a jump on its competition, particularly arch-rival Dell Inc., by unveiling its new business line first. HP announced three new desktops, a workstation and six notebooks during a press conference Wednesday in New York City. Only the desktops offer the vPro option, while the other new PCs take advantage of the flurry of chips launched in recent months, including Intel's "Merom" Core 2 Duo for the notebooks and a choice of Intel's "Woodcrest" Xeon 5100 or Advanced Micro Devices Inc.'s (AMD's) "Rev. F" Next-Generation Opteron for the workstation. HP promised to make life easier for the IT managers who maintain these machines by pre-loading its OpenView Configuration Management agent on all commercial notebooks, desktops and workstations. That product has been an option in the past. OpenView will bolster Intel's Active Management Technology, an ingredient of vPro, allowing IT managers to make fewer time-consuming "desk-side" visits by booting and repairing PCs remotely, said John Snaider, HP's vice president for desktop PCs. Other business-friendly enhancements on the desktops include Trusted Platform Model (TPM) 1.2 security chips, a second hard drive for real-time data backup, and a virtual partition on the hard drive for encrypting sensitive data, said Brian Schmitz, director of desktop product marketing for HP. In contrast to its concentration on Intel-powered desktops, HP is selling the new xw9400 workstation as the AMD-powered peer of its xw8400 model. AMD-based PCs account for about one-third of HP's high-end workstation sales, since they are able to run certain Nvidia graphics cards that Intel cannot handle, said Jeff Wood, HP's director of product marketing for workstations. HP is selling the dc7700 desktop for US$643, plus a premium for the vPro option. The company will launch the dc5700 and dc5750, which will be available with either Intel or AMD chips, in the fourth quarter. The xw9400 workstation will ship later in September for $1,800. The notebooks include the HP Compaq 9400 for $1,299; 8400 for $1,449; nx7400 for $849; nc6400 for $1,199; 6300 for $799; and 4400 for $1,479. DetailedÂ information about the new systems can be found at Hewlett-Packard's Web site. Â
610535
(InfoWorld) - Last year's HP Technology Forum was chased out of New Orleans by Hurricane Katrina. This year, storm clouds of a different sort hang over the event. As an estimated 6,000 attendees converge on Houston for the annual Hewlett-Packard user conference, the subject on many minds is the one the company is most loathe to discuss: theÂ shakeup of HP's boardÂ and theÂ prospect of criminal chargesÂ related to a spying scandal. The California Attorney General and a Congressional committee are among the institutions probing HP's possibly illegal methods of investigating news leaks from its board. HP has until Tuesday to respond to an invitation from the Oversight and Investigations Subcommittee of the Energy and Commerce Committee for HP's Chairman Patricia Dunn and General Counsel Ann Baskins to testify at a Sept. 28 hearing in Washington. But at the Technology Forum, a gathering of HP user groups, partners and other vendors, HP is focusing on its business success, which is considerable. With revenue, earnings and stock price all resurgent in the last year, HP CEO Mark Hurd could rightly say, "Pay no attention to that prosecutor behind the curtain," when he delivers a keynote address on Sept. 18. In the quarter ended July 31, HP's earnings-per-share (EPS) topped analysts' estimates at $0.52 on 5 percent revenue growth to $21.9 billion, compared to the year ago quarter. Across many of its business lines, HP, of Palo Alto, California, has gained on rivals, said industry analyst Rob Enderle. HP personal computer sales have grown with its "the computer is personal again" marketing campaign, Enderle noted. IBMÂ sold its personal computer businessÂ to Lenovo Group, in 2005, and Dell has suffered negative publicity from the AugustÂ recall of 4.1 million fire-prone batteriesÂ in Dell laptops. In storage, HP closed the market share gap with EMC in second quarter numbers released Aug. 29 by research firm IDC. With EMC's 20 percent share, based on unit sales, to HP's 19.3 percent, the two are in a "statistical tie" said Brad Nisbet, an analyst with IDC. "HP has been executing well under new management," Nisbet said, referring to Hurd, CEO since March 2005. In servers, HP is a strong second to IBM, according to IDC market share numbers, but has made some errors, said Enderle. It still is using Intel's Itanium processor in its high-end Integrity servers, which rivals aren't embracing. Gartner research shows that 90 percent of the Itanium chips shipped in the first quarter of this year ran on HP servers; neither Dell nor IBM build Itanium computers. Technology Forum organizers get tight-lipped when the conversation shifts to the board scandal. "That's HP's business," said Nina Buik, vice president of Encompass, one of the HP user groups planning the event. "We're not focused on those issues unless it impacts the technology." And as long as the scandal doesn't touch Hurd personally, the customer satisfaction should be unaffected, said Crawford Del Prete, senior vice president of research at IDC. . "I don't think [the scandal] is a drag on the company's success," he said. "I have not found one customer who said 'I'm not going to do business, or I am concerned about doing business, with Hewlett-Packard as a result of this.'" HP Technology forum runs from Sunday to Thursday this week.
454721
By JORDAN ROBERTSON   Associated Press writer  SAN JOSE, Calif. -- Investors have largely shrugged off Hewlett- Packard Co.'s boardroom spying scandal, dismissing the brouhaha surrounding the company as immaterial to its day-to-day operations and stellar earnings growth in recent months.