RSA CEO: Beefed Up Security Needed for E-Commerce to Succeed
606532
Better IT security and identity management is necessary if online commerce and e-government services are to succeed, RSA Security chief executive Arthur Coviello said.
413156
On a European tour, the CEO weighs in on threats ranging from Linux and EU regulators to music pirates and "bad people out there in cyberspace."
70508
Side-channel code break Security researchers have developed a new approach to breaking the RSA algorithm that creates new problems for the development of effective rights management software.â¦
211005
John Becker, the CEO of newly formed Cybertrust Inc., talks about the company's plan to deliver a range of risk management services for enterprise users.
575560
(InfoWorld) - It's been more than two months since EMC officially exchanged rings in the $2.1 billion courtship of RSA Security, but former RSA chief Art Coviello says the honeymoon's still going on, and that he's happy to take a step down from the CEO's post â¦for now. In a wide-ranging discussion with reporters over dinner in Boston on Wednesday, Coviello, the charismatic chief of RSA for more than a decade, said that he expects to stay on at EMC for at least the next few years, as he makes good on a promise to EMC CEO Joe Tucci to grow RSA into a $1 billion a year company by 2009. Tight integration with EMC's product line is a key element of that plan, such as embedding RSA's access management technology into EMC's Documentum content management system. "Customers are craving integrated solutions," he said.Â Â Â  EMC pushed RSA along towards meeting that goal by acquiring security event management vendor Network Intelligence on the same day that it closed its acquisition of RSA. Together with RSA's traditional strength in data encryption, the Network Intelligence software will be a key element of the EMC Common Security Platform, which will integrate core services authentication, auditing and authorization across EMC's product line. That $175 million buy would have been beyond the means of RSA, which reported total revenue of $181 million through the first half of 2006, especially after the Cyota and PassMark acquisitions. Network Intelligence will add around $20 million in revenue to the RSA division's bottom line this year, and double that next year, Coviello said.Â  Coviello is also banking on strong growth in demand for consumer facing "adaptive authentication" technology that RSA acquired from Cyota (Findit/4311) in December, 2005, and PassMark Security in April (Findit/4312). That business has been growing at about 100 percent annually, from $11 million last year to around $30 million this year, and Coviello expects that growth trend to continue for a least a couple more years, as banks and other financial institutions get in line with guidance from the Federal Financial Institutions Examination Council (FFIEC) to beef up user protections in online banking portals (Findit/4756). Coviello is also looking to expand the value of those acquisitions with offerings like a risk assessment service that could be sold to banks and financial services companies and that leverages the phishing and online crime intelligence collected by RSA's Cyota team in Israel. RSA researchers are also working on applying fraud intelligence, like that used by Cyota, to data flows within an organization in an effort to spot anomalies that may reveal insider threats, Coviello said. But the former CEO said he's seeing opportunity everywhere these days, as the EMC name opens doors that were previously shut to accounts across verticals, but especially in banking and financial services. Executives who saw RSA as a secure token vendor a year ago now see the company's technology as a strategic investment, when coupled with EMC, he said. Those accounts were hard to win before EMC entered the picture, and Coviello admitted that RSA's PassMark acquisition was more about getting a foot in at major financial institutions like Bank of America than about the PassMark technology. Reflecting on the first quarter since 1992 that he hasn't had to face Wall St. analysts for an earnings call, Coviello said that he felt as if he had "traded nine board members for one (Tucci)." "In some ways, I'm more independent than when I was CEO and had a board of directors, where there's a lot more scrutiny of operating costs and profitability," he said. Coviello claims that he's been given free reign to use the RSA division to develop security solutions independent of EMC's product lines, even while it leverages EMC's infrastructure, customer support and professional services groups -- not to mention the company's $6 billion war chest for future acquisitions. And with that kind of bankroll, future acquisitions are definite possibility. Coviello estimated he spent around 30 percent of his time vetting possible purchases, and that another mega-purchase along the lines of RSA weren't out of the question, though they'd have to be "compelling." But, once a CEO always a CEO. Asked whether he could be happy staying on as an Executive Vice President at EMC, Coviello said he "didn't know about that," but waxed philosophical.  "When I was 30, my goal was to be a CEO by the time I was 40. I don't think like that now. I know what I'm going to be doing for the next couple years."
325194
The annual RSA Conference kicks off this week with keynotes from industry luminaries Bill Gates and Larry Ellison.
320458
Web servers may be vulnerable to attack, security company warns.
632565
As malware threats and regulatory compliance demands continue to grow more complex, IT will become increasingly dependent on SaaS (software as a service) offerings that let them respond to problems faster while also saving money, according to top executives at the world's largest anti-malware vendors.In addition to continued adoption of managed security services delivered on- and off-site by professional consultants, IT customers will be able to resolve some of the problems they have with existing IT systems defense and compliance automation tools by shifting away from on-premise technologies in favor of adopting more hosted applications, vendor executives contend.While security technologies such as end-point protection suites and IDS (intrusion detection systems) will likely always require the use of software agents that reside on customers' devices and network infrastructure, vendor executives claim that a range of technologies, including exploit-prevention tools and compliance-monitoring filters, will gradually move to the SaaS model.As a result, providers such as McAfee, Symantec, and Trend Micro, among others, are already ramping up their SaaS portfolios to adapt to the shift."We believe that [SaaS] is the wave of future, and we already deal with the issue of updating tens of millions of machines remotely multiple times per day in multiple geographies. It's one of most complex things to do in all of technology, and one of the most impressive assets that I think we have," said David DeWalt, CEO of McAfee."IT budgets are not growing, but the threats and regulatory demands are, and customers are finding themselves thin on resources. SaaS will be a great way for businesses to save on infrastructure and maintenance costs while improving protection," said Jeff Hausman, Symantec's senior director of product management. "There's no question that the hosted model is growing dramatically."McAfee expects a SaaS transition over time Building on the infrastructure that vendors such as McAfee have already established to distribute anti-malware signatures and other product updates to their customers, the companies will add new SaaS offerings incrementally as customers warm up to the ideal.The security software providers themselves must also figure out the appropriate mix of on- and off-site tools, as well as refine pricing policies for the services over the next few years, CEO DeWalt said.However, DeWalt recognized that the process of designing and delivering SaaS products -- and selling customers on their benefits -- won't be achieved overnight. "It's a very complicated technology project, sometimes not even related to development of our own technology, but based on the IT infrastructure needed to deliver SaaS as effectively," he said. "We've learned a lot through our experiences building [anti-malware] products for the consumer and small-business markets, and we'll use those lessons to move into the SaaS business over time."As part of its move into SaaS, McAfee announced the acquisition of ScanAlert, a provider of hosted e-commerce Web site security services, for $51 million in October 2007. The company will consider additional deals in the area if there are targets that can aid in its development of the business, DeWalt said.Trend Micro, others see Intelligence in the cloud Along with e-mail filtering services -- one breed of security SaaS application that has already proven a hit with customers of companies such as Postini, which Google acquired for $625 million in July 2007 -- vendor executives contend that hosted tools used to provide end-point and network security management services will be among the first to find favor with IT and end-users.Trend Micro CEO Eva Chen said a growing number of the firm's small-business customers are already using its Remote Manager hosted tools to maintain configuration of their security programs and prevent their end-point systems from being altered by malware programs such as rootkits."We began quietly moving forward in this direction several years ago, but I believe 2008 will be a big year for SaaS development, not only because of vendor initiatives, but because of the need to deal with new threats among customers," Chen said."We think that there will be a need to move anti-threat knowledge from the customer into the cloud," Chen said. "Instead of having them download a virus pattern file, we will filter things and compare them to intelligence in the cloud, and then go to the end-user and update them without having to download the larger files used today."Keeping the channel involved Established SaaS applications in other markets, such as Salesforce.com's hosted sales-force automation tools, have traditionally bypassed resellers and other channel players and instead been provided directly to customers by vendors themselves. That may not be the case for SaaS-delivered anti-malware, Chen said.The reason? Even though SaaS tools are meant to alleviate many of the management concerns related to traditional on-premise products by handing the responsibilities back to the vendors, channel partners will be important in providing any services necessary to help users transition to the delivery model, or to customize the applications to individual business environments and provide any needed support services, Chen said.Symantec, which has pledged to turn as many of its products into SaaS offerings as it can do profitably, has also promised to keep its resellers in the loop as its brings new hosted services to market. Most customers adopting SaaS services will still consume traditional security products, leading the company to pursue a hybrid strategy that mixes the two disciplines, said product director Hausman."We have the infrastructure to provide the service, but resellers will still maintain a lot of the relationships," Hausman said. "We're the brand behind delivery to the customer, but the partner is still the same name and face that customers have grown comfortable dealing with over time."Diverse opportunities Symantec's maiden foray into SaaS is its Protection Network online secure backup service aimed initially at smaller customers, hundreds of which are already piloting the offering, according to Hausman. But Symantec is preparing several other hosted products for release.E-mail security is one area where Symantec sees SaaS opportunities, built on the success of acquired companies such as Postini. Other services that the company is pursuing might come as a surprise, including its bet that elements of DLP (data leakage prevention) and compliance monitoring can be moved to the SaaS delivery model.Vontu, the DLP gateway specialist that Symantec purchased in November 2007 for $350 million, didn't have a SaaS offering under development, but Hausman believes that under Symantec's wing, the unit can create new capabilities by tying some of the on-premise capabilities of its technology with in-the-cloud services for message filtering and archiving.Other opportunities for SaaS will emerge around anti-virus protection, security policy management, remote systems management and IT continuity protection, he said.
383169
Grid architecture aims to protect corporate networks from interior security threats.
402591
Question: We're in the early stages of startup and beginning to shop for technology. We'll need basic hardware and software, plus many other technology and Web-based services to sell online, service customers and keep it all secure.
713463
Threats to data security are mounting, especially from within organizations, but top executives aren&#39;t helping their companies keep pace, a new study has found.
99929
Thinks big RSA Verisign will spend $1bn during the next three years beefing up its internet infrastructure following this week's high-profile root server attack.â¦
373176
Security researchers find easy pickings at the RSA security conference, where the public kiosks let anyone install any software they want.   In 27B Stroke 6.
189139
(InfoWorld) - Banks, online merchants, and technology vendors must work together to prevent security problems like phishing attacks and data breaches, eBayÂ President and CEO Meg Whitman said Thursday. Whitman called on large e-mail service providers, such as Yahoo and Microsoft, to reject e-mails supposedly coming from eBay or subsidiary PayPal that do not include domain key signing authentications on them. EBay now puts the digital signatures on all the e-mail it sends, amounting to "billions" of pieces of e-mail a year, Whitman said at a Visa USA security summit in Washington, D.C. Phishing attacks, in which a scammer sends fake e-mail to entice recipients into giving up passwords and other information, remain a major concern at eBay and PayPal, Whitman said. No longer the domain of small-time crooks with bad grammar, phishing schemes are becoming sophisticated tools of organized crime, she added. Even those customers who recognize phishing schemes can get disgusted and stop doing business with the targeted businesses, she added. "It erodes the trust we've tried so hard to build," Whitman said. "We need to make it so hard for the bad guys that they ultimately think it's not worth their time to mess with our customers." Whitman also called on banks to share information about known scams and data breaches more quickly with third-party payers like PayPal. In many cases, banks share the information with each other immediately, but it takes "days or weeks or months" to reach businesses like PayPal. With faster information sharing, more scams could be prevented instead of dealt with after the fact, she said. The eBay online auction model works because most people are basically good and not out to scam others, Whitman said. However, Internet scammers continue to look for new ways to make money, she said. "Security on the Internet is actually an arms race in the classic form," she said. Earlier in the conference, Visa USA President and CEO John Philip Coghlan told the audience of more than 400 business, government, and academic leaders that payment security must become more of a strategic priority for businesses. All organizations involved in the payments system need to invest in security, he said. Maintaining trust is "emerging as one of the critical business issues of the 21st century," Coghlan said. Visa is working on pilot programs to protect card security, including encryption and dynamically generated authorization information on payment cards, he said.
200791
Blog: At eBay Developers Conference in Boston, company executives talk about their strategy for building a "commerce operating system."
729053
Even site keys aren't good enough if clever hackers take over a transaction via emerging techniques such as 'man-in-the-browser' attacks.
446418
(InfoWorld) - Oracle Corp. has always made bold claims about the security of its database and applications. Now the company has said it will make security a priority as it begins rolling out its next-generation software products for building service-oriented architectures (SOAs), Oracle Fusion, in the next several years. Speaking at an event in New York on Wednesday, Oracle President Charles Phillips outlined three areas of security that will be important to Oracle going forward -- access control, data privacy and compliance. Acquisitions and internal product development over the last 18 months have given Oracle a comprehensive portfolio in this area, allowing the company to think of security "holistically" across its product line, he said. "We take it pretty seriously," Phillips said. "We [are putting] security where it belongs, which is consistent across the architecture." Oracle has had its ups and downs when it comes to security. The company is infamous for a 2002 marketing campaign in which it called its database "unbreakable," a notion that was proven wrong by security researchers. While Oracle's database has not been the target of a widespread attack, security experts point out that it is also in a less vulnerable position than many commonly targeted programs. Oracle databases are embedded so deeply in a network's infrastructure that attacks aimed for it are thwarted by technologies closer to the surface, such as firewalls. The true test of Oracle's security will come when it begins opening up its products to allow for SOAs, which enable applications to communicate via Web services standards across disparate systems. "Adding Web services to an architecture makes everything often more insecure because you add an additional way into the database," said Alexander Kornbrust, chief executive officer of security consulting firm Red Database Security GmbH. "Web services should be designed and developed very carefully." Beginning in March 2005, Oracle began a string of purchases to bolster its security portfolio. In March the company purchased Oblix, which has access-management software. Then last November, Oracle acquired Thor Technologies for identity provisioning and compliance software and Octet String for identity virtualization software. The company is combining these acquired technologies with new software it developed internally: Database Vault, which prevents the database administrator from accessing sensitive information stored in an Oracle database, and Audit Vault, a data warehousing product to keep track of data stored in various places. The former is available now, while Audit Vault will be available in the next few months, said Thomas Kurian, senior vice president of server technology for Oracle. Together with existing products such as Oracle Identity Federation, the products help shore up a strong portfolio for protecting data across multiple applications and systems in the network, he said. Oracle has these products now, but they will become increasingly important as SOAs become more prevalent and Oracle rolls out its Fusion architecture over the next couple of years, Kurian said. "We'll be making sure at each level of the application, you have common policies that are enforced," he said. "No matter where you come in [on a network], you can still access security." Charles Kolodgy, an IDC security analyst, called Oracle's presentation on Wednesday "a little underwhelming," but said the message the company was trying to send is important. "Many of their customers are not aware that Oracle has security offerings to help customers manage identity, data protection and compliance," Kolodgy said. "They have been know for building security into their products, but not for building security products." However, despite the rosy picture Oracle paints about its past and future security strategy, it's something customers have traditionally been less than happy with, Kornbrust said. New products like Data Vault and Oracle Transparent Data Encryption -- which encrypts database data and stores the encryption keys in another location -- show the company is taking security more seriously, he said. But Oracle has a long way to go before it gets it right. "They are not doing enough helping customers to make their database secure," Kornbrust said. "The patches are still ugly ... Selling new -- and expensive -- high-end features is good but doesn't raise the bar for the normal Oracle security. Most databases I see are vulnerable in most cases." Still, said Kornbrust -- whose firm handles Oracle security exclusively -- those responsible for securing Oracle infrastructure "appreciate the direction Oracle is taking in the last month." However, it will take at least two to four years for most database administrators and developers to see results of the changes taking place now, he said.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.