Forrester security show stresses risk management
639121
(InfoWorld) - Enterprise security decision makers have long been more likely to be swayed by flashy new technologies than by the notion of comprehensive IT restructuring to protect data and other corporate assets, but the situation is evolving rapidly, according to experts participating in Forrester Research's ongoing Security Forum. Kicking off in Atlanta on Sept. 5, the two-day event will bring together a number of influential IT security consultants and researchers along with a range of vendors and end-users to debate pressing issues impacting enterprise businesses today. Whereas such technology meetings, including Forrester's inaugural 2006 security confab, have historically focused more on the acquisition of new technologies or the latest trends in malware, companies are finally beginning to spend less time on investigating individual attacks and defense mechanisms and more closely examining the idea of broad-ranging risk management, show organizers said. "There isn't any hot new technology being pitched at us these days. The process is less about shiny widgets than it is about cohesive programs that combine security and risk management," said Laura Koetzle, the Forrester analyst charged with pulling the event together. "For a long time, the power in the security industry has been in the hands of the technology providers," she said. "But as enterprise security programs are maturing, we're seeing a shift to more coherent strategies that emphasizes specific business needs." Koetzle said that the annual conference will have its fair share of security research reports on emerging threats -- including the latest on messaging security trends from specialists with Postini -- but the analyst highlighted increasing sophistication of the planned discussions, which focus on how companies can work with their customers and business partners to take a more organic approach to security. "Many people growing up in the security discipline have seen a lot over the last few years, and now they're focused on working with business partners both inside and outside of their firms to get a more holistic view of what they want to accomplish, versus blocking viruses and filtering," said Koetzle. "Today, security folks are much less likely to be a guy in a black hat in charge of some esoteric technology whom you never see, it's more about people who coordinate management strategy for companies and ensure that they have the right skills and partners in place," she said. The Forrester analyst contends that security professionals are also no longer forced to fight for attention among the ranks of IT with c-level corporate leaders having woken up to the fact that their companies' operations and reputations can be severely affected by data breaches and security gaffes. Among the scheduled speakers at the show will be representatives from IT vendors including Dell, Texas Instruments, and VeriSign, but Forester has also corralled customers from the financial services and healthcare industries to share their latest experiences. Along with a slew of Forrester's own experts, academic researchers from Johns Hopkins University and Purdue University are also slated to speak at the show. Representing Johns Hopkins will be Dr. Aviel Rubin, director of the school's Information Security Institute and a well-known expert regarding e-voting technologies and many of the issues that loom with the continued adoption of the systems. Rubin, who will also be representing his Baltimore-based consulting firm, Independent Security Evaluators, said that he will explain to show attendees how many existing IT products can still be broken by sophisticated hackers. "It will always be a fact of life that things can be broken and not always by the good guys who will publicize it, so it's important that people examine the way they handle incidents, and it's always good to encourage people to share their stories," Rubin said. However, the researcher said he will also focus on the process improvements that many companies have been able to appreciate as their security efforts have matured. "With the experience they've accrued, some companies, including vendors, are doing a better job of handling vulnerabilities and reporting," he said. "However, it's still useful to look at how things can still be circumvented and look at the measures that are being put in place to stop that sort of activity." Also presenting will be Brian Contos, chief security officer at security management specialists ArcSight and the author of the well-known insider threat tome Enemy at the Water Cooler. Contos agreed that the political battles that IT security pros needed to fight just to get attention and budget from business leaders have waned over the last several years and said that companies are getting far more aggressive in how they police their users and networks. However, that shift has also created new challenges, he said. "People want to monitor almost everything, but by adding more events, they are moving from megabytes of result information to terabytes and also trying to meld IT security efforts with physical security, which will be a long process," Contos said. "The main question we're hearing has become how companies can deal with this flood of data and turn it into something valuable, that's the challenge that many of these enterprise customers face going forward."
77766
&quot;It is easy for a CEO to say security is important,&quot; says Ernst &amp; Young partner Kent Kaufield. &quot;But in actuality, I think they view it much like purchasing insurance --something that is good
602642
As NASA readies the space shuttle fleet to fly again, the agency&#39;s risk management teams are also paying attention to risk issues that affect the International Space Station.
611545
IT managers say presentation and security are crucial when getting business intelligence information to the appropriate people over the network.
244506
Keeping tabs on your company's industry can help energize your portfolio's returns.
509718
InfoWorld - To judge from the number of announcements made at this week's RSA Conference, IT managers may need a defense against security software and hardware salespeople.
387210
(InfoWorld) - Technologies aimed at bolstering enterprise data protection remain tough to manage, but companies can derive significant benefits if they utilize the tools with a pragmatic approach, said security industry experts. A recurring theme among the consultants, technology makers, and customers gathered for the InfoWorld Enterprise Data Protection Forum being held in New York today was that the first step businesses looking to improve their information defenses must take is to locate and evaluate all of their truly vital records. Beyond that assessment process, having the ability to centralize efforts to drive data protection tools and strategies across their entire organizations is a key to their success, the experts said. From encryption technologies to DLP (data leakage prevention) systems, companies are faced with a range of alternatives for addressing their information management and security needs. Finding the right way to apply the various tools is one of the most crucial issues for most companies today in making headway with their data protection projects, industry watchers observed. "Unified management is the key; if you look at how you manage this process, you must have a top-down view into operations," said Phillip Dunkelberger, chief executive at encryption specialists PGP. "Most enterprises are trying to solve these problems with point solutions, but that's like playing whack-a-mole; you must look at this issue universally from protecting laptops to archiving and tape backup as well as in managing your custom applications." As external threats continue to evolve and businesses are presented with new security concerns like smaller, more powerful removable storage drives, IT security teams must try to adopt technologies that will allow them to take a more centralized approach, compared to individual point products, Dunkelberger maintains. The PGP executive unsurprisingly expressed his belief that the careful application of encryption technologies across an enterprise, among other tools, can provide just the type of top-down, metered approach he recommends. Installing and supporting all the various pieces needed to improve data protection remains one of the most challenging tasks for enterprises to handle, he said. "Operations teams have to make these systems work, and work cost effectively -- they need to know who to report to if there is a breach and how to respond to it," said Dunkelberger. "If you think about the future, there is a need to be more transparent to gain customers and at the same time protect their information; there's a need to shift thinking and methodology," said the CEO. "We can't do the same work over and over again. We need to take the opportunity to look at new technologies and sit down with our business partners to advance a plan." Other experts speaking at the conference said that enterprises are finally realizing that they can no longer focus on perimeter defenses alone to protect their sensitive information and that customers are getting a grip on the notion of defending data assets and intellectual capital versus merely attempting to better lock-down their networks. Gerrit Nel, global data security solutions and services development manager at IBM's Global Technology Services group, said that companies should focus on employing endpoint-based technologies that can handle DLP and other security policies. "It's better to return to the approach of addressing things at the endpoint and then building protections back into the network," said Nel. "Companies need to start looking at the value of the entire data chain; there's a need to get rid of the user aspect of data governance and inform people what they can and cannot do. Endpoints can be multi-user and data can be saved on removable devices, and there's a need for solutions to protect and encrypt data there as a result of those factors." While many enterprise customers already complain that they have too many endpoint-based technologies in place that create management complexity issues, companies should reconsider what they have installed and look to apply newer tools that offer the same type of centralized management espoused by PGP's Dunkelberger, Nel said. Another emerging concern for managing data protection is the emergence of SOA strategies within many areas of enterprise IT, said the expert. Having the ability to push governance policies across those systems will be one key to allowing for the benefits of SOA in the future without creating new security hazards, Nel said. "Many of the solutions we see today are based on SOA-type architecture and exploit Web services, so we recommend that when looking at solutions companies ensure that they can integrate those applications with their existing business applications and feed their policies in," he said. "Look for vendors that can really help solve these problems and not just point solutions aimed at addressing one part of the process."
319346
InfoWorld - IBM is aggressively expanding its security portfolio in hopes of becoming the de facto source of advice and technology for businesses looking to adopt high-level IT governance and risk management strategies -- a transformation among customers that officials at Big Blue cite as both ongoing and inevitable.
511321
One in four corporates plan to ditch maintenance contracts - Forrester Microsoft has hit back at criticism that its Software Assurance maintenance contracts offer poor value for money and may be dropped by many enterprise customers.â¦
524147
(InfoWorld) - For years, Roy Bordes has been attending corporate security conventions, at which exhibitors push video surveillance, alarm systems or bullet-resistant glass. But since the terrorist attacks against the U.S. on Sept. 11, 2001, the American Society of Industrial Security's (ASIS) annual convention "has become a much more serious show,â said Bordes, a regional vice president for the trade group. The ASIS annual convention opens Sept. 25 in San Diego. Most of the 20,000 expected attendees, who make enterprise security buying decisions, are evaluating new applications to protect both their physical and virtual assets. There's a growing convergence of network, physical and building security functions, Bordes said. Enterprise spending on converged security projects in the U.S. and Europe is forecast to reach US$11.2 billion in 2008, from just $1.1 billion in 2005, according to Forrester Research Inc. Companies are deploying the fingerprint scanner technology that can admit employees into the building and allow them to log onto their computer, said Bordes, president of The Bordes Group Inc., a security consulting firm in Orlando. Converged network and physical security is getting C-level management attention, too, said Michael Corcoran, president of the California University of Protection and Intelligence Management, in San Jose, which confers degrees in intelligence management and management of personal protection. Some graduates become a company's chief security officer, guarding executives, protecting the building and, increasingly, also the computer network, Corcoran said. âThe CSO could be from the physical-security side or the network-security side. [Companies] want someone who is well-rounded in both areas,â he said.
19923
Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
294488
Experts will rate potential severity of business security threats.
53008
Money managers are betting on what has often been a riskier segment of the market: growth stocks.
185091
The plethora of security technologies on the market is enough to overwhelm even the most knowledgeable IT managers, but in sorting through all of the options, it may be helpful to look at what is not needed.
670395
(InfoWorld) - Trying to lock down your company's applications and protect your systems from attack? If so, security scanners and source-code analysis tools are not up to the job -- despite vendor claims to the contrary. "There's an awful lot of marketing spiel, people introducing technology tools that are sold as silver bullets," said Mark Curphey, vice president of professional services at McAfee's Foundstone division, in an interview. "The reality is, in a large enterprise, those things generally don't work." "Technology is increasing at such a fast and crazy pace, but security technology isn't keeping up with it. With application security it's even worse," Curphey said. Security tools, such as code scanners, are able to detect just 1 percent to 2 percent of vulnerabilities in an application, leaving "gaping holes" behind, he said. Curphey, who has worked on security for U.S. financial institutions, is speaking this week at the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia. Software vendors and companies must get back to basics to secure their applications. "What the smart banks are doing about this is they're building security into their development life cycles and that's exactly what Microsoft has done," he said. Since being hit by a series of high-profile vulnerabilities in its software, Microsoft hasÂ significantly improved the securityÂ of the software it produces, resulting in fewer critical vulnerabilities being reported. "Microsoft are going to be the security vendor of choice in the next couple of years," Curphey said. "There's been a phenomenal turnaround in that company." While a company's IT systems may never be perfectly secure, IT managers should be able to identify and mitigate risks. "At the end of the day, security is about building something that's secure enough to do business on," Curphey said. To help protect their systems, companies need to be sure they are hiring IT staff with the right set of technical skills, setting business processes that determine how to respond to attacks on the system, and providing staff with the tools they need to respond when attacks happen, he said. HITB runs through Thursday, Sept. 21.ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
227769
CLEVELAND, OH -- As NASA (news - web sites) readies the space shuttle fleet to fly again, the agency&#39;s risk management teams are also paying attention to risk issues that affect the International Space Station (news - web sites).
555867
OCTOBER 25, 2004 (IDG NEWS SERVICE) - IBM today introduced a security service that offers a concise, monthly global-network threat report designed to help organizations assess security needs and vulnerabilities from a business perspective.