DataPower Undergoing Common Criteria "EAL4 Assurance Level"  Evaluation
633070
DataPower announced that is the first Web service security vendor to undergo Common Criteria &quot;EAL4 Assurance Level&quot; evaluation, an official, unbiased third-party evaluation criteria for IT security procedures that is recognized by the US government and 15 other countries.
430359
LicenseWise and Windows Vista Hardware Assessment help users navigate Microsoft offerings.
45575
JBoss Application Server 4.0, middleware recently certified for J2EE, is ready for enterprise production deployment, according to JBoss.
693226
A new Web Services for Management (WS-Management) specification edited by Alan Geller (Microsoft) has been published. This initial joint publication of the specification names Advanced Micro Devices (AMD), Dell
379446
Red Hat Linux's latest security certification, EAL4 Augmented with ALC_FLR.3, puts its security on par with that of Trusted Solaris and potentially gives the OS entree to those government agencies requiring extreme multilevel security.
558377
The Early Access Program (EAP) is a free program that gives any developer an opportunity to take advantage of new features and network enhancements prior to general availability of the next release of Grand Central's Business Services Network.
311136
(InfoWorld) - Security experts working on the CWE (Common Weakness Enumeration) project claim that the initiative to create a central resource of software vulnerabilities for developers is gaining momentum. Sponsored by the Department of Homeland Security (DHS) and maintained by a team of workers at nonprofit Mitre and other security professionals, the ongoing effort is roughly four months shy of publishing a final draft of its vulnerability encyclopedia, said leaders of the project. Presenting at the ongoing Black Hat 2007 conference, CWE initiative leaders said they are busy aggregating and organizing the mountains of vulnerability data they have gathered and said they are working more closely than ever with applications security testing companies to help compare the abilities of various software scanning tools. Launched in Dec. 2005, CWE seeks to establish a unified, measurable set of software flaws to help developers improve the quality of their products and drive out the types of vulnerabilities that have led to the ongoing malware explosion. By gathering input on commonly seen mistakes from developers, researchers, and security vendors, the group believes it can create a common language and standard procedures for handling the many different types of loopholes that exist in programs' source code today. Prior to the delivery of a final draft of its encyclopedia of flaws later this year, CWE officials said they are preparing a sixth iteration of the index to likely be published some time in April. While much of the work the group has completed thus far has revolved around the gathering of vulnerability formats and the various methods used to identify and remediate the coding problems, the project has recently involved a significant amount of testing of security scanning tools to get a better idea of the capabilities and limitations of those products. By gaining an understanding of the vulnerabilities that popular code scanning engines can find --Â and those they can't --Â CWE can help developers understand the types of issues they will need to look for on their own, said Bob Martin, a CWE leader and the head of Mitre's related CVE (Common Vulnerability Exposures) Compatibility effort. "We wanted to evaluate what the tools claim to cover and what they are most effective at finding," Martin said. "Right now, best test is to throw tools at a big pile of code and see what tools find the most vulnerabilities, but we're changing that paradigm into test cases where we now look at the answers so we can evaluate what the tools found and what kinds of complexities they can handle." CWE's research will not list the names and performance results of the products it is testing -- provided by over 20 firms, including Cenzic, Fortify, SPI Dynamics, Veracode, and Watchfire -- but the work to compile a resource that offers developers an idea of the types of vulnerabilities missed by the tools should provide a great deal of value, Martin said. Officials with the project said that they have been pleasantly surprised by the variety of methods employed by the commercial scanning tools and the different types of flaws found by the various products. Going into this phase of the research, the group expected to find that many scanning systems identified the same types of issues, said Sean Barnum, director of knowledge management at Cigital, a software quality assurance company. The tests also revealed that the products were looking for only 45 percent of the 600 common vulnerabilities that have already been entered into the CWE index. "We found that less than half of what we already have in CWE is covered by these tools, so this helps prove that there are a lot of known issues out there that aren't being addressed," Barnum said. "We also thought that the tools would look for the same types of things, but they are actually very different, and there's not a lot of overlap; that's something that developers need to be aware of as they choose tools; you want to right set for aggregated coverage." Before each release of CWE, workers with the project spend much of their time comparing all the vulnerability definitions and mitigation taxonomies in the index, attempting to refine the language used in the descriptions and add real-world examples of attacks that target the flaws. That work is continuing and will remain the primary focus of CWE's efforts going forward, officials said, including work to de-emphasize nomenclature that describes common problems based on the attack methods used to exploit them. Barnum said that at this point, the encyclopedia isn't as polished as it might be, but he observed that he and other project organizers believe that taking an all-inclusive approach is the best strategy for expanding the resource at this point. "It's still a kitchen sink approach, but that's a smart approach," Barnum said.
262450
Written by Net 4 Nowt AssetMetrix, an on-demand IT AssetIntelligence service, today announced a series of new reports that identify specific applications and hardware within a corporate infrastructure that may no longer work properly after the
545454
New on-site auditor is fresh out of college and following a script, and he wants to make sure this data center is operating 24/7. Pilot fish assures him that it is -- but the auditor wants proof.
160182
Storage Expo WORM and a spec for LTO-4 due this year
443455
The U.S Department of Energy (DOE) is stressing incentives over regulations to improve the energy efficiency of datacenters.
100727
DataPower announced its demonstration of real-world Web service deployments with customers utilizing WS-Security and SAML for federated authentication and authorization across domains to partners and customers.
293837
(Source: Oracle)  Hyperion's 2007 survey of requirements for business intelligence and enterprise performance management soltuions revealed the differences in requirements, evaluation criteria, and purchase influencers between emerging businesses and large enterprises. Learn more in this new white paper.
203176
(InfoWorld) - In separate SOA-related announcements this week, BEA Systems is upgrading its repository while HP is adding to its roster of "SOA Competency Centers." BEA is introducing a BEA-branded version of the former Flashline repository, gearing it to SOA environments. BEA acquired Flashline in August. The BEA AquaLogic Enterprise Repository 2.5 is intended to assist customers with governance in SOA, specifically in dealing with managing IT assets in these architectures. Information is maintained about Web services types and definitions, service dependencies and ownership of services, said Paul Patrick, vice president and chief architect for AquaLogic at BEA. New features include support for XPDL (XML Process Definition Language) and support for the BEA WebLogic Server 9.2 application server. XPDL is used for business process assets management. "The real business value that [XPDL] brings is you can connect the business process management activities with SOA activities," said Charles Stack, BEA vice president of engineering. While SOA deals with Web services, WSDL, and schemas, business process management is concerned with business processes and workflows. WebLogic Server 9.2 features zero-downtime capabilities, although this was first offered in the Version 9.0 release of the application server, according to BEA. BEA's repository also can run on the IBM WebSphere and Apache Tomcat platforms. HP, meanwhile, is expanding its SOA Competency Center program, with the company planning to open facilities in Cupertino, Calif.; Singapore; and Bangalore, India. The Cupertino and Bangalore facilities open on Monday; the Singapore site opens next month. The company in 2005 opened its first SOA Competency Centers in Sophia Antipolis, France, and Tokyo. HP bills the SOA Competency Centers as "comprehensive experience centers" enabling customers and partners to evaluate SOA technologies and implementations. HP capabilities in IT architecture, management, security and governance are showcased at the centers. Customers at these facilities participate in executive briefings, discovery workshops, and demonstrations and learn about horizontal and vertical solutions for SOA, said Terri Schoenrock, executive director for SOA with HP Services Consulting and Integration. Partner technologies also are featured and proofs of concept are developed. "For our customers, one of the key questions around SOA is, is it going to work for me in my environment?" Schoenrock said. HP anticipates the three new facilities will host hundreds of visits per month. The centers are part of HP's $500 million investment in SOA, HP said. To HP, SOA is "an architectural approach to business services that a customer uses to really achieve a business initiative," said Schoenrock. Concepts such as loose coupling, reusability, discoverability and service composition are considered critical.
739905
A discussion of four of the kernel features needed for mission-critical server environments, including telecom.
579858
Chip power has increased dramatically in the last few years, thanks to new multicore processors from Intel, AMD and other chip makers. The problem is, software developers who understand how to utilize the new hardware are in short supply.
61931
A handy list of rules One of the major discussion points at Bloor Research's recent conference on "Data Warehousing: the rise of the appliance" was a discussion of the rules (though they might equally be regarded as reference points rather than rules) that might apply to data warehouse appliances as opposed to enterprise data warehouses.â¦