Mazu scores VC lifeblood from Symantec, others
618563
Mazu Networks, the Cambridge, Massachusetts, network intrusion prevention system (IPS) technology company, has secured another round of venture capital funding, including a stake from security software giant Symantec.
198820
Thinstall hops into fat wallet All the investor capital jingling in VMware's pockets has given the virtualization giant a healthy appetite for acquisitions. VMware said today it's planning to buy Thinstall, an application virtualization software firm based in San Francisco for an undisclosed sum.â¦
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
155693
CAMBRIDGE, Mass., May 29  /PRNewswire/ -- Mazu Networks, the leading(1) provider of Network Behavior Analysis (NBA) systems, today announced the final white paper in the company's series on the network operations benefits of NBA.
453972
Symantec Corp.'s reported interest in acquiring Veritas Software Corp. for more than &#36;13 billion would represent the computer security giant's biggest step yet beyond its core businesses of defending against viruses and thwarting hackers. Investors weren't impressed, though, and Symantec's shares plunged 16 percent.
546807
TechWeb - The company&#39;s technology includes software for agent-less deployment of physical and virtual machines from a centralized deployment library; and VM management support.
416302
(InfoWorld) - Symantec published a series of four research reports on Feb 28 that critique various security elements of Microsoft's new Windows Vista operating system, including the software's ability to ward off existing malware threats. Unsurprisingly, the security software maker, which still derives the bulk of its revenues from the estimated $3.6 billion market for technologies used to defend Windows computers, found a fair number of shortcomings in the latest iteration of Microsoft's dominant OS. One of the biggest problems is that Vista remains vulnerable to existing malware attacks designed to take advantage of flaws in earlier versions of the OS, according to the reports. However, the Cupertino, Calif.-based antivirus market leader also highlighted a number of features built into the product that it said will advance end-user security. An area where Symantec researchers said Microsoft has greatly improved security is related to the mitigation of virus attacks aimed at code-level vulnerabilities. Previous versions of Windows have been shipped with scads of coding errors that allowed hackers to deliver malware threats, but work on the part of Microsoft -- such as through its Security Development Lifecycle program -- has helped lower the volume of available vulnerabilities, according to the reports. The immediate benefit to Vista users will be the reduction of threats that use common infection techniques like buffer overflows and heap manipulations to deliver their payloads, Symantec predicted. Another area where Symantec recognizes security improvement on the part of Microsoft is in the use of its reduced user privilege model in Vista, which is aimed at preventing virus attacks from upping the administrative status of infected PCs to boost malware proliferation and related damage. While arguing that there may be the ability for hackers to disable Vista's new User Access Control, which is designed to keep users abreast of any changes attempted on their PCs by unknown software programs, Symantec concedes that the security tool should help fight malware attacks, including worm viruses. Despite the praise and its submission that Vista thus far appears to be the safest operating system ever produced by Microsoft, the Symantec reports levels a great deal of criticism at many other aspects of the OS. Vista is a more secure product than previous versions of Windows, but there is still plenty of need for users to buy the layered security defense products the security company markets, said Ollie Whitehouse, a researcher with Symantec's Security Response team. "Vista is a security evolution, but not a revolution," Whitehouse said. "Microsoft did invest a lot of time and resources into the development of Windows XP SP2, and Vista is a continuation of that, and they addressed a number of core issues, such as buffer overflows, but it is still only an OS, not a security solution itself." Vista may help stop some traditional types of attacks, such as worms, but Symantec maintains that newly emerging threats, integration problems with third-party Windows applications, and a range of other issues will keep users in the market for additional security tools. One area that remains a sore spot from Symantec's perspective is Microsoft's use of new features to protect the Vista kernel against root kits and other attacks. In 2006, a major controversy broke out between the two firms and other security technology providers based on the fact that Vista's PatchGuard system, available only in 64-bit versions of the OS, prevents any programs -- including Symantec's security applications -- from patching the software's kernel memory. Symantec and rival McAfee, among others, argued at that time that not being allowed to access the kernel as they have in prior iterations of Windows would prevent their advanced behavior-based technologies from working properly. But Microsoft and the security firms claim to have solved the problem using a set of APIs. In the research reports, Symantec repeats its contention that PatchGuard may also be easily bypassed, defeating its very purpose and allowing kernel-altering attacks, including root kits, to live on. Labeling the combination of PatchGuard and two other Vista kernel protection technologies, known as Driver Signing and Code Integrity, as a mere "bump in the road" for attackers, Symantec said that a single researcher bypassed all three features in one week's time, further proving their vulnerability. "Microsoft has made good strides with kernel protection, but again, it's not perfect," Whitehouse said. "PatchGuard has and will be broken, and while it is obviously better than nothing, people who have an interest will find ways to get around these features." Another area where Symantec leveled criticism at Microsoft is in relation to Vista's ASLR (Address Space Layout Randomization) feature, which is designed to help obscure programs stored in the operating system's memory to make it harder for attackers to isolate vulnerabilities. Symantec said the feature has a flaw that prevents it from working properly. Here again, Symantec mixed praise and calls for concern in outlining its observations of ASLR. "When implemented correctly, this technology is extremely effective in mitigating the exploitation of memory corruption and memory manipulation vulnerabilities," reads the Symantec report. However, the research contends that Symantec has already found that one element of ASLR that means to randomize and hide software components does not work consistently, therein making it easier for attackers to guess where vulnerabilities may lie. Symantec said further that Microsoft has confirmed the issue and pledged to fix it when it issues a Windows Vista SP1 update. Both the PatchGuard and ASLR issues feed into another Vista problem cited in the Symantec research: integration with third-party products. In addition to the potential problems introduced by PatchGuard to its own products, Symantec said that the third-party drivers provided by Microsoft may be targeted as a means of gaining kernel-level access on compromised machines. ASLR has been highlighted by at least one other security company as a potential weak point in Vista. Just as Symantec maintains that many of Vista's security features won't help protect end-users unless third-party software makers can effectively integrate with the tools, penetration testing specialists Core Security, based in Boston, published a report on Feb. 6 that highlighted a well-known vulnerability existing in CA's BrightStor backup software that it said could still be exploited on machines running Vista. Because the CA software had not been updated to integrate with ASLR and other Vista security features -- although CA said it would soon have a new version of the product to market and Microsoft officials disputed the issue -- the operating systems' onboard defense features won't help protect such legacy systems, Core said. Symantec's report repeatedly highlights the third-party integration issue as a major weak point for Vista's security goals. Microsoft officials stuck to their long-standing defense that Vista goes a long way toward mitigating many common PC security issues and that the company will continue to bring new security features to bear on the OS and future products. Microsoft said it is further investigating several specific product flaws cited in the Symantec report, including the ASLR problem. "It is important to note that none of the security features in Windows Vista, either individually or collectively, are intended as a 'Silver Bullet' solution to the problem of computer security," said Russ Humphries, senior product manager, Windows Vista Security. "We believe Microsoft has developed the right balance and made the right decisions when evaluating the tradeoffs between usability and security," Humphries said. "[Symantec's] report does not properly address the fact that many of the Window Vista security technologies have numerous options that allow for a user to make their own judgments as to their need for security balanced against usability."
662011
The software company is now looking to the red-hot virtualization market.
530503
Meanwhile, back in the data centre... Symantec announced today it would cough up $830m for infrastructure management software firm Altiris.â¦
109427
NEW YORK/SAN FRANCISCO  - Symantec Corp. SYMC.O,  the top global security software maker, on Thursday said it  will buy Veritas Software Corp. VRTS.O for $13.5 billion,  expanding into the data storage and recovery business.
664075
Venture capitalists continue to pour money into the IT security segment as emerging attacks and compliance demands pave the road for future spending among customers.Market watchers including the Computing Technology Industry Association (CompTIA) have predicted significant growth in corporate IT security budgets for 2008.In a recent survey of just over 1,000 companies conducted by the industry group, over 50 percent of respondents said they plan to spend an average of roughly 20 percent more on security technologies and services in 2008 than they did in 2007.Based on that opportunity and the wealth of new security companies coming into the market backed by strong technologies and qualified management teams, VC experts say that they will channel more funds into the sector this year in the hopes of getting behind the industry's next big thing.Among the leading areas for investment, they say, are companies building technologies aimed at addressing issues of data protection and applications security."We believe that companies looking at protecting applications and data is a fertile area, there are a lot of VC-backed companies that have been funded that have attacked different elements of the problem, but there's still a huge corporate need and plenty of room for innovative companies to succeed," said Justin Perreault, a general partner with Commonwealth Capital Ventures."I think we'll continue to see consolidation in the space because ultimately, companies don't want to deal with 20 different vendors, but there are still a lot of opportunities for companies to get to market with IPO or acquisition exits available to them long-term," he said.One of the companies that Commonwealth has put its money behind to that end is Ounce Labs, a maker of applications source code analysis tools. Perreault said that his firm believes that customers are already buying-into the concept of using code scanning technologies to address the issue of data leakage and that companies like Ounce that can automate the process without placing an additional burden on software developers stand to benefit from the trend.At the same time, areas of the security market like the NAC (network access control) and DLP (data leakage prevention) segments may have already worn out their chances to garner new investment from the VC community. "The truth is that so many security sectors are already wildly over-funded with too many companies, they may even have great ideas and technologies, but there are just too many," Perreault said. "With NAC and DLP, there are probably more people than the market can support or than there are large companies to buy them all up."At the same time, VCs need to remain mindful of the idea that there are always opportunities for companies to enter an already-crowded space and revolutionize things in some way. The most common example of that scenario is the rise of a company like Google in the search market, but issues like managing spam that have been addressed by vendors for years clearly still have a chance for innovation, said Paul Maeder, co-founder at VC firm Highland Capital Partners."When a space like DLP gets over-invested, obviously that's bad for investment, but you have to make sure that you don't get caught up in overcompensation as sometimes when people think a space is overdone, like search, along comes a Google," Maeder said. "VC is very much an industry of gossip, and that helps keep things from getting overinvested, but you also have to remember that you don't need to be the first company into a market, you just want to be the first that crosses the finish line."Among the security startups that Highland is backing these days are Bit9, a vendor that specializes in applications and device control tools for Windows environments, and Imprivata, a maker of SSO (single sign-on) authentication applications. In both cases, the expert contends, the companies his firm has invested in have the chance to address issues of serious concern to business customers in new ways, around data leakage and network access, respectively.How VCs gauge the market Most VCs agree that the key to finding the right companies to invest is based on staying in close contact with IT buyers to gauge their pain points and better understand their spending habits.Some security start-ups may have terrific ideas and strong people behind them, but if there isn't a market for the technology being pitched or a chance to create a new opportunity with something truly unique, the investors take a far more cautious approach."Our best source for information is customers -- that is the first place startups go to prove their ideas," said Maeder. "We have a cadre of CIOs who we are constantly talking with; we ask them if they're looking for something new, run business plans by them, ask if there are already too many solutions to a problem that is being addressed, and if something is an attractive value proposition."In some cases, VCs backed by specific sets of customers are emerging to help funnel money into areas of the market where customers feel there is a significant need but perhaps too few viable alternatives. One such firm is FTVentures, which is bankrolled by 40 different investors from the financial services sector. Among the businesses funding the VC are huge names including Bank of America, Citigroup, and Wells Fargo.Having such a focused group of backers helps the VC isolate security markets that truly have the potential to meet emerging demands, said Mark Lotke, a partner leading the Software Investment Team at FTVentures.In many cases the firm's backers are looking for products that can help them move away from technologies they have developed internally and continue to maintain at great expense, he said."We talk to IT and operations executives in these companies and ask where their pain points are, and in many cases they've already built homegrown tools that they're looking to replace with packaged solutions," Lotke said. "Besides addressing some problem, the companies we're invested in have had a first-mover advantage in terms of coming to market; the companies we want to invest in have to serve real-life problems today."FTVentures specializes in so-called expansion-stage investment, handing out money to companies that have already been in business for several years that are looking for additional capital to help them continue to grow.One vendor that the VC firm recently awarded millions in series-b expansion funding to is Aveksa, a maker of access control governance software. "That's a perfect example of the kind of company we're looking for, where we surveyed the market to find innovative suppliers and invested because the technology was purpose-built to solve a problem, and already had great customer traction," Lotke said. "Despite spending, it is a scary world out there right now for vendors as it can be tough to pull dollars from customers and sales cycles are being extended. But we feel that by finding these types of companies that are already proving their value, we get a much simpler road map than trying to guess what the next big thing is going to be."
636325
The sudden avalanche of technology deals is gathering momentum. Symantec&#39;s talks with software group Veritas come hot of the heels of IBM&#39;s sale of its PC business to Lenovo and Oracle&#39;s acquisition of PeopleSoft.
723113
With strong international sales and growth in its services business, Symantec reported earnings Wednesday that beat analyst expectations.
2411
The Symantec Corp, a leader in security software and one of Silicon Valley&#39;s oldest companies, announced early Thursday that it would acquire Veritas Software, a maker of data storage programs, to create the world&#39;s fourth-largest software company.
326544
Profits-plus scheme Symantec is seeking damages of more than $15m from a gang of counterfeiters, for selling fake copies of its software worldwide.â¦
384900
InfoWorld - More than a month after Symantec Corp. knocked out 50,000 Chinese PCs with a bad software update, the company is ready to offer compensation. But Chinese users eligible for the offer have to act fast; it&#39;s only good for a couple of weeks.
368635
Sun Microsystems' purchase earlier this month of open-source database maker MySQL may have been pennywise and pound-foolish, with many observers suggesting that Valley stalwart Sybase was in fact the smarter buy. The logic is compelling -- but won't someone stand up for the cussedly independent?