SAP launches security service
682337
SAP AG this week unveiled a service that evaluates security settings across a customer&#39;s SAP enterprise system. SAP Security Optimization helps customers identify and fix vulnerabilities, and minimise the
718175
(InfoWorld) - SAP continued to ramp up its on-demand CRM offering this week, announcing that it will now include service-level capabilities, the third key component of CRM solutions. In February SAP kicked off its software as a service business with a sales force automation solution. In May the company added marketing, and in its third update within the year it is now announcing SAP Service. Liz Herbert, a senior analyst at Forrester Research, said that the SAP CRM solution is now displaying the kind of depth SAP is known for. "SAP added a component for managing products that many on-demand CRM vendors don't have. You can use it as the product master or bring in the product master which is typically found in the ERP system," said Herbert. The new service component includes Service Ticket Management, Rule-based Service Ticket Distribution, and Service Level Monitoring. Also included is a rules-base service-level determination calculator that automates the routing of service tickets based on a customer's service level agreement, said Angela Bandlow, vice president at CRM Solutions Marketing. "It's a tiered service that tracks SLAs based on the customer and the required response time," said Bandlow. One of the key differentiators for the SAP offering, according to both Bandlow and Forrester's Herbert, is its ability to integrate easily with MySAP ERP systems on the back end. Using product information found in the ERP system, a sales person can pull up manufacturing availability and pricing information and deliver a quote in real time online. Bandlow said while this completes the three major components of SAP CRM OnDemand, quarterly updates can be expected with the next update due in December. To date, the solution, like almost all on-demand solutions, is not industry-specific. But Bandlow said the company is looking at that and will respond to customer demand.
420399
SAP is offering a new service called SAP Security Optimization, which provides a detailed analysis of security gaps and vulnerabilities and action plans on how to resolve them.
698117
Strengthening its commitment to enable customers to tap the potential for business improvement through radio frequency identification (RFID) applications, SAP AG today issued a call to action for an open public ...
648300
SAP's upcoming suite of hosted apps, code-named A1S, is the first of its kind designed for medium-sized businesses.
555867
OCTOBER 25, 2004 (IDG NEWS SERVICE) - IBM today introduced a security service that offers a concise, monthly global-network threat report designed to help organizations assess security needs and vulnerabilities from a business perspective.
570924
The companies plan to share security features to help customers protect their networks from worms and viruses.
429195
Unified support for passwords, smart cards and tokens means better network security, the company says.
566376
InfoWorld - Veracode launched a new version of its binary code analysis service on Monday that focuses specifically on helping software engineers find potential backdoor vulnerabilities in their programs.
492229
InfoWorld - Business software vendor SAP has added an offering to its growing suite of quickly deployable applications aimed at helping businesses manage specific tasks across diverse industries.
581752
Symantec on Tuesday introduced versions of its consumer and small business security software with updates that protect against network-scanning worms such as Sasser, and keep phishing attacks at bay.
521853
InfoWorld - Veracode launched its Software Security Ratings Service on June 25, introducing its new system for use in testing the safety of applications development among enterprise customers and third-party software makers.
56366
SAP AG will unveil on  Wednesday a line of business management programs to be  delivered over the Web, becoming the first major software  company to make a big bet on software as a service.
92354
Symantec Corp. is fishing for dollars with a new service designed to help companies combat the ongoing epidemic of online identity theft, or "phishing," scams.
279019
(InfoWorld) - In search of new markets and customers, SAP AG is developing a new breed of hosted, on-demand products and looking at ways to make its complex business software easier to use. Vishal Sikka, SAP's chief software architect, talked about one of the company'sfirst on-demand offerings, its software-as-a-service philosophy, search functionalities in enterprise software, Web service standards and more in an interview. The interview comes ahead ofÂ next week's Cebit trade show where customers will have an opportunity to see a brief 15-minute demonstration of SAP's planned new suite of hosted, on-demand midmarket applications, known internally as A1S. The Walldorf, Germany, vendor hopes to launch the product later this year. IDGNS: What is so different about designing an on-demand product, such as your new CRM offering? Sikka: There are a few things that are fundamentally interesting. One is the better economics you can offer by hosting. This is more a function of how much you can leverage the underlying stack technologies -- the different hardware -- below the application layer. Another aspect is the time to get up and running. This a matter of how closely you can get the software to reflect the way customers do their business. A CRM on-demand solution for an insurance company in the U.S. is very different from a CRM on-demand solution for a company in Thailand. IDGNS: What specifically is so different in the design of an on-demand product? The level of prefiguration, number of functions, ease of use? Sikka: Exactly. What you see in our CRM on-demand offering is a significantly easier product to use through ways such as preconfiguration, fewer functions and taking massive advantage of underlying infrastructure. You'll see us do things that go far beyond Salesforce.com. You'll see us starting to work with some of the "cloud" platforms like Amazon and Google. We haven't yet announced any relationships but you'll start to see us doing things of this sort. IDGNS: What role will the software-as-service model play in SAP software across the board? Sikka: We look at it as another deployment option. When you look at SAP, the breadth of functionalities that we offer across our customers, industries and nationalities is very vast. One size doesn't fit all. We're using a wide variety of deployment options. For a certain class of processes, it is advantageous to offer that software as a service. For other processes, it may be better to offer our software as an on-premise model. IDGNS: Are there any limitations in designing software-as-a-service products? Sikka: You have to look at the trade-off between the ability to customize and share data. IDGNS: Will your vertical applications disappear as you move toward intelligent xApps? Sikka: No. Our xApps augment vertical applications. They give companies the ability to build the last mile; they're more narrowly defined applications that tend to leverage existing applications. IDGNS: What about your proprietary programming language ABAP? Will it fade away soon? Sikka: I want to take this opportunity to demystify something. In the age of the enterprise service-oriented architecture, the whole programming-language debate is a very big red herring. Programming languages are an area of constant innovation. Interestingly, what we find in our world is that applications live a lot longer than programming languages do. For instance, Sabre, the application used for airline reservations, is still written in Cobol, even though the last compiler was written over 20 years ago. IDGNS: So ABAP is here to stay? Sikka: You won't see ABAP going away anytime soon. Why? Because a lot of the application code that our customers use is in ABAP. It has a very, very reliable, high-performance underlying platform that is far better than anything we have seen in the market. You'll see ABAP for a long time, but you'll also see more Java because certain applications are best written in Java. And you'll see us using other languages. We do a lot of work in Microsoft programming models. Our approach toward programming languages is to make the programming language distinction irrelevant. IDGNS: How about enterprise search? Do you have any new developments in the pipeline? Sikka: This is an ongoing development. What you have seen from us so far is early thinking in this area. A lot more is to come. You will see enterprise search evolving around different fronts, such as contextual searching. We own the application so we know who the user is, what the user's role is and what the user is authorized to see. IDGNS: What about the cooperation between Microsoft and SAP? What are next steps with Duet and what are the challenges? Sikka: The challenges are always there when you bring two big companies together, like Microsoft and SAP. We have different development philosophies. Microsoft is much more volume oriented and more consumer focused. But we have a great relationship with them. The Duet product is an example. Over time, you'll see Duet expanding in many interesting ways to cover a much wider set of scenarios. You'll see us bringing it closer to our xApp composition platform, so it will be much easier for customers to add on to it. You'll see us working even more closely with Microsoft moving ahead. IDGNS: What about Muse. Any new developments on the user interface front? Sikka: This is an ongoing effort toward rethinking our UI approach. To understand the overall user experience and direction, you have to step back and look at the context in which customers use SAP applications. This is very broad. There are people who are on the factory floor. There are truck drivers, mobile phone users, notebook users and desktop users. We're reaching out to end-users in whatever context they're in. Duet is example. A lot of work happens inside Microsoft Office. Of course, a big area where SAP users -- whether a payroll clerk or an accounting manager -- spend a lot of time is in front of a SAP screen. We want to expose those users to a rich client. This is what Muse is. IDGNS: How are your efforts moving ahead to create a developer community as passionate as the one driving the development of open-source software? Sikka: Having a passionate developer community is something we're extremely interested in. The SAP ecosystem has been around for a long time. Thousands of companies have developed add-ons and we're encouraging this. Beyond that, we're extremely interested in developing efficiencies. We have distributed labs across the world. We have done a lot of thinking in how to optimize the benefits you get from a distributed, decentralized development network like the one we have. IDGNS: Do different regions bring different expertise to the picture? Sikka: Yes, across the board. We see a lot of Linux expertise in China, a lot of mobile expertise in India and Windows expertise in Israel. I don't want to stereotype areas but you see a natural coalescing of skills in different areas. It makes sense to have development in those areas. Â
533101
IBM today introduced a security service that offers a concise, monthly global-network threat report designed to help organizations assess security needs and vulnerabilities from a business perspective.
161583
(InfoWorld) - Veracode launched its Software Security Ratings Service on June 25, introducing its new system for use in testing the safety of applications development among enterprise customers and third-party software makers. With the debut of the service, Veracode, which is based in Burlington, Mass., claims to have unveiled the world's first standards-based system for rating the overall security of software programs before they are put into production mode. While many companies that harbor software development departments have begun using source code analysis tools to look for potential vulnerabilities in their applications, Veracode aims to take the process one step further by offering businesses and ISVs the ability to scan binary code of their programs for problems. Testing binary code, versus scouring individual lines of source code, allows developers to scan an entire application before it is taken into production, thus increasing their likelihood of finding errors they might have missed along the way and eliminating the need to pursue code that ends up getting cut from a program before it approaches its final state, Veracode officials said. The approach also benefits efforts to develop software using the increasingly popular SOA approach by allowing workers to test code being drawn from multiple programs in their final, integrated state, the company maintains. To support its ratings service -- which customers can use to test the code of their own homegrown applications or those of third-party providers -- the company built its scoring system around the CWE (Common Weakness Enumeration) classification, which has been forwarded by federally funded IT security watchdogs Mitre, as well as the CVSS (Common Vulnerability Scoring System), which has been piloted by the FIRST (Forum of Incident Response and Security Teams) industry group. By combining the two standards into an integrated testing tool that scans for potential problems and produces a score based on its findings, Veracode officials claim that they can offer companies a more comprehensive manner of understanding just where their programs are weakest from a security perspective. "The software industry is valued at roughly $350 billion, but the entire industry has almost no notion of its own security quality, and part of that problem is that there haven't been tools like this in the past," said Matt Moynahan, chief executive of Veracode and a former division manager at Symantec. "This is a responsible way for people to improve the security of their code without placing an undue burden on an ISV community that is already desperate to fix this problem, but faces a huge challenge in finding people who are capable of writing safer programs," he said. Moynahan said that during his time at Symantec -- where he helped oversee sales of the company's Norton consumer desktop anti-virus products -- he was exposed to the grueling testing process that software developers must undergo to eliminate flaws from their applications. By allowing such ISVs and internal software development shops to assess where they may have problems earlier in the design process, or before applications have been installed, Veracode can dramatically cut the amount of time and effort necessary to find and fix subsequent security problems, he said. The Software Security Ratings Service promises to chart both the severity and potential exploitability of any flaws it locates in a particular program, along with the types of business information which could be exposed by an attack on the applications being tested. "This isn't necessarily a development problem as people have been making it out to be; secure coders simply don't grow on trees, and developers have not been trained in the security testing process," Moynahan said. "This also helps tackle the development outsourcing problem when it comes to security, instead of forcing companies to reconsider the approach altogether based on fears of insecure code." One roadblock that has made it difficult for such an independent software rating system to have been developed in the past is that companies have been reluctant to release their source code to outsiders for testing, mainly out of fear of handing over their most valuable intellectual property to others, the CEO said. Since the ratings system is delivered via a software-as-a-service (SaaS) model whereby users aren't forced to distribute their code externally for testing, Moynahan expects that more development shops will be open to testing their code in such a manner. Beyond the ratings service, Veracode similarly offers its flagship SecurityReview application -- which promises to automate applications security auditing -- as an on-demand subscription service. In the last month alone, two of the best-known providers of source code and Web applications security testing, Watchfire and SPI Dynamics, have been acquired by IBM and HP respectively, illustrating a major push among providers of software development tools to further integrate security monitoring features into their products. While those acquisitions should prove useful in helping businesses improve the security of their applications development process, at least one expert said that technologies provided by companies such as Veracode -- those that can look directly at binary code for vulnerabilities -- could see increased demand as developers seek even more tools for driving mistakes and incompatibilities out of their programs. "Developers should be trying to find all possible ways to break their applications, not just looking at source code for mistakes; they need to have a more hacker-like mentality, and to do that you have to test throughout the whole development process," said Joseph Feiman, analyst with Gartner, based in Stamford, Conn. "To that end, no one today is testing binary code, which could be a significant benefit to improving security, so there will be a growing market for those tools that can handle that type of work," Feiman said. "Especially with the rise of SOA, and with people buying packages and services that offer them no access to the source code, we should see growth in this evolving market for binary testing tools."