IBM responds by introducing a host of integrated solutions to thwart Web application attacks.
The financial pressures that companies are under today certainly are being felt in IT departments all across the world. The result, clearly, is IT managers searching for more efficient and cost-effective solutions. While Web services, and more recently, cloud computing, appear to offer companies the means to reduce costs and improve service levels, they have opened up huge data vulnerabilities that IBM and its worldwide customers are scrambling to plug.
IBM has been in the security business for a long time, but this summer it is ramping up its portfolio of security solutions and services at a rapid pace in order to try to protect its customers from an onslaught of threats and dangerous attacks over the Internet that are increasing at a frightening pace. IBM has an army of more than 15,000 researchers, developers, and subject matter experts on security initiatives. It holds more than 3,000 security and risk management patents. It has nine security operations centers and seven security research centers that manage security in more than 133 countries. If this were a Western movie, IBM would be the cowboy wearing a white hat and riding a white horse while chasing a band of outlaws that far outnumber it and probably have bigger guns.
IBM's recent acquisition of the Waltham, Massachusetts-based company Ounce Labs, Inc. will give IBM a portfolio of new solutions to help its customers identify and resolve vulnerabilities in their applications' source code. Ounce Labs is a privately held company whose software is designed to help reduce risks and costs associated with security and compliance issues. Its solutions, which provide application source-code testing, identify and resolve security vulnerabilities.
On the heels of the Ounce Labs acquisition, IBM announced last week the release of what it is calling "the industry's most comprehensive solutions for helping to combat Web application attacks and to secure the integrity of data processed by Web applications." A forthcoming report is expected to provide statistics on the threat levels and on Web application attacks, which have shot up during the second quarter of 2009. The IBM X-Force 2009 Midyear Trend and Risk Report will be released later this month. One scary statistic inside indicates that SQL injection attacks, in which malicious code is placed into legitimate Web sites to infect unsuspecting visitors, nearly doubled last quarter over the first quarter in 2009, which itself showed a rise of 50 percent above the fourth quarter of 2008. Criminals are intent on stealing and manipulating data and taking command of infected computers.
Such threats require robust security solutions that go beyond much that the industry has felt it needed to deploy to this point. Dan Powers, vice president of business strategy at IBM Internet security systems, owns the job of overseeing and coordinating IBM's solutions to target these threats. "Web application security is one of the top pain points for enterprises today," says Powers. "IBM can offer a comprehensive solution designed to help turn the tide against SQL injection and other Web application attacks," he says with confidence. "Additionally, our integrated approach to security may help to reduce costs and simplify security management, which can ultimately reduce opportunities for human error and improve overall security posture."
Earlier this month, IBM announced its information infrastructure portfolio that includes IBM SiteProtector 8.0, a key offering. Other solutions included Proventia Server for Windows 2008, encrypted disk support for the System Storage DS5000, and IBM Tivoli Identity Manager 5.1, for more effective enforcement of service on demand. It also included Tivoli Security Information and the Event Manager's named entity recognition component (NERC) module that helps improve security without affecting productivity. Since Web applications often rely on Web services and service-oriented architecture (SOA), IBM figures it makes sense to integrate the effective security and governance features of its WebSphere Data Power SOA Appliances with Tivoli Security Policy Manager, which is known for its centralized management capabilities. Using both solutions, enterprise architects can combine forces with security operations personnel to better align business and IT interests by centrally managing and enforcing security policies for Web services across multiple policy enforcement points. The hoped-for result is a reduction in manual, and sometimes inconsistent, administration of security policies and enablement of a consistent enforcement of operational and lifecycle governance policies.
Along the same lines of combining solutions, IBM also is integrating Proventia SiteProtector 8.0 with Rational AppScan, a leading solution for Web application vulnerability and code testing. AppScan provides automated Web application scanning and testing for all common Web application vulnerabilities--including WASC threat classifications, such as SQL injection, cross-site scripting, and buffer overflow--and offers fix recommendations to ease remediation. In addition, IBM recently announced a Web application protection module for network and host intrusion-prevention systems.
IBM is hoping its combined solutions will allow enterprises to correlate application vulnerabilities with potential security events, block real-time attacks, prioritize responses, and immediately address the worst threats. It sees its customers eventually with an improved security posture, a consolidated reporting infrastructure, and a common workflow system for managing security incidents.
Defending against Web application threats will take more than a traditional reactive approach to security. Using point products that address only small segments of the problem and that add to complexity of security operations won't be enough. The solution begins with including security-oriented features and architecture in new code development, real-time blocking of attacks, dedicated security for Web services, and tight access management. All this is going to cost money, so IBM is arranging financing for these comprehensive security solutions, a welcome relief at a time when business may be down, but security threats are up--way up.
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online