Read more about RSA Conference 2011
Bookmark and Share
  • Comprehensive vulnerability, configuration, OS and app auditing


    nCircle announced that its solutions now audit for over 40,000 conditions including vulnerabilities, configurations, operating systems and applications. The company also continues to expand its policy library with over 130 security and compliance policies. nCircle Suite360 includes products for vulnerability management, configuration auditing, web application scanning, file integrity monitoring and PCI scanning. Suite360 now audits for over 19,000 vulnerabilities. Suite360 increased coverage by 38% in 2010 by adding coverage for 11,000 vulnerabilities, applications, operating systems and configurations. Suite360 also added 27 new security and compliance policies in 2010, bringing the total number of policies to 130. New policies include:5 new FDCC policiesnew DISA STIG policies19 new CIS-certified configuration policiesSuite360 now includes a total of 47 Center for Internet Security (CIS) policies covering common enterprise operating systems, applications and network devices including Microsoft, Linux, Oracle, Cisco, VMware, Solaris, AIX and more. Its policies enable customers to compare the configurations of their assets to a wide range of industry best practices, identify non-compliant configurations and automatically alert on high-risk changes and misconfigurations. The company also announced new functionality in Suite360, including an interactive, configurable dashboard, new configuration auditing scan modules and policies, and integration with Cyber-Ark's Privileged Identity Management (PIM) Suite. This itegration enables customers to store and manage their IT systems' credentials -- as required by authenticated nCircle scans -- directly in the Cyber-Ark Enterprise Password Vault (EPV), improving security and simplifying credentials management.

  • Real-time threat intelligence delivery


    As the threat landscape is evolving on a daily basis, it is imperative that organizations and their IT security teams are aware of the latest vulnerability threats. Perimeter E-Security’s Threat Intelligence Service, powered by Secunia, delivers the latest vulnerability information to customers. The service delivers only what is relevant to each customer, reducing the time for planning and remediation that may be required. Through this partnership, Perimeter E-Security will receive real-time vulnerability information directly from Secunia’s Vulnerability Intelligence service. Threat Intelligence Service subscribing customers will receive daily updates for the vulnerabilities most relevant to their IT environments. “Knowledge is power – and powerful knowledge is what Secunia provides. Secunia’s Vulnerability Intelligence is a complementary match for Perimeter E-Security’s services, providing customers with valuable insights into the dangers that they may be facing so that they can adapt swiftly and take remedial action,” said Niels Henrik Rasmussen, CEO & Founder, Secunia. “Secunia’s leadership in vulnerability advisories make them an excellent partner for Perimeter E-Security. With more Fortune 500 companies, financial services firms, and mid-sized businesses relying on our information security and secure messaging services than ever before, our Threat Intelligence Service must be powered by the best-in-class vulnerability data,” stated John Viega, Executive VP, Products and Engineering, Perimeter E-Security. “We continue to evolve our services to deliver the most comprehensive protection for our customers’ networks. The Threat Intelligence Services provides the data that customers need to plan for necessary system updates to be informed against the ever-changing cyber security threats.”

  • Mobile security solution enforces policy in the cloud


    Zscaler unveiled Zscaler Mobile, which adds a uniform way to secure the mobile experience for small to large organizations. The solution enforces policy in the cloud, not on the device. This means all network content is scanned, both user traffic and app traffic, to ensure that all malicious content is blocked in the cloud – long before it reaches the mobile device, or the corporate network. In tandem with Zscaler’s existing Web and e-mail cloud security services, Zscaler Mobile enforces the same policy for users wherever they go, across all their devices. The new solution ensures protection for leading smartphones and tablets including iPhone, iPad and Android devices. Zscaler launched its cloud-delivered, web security service in 2008 and is now protecting millions of users in 140 countries. Zscaler Mobile leverages this proven infrastructure to extend protection to mobile devices. Key features include:Uniform policy for users: Zscaler allows IT administrators to define a uniform policy for any user and have it seamlessly enforced regardless of the device the user is connecting with. Administrators no longer have to deal with multiple point products to secure PCs, smartphones and tablets.Global footprint for near-zero latency: With over 40 strategically located data centers worldwide, Zscaler minimizes latency associated with inspecting traffic in the cloud.No extra software to install on mobile devices: Unlike other mobile security vendors that require platform-specific apps to be installed on every device, Zscaler Mobile works seamlessly across mobile platforms, including iPhones, iPads, and Android devices.Up-to-date 24x7 mobile security: Zscaler Mobile requires no signature updates and provides real-time inspection in the cloud for every web transaction, regardless of whether it came from a browser or from an app installed on the device.No degradation of device performance: Zscaler Mobile runs in the cloud and has no impact on device performance, battery life, or processing resources.Centralized reporting and administration: Zscaler provides real-time logs and reports for any user, from any location, on any device, at any time.

  • Securing data centers from blended threats


    Fortinet announced the addition of a new consolidated security appliance to its FortiGate product family, and a new release of its FortiOS 4.0 operating system for said family. The FortiGate-3140B consolidated security appliance is designed for large enterprises and data centers requiring maximum firewall, virtual private network and intrusion prevention system (IPS) performance to optimize protection against blended threats, destructive malware and constantly evolving attempts to breach security in high-speed network environments. Leveraging custom FortiASIC processors, the appliance provides large enterprises with up to 58 gigabits-per-second of firewall performance, 10 Gbps of IPS performance, and up to a robust 22 gigabits-per-second of VPN performance, all in a highly compact two rack unit (2-RU) form factor designed to preserve precious wiring closet real estate. The new appliance comes standard with ten 10-gigabit Ethernet (10-GbE) ports. To provide the most flexible protection for the most demanding network environments, the appliance offers a total of 22 ports, making the system ideal for data centre and other high-bandwidth applications. This port density enables it to be deployed as either a high-performance firewall or a unified threat management solution that can be easily configured to concurrently support VPN, IPS, application control, anti-spam and anti-virus security measures without degrading performance. Equipped with the third major release of the FortiOS 4.0 MR3 operating system, the appliance will feature active profiling for improved policy enforcement and flow-based inspection for superior Web filtering and traffic shaping. The advancements offered in the FortiOS 4.0 MR3 operating system introduce wireless controller extensions that support automatic provisioning of wireless access points, detection and suppression of rogue access points, multiple authentication methods and strengthened unified management of both wired and wireless networks from a single FortiGate platform. The FortiOS operating system also features active profiling that provides the ability to use a form of behavioral analysis to create and actively enforce policies based on deviations from corporate, group or individual baseline profiles. A range of policy enforcement options is available for suspicious behavior, including monitoring, quarantining and/or outright blocking. Flow-based inspection enhancements included with the OS enable more powerful Web filtering and traffic shaping features, interface-based “one-arm” IPS, and advanced data loss prevention (DLP) capabilities. Flow-based inspection also leverages FortiASIC processors to further accelerate anti-virus, application control, IPS and IPv6 firewall inspection. Other FortiOS 4.0 MR3 operating system enhancements include:Stronger authentication: Two-factor authentication via FortiToken, SMS messaging and email is enabled. FortiToken supports one-time password authentication, IPSec and SSL VPN authentication, and administrator and firewall login.Expanded compliance: Extensions in vulnerability scanning have been added to support rogue access point detection and suppression in wireless networks. PCI DSS compliance requires periodic detection and removal of unauthorized wireless devices.Setup wizards: New HTML-based wizards streamline the setup of all FortiGate consolidated security appliances. Setup of basic, as well as advanced firewall, UTM, dual-WAN, and remote VPN security features is now faster and easier.

  • Cloud encryption software for private cloud infrastructures


    CREDANT announced the beta program for its cloud encryption software for virtual desktop infrastructure (VDI) private cloud infrastructures. With this launch, the company enables organizations to control and enforce security whether corporate data is located in private, hybrid or public cloud infrastructures. The cloud security platform provides a data security approach that enables granular encryption, access control and key management that allows enterprises to protect against insider threat, including from the cloud provider itself. The company’s approach is to protect data itself rather than protecting specific volumes, drives or devices. Its encryption technology is automated, centrally managed and policy-based, providing real-time protection and peace-of-mind for enterprise and government customers with sensitive data. The solution will enable businesses and government organizations to deploy private cloud infrastructures as part of their long-term roadmap to full cloud utilization by putting data security in the control of the enterprise—not the cloud administrator. By enabling the IT security organization to control encryption of critical data on cloud platforms centrally, and in a way that is fully integrated with other data protection and encryption solutions already in place, organizations can safely embrace private, hybrid and public cloud computing models with the knowledge that their data is safe from co-tenants, hackers and malicious insiders. The CREDANT cloud security platform:Effectively eliminates the risk of an insider (either within the organization or working for an outsourced provider) accessing or stealing sensitive data;Provides granular access to decrypted information to the authorized user only while administrators (local and third-party) access only the system and not the protected data;Enables seamless management of data security on physical infrastructure, mobile devices, removable media, private clouds, VDIs, and hybrid/public cloud models, in a way that is transparent to users; and,Prevents unprotected data leakage to removable media while enabling secure usage and control of removable storage.Organizations can register to participate in the beta program here.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th