This week was always going to be about the San Francisco RSA conference. This year, the big theme has been cloud security and how security, cloud computing and deployments are intrinsically linked. RSA’s Chairman Art Coveillo had some interesting things to say, as well as news of integrations between McAfee and RSA. But there are others there, too, such as Symantec, Modulo and Qualys.
Security and the future of Cloud Computing
Apart from some of the releases around the cloud and cloud security at the RSA conference, there were a couple of notable interventions, not least of which was the one from RSA chairman Art Coviello, who addressed the one issue that needs to be resolved before general cloud adoption: Security.
We all know that concern about information security is one of the major issues holding everything back, but Coveillo said it doesn’t need to be this way, with industry-wide cooperation.
Companies are always going to compete, he said, but, generally speaking, they will need to cooperate to establish standards and best practice so that cloud deployments are less stressful, security-wise, for enterprises.
In his keynote address, entitled Trust in the Cloud: Proof not Promises, he said:
We now recognize the limitations of perimeter defenses, and the need for information-centric security having become conventional wisdom . . . [However] to be cost-effective, security infrastructures must be grounded in a thorough understanding of risk, balancing the elimination of threats with materiality and probability.”
New threats can be balanced by an industry-wide “cooperative ecosystem." Vendors, he added, “must integrate technologies, industries must share best practices and threat intelligence and governments must cooperate with one another and with the private sector.”
Ultimately, security is about getting the right security to the right people, with virtualization technology a core element of this.
Virtualization, he explained, can give the industry better control and industry-wide visibility, which is ultimately the only way to protect against information threats. Security needs to be logically information-centric, built-in and automated, risk-based and adaptive.
You can almost feel the tears welling up in your eyes at the thought of such widespread cooperation between competing companies, but whether it actually happens remains to be seen. Cloud competition is tight and the idea of companies offering technologies -- which might give them an edge -- to competitors seems a bit idealistic.
RSA and McAfee Extend Partnership
Moving on, there's more from RSA (news, site) -- an announcement that it and McAfee (news, site) have announced a technology partnership that in a way suggests the kind of thing Coviello is talking about.
By formally joining each other's interoperability partner programs, McAfee and RSA are kicking off joint development efforts that will offer customers combined solutions from both industry leaders to harness IT security and event data and to deliver a comprehensive view of security risk.
In fact, on this partnership, Coviello said:
Security is maturing into a model that requires an intelligent platform that can harness raw IT and security data and deliver a single view of risk to organizations that is correlated and is meaningful to the business . . . Together, RSA and McAfee are committing to a path of bringing new ideas, best practices and proven solutions designed to help organizations take a risk-based approach to apply business-aligned security controls in the enterprise."
And there you have it. He’s not just talking about what his keynote addresses; he’s committing RSA to the kind of partnerships that he believes will solve this problem.
While McAfee and RSA already provide integration between McAfee Vulnerability Manager and the RSA Archer eGRC platform to help customers address the business impact, they plan to deepen the integration by:
- Integrating the RSA Archer eGRC platform and the McAfee ePolicy Orchestrator platform
- Integrating ePolicy Orchestrator software and the RSA enVision platform to enhance both the real-time detection and automated response to attacks
- Share information about various risks such as security threats, compliance violations and policy breaches gathered through their respective platforms; this information will be intelligently analyzed to enable customers to respond with targeted countermeasures, audit and remediation controls
McAfee and RSA also recently completed updated interoperability certification of McAfee Endpoint Encryption and RSA SecurID800 hybrid authenticators. Interesting times ahead here. We’ll be watching where this goes.
Symantec Upgrades EndPoint
Symantec (news, site) used the conference to announce versions of Symantec Endpoint Protection and Symantec Endpoint Protection Small Business Edition (currently in beta), which offers advanced protection while improving system performance.
Complete with advanced features to secure virtual infrastructures and powered by Insight, Symantec’s community and cloud-based reputation technology. Symantec Endpoint Protection 12 is designed to detect and block sophisticated new threats earlier and more accurately than any other security product.
Insight 12, Symantec says, has analyzed anonymous software adoption patterns from more than 175 million customer computers to derive security ratings for more than 2.5 billion unique software files.
Endpoint Protection reduces the overhead of virus scanning by 70 percent by using Insight to identify and whitelist files, resulting in fewer scans.
It also launched an edition for the SMB sector, particularly for companies with fewer than 100 seats. Both additions are due to be released later this summer.
Modulo Takes Risk Manager to Cloud
Meanwhile, Modulo (news, site) has announced that Modulo Risk Manager is now available in the cloud. The service enables customers to take advantage of the scalability of the cloud to automate their GRC programs and manage risks, as well as meet various standards, laws and regulations.
This integrated GRC solution deals with issues such as compliance cross-referencing and vendor risk management, while also introducing integration methods such as iPhone and mobile device collectors and an open-source GRC data collection platform.
GRC Open Source Collectors, called modSIC (Modulo Open Distributed SCAP Infrastructure Collector), is an open-source initiative for GRC management, Modulo says.
It provides a common platform to create collectors and gather security data to automate policy compliance, audits and risk assessments using the Security Content Automation Protocol (SCAP) standard.
The platform also offers automated collectors for data gathering for analysis in the GRC process, onsite as well as remotely, using devices such as the iPhone and other smartphones. There’s a lot more in this offering, so it's worth checking out.
Qualys Offers Security-as-a-Service
In other conference news, Qualys, a provider of on-demand IT security risk and compliance management solutions, has introduced its version of one of the services that are really going to be big in the future -- Security-as-a-Service.
The platform will host the QualysGuard IT security and compliance Software-as-a-Service (SaaS) suite of applications in the cloud.
Overall, it provides an integrated framework with new functionality in all Qualys security and compliance applications. Standards-based integration and middleware ties together the browser, all Qualys applications, six platform services and engines, the user’s security and compliance data, scanners, and the QualysGuard KnowledgeBase.
For users, this means prioritized job management, modular services to improve uptime and performance, dynamic analysis and reporting capability, and support for physical and virtual appliances, either from Qualys or deployment by other cloud solution providers.
The Qualys platform is operational this week for Malware Detection 1.0 and SECURE Seal 1.0. Migration of QualysGuard Vulnerability Management, Policy Compliance (PC) and PCI Compliance will occur in phases throughout 2011 to subscribers.