Security is a hot topic in technology circles these days. For proof of that statement, one need look no further than the buzz surrounding this year’s RSA Conference in San Francisco, an annual gathering focused on IT security.
Once the exclusive province of cryptographers, the annual conference has grown and diversified in recent years along with the IT security industry itself. This year’s conference will reflect heady times for that industry, with a high-profile keynote address by Microsoft chairman and chief software architect Bill Gates, swollen attendance figures and a gaggle of product news from companies looking to build bridges between their products and those of competitors.
Weary after a year punctuated by major outbreaks of worms such as Blaster, Sobig and MyDoom, more than 10,000 visitors are expected to visit San Francisco’s Moscone Center this week, where more than 250 exhibitors are displaying technology to stop malicious hackers, viruses and other online scourges, according to Sandra LaPedis, area vice-president and general manager of RSA Conferences, a division of RSA Security Inc.
Attendance at this year’s show is expected to be up by about 20 per cent over last year, due in part to Gates’ appearance at the show, an improving economy and a sustained interest among companies and the public in computer security topics such as viruses, spam and identity theft, she said.
Conference organizers have also changed tactics to try to broaden the appeal of the show, adding a separate discussion track on identity and access management and adding a private Executive Security Action Forum for Fortune 500 chief information officers (CIOs) and chief information security officers (CISOs) on Monday, she said.
Dozens of companies, large and small, are planning news announcements to coincide with the conference, with the need for better security management the dominant theme.
VeriSign Inc., IBM Corp. and others are backing a new program to develop an open standard for strong, multi-factor authentication that can be used across the Internet.
VeriSign plans to announce on Monday an initiative called the Open Authentication Reference Architecture (OATH), which will replace the patchwork of proprietary user authentication products, allowing users to seamlessly access services on corporate networks and the Web, VeriSign executives said. IBM Corp. said its Tivoli Identity Management product will support the new OATH architecture.
Sun Microsystems Inc. is also planning to announce changes to its product line at RSA that are intended to make network security easier to manage.
Calling its new security model “Infinite Access,” the company plans to announce the integration of its Java Card technology with a wide range of the company’s other software products. The closer integration will provide strong, multi-factor authentication “out of the box” (without requiring custom integration) for customers who use its Java Desktop System, the company’s alternative to Windows, said Rama Moorthy, manager of the Security Marketing and Strategy group at Sun.
The idea is to make security ubiquitous, invisible to users and easy for businesses to use, Moorthy said.
Sun also plans to announce closer integration of its identity management product, the Java System Identity Server, with Microsoft’s Active Directory Server. A new version of the Java System Identity Server that incorporates technology acquired with Sun’s purchase of WaveSet Inc. features improved lifecycle management for user accounts and will allow customers to directly manage accounts within Microsoft’s Active Directory Server using the Java System Identity Server, she said.
Companies such as Qualys Inc. and Tripwire Inc. will use RSA to announce new versions of their products that work better with other security management technologies.
Qualys, of Redwood City, Calif., plans to announce integration between its QualysGuard vulnerability testing service and security event management products by ArcSight Inc., GuardedNet Inc. and Network Intelligence Inc. The integration will allow customers using those products to correlate vulnerability information from QualysGuard with intrusion detection systems (IDS) and firewalls to provide a single view of network security, a Qualys spokeswoman said.
Tripwire Inc., of Portland, Ore., which makes software to monitor changes in computer configurations, said it will announce an upgrade to its server management product. Tripwire Manager 4.1 will be easier to use with other enterprise management software such as Hewlett Packard Co.’s OpenView and IBM Corp.’s Tivoli, the company said.
Sensing an opportunity, a new company, Skybox Security Inc. of Menlo Park, Calif., will use the RSA Conference to unveil its product, called Skybox View, which is described as an enterprise risk management platform. Based on attack simulation technology developed at Dartmouth College’s Institute for Security Technology Studies, Skybox View creates an integrated security model of an organization’s network that maps network scanners, firewalls and routers, as well as considering management systems and security policies. The product then launches simulated attacks against them to identify likely access paths for attackers, the company said.
Finally, the Organization for the Advancement of Structured Information Standards (OASIS) plans to announce growing support for its emerging AVDL (Application Vulnerability Description Language) standard, which allows security products from different vendors to share data about software vulnerabilities. A host of security technology companies, along with the U.S. Department of Energy Computer Incident Advisory Capability, announced support of the nascent standard.
The OASIS AVDL Technical Committee has completed the first specification for the standard and will submit it to OASIS for approval in March, according to Brian Cohen, CEO of SPI Dynamics Inc., of Atlanta, and a member of the AVDL Working Group.
AVDL will be a common language among disparate security products and, when widely adopted, will set the stage for a closer integration between vulnerability detection system and automated patching and remediation products, said Wes Wasson, vice president of marketing at NetContinuum Inc. of Santa Clara, Calif., another AVDL Working Group member.
“These devices need to start communicating in intelligent ways,” said Pete Lindstrom, research director at Spire Security LLC, a market research and analysis company.
“It doesn’t mean you go bonkers with automation overnight, but we need to slowly get comfortable with things like dynamic reconfigurations (of network devices) in our environments,” he said.
Eventually, closer links between vulnerability assessment products and technology such as firewalls and IDS is needed, he said.