Virtual Patch Management Offers Automation, Availability, and Cost Benefits Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst

Size: px
Start display at page:

Download "Virtual Patch Management Offers Automation, Availability, and Cost Benefits Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst"

Transcription

1 ESG Brief Virtual Patch Management Offers Automation, Availability, and Cost Benefits Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: Timely patch management is a security best practice, yet many organizations continue to struggle in this area. Unfortunately, patch management remains difficult as it crosses all types of systems and applications and often involves emergency processes and critical system downtime. To address these disruptive issues, many organizations are turning to virtual patching technologies. Why? Virtual patching provides a compensating control to shield software vulnerabilities and block malware exploits. By doing so, virtual patching can help IT replace patching firedrills with a more formal, automated, and scheduled process. This can help address risk, streamline operations, and lower IT cost. Overview Software patch management is one of many tasks performed by a combination of enterprise security and network operations organizations. While patch management is a critical activity for risk management, many organizations aren t particularly adept in this area. According to recent ESG research, less than one-third of enterprise organizations say they are very good in terms of their ability to patch vulnerable systems in. Alternatively, 17% of enterprises claim that they are fair or poor when it comes to patching vulnerable systems in. 1 Figure 1. Enterprises Rate Themselves on Their Ability to Patch Vulnerable Systems in a Timely Manner Please rate your organization in terms of its ability to patch vulnerable systems in a timely manner (N = 305) Poor, my organization has many problems patching patch vulnerable systems in 1% Fair, my organization has problems patching patch vulnerable systems in 16% Very good, my organization can patch vulnerable systems in a timely manner nearly all the time 30% Good, my organization can patch vulnerable systems in a timely manner most of time 53% 1 Source: ESG Research Report, Security Management and Operations: Changes on the Horizon, July All other ESG research references and charts in this brief are taken from this research report, unless otherwise noted.

2 As part of its research of security management and operations activities like patch management, ESG created a segmentation model of enterprise organizations based upon their security management and operations skills. Of the total survey population, 19% were classified as advanced with security management and operations, 49% were considered progressing with security management and operations, and 32% had basic security management and operations skills. This segmentation model is quite useful for the further analysis of enterprise organizations patch management skills. While only 9% of advanced organizations rated their patch management processes as fair or poor, 16% of progressing organizations and 27% of basic organizations claim that they are fair or poor at patching vulnerable systems in a timely manner. Clearly, patch management issues are fairly persistent especially at organizations with widespread information security difficulties across the enterprise even 9% of advanced organizations rated their patch management capabilities as fair or poor (see Table 1). Table 1. Patch Management Skills Analyzed by the ESG Security Management and Operations Segmentation Model Rating of organization s ability to patch vulnerable systems in a timely manner Very good, my organization can patch vulnerable systems in nearly all the time Good, my organization can patch vulnerable systems in most of time Fair, my organization has problems patching patch vulnerable systems in a timely manner Poor, my organization has many problems patching patch vulnerable systems in Advanced organizations Progressing organizations Basic Organizations 42% 35% 22% 50% 51% 51% 7% 14% 26% 2% 2% 1% Why Is Patch Management So Difficult? Patch management is well understood and extremely critical, so common wisdom suggests that it would be a fairly routine process. Given this, why do so many organizations still struggle? Probably because patch management issues include: High volume. There are approximately 1,000 to 1,300 software vulnerabilities and associated patches announced per quarter 4,000 to 5,000 per year. This volume of software patches puts the security and network operations team in a state of perpetual patch management on all types of applications ( production applications, homegrown applications, out-of-support applications, etc.) and an assortment of systems (Windows, Linux, virtual systems, mobile operating systems, etc.). IT simply can t keep up. Incremental work. Patch management includes lots of support work like system testing, change management review, and scheduling of patch activities for hundreds or thousands of systems. All of these independent processes add operational overhead and plenty of opportunity for human error. Poor timing. Beyond scheduled patch deployment, newly discovered critical vulnerabilities force security and network operations teams into drop everything emergency patching tasks. These fire drills can be

3 costly as they may require unscheduled system downtime for business-critical applications. Furthermore, system patching can t always be done during regular business hours; especially when applications are configured in high-availability clusters. This forces exhausted employees to unexpectedly work late at night or on weekends. As if these issues weren t enough, ESG believes that patch management problems may actually be getting worse. Why? Many organizations have embraced virtualization and mobile computing adding hundreds of new systems to the IT portfolio and patch management responsibilities. Additionally, organizations are performing more extensive security testing on applications and thus uncovering more vulnerabilities in need of software patches. All of this additional patch management oversight is still managed through the same tedious processes by the same IT personnel, exacerbating the already tenuous patch management process. One quarter of all enterprises claim to have a problematic shortage of IT security skills so they can ill afford additional patch management work. 2 And since 50% of organizations identify budget constraints as one of their biggest security challenges, few CISOs will have the luxury of spending their way out of this problem. Virtual Patching Can Provide Some Relief CISOs recognize the importance that patch management plays in risk management. This raises a critical question: How can organizations overcome the problems described above to gain more structure and make patch management a more formal process-driven activity? ESG believes that virtual patching technologies, like Trend Micro Deep Security, have the potential to supplement regular patch management activities to greatly improve patch management efficiency. Just what is virtual patching? The TechTarget website, WhatIs, defines virtual patching as follows: Virtual patching is the quick development and short-term implementation of a security policy meant to prevent an exploit from occurring as a result of a newly discovered vulnerability A virtual patch analyzes transactions using the security enforcement layer to prevent malicious traffic from reaching the vulnerable application. The virtual patch, if effective, prevents the exploit from taking place without modifying the application's source code. 3 Virtual patching is typically deployed as a vulnerability-facing technology residing on a network security device. Aside from blocking specific exploits, leading virtual patching gateways also include stateful firewalls, IDS/IPS, and web application firewalls (WAF). This provides further network-based protection for critical systems from layers 2 through 7 of the OSI stack and guards against common application exploits such as SQL injections. The best virtual patching solutions receive vulnerability intelligence from multiple vulnerability tracking intelligence services to continually update protection for zero-day vulnerabilities. Finally, virtual patching solutions should also provide out-of-the-box protection for common enterprise applications, network services, and databases. Virtual Patching Offsets Many Existing Problems Virtual patching doesn t replace traditional software patch management. Rather, it provides an effective compensating control so that CIOs/CISOs can better control, manage, and structure their patch management processes; increasing efficiency while streamlining operations. In this way, virtual patching can directly address some of the typical patch management problems described previously by (see Table 2): Eliminating patch management fire drills. When critical vulnerabilities lead software vendors to release outof-band software patches, virtual patching can provide a temporary compensating control for blocking new threats. This gives CIOs more time to assess risks, aggregate multiple patches into a single distribution, test patches against production applications, and apply software patches in a timeframe that meets the organization s schedule. Avoid system downtime. While patching systems is never convenient, current patch management practices often mean taking critical systems offline. This can only disrupt business operations and annoy customers, 2 Source: ESG Research Report, 2012 IT Spending Intentions Survey, January Source: TechTarget, WhatIs: Virtual Patching.

4 business partners, and employees. Once again, patching can help bridge this gap, lower cost, and alleviate the need for unscheduled and troublesome system downtime. Free up valuable employees. According to ESG research, about one-third of enterprise organizations claim that their security team spends a majority of its time addressing emergency issues and not enough time on more proactive security management and strategy. Clearly, patch management issues contributed to this organizational problem in the past. Virtual patching won t solve this problem but it can certainly give security professionals some time back to focus on more strategic security issues. Table 2. Virtual Patching Can Help Address Patch Management Issues Traditional patch management problem High volume Incremental work Poor timing Virtual patch solution Virtual patches can block exploits associated with multiple software vulnerabilities. This gives IT the opportunity to aggregate individual patches into more efficient multiple-patch distributions. Activities like testing and software distribution can be scheduled and combined. This gives IT the opportunity to automate manual processes. Virtual patches act as a temporary compensating control. This gives IT the opportunity to replace patching fire-drills with scheduled patch management cycles. Virtual patch management can also help in other areas. Patches sometimes lag a vulnerability announcement leaving organizations at risk until software vendors develop and distribute software fixes. Additionally, patching legacy or outof-support systems can be extremely costly. In these instances, virtual patching is probably the best solution. The Bigger Truth Every CISO faces three common trends: 1. The increasingly dangerous threat landscape. This includes growing malware sophistication and volume as well as an increase in targeted attacks. 2. Growing IT complexity. Many organizations are implementing technologies like cloud computing, mobile devices, and infrastructure virtualization. These technologies make IT more complex and increase the overall attack surface. 3. Skills and budget limitation. As previously mentioned, 25% of organizations say they have a problematic shortage of IT security skills. While many want to hire new security staff, 83% say it is extremely difficult or somewhat difficult to recruit and hire security professionals at this time. Furthermore, security budgets are tight so CISOs are being asked to do more with less. While these trends are bound to make IT security even more challenging, many organizations continue to rely on an array of manual processes and one-off security point tools. This is simply a recipe for increasing IT risk and ultimate failure. CISOs must figure a strategy that replaces fire drills, manual processes, and point tools with formal schedules, automation, and integrated solutions. Virtual patching is not a silver bullet but it can certainly help facilitate this transition. By introducing a network-based compensating control for software patching, virtual patching can help address risk, streamline security operations, and lower cost. Given this winning formula, smart CISOs should add virtual patching solutions like Trend Micro Deep Security to their strategic plans. All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of The Enterprise Strategy Group, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client

5 Relations at ESG Brief: Virtual patch Management Offers Automation, Availability, and Cost Benefits

The Growing Need for Real-time and Actionable Security Intelligence Date: February 2014 Author: Jon Oltsik, Senior Principal Analyst

The Growing Need for Real-time and Actionable Security Intelligence Date: February 2014 Author: Jon Oltsik, Senior Principal Analyst ESG Brief The Growing Need for Real-time and Actionable Security Intelligence Date: February 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: ESG data indicates that many enterprise organizations

More information

Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst

Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave

More information

White. Paper. Rethinking Endpoint Security. February 2015

White. Paper. Rethinking Endpoint Security. February 2015 White Paper Rethinking Endpoint Security By Jon OItsik, Senior Principal Analyst With Kyle Prigmore, Associate Analyst February 2015 This ESG White Paper was commissioned by RSA Security and is distributed

More information

Utilizing Security Ratings for Enterprise IT Risk Mitigation Date: June 2014 Author: Jon Oltsik, Senior Principal Analyst

Utilizing Security Ratings for Enterprise IT Risk Mitigation Date: June 2014 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Utilizing Security Ratings for Enterprise IT Risk Mitigation Date: June 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: What do large enterprises need in order to address increasingly

More information

Compensating Security Controls for Windows Server 2003 Security

Compensating Security Controls for Windows Server 2003 Security ESG Solution Showcase Compensating Security Controls for Windows Server 2003 Security Date: May 2015 Author: Jon Oltsik, Senior Principal Analyst Abstract: It is common knowledge by now that Microsoft

More information

IBM: An Early Leader across the Big Data Security Analytics Continuum Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst

IBM: An Early Leader across the Big Data Security Analytics Continuum Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst ESG Brief IBM: An Early Leader across the Big Data Security Analytics Continuum Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: Many enterprise organizations claim that they already

More information

Is your organization developing its own custom applications specifically for mobile devices? (Percent of respondents, N=242)

Is your organization developing its own custom applications specifically for mobile devices? (Percent of respondents, N=242) Solution Brief Check Point Capsule for Mobile Computing Security, Operations Efficiency, and Business Enablement Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst; Kyle Prigmore, Research

More information

White. Paper. Cloud Computing Demands Enterprise- class Password Management and Security. April 2013

White. Paper. Cloud Computing Demands Enterprise- class Password Management and Security. April 2013 White Paper Cloud Computing Demands Enterprise- class Password Management and Security By Jon Oltsik, Senior Principal Analyst April 2013 This ESG White Paper was commissioned by McAfee (a Division of

More information

Security Intelligence: A Key Component of Big Data Security Analytics Date: December 2012 Author: Jon Oltsik, Senior Principal Analyst

Security Intelligence: A Key Component of Big Data Security Analytics Date: December 2012 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Security Intelligence: A Key Component of Big Data Security Analytics Date: December 2012 Author: Jon Oltsik, Senior Principal Analyst Abstract: The intersection of big data and security analytics

More information

Research Perspectives

Research Perspectives Research Perspectives Paper Network Security Operations and Cloud Computing By Jon Oltsik, Senior Principal Analyst April 2015 This ESG Research Perspectives Paper was commissioned by Tufin and is distributed

More information

Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst

Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Enterprise Organizations Need Contextual- security Analytics Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: Large organizations have spent millions of dollars on security

More information

Data- centric Security: A New Information Security Perimeter Date: March 2015 Author: Jon Oltsik, Senior Principal Analyst

Data- centric Security: A New Information Security Perimeter Date: March 2015 Author: Jon Oltsik, Senior Principal Analyst ESG Solution Showcase Data- centric Security: A New Information Security Perimeter Date: March 2015 Author: Jon Oltsik, Senior Principal Analyst Abstract: Information security practices are in the midst

More information

ESG Brief. Overview. 2014 by The Enterprise Strategy Group, Inc. All Rights Reserved.

ESG Brief. Overview. 2014 by The Enterprise Strategy Group, Inc. All Rights Reserved. ESG Brief Webroot Delivers Enterprise-Class Threat Intelligence to Security Technology Providers and Large Organizations Date: September 2014 Author: Jon Oltsik, Senior Principal Analyst; Kyle Prigmore,

More information

Market Research. Study. Database Security and Compliance Risks. December, 2009. By Jon Oltsik

Market Research. Study. Database Security and Compliance Risks. December, 2009. By Jon Oltsik Market Research Study Database Security and Compliance Risks By Jon Oltsik December, 2009 An ESG Market Research Study Sponsored by Application Security, Inc. 2009, Enterprise Strategy Group, Inc. All

More information

RSA Enterprise Compromise Assessment Tool (ECAT) Date: January 2014 Authors: Jon Oltsik, Senior Principal Analyst and Tony Palmer, Senior Lab Analyst

RSA Enterprise Compromise Assessment Tool (ECAT) Date: January 2014 Authors: Jon Oltsik, Senior Principal Analyst and Tony Palmer, Senior Lab Analyst ESG Lab Review RSA Enterprise Compromise Assessment Tool (ECAT) Date: January 2014 Authors: Jon Oltsik, Senior Principal Analyst and Tony Palmer, Senior Lab Analyst Abstract: This ESG Lab review documents

More information

Cybersecurity Skills Shortage: A State of Emergency

Cybersecurity Skills Shortage: A State of Emergency Enterprise Strategy Group Getting to the bigger truth. ESG Brief Cybersecurity Skills Shortage: A State of Emergency Date: February 2016 Author: Jon Oltsik, Principal Analyst, Doug Cahill, Senior Analyst,

More information

Advanced Cyber Threats Demand a New Privileged Account Security Model Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst

Advanced Cyber Threats Demand a New Privileged Account Security Model Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst ESG Brief Advanced Cyber Threats Demand a New Privileged Account Security Model Date: June 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: In spite of marginal progress, privileged accounts

More information

White. Paper. The Big Data Security Analytics Era Is Here. January 2013

White. Paper. The Big Data Security Analytics Era Is Here. January 2013 White Paper The Big Data Security Analytics Era Is Here By Jon Oltsik, Senior Principal Analyst January 2013 This ESG White Paper was commissioned by RSA Security and is distributed under license from

More information

Staying Secure After Microsoft Windows Server 2003 Reaches End of Life. Trevor Richmond, Sales Engineer Trend Micro

Staying Secure After Microsoft Windows Server 2003 Reaches End of Life. Trevor Richmond, Sales Engineer Trend Micro Staying Secure After Microsoft Windows Server 2003 Reaches End of Life Trevor Richmond, Sales Engineer Trend Micro Windows Server 2003 End of Life- Why Care? The next big vulnerability (Heartbleed/Shellshock)

More information

This ESG White Paper was commissioned by Blue Coat and is distributed under license from ESG.

This ESG White Paper was commissioned by Blue Coat and is distributed under license from ESG. White Paper Network Encryption and its Impact on Enterprise Security By Jon Oltsik, Senior Principal Analyst February 2015 This ESG White Paper was commissioned by Blue Coat and is distributed under license

More information

VMware and the Need for Cyber Supply Chain Security Assurance

VMware and the Need for Cyber Supply Chain Security Assurance White Paper VMware and the Need for Cyber Supply Chain Security Assurance By Jon Oltsik, Senior Principal Analyst September 2015 This ESG White Paper was commissioned by VMware and is distributed under

More information

The ESG Cybersecurity Maturity Model

The ESG Cybersecurity Maturity Model ESG Brief The ESG Cybersecurity Maturity Model Date: October 2014 Author: Jon Oltsik, Senior Principal Analyst Abstract: As part of its research, ESG regularly uses a scoring system to divide survey populations

More information

White. Paper. Understanding and Addressing APTs. September 2012

White. Paper. Understanding and Addressing APTs. September 2012 White Paper Understanding and Addressing APTs By Jon Oltsik, Senior Principal Analyst September 2012 This ESG White Paper was commissioned by Trend Micro and is distributed under license from ESG. 2012,

More information

Threat Intelligence and Its Role Within Enterprise Cybersecurity Practices

Threat Intelligence and Its Role Within Enterprise Cybersecurity Practices Research Report Abstract: Threat Intelligence and Its Role Within Enterprise Cybersecurity Practices By Jon Oltsik, Senior Principal Analyst With Bill Lundell, Senior Research Analyst and Jennifer Gahm,

More information

The SentinelOne Endpoint Protection Platform

The SentinelOne Endpoint Protection Platform Enterprise Strategy Group Getting to the bigger truth. SOLUTION SHOWCASE The SentinelOne Endpoint Protection Platform Date: September 2015 Author: Jon Oltsik, Senior Principal Analyst; and Doug Cahill,

More information

Information-driven Security and RSA Security Analytics and RSA ECAT

Information-driven Security and RSA Security Analytics and RSA ECAT White Paper Information-driven Security and RSA Security Analytics and RSA ECAT By Jon Oltsik, Senior Principal Analyst September 2014 This ESG White Paper was commissioned by RSA, The Security Division

More information

White. Paper. The Modern Network Monitoring Mandate. April 2014

White. Paper. The Modern Network Monitoring Mandate. April 2014 White Paper The Modern Network Monitoring Mandate By Bob Laliberte, Senior Analyst April 2014 This ESG White Paper was commissioned by Emulex and is distributed under license from ESG. White Paper: The

More information

Integrated Network Security Architecture: Threat-focused Nextgeneration

Integrated Network Security Architecture: Threat-focused Nextgeneration White Paper Integrated Network Security Architecture: Threat-focused Nextgeneration Firewall By Jon Oltsik, Senior Principal Analyst September 2014 This ESG White Paper was commissioned by Cisco Systems

More information

Next-generation Security Architecture for the Enterprise

Next-generation Security Architecture for the Enterprise White Paper Next-generation Security Architecture for the Enterprise By Jon Oltsik, Senior Principal Analyst October 2014 This ESG White Paper was commissioned by Palo Alto Networks and is distributed

More information

How Companies Can Improve Website & Web Application Security. Even with a Tight IT Budget

How Companies Can Improve Website & Web Application Security. Even with a Tight IT Budget How Companies Can Improve Website & Web Application Security Even with a Tight IT Budget Website and web application security is no longer a luxury it s a necessity. We live in the age of cyber warfare

More information

Windows Server 2003 End of Support. What does it mean? What are my options?

Windows Server 2003 End of Support. What does it mean? What are my options? Windows Server 2003 End of Support What does it mean? What are my options? Windows Server 2003 End of Life- Why Care? The next big vulnerability (Heartbleed/Shellshock) is looming No more patches from

More information

White. Paper. Endpoint Security Demands Defense-indepth and Advanced Analytics. November 2013

White. Paper. Endpoint Security Demands Defense-indepth and Advanced Analytics. November 2013 White Paper Endpoint Security Demands Defense-indepth and Advanced Analytics By Jon Oltsik, Senior Principal Analyst November 2013 This ESG White Paper was commissioned by Bit9 and is distributed under

More information

The Network Application Security Architecture Requirement

The Network Application Security Architecture Requirement White Paper The Network Application Security Architecture Requirement By Jon Oltsik March, 2011 This ESG White Paper was commissioned by Juniper Networks and is distributed under license from ESG. 2011,

More information

Total year-over-year spending change in networking, 2009-2012. (Percent of respondents) 37% 36% 35% 37% 29% 26% 16% 13% 0% 20% 40% 60% 80%

Total year-over-year spending change in networking, 2009-2012. (Percent of respondents) 37% 36% 35% 37% 29% 26% 16% 13% 0% 20% 40% 60% 80% Research Brief 2012 Networking Spending Trends Date: March 2012 Author: Jon Oltsik, Senior Principal Analyst; Bob Laliberte, Senior Analyst; and Bill Lundell, Senior Research Analyst Abstract: According

More information

To the best of your knowledge, does your organization currently utilize video surveillance at any of its locations? (Percent of respondents, N=302)

To the best of your knowledge, does your organization currently utilize video surveillance at any of its locations? (Percent of respondents, N=302) Research Brief Video Surveillance: Now on IT s Watch Date: December 2013 Author: Jon Oltsik, Senior Principal Analyst, Bill Lundell, Senior Research Analyst, and John McKnight, VP Research This ESG Research

More information

White. Paper. Enterprises Need Hybrid SSO Solutions to Bridge Internal IT and SaaS. January 2013

White. Paper. Enterprises Need Hybrid SSO Solutions to Bridge Internal IT and SaaS. January 2013 White Paper Enterprises Need Hybrid SSO Solutions to Bridge Internal IT and SaaS By Jon Oltsik, Senior Principal Analyst January 2013 This ESG White Paper was commissioned by McAfee. and is distributed

More information

The Clock is Ticking on Windows Server 2003 Support

The Clock is Ticking on Windows Server 2003 Support A Trend Micro White Paper April 2015 The Clock is Ticking on Windows Server 2003 Support >> How Trend Micro can secure your end of life servers while enabling a safe transition Contents Introduction...3

More information

Trend Micro. Advanced Security Built for the Cloud

Trend Micro. Advanced Security Built for the Cloud datasheet Trend Micro deep security as a service Advanced Security Built for the Cloud Organizations are embracing the economic and operational benefits of cloud computing, turning to leading cloud providers

More information

An Analytics-based Approach to Cybersecurity

An Analytics-based Approach to Cybersecurity ESG Solution Showcase An Analytics-based Approach to Cybersecurity Date: May 2015 Author: Jon Oltsik, Senior Principal Analyst Abstract: Since the Google Aurora incident announced in 2010, large organizations

More information

Web Application Security Testing Tools and Services

Web Application Security Testing Tools and Services Research Report Abstract: Web Application Security Testing Tools and Services By Jon Oltsik, Senior Principal Analyst, and Jane Wright, Senior Research Analyst With Jennifer Gahm April 2013 Introduction

More information

CHAPTER 3 : INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS GLOBAL THREAT INTELLIGENCE REPORT 2015 :: COPYRIGHT 2015 NTT INNOVATION INSTITUTE 1 LLC

CHAPTER 3 : INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS GLOBAL THREAT INTELLIGENCE REPORT 2015 :: COPYRIGHT 2015 NTT INNOVATION INSTITUTE 1 LLC : INCIDENT RESPONSE FIVE KEY RECOMMENDATIONS 1 FIVE KEY RECOMMENDATIONS During 2014, NTT Group supported response efforts for a variety of incidents. Review of these engagements revealed some observations

More information

Devising a Server Protection Strategy with Trend Micro

Devising a Server Protection Strategy with Trend Micro Devising a Server Protection Strategy with Trend Micro A Trend Micro White Paper Trend Micro, Incorporated» A detailed account of why Gartner recognizes Trend Micro as a leader in Virtualization and Cloud

More information

Business Enablement Demands Tight Identity and Security Integration Date: April 2009 Author:

Business Enablement Demands Tight Identity and Security Integration Date: April 2009 Author: INFORMATION SECURITY BRIEF Business Enablement Demands Tight Identity and Security Integration Date: April 2009 Author: Jon Oltsik, Principal Analyst Abstract: Identity management and security were once

More information

This ESG White Paper was commissioned by DH2i and is distributed under license from ESG.

This ESG White Paper was commissioned by DH2i and is distributed under license from ESG. White Paper Application Virtualization: An Opportunity for IT to do More with Much Less By Mark Bowker, Senior Analyst November 2012 This ESG White Paper was commissioned by DH2i and is distributed under

More information

Varonis: Secure Enterprise Collaboration and File Sharing Date: June 2015 Author: Terri McClure, Senior Analyst; and Leah Matuson, Research Analyst

Varonis: Secure Enterprise Collaboration and File Sharing Date: June 2015 Author: Terri McClure, Senior Analyst; and Leah Matuson, Research Analyst ESG Brief Varonis: Secure Enterprise Collaboration and File Sharing Date: June 2015 Author: Terri McClure, Senior Analyst; and Leah Matuson, Research Analyst Abstract: With the burgeoning workplace mobility

More information

Devising a Server Protection Strategy with Trend Micro

Devising a Server Protection Strategy with Trend Micro Devising a Server Protection Strategy with Trend Micro A Trend Micro White Paper» Trend Micro s portfolio of solutions meets and exceeds Gartner s recommendations on how to devise a server protection strategy.

More information

ProtectWise: Shifting Network Security to the Cloud Date: March 2015 Author: Tony Palmer, Senior Lab Analyst and Aviv Kaufmann, Lab Analyst

ProtectWise: Shifting Network Security to the Cloud Date: March 2015 Author: Tony Palmer, Senior Lab Analyst and Aviv Kaufmann, Lab Analyst ESG Lab Spotlight ProtectWise: Shifting Network Security to the Cloud Date: March 2015 Author: Tony Palmer, Senior Lab Analyst and Aviv Kaufmann, Lab Analyst Abstract: This ESG Lab Spotlight examines the

More information

YOUR DATA UNDER SIEGE: GUARD THE GAPS WITH PATCH MANAGEMENT. With Kaspersky, now you can. kaspersky.com/business Be Ready for What s Next

YOUR DATA UNDER SIEGE: GUARD THE GAPS WITH PATCH MANAGEMENT. With Kaspersky, now you can. kaspersky.com/business Be Ready for What s Next YOUR DATA UNDER SIEGE: GUARD THE GAPS WITH PATCH MANAGEMENT. With Kaspersky, now you can. kaspersky.com/business Be Ready for What s Next Your Data Under Siege: Guard the Gaps with Patch Management 1.0

More information

By Jason Buffington, Senior Analyst, and Monya Keane, Research Analyst

By Jason Buffington, Senior Analyst, and Monya Keane, Research Analyst White Paper How to Accelerate IT Resiliency Through Virtualization By Jason Buffington, Senior Analyst, and Monya Keane, Research Analyst August 2015 This ESG White Paper was commissioned by Axcient and

More information

Getting on the Road to SDN. Attacking DMZ Security Issues with Advanced Networking Solutions

Getting on the Road to SDN. Attacking DMZ Security Issues with Advanced Networking Solutions White Paper Getting on the Road to SDN Attacking DMZ Security Issues with Advanced Networking Solutions By Bob Laliberte, Senior Analyst March 2014 This ESG White Paper was commissioned by NEC and is distributed

More information

White. Paper. Desktop Virtualization, Management, and Security. November, 2009. By Jon Oltsik, Principal Analyst and Mark Bowker, Senior Analyst

White. Paper. Desktop Virtualization, Management, and Security. November, 2009. By Jon Oltsik, Principal Analyst and Mark Bowker, Senior Analyst White Paper Desktop Virtualization, Management, and Security By Jon Oltsik, Principal Analyst and Mark Bowker, Senior Analyst November, 2009 2009, Enterprise Strategy Group, Inc. All Rights Reserved Contents

More information

The State of Mobile Computing Security

The State of Mobile Computing Security Research Report Abstract: The State of Mobile Computing Security By Jon Oltsik, Senior Principal Analyst and Bill Lundell, Senior Research Analyst With Jennifer Gahm, Senior Project Manager February 2014

More information

REV: 0.1.1 (July 2011) McAfee Security: Intrusion Prevention System

REV: 0.1.1 (July 2011) McAfee Security: Intrusion Prevention System McAfee Security: Intrusion Prevention System REV: 0.1.1 (July 2011) 1 Contents 1. McAfee Network Security Platform...3 2. McAfee Host Intrusion Prevention for Server...4 2.1 Network IPS...4 2.2 Workload

More information

The Need for Real-Time Database Monitoring, Auditing and Intrusion Prevention

The Need for Real-Time Database Monitoring, Auditing and Intrusion Prevention Whitepaper The Need for Real-Time Database Monitoring, Auditing and Intrusion Prevention May 2007 Copyright Sentrigo Ltd. 2007, All Rights Reserved The Challenge: Securing the Database Much of the effort

More information

WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION

WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION Table of Contents Executive Summary...3 Vulnerability Scanners Alone Are Not Enough...3 Real-Time Change Configuration Notification is the

More information

Trends in Private Cloud Infrastructure

Trends in Private Cloud Infrastructure Research Report Abstract: Trends in Private Cloud Infrastructure By Mark Bowker, Senior Analyst and Bill Lundell, Senior Research Analyst With Jennifer Gahm, Senior Project Manager April 2014 Introduction

More information

White. Paper. Information Security, Virtualization, and the Journey to the Cloud. August, 2010

White. Paper. Information Security, Virtualization, and the Journey to the Cloud. August, 2010 White Paper Information Security, Virtualization, and the Journey to the Cloud By Jon Oltsik August, 2010 This ESG White Paper was commissioned by Trend Micro and is distributed under license from ESG.

More information

SavvyDox: Next-generation Collaboration Bridges the Space Between EFSS and ECM

SavvyDox: Next-generation Collaboration Bridges the Space Between EFSS and ECM ESG Solution Showcase SavvyDox: Next-generation Collaboration Bridges the Space Between EFSS and ECM Date: June 2015 Author: Terri McClure, Senior Analyst; and Leah Matuson, Research Analyst Abstract:

More information

White Paper. Why Next-Generation Firewalls Don t Stop Advanced Malware and Targeted APT Attacks

White Paper. Why Next-Generation Firewalls Don t Stop Advanced Malware and Targeted APT Attacks White Paper Why Next-Generation Firewalls Don t Stop Advanced Malware and Targeted APT Attacks White Paper Executive Summary Around the world, organizations are investing massive amounts of their budgets

More information

Lower Security Risks and Costs with Virtual Patching

Lower Security Risks and Costs with Virtual Patching Lower Security Risks and Costs with Virtual Patching A Trend Micro White Paper Trend Micro Deep Security August 2010 I. INTRODUCTION Patch management for vulnerability remediation can be a painful exercise

More information

Cisco Systems and the Migration from Network Access Control (NAC) to Endpoint Visualization, Access, and Security (EVAS)

Cisco Systems and the Migration from Network Access Control (NAC) to Endpoint Visualization, Access, and Security (EVAS) White Paper Cisco Systems and the Migration from Network Access Control (NAC) to Endpoint Visualization, Access, and Security (EVAS) By Jon Oltsik, Senior Principal Analyst October 2014 This ESG White

More information

The Challenge of Securing and Managing Data While Meeting Compliance

The Challenge of Securing and Managing Data While Meeting Compliance ESG Brief Commvault: Integrating Enterprise File Sync and Share Capabilities with Data Protection and Backup Date: September 2015 Author: Terri McClure, Senior Analyst, and Leah Matuson, Research Analyst

More information

Reducing the Critical Time from Incident Detection to Containment

Reducing the Critical Time from Incident Detection to Containment White Paper Reducing the Critical Time from Incident Detection to Containment By Jon Oltsik, Senior Principal Analyst May 2014 This ESG White Paper was commissioned by Bradford Networks and is distributed

More information

Vulnerability Management

Vulnerability Management Vulnerability Management Buyer s Guide Buyer s Guide 01 Introduction 02 Key Components 03 Other Considerations About Rapid7 01 INTRODUCTION Exploiting weaknesses in browsers, operating systems and other

More information

Performance and Scalability with the Juniper SRX5400

Performance and Scalability with the Juniper SRX5400 ESG Lab Review Performance and Scalability with the Juniper SRX5400 Date: March 2015 Author: Mike Leone, ESG Lab Analyst; and Jon Oltsik, ESG Senior Principal Analyst Abstract: This ESG Lab review documents

More information

Breaking down silos of protection: An integrated approach to managing application security

Breaking down silos of protection: An integrated approach to managing application security IBM Software Thought Leadership White Paper October 2013 Breaking down silos of protection: An integrated approach to managing application security Protect your enterprise from the growing volume and velocity

More information

End-to-End Application Security from the Cloud

End-to-End Application Security from the Cloud Datasheet Website Security End-to-End Application Security from the Cloud Unmatched web application security experience, enhanced by real-time big data analytics, enables Incapsula to provide best-of-breed

More information

IBM Security QRadar Vulnerability Manager

IBM Security QRadar Vulnerability Manager IBM Security QRadar Vulnerability Manager Improve security and compliance by prioritizing security gaps for resolution Highlights Help prevent security breaches by discovering and highlighting high-risk

More information

ESG Lab Review. Authors: Copyright 2006, Enterprise Strategy Group, Inc. All Rights Reserved

ESG Lab Review. Authors: Copyright 2006, Enterprise Strategy Group, Inc. All Rights Reserved ESG Lab Review Acopia ARX: Transparent, Heterogeneous Data Migrations for NAS Storage A Product Review by ESG Lab February 2006 Authors: Tony Asaro Brian Garrett Copyright 2006,, Inc. All Rights Reserved

More information

White. Paper. Big Data Advisory Service. September, 2011

White. Paper. Big Data Advisory Service. September, 2011 White Paper Big Data Advisory Service By Julie Lockner& Tom Kornegay September, 2011 This ESG White Paper was commissioned by EMC Corporation and is distributed under license from ESG. 2011, Enterprise

More information

White. Paper. EMC Personalized Support Services: A Focus on Keeping IT Healthy. November 2012

White. Paper. EMC Personalized Support Services: A Focus on Keeping IT Healthy. November 2012 White Paper EMC Personalized Support Services: A Focus on Keeping IT Healthy By Terri McClure, Senior Analyst November 2012 This ESG White Paper was commissioned by EMC and is distributed under license

More information

Enterprise-Grade Security from the Cloud

Enterprise-Grade Security from the Cloud Datasheet Website Security Enterprise-Grade Security from the Cloud Unmatched web application security experience, enhanced by real-time big data analytics, enables Incapsula to provide best-of-breed security

More information

EMC s Enterprise Hadoop Solution. By Julie Lockner, Senior Analyst, and Terri McClure, Senior Analyst

EMC s Enterprise Hadoop Solution. By Julie Lockner, Senior Analyst, and Terri McClure, Senior Analyst White Paper EMC s Enterprise Hadoop Solution Isilon Scale-out NAS and Greenplum HD By Julie Lockner, Senior Analyst, and Terri McClure, Senior Analyst February 2012 This ESG White Paper was commissioned

More information

Managing Your Legacy Systems: What Will Life Be Like After Windows Server 2003?

Managing Your Legacy Systems: What Will Life Be Like After Windows Server 2003? Managing Your Legacy Systems: What Will Life Be Like After Windows Server 2003? After Microsoft ended support for Windows XP last April 8, 2014, users and organizations alike that continued to use the

More information

White. Paper. Building Next Generation Data Centers. Implications for I/O Strategies. August 2014

White. Paper. Building Next Generation Data Centers. Implications for I/O Strategies. August 2014 White Paper Building Next Generation Data Centers Implications for I/O Strategies By Bob Laliberte, Senior Analyst August 2014 This ESG White Paper was commissioned by Emulex and is distributed under license

More information

Endpoint Security: Become Aware of Virtual Desktop Infrastructures!

Endpoint Security: Become Aware of Virtual Desktop Infrastructures! Endpoint Security: Become Aware of Virtual Desktop Infrastructures! An Ogren Group Special Report May 2011 Executive Summary Virtual desktops infrastructures, VDI, present IT with the unique opportunity

More information

Trend Micro Cloud Protection

Trend Micro Cloud Protection A Trend Micro White Paper August 2015 Trend Micro Cloud Protection Security for Your Unique Cloud Infrastructure Contents Introduction...3 Private Cloud...4 VM-Level Security...4 Agentless Security to

More information

VDI-Centric Endpoint Security Can Help Lower Costs and Increase ROI

VDI-Centric Endpoint Security Can Help Lower Costs and Increase ROI White Paper VDI-Centric Endpoint Security Can Help Lower Costs and Increase ROI By Jon Oltsik, Senior Principal Analyst June 2012 This ESG White Paper was commissioned by Trend Micro and is distributed

More information

White. Paper. EMC Isilon: A Scalable Storage Platform for Big Data. April 2014

White. Paper. EMC Isilon: A Scalable Storage Platform for Big Data. April 2014 White Paper EMC Isilon: A Scalable Storage Platform for Big Data By Nik Rouda, Senior Analyst and Terri McClure, Senior Analyst April 2014 This ESG White Paper was commissioned by EMC Isilon and is distributed

More information

Managing the Unpredictable Human Element of Cybersecurity

Managing the Unpredictable Human Element of Cybersecurity CONTINUOUS MONITORING Managing the Unpredictable Human Element of Cybersecurity A WHITE PAPER PRESENTED BY: May 2014 PREPARED BY MARKET CONNECTIONS, INC. 14555 AVION PARKWAY, SUITE 125 CHANTILLY, VA 20151

More information

Endpoint Security More secure. Less complex. Less costs... More control.

Endpoint Security More secure. Less complex. Less costs... More control. Endpoint Security More secure. Less complex. Less costs... More control. Symantec Endpoint Security Today s complex threat landscape constantly shifts and changes to accomplish its ultimate goal to reap

More information

Requirements When Considering a Next- Generation Firewall

Requirements When Considering a Next- Generation Firewall White Paper Requirements When Considering a Next- Generation Firewall What You Will Learn The checklist provided in this document details six must-have capabilities to look for when evaluating a nextgeneration

More information

The Benefits of a Hybrid Security Architecture

The Benefits of a Hybrid Security Architecture White Paper The Benefits of a Hybrid Security Architecture By Jon Oltsik, Senior Principal Analyst November, 2011 This ESG White Paper was commissioned by Blue Coat Systems, Inc, and is distributed under

More information

White. Paper. Good Enough Email Security Is No Longer Good Enough. January 2013

White. Paper. Good Enough Email Security Is No Longer Good Enough. January 2013 White Paper Good Enough Email Security Is No Longer Good Enough By Jon Oltsik, Senior Principal Analyst January 2013 This ESG White Paper was commissioned by Trend Micro and is distributed under license

More information

Defending Against Cyber Attacks with SessionLevel Network Security

Defending Against Cyber Attacks with SessionLevel Network Security Defending Against Cyber Attacks with SessionLevel Network Security May 2010 PAGE 1 PAGE 1 Executive Summary Threat actors are determinedly focused on the theft / exfiltration of protected or sensitive

More information

Securing the Database Stack

Securing the Database Stack Technical Brief Securing the Database Stack How ScaleArc Benefits the Security Team Introduction Relational databases store some of the world s most valuable information, including financial transactions,

More information

ESG Brief. Modern Data Centers: Massive Scale and Complexity. Data Center Networking Discontinuity

ESG Brief. Modern Data Centers: Massive Scale and Complexity. Data Center Networking Discontinuity ESG Brief IBM and NEC Bring SDN/OpenFlow to Enterprise Data Center Networks Date: January, 2012 Author: Jon Oltsik, Senior Principal Analyst, and Bob Laliberte, Senior Analyst Abstract: Enterprise data

More information

White Paper. Architecting the security of the next-generation data center. why security needs to be a key component early in the design phase

White Paper. Architecting the security of the next-generation data center. why security needs to be a key component early in the design phase White Paper Architecting the security of the next-generation data center A White Paper by Bloor Research Author : Fran Howarth Publish date : August 2011 teams involved in modernization projects need to

More information

Closing the Vulnerability Gap of Third- Party Patching

Closing the Vulnerability Gap of Third- Party Patching SOLUTION BRIEF: THIRD-PARTY PATCH MANAGEMENT........................................ Closing the Vulnerability Gap of Third- Party Patching Who should read this paper IT Managers who are trying to manage

More information

Everything You Wanted to Know about DISA STIGs but were Afraid to Ask

Everything You Wanted to Know about DISA STIGs but were Afraid to Ask Everything You Wanted to Know about DISA STIGs but were Afraid to Ask An EiQ Networks White Paper 2015 EiQ Networks, Inc. All Rights Reserved. EiQ, the EiQ logo, the SOCVue logo, SecureVue, ThreatVue,

More information

BIG SHIFT TO CLOUD-BASED SECURITY

BIG SHIFT TO CLOUD-BASED SECURITY GUIDE THE BIG SHIFT TO CLOUD-BASED SECURITY How mid-sized and smaller organizations can manage their IT risks and meet regulatory compliance with minimal staff and budget. CONTINUOUS SECURITY TABLE OF

More information

AccelOps NOC and SOC Analytics in a Single Pane of Glass Date: March 2016 Author: Tony Palmer, Senior ESG Lab Analyst

AccelOps NOC and SOC Analytics in a Single Pane of Glass Date: March 2016 Author: Tony Palmer, Senior ESG Lab Analyst ESG Lab Spotlight AccelOps NOC and SOC Analytics in a Single Pane of Glass Date: March 2016 Author: Tony Palmer, Senior ESG Lab Analyst Abstract: This ESG Lab Spotlight details ESG s hands-on testing of

More information

Why You Need to Test All Your Cloud, Mobile and Web Applications

Why You Need to Test All Your Cloud, Mobile and Web Applications Why You Need to Test All Your Cloud, Introduction In a recent survey of security executives, more than 70 percent of respondents acknowledged that they are performing vulnerability tests on fewer than

More information

Hosted Desktops Rightsized for Desktop Transformation

Hosted Desktops Rightsized for Desktop Transformation White Paper Hosted Desktops Rightsized for Desktop Transformation By Mark Bowker, Senior Analyst December 2013 This ESG White Paper was commissioned by Citrix and HP and is distributed under license from

More information

End of Support Should Not End Your Business. Challenge of Legacy Systems

End of Support Should Not End Your Business. Challenge of Legacy Systems End of Support Should Not End Your Business When software vendors announce a product end-of-life (EOL), customers typically have 24 to 30 months to plan and execute their migration strategies. This period

More information

White. Paper. Benefiting from Server Virtualization. Beyond Initial Workload Consolidation. June, 2010

White. Paper. Benefiting from Server Virtualization. Beyond Initial Workload Consolidation. June, 2010 White Paper Benefiting from Server Virtualization Beyond Initial Workload Consolidation By Mark Bowker June, 2010 This ESG White Paper was commissioned by VMware and is distributed under license from ESG.

More information

Virtualization Essentials

Virtualization Essentials Virtualization Essentials Table of Contents Introduction What is Virtualization?.... 3 How Does Virtualization Work?... 4 Chapter 1 Delivering Real Business Benefits.... 5 Reduced Complexity....5 Dramatically

More information

eguide: Designing a Continuous Response Architecture Executive s Guide to Windows Server 2003 End of Life

eguide: Designing a Continuous Response Architecture Executive s Guide to Windows Server 2003 End of Life Executive s Guide to Windows Server 2003 End of Life Facts About Windows Server 2003 Introduction On July 14, 2015 Microsoft will end support for Windows Sever 2003 and Windows Server 2003 R2. Like Windows

More information

RETHINKING CYBER SECURITY

RETHINKING CYBER SECURITY RETHINKING CYBER SECURITY CHANGING THE BUSINESS CONVERSATION INTRODUCTION Advanced Persistent Threats (APTs) and advanced malware have been plaguing IT professionals for over a decade. During that time,

More information

Enterprise Strategy Group Getting to the bigger truth. By Bill Lundell, Senior Research Analyst and John McKnight, VP Research and Analysts

Enterprise Strategy Group Getting to the bigger truth. By Bill Lundell, Senior Research Analyst and John McKnight, VP Research and Analysts Enterprise Strategy Group Getting to the bigger truth. By Bill Lundell, Senior Research Analyst and John McKnight, VP Research and Analysts March 2015 4 Cloud Computing: Not a Question of If, but Rather

More information