The Compliance and Security Connection

An Update on the Ecora Blog

I just wanted to write a brief note to let everyone know that I will be unable to make new posts to the Ecora Software blog for a while due to some new surgery that I will be having this Wednesday that will have me sidelined for quite some time.

I am looking forward to regaining my full health and being able to return and share new thoughts and even new topics with you soon.

Thanks to each of you for taking the time to read my thoughts and especially to so many of you who have taken the time to post comments over the past few years.

Best regards,

Mark

What the Current Economic Uncertainty Means for IT

This has been a difficult period of time for all of us, on both a business and personal level. The rising cost of fuel has impacted us all, and nearly every region of the county has faced some type of significant weather-related challenge in the past six months.

Now that the weather has improved and fuel prices have moderated some, people have been distracted by the current Olympic Games in Beijing, as is probably evidenced by the amount of YouTube or NBCOlympics.com hits your network has seen in the past two weeks. Throw in the typical summer vacations and the upcoming Democratic and Republican conventions to kick-off one of the most significant Presidential elections in decades, and it’s clear that the upheaval to the economy isn’t going to end immediately.

The Impact on IT Budgets

According to a recent survey by InformationWeek, “of more than 600 business technology executives who responded to our most recent survey, 40% say they decreased IT spending this past quarter relative to their original 2008 budgets; for companies with annual revenue of more than $500 million, it's 50%.”

The survey indicates that budgets going forward this year are not likely to grow. In fact, a large percentage said they were expecting cutbacks. According to the article, “39% say they're cutting, and those cutbacks could be significant, with 19% saying their IT spending this year will be down more than 10%.”

What to Consider When Making Cuts

If you are faced with the unenviable task of reducing an IT budget that you already scrutinized before you submitted it, what are some things you should consider? According to Laurie M. Orlov of CIO Magazine, you should consider the future.

In her article, When Cutting IT Costs, Look to the Future, Ms. Orlov talks about some of the mistakes that were made following the dotcom bust and the Y2K spending hangover and suggests different tactics should be considered in the current economic downturn.

Here are three suggestions she has:

1. Protect hard-to-fill roles
2. Bring on the interns
3. Solicit ideas from your staff and peers

Those work well for maintaining some of the human capital of the organization and maintaining a solid workforce, but it doesn’t begin to address the need to continuously maintain business services , keep corporate and personal data secure, and continue to meet a growing number of compliance mandates aimed at IT.

In the same issue of CIO Magazine, Mack Murrell, Dow Chemical’s vice president of IT, shares some ideas that begin to shed light on some technology decisions you can make to help in tight economic times like we’re in now.

Here are some of the key items Murrell shares:

• “We look at cost management from a strategic point of view. I’ve got a three-to-five year look ahead on costs.”
• Dow has controlled IT costs by maintaining an “appropriate” level of IT standardization
• IT customizes solutions only when necessary

One key, as the article states, is certainly standardization. In this case, the reference was to standardizing of hardware and applications. But, when you are standardizing your infrastructure, it is also important to standardize how they are configured.

Standardizing configurations ensures that your infrastructure will perform at its optimum potential and that critical business services will be available for both your external and internal customers. However, this requires the ability to know how you expect systems to be configured, can easily document how they are really configured, and what discrepancies exist between the two so that corrections can be made.

In addition, nearly every organization faces multiple internal and external audits of their IT infrastructure. A lot has changed since the passage of Sarbanes-Oxley back in 2002.  Audit firms have spent a great deal of time and effort over the past six years hiring and training auditors to be much more knowledgeable about the type of configuration controls that should be in place to reduce the potential risk that might otherwise exist to regulated data in your infrastructure.

Beyond that, Sarbanes-Oxley is no longer the only audit concern facing IT. In fact, Gartner analysts are now forecasting that “by 2012, the number of regulations that directly affect IT operations will double.” In challenging economic times, it is vital that you can respond to various audit demands without the need for a lot of manual effort or external sub-contractors that you can’t afford.

In addition to the suggestions made by Ms. Orlov and Mr. Murrell, if you don’t have an automated solution for effectively documenting and auditing the configuration attributes across your enterprise, let me suggest requesting a personal demonstration of a tool like Ecora Auditor Pro.

Contributed by Mark Tordoff and Bryan Cote

An Olympic-sized IT Project

It's hard to believe, but the 2008 Summer Olympics in Beijing are more than half over. Based on the viewership numbers that are being recorded, a large majority of us have been spending some really late nights in front of the television. In fact, nearly 70 million people caught some portion of the opening ceremonies.

There were certainly plenty of people who felt Michael Phelps attempt at 8 gold medals in a single Olympics was unrealistic (can you say, Ian Thorpe"?), which we now know was certainly challenging and, in the end, made Phelps' achievement all the more captivating. Yet, NBC, prior to the Olympics, made it's own seemingly surreal commitment.

NBC, through it's various broadcast networks and its website, www.nbcolympics.com, committed to broadcasting just shy of 3,000 hours covering virtually every Olympic competition. According to an article in the July 21st eWeek, this "will exceed the total number of U.S. television hours for all previous Summer Olympic Games combined." What I found most interesting in the article is the work being done by Omneion to support NBC, both in storing nearly 17 TB of footage, but also the fact that, through ProCast, a video acceleration management product, 40 US-based "shot-pickers" are able to identify proxy footage for use in deliverable pieces, then feed the information back to the NBC data center in Beijing so that high-resolution clips can be matched to the proxy file.

It has also been quite impressive to consider how much technology has entered into the Olympics themselves, whether we actually like how it was used or not. Beginning with the spectacle that was the opening ceremonies, we later learned that some of the beautiful fireworks were actually 3-D computer graphics. What was more upsetting was that the little girl who sang was not actually singing at all, but was lip-syncing (albeit better than Milli Vanilli ever did!), because some authority within the Chinese government had deemed that 7-year-old Yang Peiyi was not cute enough.

Once the actual competition began, the use of technology played significant roles in competitions involving swimming, diving and gymnastics particularly. No event will represent the importance of technology more than Michael Phelps' gold medal win in the 100 meter butterfly by a mere 0.01 second. Let's face it, by any human eye, Michael would never have been declared a winner. However, between the cameras placed under the water's surface and the touch pads themselves, it was obvious even to Serbia's coaches and Milorad Cavic himself that Phelps had managed to touch ahead of the coasting Cavic.

Certainly, with the majority of the track and field events scheduled for this week, we are certain to see more races decided through the use of electronic technology.

The one question that remains to be answered will be how technologically secure were these Games. We all know that in spite of the incredible technological and human resources being used by China to have a safe and secure games, there was still the murder of Todd Bachman, father of former Olympian Elisabeth Bachman and father-in-law of US men's volleyball coach Hugh McCutcheon in the hours after the opening ceremonies.

The questions that will be of interest will be what potential personal information may be breached from the systems used to store information on the athletes and the event attendees. Given the focus on these games, those intent on stealing personal data must be placing a lot of resources focused on trying to capture the valuable data that is lying in servers throughout Beijing.

Think about it - there are more than 11,000 athletes and some 160,000 were estimated to be in attendance for the opening ceremony alone. I am not sure what data was required of the Olympians themselves to prove their identification, but you have to assume that's in a database somewhere in Beijing, but there is credit and debit card information at who knows how many hotels, restaurants and other tourist destinations throughout the area. You can find out a lot more about the Beijing Olympics IT team in this Computer Weekly story.

To find out more about why this has probably been on the minds of the IT professionals behind the Olympic Games and may remain there long after the closing ceremony is over, you'll have to read my posts the rest of this week on some of the findings from the TJX case that were unveiled two weeks ago in court documents.

Contributed by Mark Tordoff

Ecora Further Enhances Auditor Professional with Expanded Enterprise Features

Ecora Software, the market-proven leader for configuration auditing and compliance reporting solutions, announced the availability of Service Pack 1 for its Ecora Auditor Professional™ version 4.5 software. Auditor Professional is used by more than 800 customers worldwide to reduce the high cost of compliance mandates, lower the cost of downtime, increase overall security, and improve the operational efficiency of IT professionals. Auditor Professional 4.5 discovers, collects, analyzes and reports on configuration data from your infrastructure and delivers immediate value by leveraging pre-defined policies and rich report templates to provide the foundation for effective configuration and change management. Created to ensure that companies are prepared for any IT challenge related to system configuration, version 4.5 takes the cost and complexity out of compliance audits while providing IT professionals with a comprehensive and flexible solution to help deliver higher levels of security, reliability, and availability.

Auditor Professional 4.5 SP1 contains new capabilities and critical updates in several key areas including:

Virtualization

Ecora Auditor Pro 4.5 SP1 now offers discovery and reporting capabilities for VMware's ESX server Version 3.5. This version of VMware's virtualization infrastructure products provides advanced functionality, including the well-received VMware Storage VMotion and VMware Update Manager and provides a software upgrade path to the company's ESXi implementation which is pre-installed on select server hardware from Dell, Fujitsu, Siemens, HP, IBM, and NEC.

Enterprise Support

Ecora has extended its capabilities for help desk and asset database integration by adding support for BMC Remedy 7 and software-as-a-service (SaaS) solutions, such as Service-now.com, to supplement previously released support for BMC Remedy 6 and HP Service Desk 4.5. Integration between Auditor Professional and these enterprise IT service management systems ensures staff are informed of changes that may not have been planned and validate configuration and asset databases are accurate and up to date with current configuration information directly from across all systems.

"The feedback from customers and the analyst community on Auditor Professional 4.5 has been tremendous," said John Walsh, Senior Vice President of Engineering, Ecora. "Service Pack 1 further extends the enterprise capabilities we shipped Auditor Pro 4.5 in January and offers new options for organizations looking to leverage virtualization to reduce costs and develop a 'green' IT environment as well as those looking to validate the effectiveness of their change management process. The addition of support for SaaS solutions such as Service-now.com means that organizations of almost any size can take advantage of IT service management systems that are integrated with deep configuration data and reporting."

Availability

Ecora's Auditor Professional 4.5 SP1 is available immediately. For more information and current pricing, contact Ecora by phone at 877-92ecora (923-2672) or by emailing sales@ecora.com. A trial evaluation of Auditor Professional can be requested on www.ecora.com.

About Auditor Pro

Ecora's Auditor Pro delivers immediate value by leveraging pre-defined policies and rich report templates to provide the foundation for effective change and configuration management. Auditor Pro has distinguished itself in the marketplace by delivering exceptional value in each of the five core competencies required for an effective configuration audit and analytics solution: Discovery, Collection, Analysis, Reporting, and Closed-Loop Change Validation.

About Ecora Software

Ecora Software is the market-proven leader for Configuration Auditing and Compliance Reporting solutions that allow a proactive view of the IT infrastructure and deliver actionable evidence ensuring critical business services remain operationally effective, secure, and compliant with internal standards and external regulations. Auditor Professional™ offers immediate value with its agentless architecture matched with rich report templates and pre-defined policies providing the foundation for effective change and configuration management. Please visit us at www.ecora.com

BMC, BMC Software, BMC Remedy are registered trademarks of BMC Software, Inc., HP Service Desk is a registered trademark of Hewlett-Packard Development Company, L.P., and Service-now.com is a registered trademark
of Service-now.com.

OMB Says Government Security Incidents Rose in 2007

According to FCW.com, "Agencies reported twice as many information technology security incidents in fiscal 2007 compared with the year before. The number of incidents in six categories reached 12,986, compared with 5,146 in 2006, the Office of Management and Budget said. One of those categories, unauthorized access, jumped to 2,321 in 2007 from 706 the year before, OMB said in its report to Congress that was released today. The increase in unauthorized access is due mainly to reporting required now for all instances where personally identifiable information may have been revealed, the report states.

Although OMB is concerned by the increase in incident reporting, it’s not altogether a bad thing, said Karen Evans, OMB’s administrator for e-government and information technology.

'It’s a good thing because agencies are sharing the information with [the U.S. Computer Emergency Readiness Team] the way they’re supposed to so we can take action in a comprehensive way,' she said in a briefing call with reporters. She expects that use of secure identification cards required under Homeland Security Presidential Directive 12 will help reduce security incidents because the cards provide two-factor authentication."

GovernmentExecutive.com, in an article on the same OMB report, quoted Alan Paller, director of research at the SANS Institute, a nonprofit cybersecurity research organization in Bethesda, Md. as saying, "The fact that the number [of incidents] is going up does not reflect worse security, if reflects worse attacks. The attacks are more sophisticated."

The article goes on to share that "Members of Congress also expressed concern with the reliance on certification and accreditation for judging system security during a recent hearing. Evans said that OMB is trying to work with the National Institute of Technology and Standards and Technology to develop new metrics for evaluating information security.

To Paller, money could be better spent. 'It costs on the order of $50,000 per system to do one of those [system reviews], and on average fewer than 8 percent are ever even read by anyone that can do anything with them,' he said. 'Agencies are spending this large chunk of money for report writing, rather than using it to actually secure the systems.'"

Evans' response leads me to ask, how is a card going to correct unauthorized access? If they gained unauthorized access before, doesn’t that mean they were using someone else’s credentials or there were other access points in the system that were weak enough to be bypassed? There is clearly a need for strong access security at all levels of the enterprise, not just the initial point of entry.

Ms. Evans is a much-quoted spokesperson for IT security in the federal government. In this case, her answers seem a little bit too much like trying to put a positive spin on some bad numbers, as opposed to calling for more effort among federal agencies to improve their security efforts. That's not something a card is going to help.

Contributed Mark Tordoff

OMB Says Government Security Incidents Rose in 2007

According to FCW.com, "Agencies reported twice as many information technology security incidents in fiscal 2007 compared with the year before. The number of incidents in six categories reached 12,986, compared with 5,146 in 2006, the Office of Management and Budget said. One of those categories, unauthorized access, jumped to 2,321 in 2007 from 706 the year before, OMB said in its report to Congress that was released today. The increase in unauthorized access is due mainly to reporting required now for all instances where personally identifiable information may have been revealed, the report states.

Although OMB is concerned by the increase in incident reporting, it’s not altogether a bad thing, said Karen Evans, OMB’s administrator for e-government and information technology.

'It’s a good thing because agencies are sharing the information with [the U.S. Computer Emergency Readiness Team] the way they’re supposed to so we can take action in a comprehensive way,' she said in a briefing call with reporters. She expects that use of secure identification cards required under Homeland Security Presidential Directive 12 will help reduce security incidents because the cards provide two-factor authentication."

GovernmentExecutive.com, in an article on the same OMB report, quoted Alan Paller, director of research at the SANS Institute, a nonprofit cybersecurity research organization in Bethesda, Md. as saying, "The fact that the number [of incidents] is going up does not reflect worse security, if reflects worse attacks. The attacks are more sophisticated."

The article goes on to share that "Members of Congress also expressed concern with the reliance on certification and accreditation for judging system security during a recent hearing. Evans said that OMB is trying to work with the National Institute of Technology and Standards and Technology to develop new metrics for evaluating information security.

To Paller, money could be better spent. 'It costs on the order of $50,000 per system to do one of those [system reviews], and on average fewer than 8 percent are ever even read by anyone that can do anything with them,' he said. 'Agencies are spending this large chunk of money for report writing, rather than using it to actually secure the systems.'"

Evans' response leads me to ask, how is a card going to correct unauthorized access? If they gained unauthorized access before, doesn’t that mean they were using someone else’s credentials or there were other access points in the system that were weak enough to be bypassed? There is clearly a need for strong access security at all levels of the enterprise, not just the initial point of entry.

Ms. Evans is a much-quoted spokesperson for IT security in the federal government. In this case, her answers seem a little bit too much like trying to put a positive spin on some bad numbers, as opposed to calling for more effort among federal agencies to improve their security efforts. That's not something a card is going to help.

Contributed Mark Tordoff

Customers Benefit When IT Vendors Collaborate...and Cooperate

In my post this past Tuesday, I shared various IT projections for 2008. One of the more common themes was the need for integration.

Over the past two years, as we were determining the necessary enhancements to add in our latest release of Auditor Pro 4.5, which was announced on BusinessWire and picked up by Forbes.com, Yahoo Finance, MarketWatch and Security Sales & Integration, we heard similar comments from many of our 800 active worldwide customers.

One of the leading developments in Ecora's latest release is Auditor's Service Management Interface Connector, with established integrations with BMC Remedy and Atrium and HP Service Desk. This was added to the product's development cycle as a direct result of customer input requesting the ability to receive systemic validation of approved system changes while having the ability to use existing change processes to remediate unintended or inappropriate changes that are revealed from scheduled configuration audit reporting.

This is just one form of "integration" however. One that has really energized me is the cooperation between IT vendors that have no direct, revenue generating interest, but rather recognize that by working with vendors with other areas of expertise, they can provide IT professionals with more comprehensive information and provide more comprehensive solutions. One recent example of that was a webinar we did with StackSafe, which provides software infrastructure testing solutions that enable IT Operations to significantly improve uptime and resiliency. What is exciting about StackSafe is, as a start-up, they invested in having some meaningful research conducted by Research Edge that not only helped them identify a meaningful market for their product, but also provided IT professionals with invaluable statistical evidence to validate to their organization's senior management how investing in an appropriate testing environment can improve overall IT productivity. How many times do you know something would be worthwhile for your company but you don't have the proof to substantiate it, so it never goes anywhere? That's why we felt it was so valuable to share this research with our customers and prospects too. Read what Dennis Powell from StackSafe had to say about some of the webinar feedback.

A debate along these lines came up in a recent issue of SC Magazine over PCI compliance and whether you should look for an "all in one" solution" like Big Blue has been peddling or choose several best-of-breed vendors to meet the 12 requirements.

Ecora's Senior Product Manager, Bryan Cote, participated in the debate and made these comments:

"Solutions which are comprised of best-of-breed components offer clients the ability to select vendors with the experience needed to address their unique business challenges and implement those components in an incremental fashion as their compliance requirements dictate.

While it may be obvious that there are differences in competencies for a network vulnerability scanning vendor and a server configuration auditing application, those differences become more distinct when you factor in the need to apply those competencies to a host of different customer profiles and operational requirements.

All-in-one solutions tend to be configured to “typical” business and operational profiles. Best-of-breed solutions tend to address a broader set of requirements and offer broader value than simply addressing the compliance issue at hand. In terms of responding to evolving standards such as PCI, best-of-breed solutions tend to respond faster with updates and enhancements, enabling you to respond quicker."

Not only will you gain the unique expertise of each vendor, they will have more reason to continue to earn your business by continuing to provide you with valuable insight into your specific challenges and maintain their commitment to enhancing their product offering as your needs change. It may even foster actual product integrations, as in the case of our integrations with BMC and HP and the prospect of integrations with other other IT and Business Service Management-related services and components.

Contributed by Mark Tordoff
   

2008 IT Projections Focus on Delivering Greater Consumer Value

Shortly after the first of the year, I shared several specific IT challenges Ecora expected organizations to face in 2008. The Sarbanes-Oxley Journal took enough interest in what we'd learned from our customers that they shared it in their January 28th edition and their sister publication, Regulations-Daily.

Several other publications have shared interesting thoughts on 2008 in recent weeks.CIO Insight shared the results of their survey of some 251 respondents on their organization's three most important business priorities for 2008. Not surprisingly, the top two responses were delivering better service to customers and improving business processes. Mirroring those priorities, the same individuals indicated that creating or improving strategic applications and expanding their IT infrastructure to keep up with growth were their top technology priorities for 2008.

Mario Moreira, in CM Crossroads, shared his predictions for the Configuration Management and Application Lifecycle Management categories in 2008 and they also feed into the idea of steamlining the delivery of business services with the intent of improving overall business productivity and performance.

Here is a summary of Mario's predictions:

"Prediction #1:  A need for more agility    I predict that we will see a continued focus on agility in the way we approach and deploy CM and ALM.  This takes several forms.  First it is the ability for companies to establish CM systems quickly and easily.  Second, it is the ability to increase productivity by having faster tools that allow for a continuous nature of progress.   

Prediction #2:  A need for more standard IT Standardization   I predict that we will see companies more focused on standard approaches to change control.    This takes several forms.  Part of this is driven by ITIL and ISO 20000 certification.  ITIL provides a set of practices and procedures where Change Management, Configuration Management, and Release Management make up key practices.  More companies are moving toward ITIL and the companion ISO 20000 certification.  ISO 20000 is the international standard for IT Service management and the management overview over the ITIL practices.      

Prediction #3:  More focus on Integrations 2008 will continue to see a growing need to have more of a need for ALM technology that has well integrated functionality to support processes across an application lifecycle and even into environments.  This will support the end-to-end view that many customers are looking for when managing their software development.   This also includes the continued shift where the consumers are looking for CM tools that better integrate with other tools in the application lifecycle and tools and require less integration effort."

  An article in Computerworld from Mary K. Pratt highlights 8 technologies to master in 2008. Given some of the other suggestions above, it is no surprise that virtualization, automation and integration make up 3 of the 8 areas Mary focuses her attention on. Concepts like Real-time collaboration, Web 2.0, consumer-oriented devices, and unified communications also make sense when so many organizations are trying to deliver more services to consumers, while maximizing the productivity of their people and physical resources.

Tomorrow, I'll share how Ecora has taken what we've heard from our customers and applied it to our latest release as an example of how vendors takes input from analysts, industry experts, customers and prospects and integrates it into the software development process.

Contributed by Mark Tordoff

Ecora Outlines IT Challenges Ahead in 2008

One of the benefits of working with as many customers as we do at Ecora is the opportunity to get a broad perspective of the challenges facing IT organizations. This view crosses numerous industries and a variety of organizational sizes.

For the first time, Ecora has used the insight we've received to summarize some of the challenges we expect IT to face in the coming year into three distinct categories: emerging and new compliance initiatives, trends in best practices and IT implementations. While not meant to be an exhaustive list of the potential challenges for the year to come, we feel these will be some of the topics that will gain the greatest mindshare this year. I thought it would be appropriate to share those challenges with you in hopes that it might foster a discussion on a number of the points.

Emerging Compliance Issues

--The Impact of Multiple Compliance Initiatives: Organizations have become subject to multiple compliance mandates in recent years. While Sarbanes-Oxley (SOX) has garnered the majority of headlines in 2008, the average enterprise company will be charged with meeting the standards of between six to 10 federal and state compliance initiatives at any one time. Companies attempting to manage each compliance standard independently will be hampered by escalating audit expenses, a continuing drain on staff resources, and consistent failures to meet deadlines for new IT initiatives. At any one time, the following standards could apply to a typical enterprise company:

-- Sarbanes-Oxley (SOX)

-- Health Insurance Portability and Accountability Act (HIPAA)

-- Federal Rules of Civil Procedure (FRCP)

-- Basel II

-- Gramm-Leach-Bliley Act (GLBA)

-- Japan's Internal Controls over Financial Reporting (ICFR) or (J-SOX)

-- Payment Card Industry Data Security Standard (PCI DSS)

New Compliance Initiatives
--2008 will be another watershed year in which companies will be required to comply with federal and state mandates. Some of the recent compliance initiatives companies can expect to deal with in 2008 include:
		-- SOX: For public companies under the 75 million cap, non-accelerated filers will be required to provide management's assessment regarding internal control over financial reporting in its annual reports for fiscal years ending on or after Dec. 15, 2007. Government estimates put the number of companies in this category at roughly 13,000.
		-- FRCP: On Dec. 1, 2006, the rules governing procedure for electronic discovery in federal cases were amended under FRCP. This is significant, as recent studies indicate that 92 percent of corporate legal departments have had to deal with some sort of e-discovery issue in the past 12 months.
		-- PCI: Level one merchants, those conducting more than six million transactions annually, were required to meet PCI compliance by Sept. 30, 2007; while level two merchants, 150,000 to six million transactions annually, were required to meet that deadline on or before Dec. 31, 2007. The field will expand in 2008 to include level three, 20,000 to 149,999 annual transactions, and level four merchants, under 20,000 annual transactions. Of note, Visa reports that, while level four merchants have far fewer annual transactions than those at levels one, two and three, they account for more than 99 percent of the merchants that accept Visa.

Trends in Best Practices

-- Adoption of ITIL v3: Companies will actively pursue programs to implement Information Technology Infrastructure Library (ITIL) v3 and more widely adopt a "service management" approach for IT. This is a trend away from managing discrete devices, towards managing services against internal service level agreements or "SLA's".

-- System Reliability Expectations to Expand to the 6th Nine: Service Level Agreements are moving beyond the "Five-9s" expectation of 99.999 percent uptime and reliability. In the coming year, many organizations will be expected to increase to 99.9999 percent reliability. While the figure may seem nominal on the surface, a closer look into reliability statistics highlights that, in industries such as financial services and banking, the 6th 9 can represent recovery of lost revenue in the millions of dollars.

-- Service Oriented Architecture (SOA): In 2008, companies will continue to redefine views of their architecture based on business services, while adopting a risk-based approach to data. The ability to define audit parameters will necessitate companies develop new methodologies for auditing and analyzing the configuration of their infrastructures. The goal will be to create a holistic view of architecture rather than each application, system and network device operating within its own independent silo.

IT Implementations
--Introduction of New Software by major vendors: Many major software vendors have introduced new versions of software that are only now beginning to impact a vast majority of organizations. Software versions with change management and compliance issues that are expected to be widely deployed in 2008 include:
		-- Microsoft Exchange 2007: The implementation of Exchange 2007 will not allow organizations to deploy the new version on the existing Exchange server, meaning a new server environment will need to be deployed. This will require the physical transfer of data from one server to another, thus creating an opening for possible configuration issues.
		-- Microsoft Vista: In 2008, the industry will see the first major adoption of Vista by the business and educational communities. Business and secondary and post-secondary educational institutions have been slow to adopt Vista until the first service pack offering had been released and, with its release, should now lead organizations to integrate Vista in increasing numbers. This will present a myriad of challenges for companies as they attempt to configure existing applications to a new environment.
		-- Virtualization: 2008 will continue the rise in adoption of virtualization and all that goes with it. While virtualization brings many performance benefits to the IT environment, business must continue to be cognizant of the security concerns that are created in a virtual environment versus the traditional physical environment. As pointed out by Gartner Research, 60 percent of all virtualized environments will be less secure than their physical counterparts through 2009. Let me know your thoughts on these items or areas we may have neglected to mention that you feel are worthy of attention. Contributed by Mark Tordoff

When Technology Vendors Collaborate, You Win

It is often easy to become jaundiced by marketing pitches for simplifying complex IT processes or solving compliance mandates out of the box.

Often, competing companies will say virtually the same thing, making it virtually impossible to distinguish one offering from another. With tens or hundreds of thousands of dollars involved in the purchasing decision, it can really put the person responsible for championing a software or hardware investment in a tough place.

Yet, there are times when vendors come together that is, in my mind, very refreshing.

I remember feeling that way sitting across from David Taylor, president of the PCI Security Vendors Alliance at last year's RSA Conference. David, whose day job is as vice president of data security strategies with Protegrity, was sharing the vision he and several others had in organizing the Alliance. At the time, they were struggling with whether or not to allow membership to companies seen as competitors to the founding companies. Yet, in listening to David, you knew that his heart was to see the industry rise above the day-to-day battle for sales to truly educate merchants and processors on how to secure their environments and succeed at meeting the PCI Data Security Standards. I walked away convinced that David was interested in pursuing something more enduring than just another consulting opportunity.

Over the past few weeks, I've been privileged to work on the preparations for three webinars that will be held this week. Each of them is a collaborative effort between Ecora and another company within the industry. Each is a unique opportunity to learn important information involving key IT challenges like downtime, compliance and security.

StackSafe is a new company whose offerings will become publicly available in 2008, yet is already considered by Network World as one of its top ten IT management companies to watch. StackSafe has spent its ramp-up time very productively by utilizing Research Edge to conduct detailed studies around the issues of downtime and change management. In a webinar this Tuesday, Dennis Powell from StackSafe will be sharing key findings from this research.  This study, which involved more than 400 participants, really brings a lot more detail to the issues around what really causes most downtime and what are the necessary steps to reduce these incidents. It's exciting to see a new company make a commitment to know what problems need to be addressed, rather than just try to force "their solution" onto the market or carve out a piece of someone's else market rather than be innovative.

VeriSign has been doing assessments around cardholder data security for as long as anyone. Before their was a PCI Security Standards Council, there was Visa's Cardholder Information Security Program and VeriSign was a qualified assessor almost since the beginning. Now, as you know, there have been lots of propaganda from vendors and assessors alike about who can help you become compliant, what the requirements mean and even IBM's recent announcement that they offer a total solution for all 12 PCI requirements. (by the way, what's IBM's liability if you were to use them as your total compliance solution and you still fail the assessment?)

Recently, VeriSign took the collective results of their CISP and PCI-related assessments from the past four years to come up with the most common failure points they've found. Conducting more than 100 assessments annually, it is safe to say that this is the most far-reaching evaluation of cardholder data security to date. On Wednesday, Branden Williams, the team lead for VeriSign's PCI practice will be sharing those findings. VeriSign doesn't have to share these results through a vendor like Ecora, but chooses to do it because they've made it part of their mission to evangelize the need for greater security around cardholder information. Trust me, VeriSign could find far larger venues to share their message, which is what makes their participation such an important opportunity for everyone who attends.

Finally, one of the coolest things I've experienced since coming to Ecora has been witnessing a conversation between Paul Carman, Technical Product Manager at Intellitactics, and Bryan Cote, Senior Product Manager at Ecora that's taken place over the last several weeks. What began initially as an innocent inquiry to co-promote a webinar became a lively discussion around the challenges of identifying potential vulnerabilities and tying them to specific configuration attributes. What has evolved from these conversations has gone far beyond a simple webinar where each company talks about its own unique value proposition. Instead, the commitment of two organizations to passionately share their expertise has given birth to some rather revolutionary thinking that could reap great benefits for providing greater visibility into the potential risks associated with both authorized and unauthorized configuration change. You can hear about the results of the collaborative efforts of these two companies in a webinar this Thursday.

Now, in spite of all that I've said, I realize that some of you are still going to see this as a marketing guy's creative effort to get you to sign up for a webinar. I knew that was a risk going into this. However, I hope you'll see this for what it is. A real heart-felt expression of the enjoyment I've received working collaboratively with others to provide meaningful information to help make an IT professional's job a little easier...to at least point them in the right direction. Regardless of what vendor's are involved, pay attention when they work together. It's usually indicates some group of people are thinking about something greater than their own immediate success.

Contributed by Mark Tordoff