IBM responds by introducing a host of integrated solutions to thwart Web application attacks.
The financial pressures that companies are under today certainly are being felt in IT departments all across the world. The result, clearly, is IT managers searching for more efficient and cost-effective solutions. While Web services, and more recently, cloud computing, appear to offer companies the means to reduce costs and improve service levels, they have opened up huge data vulnerabilities that IBM and its worldwide customers are scrambling to plug.
IBM has been in the security business for a long time, but this summer it is ramping up its portfolio of security solutions and services at a rapid pace in order to try to protect its customers from an onslaught of threats and dangerous attacks over the Internet that are increasing at a frightening pace. IBM has an army of more than 15,000 researchers, developers, and subject matter experts on security initiatives. It holds more than 3,000 security and risk management patents. It has nine security operations centers and seven security research centers that manage security in more than 133 countries. If this were a Western movie, IBM would be the cowboy wearing a white hat and riding a white horse while chasing a band of outlaws that far outnumber it and probably have bigger guns.
IBM's recent acquisition of the Waltham, Massachusetts-based company Ounce Labs, Inc. will give IBM a portfolio of new solutions to help its customers identify and resolve vulnerabilities in their applications' source code. Ounce Labs is a privately held company whose software is designed to help reduce risks and costs associated with security and compliance issues. Its solutions, which provide application source-code testing, identify and resolve security vulnerabilities.
On the heels of the Ounce Labs acquisition, IBM announced last week the release of what it is calling "the industry's most comprehensive solutions for helping to combat Web application attacks and to secure the integrity of data processed by Web applications." A forthcoming report is expected to provide statistics on the threat levels and on Web application attacks, which have shot up during the second quarter of 2009. The IBM X-Force 2009 Midyear Trend and Risk Report will be released later this month. One scary statistic inside indicates that SQL injection attacks, in which malicious code is placed into legitimate Web sites to infect unsuspecting visitors, nearly doubled last quarter over the first quarter in 2009, which itself showed a rise of 50 percent above the fourth quarter of 2008. Criminals are intent on stealing and manipulating data and taking command of infected computers.
Such threats require robust security solutions that go beyond much that the industry has felt it needed to deploy to this point. Dan Powers, vice president of business strategy at IBM Internet security systems, owns the job of overseeing and coordinating IBM's solutions to target these threats. "Web application security is one of the top pain points for enterprises today," says Powers. "IBM can offer a comprehensive solution designed to help turn the tide against SQL injection and other Web application attacks," he says with confidence. "Additionally, our integrated approach to security may help to reduce costs and simplify security management, which can ultimately reduce opportunities for human error and improve overall security posture."
Earlier this month, IBM announced its information infrastructure portfolio that includes IBM SiteProtector 8.0, a key offering. Other solutions included Proventia Server for Windows 2008, encrypted disk support for the System Storage DS5000, and IBM Tivoli Identity Manager 5.1, for more effective enforcement of service on demand. It also included Tivoli Security Information and the Event Manager's named entity recognition component (NERC) module that helps improve security without affecting productivity. Since Web applications often rely on Web services and service-oriented architecture (SOA), IBM figures it makes sense to integrate the effective security and governance features of its WebSphere Data Power SOA Appliances with Tivoli Security Policy Manager, which is known for its centralized management capabilities. Using both solutions, enterprise architects can combine forces with security operations personnel to better align business and IT interests by centrally managing and enforcing security policies for Web services across multiple policy enforcement points. The hoped-for result is a reduction in manual, and sometimes inconsistent, administration of security policies and enablement of a consistent enforcement of operational and lifecycle governance policies.
Along the same lines of combining solutions, IBM also is integrating Proventia SiteProtector 8.0 with Rational AppScan, a leading solution for Web application vulnerability and code testing. AppScan provides automated Web application scanning and testing for all common Web application vulnerabilities--including WASC threat classifications, such as SQL injection, cross-site scripting, and buffer overflow--and offers fix recommendations to ease remediation. In addition, IBM recently announced a Web application protection module for network and host intrusion-prevention systems.
IBM is hoping its combined solutions will allow enterprises to correlate application vulnerabilities with potential security events, block real-time attacks, prioritize responses, and immediately address the worst threats. It sees its customers eventually with an improved security posture, a consolidated reporting infrastructure, and a common workflow system for managing security incidents.
Defending against Web application threats will take more than a traditional reactive approach to security. Using point products that address only small segments of the problem and that add to complexity of security operations won't be enough. The solution begins with including security-oriented features and architecture in new code development, real-time blocking of attacks, dedicated security for Web services, and tight access management. All this is going to cost money, so IBM is arranging financing for these comprehensive security solutions, a welcome relief at a time when business may be down, but security threats are up--way up.