Access management is critical to protecting a business’s assets, but implementation has languished because of cost and complexity. In particular, application- and server-based techniques take too much time, apply to only one application at a time, and fail to provide enough protection because they leave the rest of the network wide open. The new frontier in access management is to implement access control directly in the network infrastructure. This approach, based on intelligent infrastructure, provides a simpler, faster, and dynamic means of controlling access to corporate resources, with tighter security to boot.
Why has access management emerged as such a critical task? Traditionally, we allowed anyone inside the building to go anywhere on the LAN – they were assumed to be a trusted insider. But now, with today’s increased reliance on contractors and business partners, as well as guest demands for network access while onsite, the outsiders are now the insiders. The simultaneous change to migrate to digital storage of nearly all critical business assets, and insider awareness of the value of that information, has dramatically increased corporate risk.
Businesses today must enable the connectivity and access people require to do their jobs effectively and businesses require to collaborate with outside entities, but they must also ensure their valuable online assets are not compromised.
Application-based controls have been available for a long time and indeed will continue to flourish. Details about which personnel can complete which steps in an order entry and fulfillment process, for example, will continue to reside within a company’s enterprise resource planning (EPR) application. But not all applications have such controls, and implementing basic control over who can access a certain application is not scalable when attempted application by application.
Similarly, server-based controls have their place too, with IT able to designate folder and file access directly on servers. Again, however, the scalability issue is severe, with IT needing to designate for each folder and file, on every server, which groups of people should be allowed access.
Network-based controls have the advantage of applying controls within the infrastructure so that IT does not have to go to each application or each folder on a server to designate access rights. These tools, however, have also had significant scalability issues to date. IT has historically had only the most primitive of tools at their disposal – the use of virtual LANs (VLANs) and access control lists (ACLs).
VLANs and ACLs are challenging to configure, relying on IP addresses and TCP port numbers and an arcane syntax. Plus, IT has very few testing or troubleshooting tools available to determine if an ACL has been properly configured or to know when or against whom an ACL has been used to block access. In these days of increased business scrutiny, with auditing and compliance concerns impacting the majority of businesses, IT needs a fresh way to embed controls in the network.
More intelligent infrastructure, with knowledge of the user and application and the ability to enforce access policies based on that information, are the key to IT’s ability to keep pace with changing business practices while protecting assets on the LAN. Intelligent LAN appliances and next-generation switches can deliver this user and application control. Having such intelligence embedded in the infrastructure gives IT the simple tools they need to support connectivity without risking valuable data. The intelligent appliances allow IT to embed control in networks without making any other infrastructure changes, while intelligent switches are the smart choice for any network expansion or upgrade.
Intelligent infrastructure leverages many existing assets. It ties into the directory structure, with its user groups in place, and uses that data to automatically authenticate users as they come onto the LAN and place them into a role. IT can also designate “security zones,” classifying files, servers, and applications into their appropriate business use and outlining which groups can access those zones.
With these two basic steps, IT has just answered the most challenging aspects of access management – who should go where on the LAN. And by tying into directories, IT is able to automatically keep up with individual user changes, provisioning and deprovisioning users readily. Plus, by elevating policy to roles, IT simplifies the control matrix needed – those who process bill payments need to be in the PCI (Payment Card Industry) role and have rights to the servers and applications hosting credit card data. This approach is much simpler than trying to create ACLs to block the IP addresses that shouldn’t reach those servers.
IT can also use this user and application intelligence to get more granular about their controls. It may be appropriate, for example, for a bank teller to access customer accounts out on the floor, but that same access – by the same person, to the same application – would not be appropriate from the back office location. Application- or server-based controls cannot provide this level of context to ensure appropriate access management.
This intelligence also provides layers of protection for IT beyond policy enforcement. An understanding of application behavior means that an application with aberrant behavior is now identifiable, and can be stopped. So if an application or device is being used inappropriately, to propagate an attack or attempt data access it shouldn’t have, the intelligent infrastructure can detect and stop this traffic.
Plus, by embedding this intelligent control in the infrastructure right at the user edge of the LAN, IT gains much tighter control throughout the LAN. Using ACLs, embedded on a core switch only, leaves the rest of the LAN wide open, to both intentional attacks or the accidental spread of malware.
Centralized policy creation, distributed to enforcement devices throughout the LAN, vastly simplifies the task of access management in today’s LANs. Appliances and switches that offer intelligent control over users and applications provide the critical foundation needed to support the business today. This intelligent infrastructure allows IT to support the full scope of users “inside” and “outside” the business, quickly roll out new applications and locations, and yet simultaneously protect the vital assets at the heart of today’s companies.
Jeff Prince is chief technology officer for ConSentry Networks. Jeff has more than 18 years of experience developing networking and ASIC technologies. Jeff holds eight patents related to networking technologies, and he has a BS in Computer Engineering from California State University Chico. Jeff is also a managing partner at Prince Ventures, LP.
Senin, 03 November 2008
Jumat, 03 Oktober 2008
ONStor introduces new midmarket enterprise NAS solution for resellers
ONStor Inc., a provider of clustered NAS solutions for primary and value-tier data storage for enterprises and content-rich organizations, introduced the Pantera 3110 and Pantera 3110-HA integrated NAS solutions -- designed to be sold exclusively by IT solution providers. The simple-to-buy, simple-to-sell, file data storage products are offered at entry level price points and deliver data center class performance in an energy efficient, small 1u form factor ideal for small and medium sized enterprises (SMEs) as well as enterprise workgroup environments. The new Pantera filers integrate ONStor's unique virtual file server functionality with Nexsan's SATABoy RAID storage system. The products will enable channel partners to offer their SME customers a turnkey NAS solution with the flexibility to grow quickly and respond to storage need fluctuations without business disruption while maximizing power and cooling efficiency.
"ONStor has always been loyal to the channel both in North America and in our global sales execution," said Tom Gallivan, senior vice president, worldwide sales at ONStor. "In order to increase our channel presence and compete in the midmarket, we've chosen to create a product set that makes it easy for our channel partners to install, deploy and sell true enterprise class NAS functionality at entry level price points."
Both the Pantera 3110 and 3110-HA systems allow midmarket data center managers the ability to start with a lower capacity system and seamlessly grow continually to keep up with the unpredictable growth of unstructured data. Each product provides enterprise features such as RAID 5 and RAID 6 storage for high availability, virtual servers, snapshots, a scalable file system and clustering capabilities. This offers IT solution providers a powerful, scalable, yet cost-effective NAS solution to better serve their customers.
"Unstructured data growth is impacting the midmarket with tremendous force, as these organizations have even smaller IT budgets and less resources to house space- and power-hungry storage devices than large enterprises," said George Crump, president of industry analyst firm Storage Switzerland. "The Pantera 3110 Series of products give SMEs the best opportunity to both consolidate the footprint and management of their file serving environments while dramatically shrinking power consumption. ONStor has hit a home run by developing an advanced integrated NAS solution at a price that makes sense for the midmarket and is simple for the channel to sell."
SATABoy is a high-capacity (14TB in 3U) product that provides organizations with unparalleled storage flexibility to meet real-world business objectives. It is highly scalable and enables cost-effective storage of large amounts of information online. In addition, SATABoy's exceptional performance ensures faster response times for mission-critical applications.
The Pantera 3110 has an estimated street price of $30,000 with 7TB of storage and the Pantera 3110-HA has an estimated street price of $50,000 for 10TB of storage. For more information visit www.onstor.com.
ONStor's Partner Program
ONStor's partner program includes the Margin Advantage Program and Elite Solution Partner Program. The programs offer qualified partners the benefits including:
Increased revenue and profit: The program provides aggressive incentives to both the channel and ONStor sales teams. Depending on the level of participation, various levels of discounts are offered on ONStor hardware and software licenses.
Sales and marketing support: This includes sales and technical training, access to a secure ONStor partner network site, sales guides, presentations, lead generation and marketing activities, business/territory planning and educational product information.
Education and training: ONStor provides free instructor-led training to ONStor Margin Advantage and Elite Solution Partner members.
Technical tools and materials: This includes online training webcasts, best-practice guides, technical briefs, and white papers continually updated with the latest technical information on ONStor's products.
source : http://www.wwpi.com
"ONStor has always been loyal to the channel both in North America and in our global sales execution," said Tom Gallivan, senior vice president, worldwide sales at ONStor. "In order to increase our channel presence and compete in the midmarket, we've chosen to create a product set that makes it easy for our channel partners to install, deploy and sell true enterprise class NAS functionality at entry level price points."
Both the Pantera 3110 and 3110-HA systems allow midmarket data center managers the ability to start with a lower capacity system and seamlessly grow continually to keep up with the unpredictable growth of unstructured data. Each product provides enterprise features such as RAID 5 and RAID 6 storage for high availability, virtual servers, snapshots, a scalable file system and clustering capabilities. This offers IT solution providers a powerful, scalable, yet cost-effective NAS solution to better serve their customers.
"Unstructured data growth is impacting the midmarket with tremendous force, as these organizations have even smaller IT budgets and less resources to house space- and power-hungry storage devices than large enterprises," said George Crump, president of industry analyst firm Storage Switzerland. "The Pantera 3110 Series of products give SMEs the best opportunity to both consolidate the footprint and management of their file serving environments while dramatically shrinking power consumption. ONStor has hit a home run by developing an advanced integrated NAS solution at a price that makes sense for the midmarket and is simple for the channel to sell."
SATABoy is a high-capacity (14TB in 3U) product that provides organizations with unparalleled storage flexibility to meet real-world business objectives. It is highly scalable and enables cost-effective storage of large amounts of information online. In addition, SATABoy's exceptional performance ensures faster response times for mission-critical applications.
The Pantera 3110 has an estimated street price of $30,000 with 7TB of storage and the Pantera 3110-HA has an estimated street price of $50,000 for 10TB of storage. For more information visit www.onstor.com.
ONStor's Partner Program
ONStor's partner program includes the Margin Advantage Program and Elite Solution Partner Program. The programs offer qualified partners the benefits including:
Increased revenue and profit: The program provides aggressive incentives to both the channel and ONStor sales teams. Depending on the level of participation, various levels of discounts are offered on ONStor hardware and software licenses.
Sales and marketing support: This includes sales and technical training, access to a secure ONStor partner network site, sales guides, presentations, lead generation and marketing activities, business/territory planning and educational product information.
Education and training: ONStor provides free instructor-led training to ONStor Margin Advantage and Elite Solution Partner members.
Technical tools and materials: This includes online training webcasts, best-practice guides, technical briefs, and white papers continually updated with the latest technical information on ONStor's products.
source : http://www.wwpi.com
Open-E announces new data storage server for VMWare
Open-E, Inc., a provider of unified IP storage management software and VMware Technology Alliance Partner (TAP) program member, introduced its latest product offering, Data Storage Server (DSS) for VMware ESX 3.5. VMware provides TAP program members with tools to develop products that are complementary to VMware virtualization software and help deliver high-value solutions to joint customers. Data Storage Server for VMware ESX 3.5 will provide mutual customers with enhanced capabilities for consolidating storage environments.
“DSS effectively leverages VMware virtualization to solve storage management challenges in virtualized server environments, enabling customers to consolidate storage resources,” said Bernie Mills, senior director, alliances programs at VMware. “We are pleased that Open-E is helping to deliver added value to customers with innovative technology combined with the significant business benefits of VMware virtualization, including lower capital and operating expenses, business continuity, strengthened security and reduced energy consumption.”“This alliance with VMware validates DSS for consolidation of storage resources in a virtual infrastructure to support more comprehensive data protection,” said Krzysztof Franek, CEO of Open-E. “Our combined solution allows datacenters to provision their storage easily and cost-effectively. It also provides for enhanced functionality with built-in data protection; virtualization; backup and recovery; and volume replication for disaster recovery – all with any-to-any connectivity.”With more than 800 members worldwide, the VMware TAP program works with best-of-breed technology partners to provide them with a comprehensive set of VMware technical and marketing services, support, tools and expertise to deliver enhanced value to joint customers.
source : http://www.wwpi.com
“DSS effectively leverages VMware virtualization to solve storage management challenges in virtualized server environments, enabling customers to consolidate storage resources,” said Bernie Mills, senior director, alliances programs at VMware. “We are pleased that Open-E is helping to deliver added value to customers with innovative technology combined with the significant business benefits of VMware virtualization, including lower capital and operating expenses, business continuity, strengthened security and reduced energy consumption.”“This alliance with VMware validates DSS for consolidation of storage resources in a virtual infrastructure to support more comprehensive data protection,” said Krzysztof Franek, CEO of Open-E. “Our combined solution allows datacenters to provision their storage easily and cost-effectively. It also provides for enhanced functionality with built-in data protection; virtualization; backup and recovery; and volume replication for disaster recovery – all with any-to-any connectivity.”With more than 800 members worldwide, the VMware TAP program works with best-of-breed technology partners to provide them with a comprehensive set of VMware technical and marketing services, support, tools and expertise to deliver enhanced value to joint customers.
source : http://www.wwpi.com
Jumat, 12 September 2008
Webinar spam
by Ken Anderberg
Every day, my Outlook inbox fills up with invitations to attend a variety of webinars. Here is a recent two-day sampling of topics covered by these online events: disaster recovery, workload automation, deduplication, aligning ITSM strategies, improving security, monitoring user activity, customer identity protection and IT automation. Who has the time?
Why am I so blessed to receive so many invitations, perhaps 10 to 15 every day? Simply because I am subscribed to several technology magazines, a situation I suspect is similar for a large percentage of Communications News' audience. There are a lot of technology-related magazines out there, as most of you know. Some, like this one, cover a myriad of topics important to IT management, and others focus on vertical segments, such as security or telephony.
Every time you sign up for one of these magazines, however, you also are signing up to receive e-mail invitations to attend Web seminars or virtual trade shows. (Note: Communications News does not conduct webinars, so we don't pester our subscribers with e-mails to attend.) And you don't just receive one such invitation per event; they keep coming until you sign up to attend and even more after the event has been held.
Why are they pushing you so hard to sign up for these events? First of all, these are commercial ventures, with sponsors signed on and participating in the presentations. These sponsors generally are guaranteed a certain number of attendees, so the publications keep bombarding their subscribers with e-mail promotions until enough people sign up. The sponsors receive the list of all attendees and generally follow up with calls or e-mails to sell their products or services to what are considered interested buyers.
I have participated in several such Web events, including one virtual trade show. My experiences, however, have been less than satisfactory. The webinars I have sampled lacked useful, hands-on information, often being more infomercial than educational. Even the stated interactive benefit of these is suspect, as you can pose questions to the presenters, but there is no guarantee an answer will be given. The process is kind of like sending a query into a dark room and hoping a voice responds with a useful answer.
Not all of these online events are the same, of course. I've only sampled a few. The ones I'm now ignoring in my inbox might be worthwhile, or they could still be a waste of time. I'll never know, because now these messages have become spam. Delete.
Ken Anderberg
kanderberg@comnews.com
COPYRIGHT 2008 Nelson Publishing
COPYRIGHT 2008 Gale, Cengage Learning
Radiant Logic launches RadiantOne Virtual Context Server
Radiant Logic recently introduced its RadiantOne Virtual Context Server (VCS) that expands upon Radiant Logic’s identity virtualization platform. By extracting contextual information buried in application silos, RadiantOne VCS enables better integration of business processes.
RadiantOne VCS publishes information out of application silos by dynamically generating English sentences out of application metadata. Those sentences are organized into meaningful views acting as contextual links across business processes. This enables information to be searched, retrieved across application silos and updated in the right context.
As noted by Forrester Research’s report, Information-As-A-Service: Delivering Real-Time Information Drives Market Toward Mainstream on May 2, 2008, “Enterprises increasingly need the ability to search information across the organization more easily and quickly to meet business and legal requirements and to support information and knowledge workers. Yet searching across many types of databases and content can pose a challenge, especially if the data is archived or stored in multiple content repositories of different types.”
This information, often in the form of transactional data in the enterprise, is fragmented across business functions and buried into forms and application logic. Integrating this information without a common semantic layer has been a constant challenge of data integration. RadiantOne VCS bridges the void between understanding transactions within and across silos by translating low level data transactions into English sentences.
“By generating plain English sentences out of transactional data and linking those sentences by context, RadiantOne VCS creates a radical new way to integrate data silos,” said Claude Samuelson, PhD and vice president of engineering at Radiant Logic, Inc. “RadiantOne VCS’
patent-pending technology enables a simple keyword search (such as Google) to reveal the who, what, when, how, and why of data, all while enforcing the security that is critical to applications and users. And because RadiantOne VCS understands the nature of relationships between objects within an existing application, updates are performed within the context of an existing process.”
source http://www.wwpi.com/
Langganan:
Postingan (Atom)