Ще има нови начини за тестване на антивирусните програми

The traditional methods of testing anti-virus products are inadequate in today’s threat environment as they don’t take into account newer and more advanced levels of protection. We support AMTSO’s efforts, which we believe can result in real-world tests that benefit consumers and corporations alike in choosing where to invest in their computer protection.

— Jeff Green, senior vice president, McAfee Avert Labs

Големите разработчици на програми за компютърна сигурност и независимите организации, тестващи софтуер, сформираха алианс, наречен Anti-Malware Testing Standards Organization (AMTSO). Негова основна задача ще бъде изработката на общи индустриални стандарти за тестване на защитните продукти.

На 4 февруари в Билбао бе проведена и първата обща среща на учредителите, съобщиха в официално прес-съобщение от компанията Panda Security, която е била неин домакин. На първото събрание е формулиран уставът на “Организацията за Стандарти на Тестове за Зловреден код”
“Учредяването на AMTSO е предизвикано от нарастващото притеснение за разминаването, което се получава между това, което антивирусните технологии в действителност правят и методите, които се използват за тяхната оценка. Решенията за противодействие на зловредния код стават все по-сложни, а същевременно повечето от съществуващите тестове не са способни да оценят точно продукта, който противодейства. Това води до факта, че понякога оценките на продуктите са непълни, неточни или заблуждаващи”, пише на заглавната страница от официалния сайт на организацията.С други думи AMTSO има за цел да подпомогне подобряването на обективността, качеството и адекватността на тестовете на технологиите за противодействие на зловреден код и ще обявява общоприетите стандарти и насоки за тестване за зловреден софтуер. Всъщност визията на AMTSO е формулирана още през май 2007г., по време на Международния семинар за антивирусно тестване в Рейкявик, Исландия. Тя е допълнително развита на Азиатската конференция на антивирусните анализатори в Сеул, Северна Корея, която се проведе миналия декември. А по силата на все още неокончателния устав новоучреденият форум ще се заеме със следните основни задачи:
· Да направи форум за обсъждания относно продукти за противодействие срещу зловредния код;
· Да развива и публикува обективни стандарти и най-добрите практики за тестване на продукти за противодействие на зловредния софтуер и свързаните с тях продукти;
· Да насърчава образоваността и съзнанието за проблемите, свързани с продуктите за противодействие срещу зловреден софтуер;
· Да предостави средства и възможности за подпомагане на методите за тестване, базирани на стандартите;
· Да извършва анализ и проверка на съвременните и бъдещите продукти за тестване на зловреден код.
Организацията засега обединява около 40 компании, разработващи софтуер за сигурност и тестови лаборатории. В списъка на учредителите на AMTSO влизат редица авторитетни имена като AV-Comparatives, AV-Test.org, AVG Technologies, BitDefender, ESET, F-Secure, Kaspersky, McAfee, Panda Software, Sophos, Symantec, Trend Micro и др. На учредителното събрание на алианса е имало и представители от IBM и Microsoft.
“Членството в AMTSO е свободно за всички учени, оценители, хора, които провеждат тестове и продавачи, при спазване на условията определени от организацията”, гласи още официалната информация.

една статия на  PC World Bulgaria 6.02.2008

The top 10 storage industry predictions by the Framingham 

IT managers looking to boost storage efficiency next year will embrace online storage services, push de-duplication in the data center and adopt solid-state disk drives to help fuel hardware consolidation strategies and green initiatives, according to IDC’s top 10 storage predictions for 2008.

The top 10 storage industry predictions by the Framingham, Mass.-based market research company expected to arrive in 2008 include:

– 1. Storage services models for data backup, archiving and replication will be more appealing to businesses.
– 2. New role-based storage systems will demand tighter integration between the storage layer and content-generating applications.
– 3. Vendors will build object-based storage systems to classify data and add policies closer to the point of creation.
– 4. Falling prices of solid-state disk drives will push mainstream adoption.
– 5. Virtual servers will become an ideal conduit for iSCSI.
– 6. Value-added storage services will become nontethered from storage infrastructure.
– 7. Full-disk encryption will be prevalent in the data center to satisfy compliance and safe harbor provision rules.
– 8. Offerings designed for small and midsize businesses featuring integrated storage and server technology will flood the storage market.
– 9. Green storage initiatives will cause companies to seek nondisruptive/partial hardware upgrades.
– 10. De-duplication, thin provisioning and virtual tape libraries will be in demand because of power saving efforts in the data center.

According to IDC, storage capacity is exploding at a rate of almost 60% per year. That type of accelerated growth is forcing IT executives to rethink what type of storage system is best suited for their data — and to consider the costs in light of shrinking floor space and rising costs of power, said Dave Reinsel, an analyst at IDC.

Reinsel said he foresees 2008 as the year there will be many “toes in the water” regarding companies evaluating the benefits of solid-state disk drive technology in a corporate setting. He said this is largely because of the increasing importance of end users leveraging services over the Web, which requires faster response times and transaction processing. These tasks are a better fit for high-performing and flash-based solid-state technology than physical hard disk drives.

“There are very simple situations and application scenarios where solid-state disks will be worth the risk. It does promise some great potential benefit in terms of I/O,” said Reinsel, who noted that high prices that have stunted solid-state adoption will drop in 2008. IDC predicts solid state will make a significant impact on reducing heat from spindle usage in server blade deployments and to boost functionality in mobile devices.

In the new study, IDC storage analysts said this year’s top 10 storage predictions for 2008 address three areas: new data storage models such as object-based storage; green storage technology, which helps companies reduce their carbon footprint and energy expenditure; and new forms of storage delivery such as online storage services.

Online storage began its transformation in 2007 from a simplified backup option for consumers and small businesses to an offering that can enable larger businesses bolster disaster recovery operations, regulatory compliance needs and help curb storage infrastructure costs. Even Google Inc. is reportedly interested in building online storage technology to take advantage of the lucrative market.

SANTA CLARA, Calif., Dec. 27 /PRNewswire-FirstCall/ — McAfee, Inc. today announced that leading research firm Gartner, Inc. has placed the company in the leaders quadrant in its “Magic Quadrant for Endpoint Protection Platforms” as published on December 21, 2007.(1) Gartner’s research examined vendors who offer solutions in the endpoint protection marketplace.

McAfeeм световният производител на антивирусен софтуер с централа в Санта Клара, САЩ получи лидерската позиция в годишното изследване на Гартнер за запита на

Gartner’s Magic Quadrant for Endpoint Protection Platforms is based on an assessment of a company’s ability to execute and completeness of vision. According to Gartner, “Leaders demonstrate balanced progress and effort in all execution and vision categories. Their actions raise the competitive bar for all products in the market, and they can change the course of the industry.”

Factors contributing to a company’s ability to execute include products and services, overall viability, market responsiveness, and track record. Gartner gauges a company’s completeness of vision by considering its market understanding, sales and marketing strategy, offering or product strategy, business model, and innovation, among other criteria.

“We believe our position in the leader quadrant further validates McAfee’s commitment to delivering market leading security risk management solutions,” said Kevin LeBlanc, director of product marketing, endpoint security at McAfee. “Customers and partners rely on McAfee to provide best-in-class protection against varying security threats which could disrupt business productivity.”

The report observes that “point products for antivirus, antispyware, personal firewalls, and Host Based Intrusion Prevention (HIPS) are rapidly being replaced by suites with a centralized and extensible management framework. The management and reporting capability of EPP (Endpoint Protection Platforms) suites is a substantial differentiator especially in large enterprise. A modular architecture that allows selective configuration based on security requirements and device location is also critical.”

About Gartner, Inc. and the Magic Quadrant

The Magic Quadrant is copyrighted December 21, 2007 by Gartner, Inc. and is reused with permission. The Magic Quadrant is a graphical representation of a marketplace at and for a specific time period. It depicts Gartner’s analysis of how certain vendors measure against criteria for that marketplace, as defined by Gartner. Gartner does not endorse any vendor, product or service depicted in the Magic Quadrant, and does not advise technology users to select only those vendors placed in the “Leaders” quadrant. The Magic Quadrant is intended solely as a research tool, and is not meant to be a specific guide to action. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

About McAfee, Inc.

McAfee, Inc., the leading dedicated security technology company, headquartered in Santa Clara, California, delivers proactive and proven solutions and services that secure systems and networks around the world. With its unmatched security expertise and commitment to innovation, McAfee(R) empowers home users, businesses, the public sector, and service providers with the ability to block attacks, prevent disruptions, and continuously track and improve their security. http://www.mcafee.com/.

(1) Gartner, Inc., “Magic Quadrant for Endpoint Protection Platforms, 2007″ by Peter Firstbrook et al, Dec. 21, 2007

McAfee and/or other noted McAfee related products contained herein are registered trademarks or trademarks of McAfee, Inc., and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. Any other non-McAfee related products, registered and/or unregistered trademarks contained herein is only by reference and are the sole property of their respective owners. (C)2007 McAfee, Inc. All Rights Reserved.

McAfee’s Leading Ranking in Gartner’s End Point Protection Magic Quadrant

Gartner places McAfee in the leader’s quadrant for third year in row

Антивирусните решения, предлагани от McAfee продължават да доминират при платформите за защита в крайната точка, като са поставени на водеща позиция за трета поредна година в проучването на Гартнер, направено в края на 2007 г.

McAfee представи новия си продукт, предназначен специално за повишаване на нивото на сигурност на информацията за мобилните потребители - McAfee VirusScan Mobile. Приложението се справя със заплахи за сигурността, идващи от електронна поща, месинджъри или изтеглени от Интернет мултимедийни файлове. McAfee VirusScan Mobile предпазва устройствата, като следи входните точки, които е възможно да се използват за атаки - SMS, MMS и електронна поща, като входящите файлове и информация биват автоматично сканирани за наличие на зловреден код. Освен това приложението е в непрекъсната връзка с Avert Labs на McAfee за актуална информация за най-новите вируси. Понастоящем приложението работи с Microsoft Windows Mobile 5 Smartphone и Windows Mobile 6 Standard Edition. Потребители, които са закупили McAfee Total Protection и McAfee Internet Security Suite, получават McAfee VirusScan Mobile безплатно.

The stand-alone antivirus market has been replaced with a broader suite of defensive technologies supported by an extensible management platform that can subsume horizontal products, such as data protection and device management capabilities.

WHAT YOU NEED TO KNOW
Point products for antivirus, anti-spyware, personal firewalls and host-based intrusion prevention (HIPS) are rapidly being replaced by suites with a centralized and extensible management framework. The management and reporting capability of endpoint protection platform (EPP) suites is a substantial differentiator, especially in large enterprises. A modular architecture that enables selective configuration based on security requirements and device location is also critical. EPP suites are being extended with new capabilities, such as encryption and data loss prevention (DLP). Management of end-node protection will increasingly duplicate operational management capability and eventually subsume these tools for small or midsize businesses (SMBs).
MAGIC QUADRANT
Figure 1. Magic Quadrant for Endpoint Protection Platforms, 2007

Source: Gartner (December 2007)
Market Overview
The traditional point product antivirus, anti-spyware and personal firewall markets have been eclipsed by broader suites of related security technologies, which Gartner has labeled the EPP. Basic component technologies in EPP suites include antivirus, anti-spyware, HIPS and a personal firewall. Advanced EPP suites will include network access control (NAC) and data protection technologies, such as DLP and full-disk encryption. The requirements for holistic NAC solutions and the demanding management needs of large enterprise are also forcing EPP suites to replicate some PC configuration life cycle management tasks, such as security configuration management, asset discovery, patching and software management. By combining multiple corelated technologies into a single management framework, EPPs have the promise of increasing security while lowering complexity, cost and administrative overhead.
Spyware and virus threat databases and scan engines have largely merged into a single
signature-based anti-malware agent. Although there are subtle differences in the speed and detection rates of anti-malware databases, this component is largely viewed as a commodity by buyers. Even the best signature databases can miss the wild threats 2% to 10% of the time, and most have less than a 50% chance of catching completely new threats. Signatures are extremely ineffective against targeted threats and “zero day” threats. HIPS and personal firewalls are increasingly critical to improve overall security. The convergence of these functions into a common management framework should increase the adoption of HIPS and desktop personal firewalls.
Enterprise interest in stand-alone personal firewalls has declined considerably as the capability of EPP suite firewalls has improved and given that Microsoft’s entry-level personal firewalls are already included with Windows. Security-conscious enterprises want more-advanced firewall functionality at least for their mobile population.
Advanced features that define more-visionary firewalls include:
• Audit capabilities and protections to ensure that the firewall policy is active
• Detailed event logs
• Verified updates to firewall settings
• Coordinated use of firewall in conjunction with malware protection for the rapid defense
of unpatched vulnerabilities
• Wireless firewall policies, such as enforcing one active network interface card (NIC) to
avoid LAN-to-wireless-LAN bridges
• Firewall policies applied locally to application network traffic and rights management
Organizations should evaluate EPP firewalls and plan to phase out stand-alone personal firewall solutions.
HIPS technologies are critical to secure endpoints from more-evasive, targeted and zero-day threats. Advanced HIPS solutions use various protection styles to provide layers of defense at endpoints, including:

• Protocol anomaly detection
• Deep-packet inspection for known network attack signatures or vulnerability attack signatures
• Simulation of potentially malicious code before it executes by using static analysis, code simulation or virtual machines
• Genetic heuristics, which is the use of broad signatures to detect variants using common malware family characteristics
• Comprehensive buffer overflow and program flow control protectio
• Advanced application control to determine which applications are allowed to execute and to restrict system resource access
• “Sandboxing” and other virtualization techniques to inspect and isolate potentially malicious code from causing damage to the endpoint
• Behavior-based analysis of executing code to determine whether it is behavingmaliciously and providing the capability to undo the damage and remove the malware.

Visionary HIPS solutions must enable selection and configuration/tuning to balance the security level, transparency to end users and administration overhead. Solutions should provide preconfigured out-of-the-box templates for common application and system configurations, as well as a learning mode for custom applications.
The management capability of EPP suites is a substantial differentiator. Simply maintaining the security status for large PC fleets that are increasingly mobile for long periods of time is difficult. As NAC becomes an integrated feature of EPP suites, management capability has been forced to expand from simply maintaining the security posture of the EPP components to checking the security configuration, software inventory and patch levels. The new EPP management consoles are beginning to add PC configuration life cycle management capabilities to ensure the security and integrity of clients. Meanwhile, some PC life cycle operations vendors are starting to add defensive security tools to their offerings. These two markets will continue to slowly converge, although it will not be until after 2010 that a significant percentage of the market will buy
completely integrated tools from a single vendor (see “PC Security and Operational ManagementFunctions Are Converging”).

Market Definition/Description
Enterprise antivirus, anti-spyware, personal firewall and desktop HIPS products make up the majority of endpoint security spending. The combined revenue of these segments was more than $2.2 billion in 2005, and we anticipate that the EPP market will grow to nearly $3.6 billion by 2010.
This market is still dominated by the market share of the big three traditional antivirus vendors (McAfee, Symantec and Trend Micro), which represent roughly 85% of the market share.
However, many nimble vendors are beginning to challenging the status quo with innovative EPP solutions and a higher level of customer focus.
Microsoft’s impact on the enterprise market is still nascent; however, we expect it to have a growing market share, starting primarily in Microsoft-centric SMBs.
Despite the introduction of new players, the displacement of incumbents is still a significant challenge. The biggest impact of the challengers and visionaries is to push the dominant players in the market to invest in new features and functionally and to keep pricing rational.

Inclusion and Exclusion Criteria
Inclusion in this Magic Quadrant is limited to vendors that meet the following minimum criteria:

• Products must provide malware (virus, spyware, rootkits, trojans and worm) detection and cleaning, a personal firewall and/or some form of host intrusion prevention (such as application control, buffer overflow protection, behavioral monitoring and enforcement, and heuristics) capability for PCs.
• Vendors must have centralized management, configuration and reporting capabilities for the products listed above that can support companies that have, at a minimum, 5,000 geographically dispersed endpoints.
• Vendors must have global service and support organizations to support enterprise products.

Added
Numerous vendors were added to the Magic Quadrant this year as a result of the evolution to endpoint protection platforms and the more liberal inclusion criteria. New entrants include BigFix, Bit9, Check Point Software Technologies, eEye Digital Security, IBM, Kaspersky Lab, LANDesk, Microsoft and Webroot Software.
Dropped
No vendors were removed

Evaluation Criteria
Ability to Execute
Our key ability to execute criteria used to evaluate vendors were overall viability, and market responsiveness and track record.

• Overall viability: This included an assessment of financial resources, such as the ability to make necessary investments in new products or channels, and the experience and focus of the executive team. We also looked at the business strategy of each vendor’s endpoint protection division and how significant that division is to the overall company.
• Market responsiveness and track record: We evaluated each vendor’s track record in bringing new products and features to customers in a timely manner, as well as the market share of the vendors.
• Sales execution: We evaluated the vendor’s licensing and pricing programs and practices. We incorporated feedback from clients and references on negotiation experiences. We also looked at the strength of channel programs, geographic presence and the track record of success with technology or business partnerships.
• Marketing execution: We evaluated the frequency of vendors’ appearance on shortlists and RFPs, according to Gartner client inquiries, and reference and channel checks. We also looked at brand presence and visibility in the market.
• Customer experience: We primarily evaluated product stability and performance, company experience with the vendor’s support, and signature quality and response times. We evaluated comments from Gartner clients and reference customers, as well as from tests, such as AV-Test.org, and other sources of data on performance and signature response times

Product/Service - no rating
Overall Viability (Business Unit, Financial, Strategy,Organization) - high

Sales Execution/Pricing - standard
Market Responsiveness and Track Record - high
Marketing Execution - standard
Customer Experience - standard
Operations - standard

Completeness of Vision
The most important vision criteria were market understanding and the product offering.

• Market understanding: In this category, vendors that understand customer requirements for proactive and integrated defenses across all malicious software (malware) threat types and have an innovative and timely road map to provide these functionalities scored best.
• Offering/product: When evaluating vendors’ product offerings, we looked at the followin product differentiators:

1. Anti-malware signature capabilities: speed, accuracy, transparency and completeness of signature-based defenses
2. HIPS capabilities: the quality, quantity, accuracy and ease of administration of nonsignature-based defenses
3. Personal firewall capabilities: advanced capabilities that exceed Microsoft’s, such as location-based policy, specific virtual private network (VPN) and wireless rules, and Universal Serial Bus (USB) and other port protection
4. Management and reporting capabilities: comprehensive centralized reporting thatenhances the real-time visibility of end-node security state and administration capabilities that ease the management burden of policy and configuration development
5. Horizontal integration: the quantity and quality of integrated-related products or technology, such as NAC, full disk encryption, data leak prevention, and e-mail and Web gateways. These related products enable vendors to become more-strategic suppliers to organizations and offer the promise of lower administration costs and better security through simpler policy administration and monitoring, and correlated threat information.
6. Sales strategy: We evaluated each vendor’s licensing and pricing programs and practices. Vendors that emphasized value to clients, tended to incorporate new functionality without “upcharges” and were reasonable during renewal negotiations received high scores. We incorporated feedback from clients, reference customers and channel partners on negotiation tactics and pricing strategies. We also evaluated the vendors’ partnership strategies. We accounted for how vendors approached new channels and delivery models.
7. Innovation: We evaluated vendors’ responses to the changing nature of customer demands. We accounted for how vendors reacted to malicious code threats, such as spyware and targeted attacks, and how they invested in R&D or pursued a targeted acquisition strategy.

Дойде краят на 2007г и е време да се замислим върху настоящите заплахи. Последните 12 месеца са една рекордна година. McAfee® отбелязаха над 100,000 нови вируси и троянци, което е 50% ръст спрямо всички заплахи до момента. Вирусът Nuwar (т.нар. Storm Worm или бурен червей) израстна в най-големия peer-to-peer ботнет, докато TJ Max разкри най-огромния пробив на данни в историята. Други сфери видяха забележителен растеж от fishing до crimeware, от откриване на уязвимости до моменталното им разработване (zero-day exploits); 2007г беше година на заплахите. В същото време имаше рязко увеличаване във възприемането и употребата на новите технологии като VoIP, virtualization и разбира се Web 2.0. Като погледнем напред към 2008г очакваме картината на заплахите да продължи да се разширява. Атаки ще се разработват за новите технологии, докато успеят да се подобрят спрямо тези, които са били успешни в миналото. McAfee Avert® Labs идентифицират следните десет заслужаващи внимание тенденции, които се очаква да се развият през 2008г:

Към остатъка от публикацията