Blog

Vioptim & Bridgeway merge business interests at InfoSec

2012-04-27T09:45:08Z

Well InfoSec 2012 was a very interesting event to attend for a number of reasons. We didn't have a stand there and probably just as well we didn't as there were so many people to see, products to look at and catch-ups to be had. However, one very significant signing took place on Wednesday.

Vioptim, based in Scotland and focused on the Scottish market, has merged its business interests with Bridgeway Security Solutions, based near Cambridge, England. This development has been in discussion stages for some months whilst we've sorted out and agreed how the two businesses will be branded as Bridgeway Security for all of our customer and vendor facing activities.

InfoSec gave us the opportunity to discuss this development with our major vendors and we're now in a position to move forward with the new identity. For our mutual customers there will be little change to how we do business, as we will maintain the regional focus that we've had for some months now under the previous collaboration arrangement. However, we will start to move agreements over to the Bridgeway name for future quotations and billings. Existing orders will remain as is, only renewals will be affected.

This is a major step for both businesses providing us with UK coverage for all of our portfolio of solutions, an increased technical support capability, more cohesive marketing and improved account management. There will be a press release out in due course which will cover the organisational structure in more detail.

Any questions, please contact me, John Howell, johnh@bridgewaysecurity.com

Please also visit www.bridgewaysecurity.com and www.vioptim.com for further information about our products and services.

Business email Archiving, Continuity and Security

2012-03-12T18:04:49Z

Three of the major considerations in managing your business email system are:

reducing the spam and unwanted emails
providing an easy to use and capable archiving system
ensuring the availability of your email service at all times

Within the UK there have been many choices available with the likes of Postini (Google), Webroot, Message Labs (Symantec), Microsoft's Forefront and Mimecast offering Software as a Service (SaaS) solutions and a number of appliance based vendors like McAfee and Cisco's IronPort providing the more traditional approach. Only Mimecast stands out as a truly UK centric solution with UK based data centres especially important for organisations that want to ensure UK jurisdiction for archived emails.

Recently we've seen the withdrawal of Webroot's email service leaving many customers with an unexpected and unwelcomed job of finding a new supplier. Google's Postini service has started to unravel with the recent cessation of its continuity service and the jury's out to see which bit goes next and when. Google has a focus on its Apps, Postini and associated services are really out on a limb and its just a question of time before the inevitable happens.

Alongside these, some other services are getting into the picture like Spamina and Proofpoint, but neither has the same set of credentials as Mimecast, especially when it comes to the Exchange continity piece. For those organisations considering migrating to Exchange 2010, Mimecast has a great deal to offer in de-risking the operation of what is now probably the most business critical of all applications.

The other big win for Mimecast is the ease of use of all of its facilities. The continuity facilities with Exchange and Outlook users is totally transparent. The user really does not know that the Exchange server or the connection to it, has gone down. They simply continue to use Outlook as normal. WHen the Exchange service comes back on line, again, there is no discernable difference, it simply works.

Similarly for the archiving service. Whether emails are stored locally or remotely, the user doesn't need to know. They simply implement a search and the relevant emails are displayed regardless of where they are stored. Having access from mobile devices is also a great extra feature now available.

We're delighted to be working with Mimecast and are looking forward to a good deal of new customers using the service.

For more information please visit www.vioptim.co/mimecast

What's going on in your IT infrastructure?

2012-01-18T15:26:37Z

When anything happens in your network infrastructure it can be logged. Servers have log files, firewalls have log files, routers and switches have log files, every single PC has a log file. That's a lot of log files! In fact, that's so many log files with such a vast amount of logged information that it becomes a complete, unintelligible, amorphous mass of data. In fact most organisations probably turn logging off because it's too hard and too time consuming to evaluate.

But what can these logs tell you? Actually, the question is probably better "what can't these logs tell you?". There is a vast amount of very useful information that can help direct your IT services in solving technical issues, access issues, security issues and generally the health of the systems being monitored.

We've been working with one of our clients to implement a SIEM (Security Information and Event Management, although possibly substituting System for Security may be quite appropriate) pilot across their estate of well over one hundred servers. It's early days but the amount of interesting information coming through already is quite staggering. Identified attacks on the infrastructure from China, Germany, Taiwan and a few other places, a SQL service failing but not spotted elsewhere, potential vulnerabilities uncovered are all in a days work for the SIEM.

This information helps direct the IT team to priority areas to look at as there is now a constant visual display (dashboard) of what is happening throughout their infrastructure. How are the servers and services coping? What happens at the start of the day when everyone logs in? Checking changes that have taken place to servers to ensure that they comply to change management control.

It's a tough job ensuring compliance against company policies, proving to the auditors that you know exactly what has been happening in your infrastructure, pro-actively closing off potential vulnerabilities in your security and checking to see what the users have been up to. Being able to display, in real-time, the state of play within the network to board members is a real bonus. It's a very difficult call to request spending on anything that is deemed non-productive and security is usually deemed as such. However, with the information now being correlated and displayed for all to see, the task gets a great deal easier.

We've been working with AlienVault on this pilot and extremely pleased to see the kind of information being presented to our customer. There's a lot to do, but at last there is some real intelligence to make sense of the vast amount of data that is being collected. Intelligence that will improve the day to day operations of this customer, will help to secure the system from outside and inside attacks and to help prevent any loss of intellectual property. SC just posted an article here.

http://www.vioptim.co.uk

The drive towards implementing an information security standard

2011-11-09T09:50:13Z

ISO27000 and the Need for a Standards Approach

It’s been interesting to note that in recent weeks, several customers have expressed the need to incorporate some information security standards within their organisation. The reason behind this has been the requirement from their customers to have certain minimum qualifications in place in order to bid for business.

Not untypical of supply chain management, it’s often the crucial missing ingredient that gives certain standards a push. Although there are a number of standards around, perhaps the most widely used is the ISO 27000 family. Derived from a British Standard (BS7799), it has been adopted – with a few adjustments – by ISO. In the retail sector, businesses using credit cards have been forced into adopting and complying with PCI DSS (Payment Card Industry Data Security Standard) in order to continue offering them as a form of payment.

True of most standards, their impact is often felt years after the initial adopters have bought into them by the supply chain. Also true, standards are often not taken aboard as a “must have” until there is either supplier, customer or regulatory pressure applied. It’s an understandable situation as there is a cost involved in achieving a standard’s accreditation and the benefit of so doing may not be altogether obvious. With Information Security, there are, perhaps, some compelling reasons for incorporating best practices into the organisation and formalising the approach, starting at the board and working down through the layers of the business.

Computer Weekly reports that Cyber attacks on the UK have reached "disturbing" levels, according to Ian Lobhan, director of communications intelligence agency GCHQ. The attacks are targeting sensitive data on government computers and defence, technology and engineering firms' designs, he said in The Times. According to Lobhan, "Such intellectual property theft doesn't just cost the companies concerned; it represents an attack on the UK's continued economic wellbeing.”

Speaking at the London Conference on Cyberspace earlier this month, William Hague stated that “it will become harder to protect users and prevent defences from being swamped as the scope for malignant activity widens alongside advantages.” Putting this in perspective, more than six million unique types of new malware were detected by industry in the first three months of 2011 alone, according to Hague.

Heavy stuff. Scary too, especially if you haven’t got your corporate defences in good shape, which is quite likely given current cost, time and understanding constraints. Worst of all, it’s the good old IT department’s neck on the block. But if you look at how information security standards, like ISO27000, are shaped, it’s actually a business problem that is - or at least should be - owned by the CEO and their heads of departments. It’s not the IT that’s at risk: it’s the business. Too many organisations are too slow in getting this message through to their senior management.

By taking a high level look at what ISO27000 and other information security standards are aiming to achieve, senior management should start to get the picture, taking a great deal of pressure away from the IT department as well as making budgetary funds available to implement mitigation strategies and solutions.

Vioptim is positioned to help promote this high level view and engage with the necessary consultancies to move towards standards compliance and accreditation.

http://www.vioptim.co.uk

Dotting the i's and crossing the PC's

2011-10-21T09:31:55Z

The recently published figures for Apple make for some eye watering reading. The quarter to 24th September 2011 resulted in a total of 17 million iPhones and, get this, 11 million iPads sold. Wow! The Guardian produced an interesting article on 22/9/11 which showed the actual and forcasted growth in tablets compared to the PC market:

Whilst there's a good deal of speculation in where the figures are going in the future, one thing is for sure and that is that the tablet market, which is forecast to be 50% Apple iPads, is going to shake up the entire industry as we know it today. But, so what?

The increase in the use of mobile technologies, which includes smartphones as well as tablets/pads, is going to have a fundamental impact on:

corporate access, data loss prevention & confidentiality
use of wireless and roaming
what is company owned v. what is privately owned
lifestyle

From a technology point of view, the first two points are incredibly important. I was interested in an article by Joanie Wexler entitled "iCloud to Test Wi-Fi Performance Mettle" (you may need to register with Webtorials to see this) in which she asks the question whether the existing Wi-Fi infrastructure is going to be able to cope with all of the automatic synchronisation of devices, citing Apple's new iCloud as the primary example. If you add to that the cost of using 3G, whilst roaming when no Wi-Fi is available, it's food for thought.

Aligned with the increase in mobility solutions comes the protection of information either on the device or being accessed by the device especially in corporate environments. Make no mistake, these mobile devices are going to have a significant impact in the corporate environment. There is absolutely no way that the IT department is going to fend off the use of corporate provided and privately owned devices from accessing corporate information. There will be delaying tactics, no doubt, but like King Canute and the sea, the tide is coming in and you're going to get wet!

So it's time to get serious with the issues surrounding the use of mobile devices in the corporate environment. In fact, it's time to rethink the corporate IT strategy to take account of the development of mobility, the use of the cloud (public and private) and all of the security issues surrounding this change in direction.

We're already doing our bit at Vioptim

email signatures - a legal reminder

2011-10-14T13:13:29Z

If you are a limited company or partnership, your email signature must contain a minimum amount of information otherwise you are liable to a £1,000 fine

Meta Compliance - taking the heat of compliance

2011-09-16T13:37:18Z

According to my sources, if it comes to a court case involving employees mis-use or abuse of using corporate Internet facilities and confidential information, it's very hard to prove that the relevant policies were communicated, understood and signed off. This came as a bit of a surprise given that much is made of Acceptable Use Policies, company confidentiality, data loss prevention, customer information and the like. Surely organisations are ensuring that they communicate this information properly and manage the sign-off's by staff?

Nope, more often than not, this information is there, possibly published on the Intranet but with little ability to ensure that it is read, that it is understood and that it is signed. That means it's pretty much unenforceable in a court of law.

With our collaboration partners, Bridgeway Security, we're offering a very effective means of managing compliance, ensuring that policies are known, are read and are accepted. Furthermore that they are updated and re-circulated in an appropriate way to ensure that everyone is up-to-date. This really does take the heat out of the problem faced by a majority of organisations that need to keep track of this type of activity.

Here's what MetaCompliance can do:

	Enterprise	Advantage
Automate policy communication	•	•
Intelligent desktop delivery to ensure self-certification	•	•
Enforcement capabilities	•	•
Policy lifecycle management	•	•
Policy adoption reporting	•	•
Integration to E-learning/intranet, email and file launch	•	•
Intelligent scheduling	•	•
Unique targeting capabilities via Active Directory	•	•
Non Electronic module (additional costing)	•	•
Vendor/Partner Risk Management	•	•
User/Employee Compliance self-management	•	•
AD Replication for multi level targeting	•	•
Dynamic Intercept/Situational Awareness	•	•
Governance Lifecycle for Joiners & Leavers	•	•
Policy awareness & understanding assessment	•	•
Policy Exchange	•	•
Information Governance Approvals Workflow	•	•
Automation of Information Governance Maturity Model		•
Extensive Risk Assessment capabilities		•
User behaviour improvement reporting		•
Information Assurance Headline Reporting		•
Extensive Governance & Compliance Reporting		•
E-learning Connections		•

There's a lot more more to information security than securing your perimeter, it's very much a top down approach to resolving some of the difficult issues through modern means. We all use computers to do our day to day tasks but MetaCompliance can ensure that everyone that needs to know about policies are informed and the audit trail managed.

Not all organisations feel that they must be watertight in this regard and that's fine, but those that do, really do need to investigate how best to make the process work.

Anti Virus, managed in the cloud

2011-09-05T13:31:21Z

We’ve been getting some good interest in a well used technology but one that has a different slant to it. Standard AV, it’s been around a while and works, but for most organisations with more than a handful of PC’s you have to have a server that looks after the management aspects i.e. setting policy, pushing out updates, producing alerts and reports. If you have one server, you should really have at least another one for business continuity.

With Resolutions MSP we’re able to provide the end-point agents (Kasperky powered by the way) but with all the management done via a web portal. The portal is where you set policies, define groups of computers/users and push out the AV agent, signature updates and policy updates. It’s also where you produce the weekly/monthly reports.

The end-point agents are also interesting and operate a bit differently to normal. In the same LAN, once an update has been received by one of the low level agents, it advertises this to all of the other agents in the network and they synchronise with one another. This saves every agent from requesting the update via the Internet which could be a bit longwinded if there are lots of PCs in the network.

Even better, if a user if off-site for any period of time, they may not be getting regular updates via the in-house server. With Resolutions MSP this is not a problem. Like most good Software as a Service applications, being away from home makes no difference, it simple pulls the update directly from the cloud based server. But now the AV administrator gets alerts and reports from the web regardless of where the user is accessing the Internet.

This type of service enables the off loading of yet another time consuming IT requirement. No-one in their right mind wants to be looking after AV across the company, feeding and watering the servers to keep them up-to-date and operational. With Resolutions MSP it’s really easy to have someone else manage this task for you.

http://www.vioptim.com/resolutions

Consumerisation in the Corporate Environment

2011-09-05T07:40:31Z

It's not new but it's starting to hit the big time from an IT management point-of-view; how to handle the onslaught of iPads, iPhones and the various derivatives (should they survive) in the corporate environment.

IT folk are not always considered to be the most accommodating when it comes to allowing new devices, applications and services into their carefully managed environments. Quite rightly, they have two critical issues to consider:

What is the risk to the business of allowing the device(s) to access the corporate network?
How much additional management time is it going to take to monitor, potentially manage, these devices?

Pressure builds very quickly on businesses when the additional capabilities that these new devices provide become a compelling case for everyday use. Once the CEO or a Partner has one, everyone wants one, so there is little choice for the IT department but to support them in as safe a way as possible.

Enter MobileIron. Designed to work with these, basically consumer, devices that have little in-built security from a corporate use point-of-view. MobileIron transforms the unmanageable into a highly sophisticated, secure device be they corporate owned or individually owned. In either case the software allows the wiping of corporate data in the event of loss or misuse. It also provides network access control by posture checking the device each time it connects and ensuring that it meets the corporate standard.

Suffice to say that we're getting lots of interest in the solution and have a number of customers actively assessing and trialing the solution. Take a look for yourselves

Remotely managing Cisco phones

2011-06-22T13:05:51Z

It’s been a roller coaster ride working alongside the guys at Unified FX. Their PhoneView application allows remote management of entire estates of Cisco IP Telephones through a very interactive interface where you can take screen shots of the phone’s display. Sounds simple? The guts behind the application requires a great deal of knowledge of the finer points of Cisco’s telephone management software – need I say more?

What has been fascinating is how the power of viral marketing has been demonstrated through the volume of interest and the hundreds of downloads that have been going on in just the last few days. The Cisco CCIE community has identified the application as “the hottest IP telephone remote control and estate management tool on the market today” (See Vik Malhi’s blog) and that, quite simply, did the trick.

What a fantastic way to build up a great contact list, full of exactly the people that you want singing the praises of your application. The interest has already been picked up by some eye watering commercial and government organisations world-wide all of whom need to get to grips with managing tens of thousands of telephone handsets. You wouldn’t believe the Webex sessions we’ve been having!

If you haven’t already had a look at PhoneView click here.