IBM today unveiled new enhancements to its security suite aimed at safeguarding Web applications and data, as attacks preying on such targets continue to dominate the headlines.
Through today’s move, IBM’s (NYSE: IBM) security management software Proventia SiteProtector 8.0 has been integrated into its Information Infrastructure portfolio of products.
“Web application security is the Achilles heel for many enterprises today,” Dan Powers, IBM Internet Security Systems (ISS) vice president of business strategy, told InternetNews.com.
The suite is also designed to make Web application security simpler and more cost effective, a key enterprise pain point.
In addition to Proventia SiteProtector, the portfolio also includes Rational AppScan, which handles software development, and a recently announced Web application protection module for Intrusion Prevention Systems (IPS).
Powers noted that AppScan was bolstered in 2007 with IBM’s acquisition of WatchFire, an application that scanned for vulnerabilities.
He also said IBM has added a new feature to WatchFire. “We updated the application scanning product so that it now looks for malware on Web sites using our ISS X-Force database,” Powers said.
IBM’s Tivoli Identity Manager 5.1 provides role management for the suite.
“Companies want to make sure that the right people are doing transactions in critical Web applications,” Powers said.
IBM’s WebSphere DataPower service-oriented architecture (SOA) appliances aid in the management and implementation of security policies as well. “They allow companies to expose secure applications to third parties,” Powers said.
The suite can be purchased as licensed software or as a service. Pricing starts at $10,000 for a small business customer.
Enterprise Web applications are vulnerable
The vulnerability of Web applications was highlighted recently when Facebook and Twitter succumbed to cyber attacks rumored to be Russian in origin.
IBM’s statistics bear this out, the company said.
“According to the latest statistics from the IBM X-Force 2009 Midyear Trend & Risk Report, which will be released later this month, Web application attacks continue to accelerate,” the company said. “For example, SQL injection attacks — attacks where criminals inject malicious code into legitimate Web sites, usually for the purpose of infecting visitors — rose 50 percent in Q1 2009 as compared to Q4 2008, and nearly doubled in Q2 at 96 percent as compared to Q1.”
“The report concludes that the most common intent of Web application attacks are to steal and manipulate data and take command and control of infected visitors,” IBM added.
Defending against these attacks is an ongoing process that is never complete.
“It’s important to think about security from the get-go,” Powers said. “Security should start at the beginning of the development process and continue with the testing of applications over time. Many meet the minimum requirements of PCI [Payment Card Industry standards] compliance, but once you get PCI-compliant, that’s just the start. You have to build security into the organization and its ongoing business practices.”
