Napera

Playing the role of Goliath in the classic biblical tale, yesterday Microsoft finally launched Windows InTune, their cloud-based desktop management service.  The twist in this story, though, is that the protagonist Napera has no intention of trying to slay this Goliath, at least not until they help pave the way to ubiquitous cloud-based IT management.  In fact we welcome InTune to the market!

Why would I not be more concerned that Microsoft has launched a cloud-based service that is nearly identical to Napera Insight?   Read the full article…

Today Napera released the results of our online survey of 200 small and medium-sized enterprises that revealed a high level of security risk and an overall lack of confidence among IT managers. Seventy percent of those surveyed received scores on the Napera Network Test indicating medium to high risk of a network security breach, and more than half of the respondents stated they do not have confidence in the security of devices and users on their networks.

The comment we heard most from folks who took the test was that the questions made them think about network security in a new way and they had never thought about the security risks the test revealed.

Read the full article…

As Jeff and I were talking about the evolution of security beyond the firewall in our webinar yesterday, along comes an out of cycle critical patch from Microsoft that proved our point nicely. Security bulletin MS08-067 reveals a previously unknown way to inject code into remote Windows systems due to a flaw in the RPC server. Within hours of the Microsoft bulletin, news of a trojan exploiting this flaw in the wild arrived.

This ranks as one of the most serious Windows flaws disclosed recently and affects almost every flavor of Windows. The Microsoft patch is rated critical for eleven variations of Windows XP, Windows 2000 and 2003. For Vista and Windows Server 2008, it was considered only ‘important’ due to the improved ability of those operating systems to defeat remote code execution attacks. What makes this particular issue even more insidious is that the RPC server can be exposed to attack when a desktop firewall is running, simply by turning on file or printer sharing.

A network vulnerability like this lends itself to worms like Zotob which wreaked havoc a few years ago and took down several networks. I speculated this morning that exploits would be stealthier this time around and aimed at monetizing security breaches. Sure enough, the Gimmiv.A trojan reported yesterday is a network aware trojan that attempts to exploit this flaw against PC’s on the local network. If it succeeds, it quietly steals passwords from the Windows and Outlook password cache and posts them to a Web site.

Traveling back to Seattle yesterday, I used the free Wi-Fi at San Jose airport. This morning when I came into the office, my laptop hadn’t received the Windows update and the Napera N24 immediately notified me. I was given a one hour deadline in which to install, which I promptly did.

That led me to wonder what the situation would be like if our network was unprotected. If I had neglected to install this Windows update and went traveling again tomorrow, it is likely my laptop would be exposed to this trojan. If I was running XP and had file or printer sharing enabled, the laptop is likely to be compromised. On an unprotected network, I could have easily waltzed past the corporate firewall, plugged in my compromised laptop and started infecting other PC’s.

Microsoft’s quick response is admirable, but the question IT managers need to ask themselves today is simple. How confident are you that users walking into your office today have installed this patch before they connect? Plenty of industry studies show that at least half of corporate PC’s won’t update in a timely fashion. Given that at least one exploit is already in the wild, and more are undoubtedly on the way, that’s a universe of opportunity for the bad guys in the coming weeks.

As a working mom with a tween and teenagers, I often have to keep a loose boundary between work and home, and my laptop and smartphone are often in use as much in the kitchen as in the office. I think that’s typical of many working parents, who find some level of work-life balance by blurring the two.

It’s not hard, therefore, to imagine how easy it is for some people to also stretch the boundaries of corporate IT policy by using the company laptop for both work and personal things, like allowing their children to use the company laptop for school research or to IM with friends or to download the latest tune onto their Zune (yeah, yeah, I used to work at Microsoft and have a Zune as does one of my sons – they’re actually really good – and I don’t have to say that anymore).

Today’s mobile workforce views the company laptop as a personal productivity tool, and IT departments must take this into consideration and address the behavior and the potential security risks that come with this trend. Even with security solutions and controls in place, you still can’t guarantee that an employee or one of their kids won’t accidently download a virus or trojan or open a spam email.
Read the full article…

Attending a tradeshow forces you to condense your message so you can concisely answer people who ask about your company. After talking to a hundred or so people this week, I got the Napera story down to the following five points.
Read the full article…

It’s been 482 days since the founders of Napera put our commitment to this company on paper. This morning we kicked off our official launch, and we’ll be busy through May with tradeshows and press engagements. Finally, our product details are out there!

We created the Napera product line to solve the network health challenge for the small and medium enterprise (SME). As a team, our focus is 100% on that customer. There are over a million SME’s worldwide, but they receive scant attention from enterprise networking vendors. Our earliest meetings with customers in fall 2006 confirmed our suspicions. IT managers want to protect their IT investment from rogue, malicious or careless network users. There was no compelling SME solution in 2006 and the situation remains unchanged today.
Read the full article…

The small to medium enterprise market is often looked down on by vendors who see their domain as large enterprise networks. Vendor CEO’s dream of marquee Fortune 1000 clients. Salespeople visualize six figure deals and sales conferences in exotic locales while their engineers build complex, technically elegant but often unworkable architectures that take years to deliver. Service organizations contemplate endless revenue streams based on slow deployments and juicy support contracts. Ironically, not all of these vendors are large – some of them are startups – but they all have an appetite for enterprise IT budgets.
Read the full article…

A recent survey published at Dark Reading confirms what customers have been telling us for over a year. According to the survey, “70 percent of shoppers don’t understand the significance of the green browser bar, and 20 percent of those questioned do not understand what the golden security padlock represents.”
Read the full article…

On Monday, I wrote about the need to keep corporate networks “healthy” – operating at peak efficiency, free from the ravages of unknown systems and infected machines. I said that a healthy network ensures greater productivity, higher customer satisfaction, and profitability.
Read the full article…