Quantcast
Channel: Symantec Connect - ブログエントリ
Viewing all 5094 articles
Browse latest View live

2H 2016 Shadow Data Report: Companies More Collaborative, More Secure and More in the Cloud than Ever Before

$
0
0
Background Image on Blogs "Quilted" Page: 
Publish to Facebook: 
No

Organizations continue to embrace the cloud with higher use of file sharing and adoption of even more cloud applications.  In the second half of 2016, Symantec customers on average broadly shared more files in the cloud than ever before. At the same time, they are sharing data more responsibly. Research shows a significant reduction in the percentage of broadly shared files in the cloud that contain confidential or compliance related content. Organizations also continue to increase the number of cloud applications in use – both sanctioned applications and unsanctioned applications often referred to as Shadow IT. 

More Data Sharing with Less Exposure

In the second half of 2016, on average customers are broadly sharing 25% of all files in cloud files sharing applications. The percentage of files broadly shared that contain sensitive data has decreased to an all-time low of 3%. To be classified as “broadly shared”, a file is shared to the public, to the entire organization, or to an external third party. In the past, it was typical to discover that 10% or more of broadly shared files contained sensitive data.  

Blog Shadow Data Report image white 2.png

Compliance Data and Emails at Risk

We are still not out of the woods because while it looks like a lower percentage of files in cloud file sharing contain compliance data than before, a surprising percentage of files with Protected Health Information (PHI), Personally Identifiable Information (PII), and Payment Card Information (PCI) data that make it to the cloud are potentially exposed. 

In file sharing applications PHI data leads the pack with 82% of all files at risk of exposure, followed by 43% of files containing PII and 42% of files containing PCI data. Email risk exposure is generally higher than file sharing exposure. 27% of emails and attachments are broadly shared and 8% of emails contain compliance related data.

More Shadow IT in Use

Organizations are using many more cloud applications than what is typically assumed by IT professionals. Shadow IT discovery research shows organizations use 928 different cloud applications on average. This is a 10% increase over the first half of 2016.

Blog Shadow data report image white 1.png

Research Findings

The Shadow Data Report for the second half of 2016 provides the latest insights into cloud adoption, usage, and threats to help organizations navigate their adoption of cloud applications and implementation of cloud security. The findings in this report are based on anonymized meta data analysis of over 20K cloud apps, 175M cloud documents, and 1.3B emails.

Get the full 2H 2016 Shadow Data Report here.


WEBINAR: Data-Centric Security: A Best Practice Approach

$
0
0
April 13, 2017 Webinar
Publish to Facebook: 
No

WEBINAR: Data-Centric Security: A Best Practice Approach

TIME: 10:00 AM PT / 1:00 PM ET

SPEAKERS: Guest Speaker Heidi Shey - Senior Analyst at Forrester and Nico Popp - SVP Engineering,  Information Protection at Symantec

Keeping data safe pays dividends for protecting your reputation and retaining trust. No-one wants to suffer a breach, let alone a mega breach, but how should you invest time and resources to prevent this? 

In this webinar, guest speaker Heidi Shey (Senior Analyst at Forrester) will join Nico Popp (SVP Engineering, Information Protection at Symantec) as they guide you through the evolving world of data protection and explain how a holistic approach to data security and identity puts you back in control.  

Such a data centric approach combines data discovery, protection and identity and delivers two key benefits:

•Ensures data is only available to the right users, irrespective of location (including cloud), organization or device

•Provides protection throughout the data lifecycle

The webcast will include a review of best practices to help you understand how a proactive, data-centric approach makes best use of your resources, and safeguards your – and your customers’ – critical data. 

クラウド時代向けに設計されたセキュリティと脅威防止で、高度なマルウェアを迎え撃つ

$
0
0
Background Image on Blogs "Quilted" Page: 

ハッカーたちは、企業のネットワークに侵入しようと、飽くことのない創意を発揮し続けています。実際、最近のマルウェア攻撃のなかには、企業の活動を停止に追い込み、関係者から金銭を奪ったり、大勢の消費者の信用を損ねたりして、ニュースの見出しを賑わせたものもあります。こうした攻撃があるたびに明らかになるのが、サイバー犯罪者も進化を続けており、多くの企業のセキュリティ防御をすり抜ける脅威を生み出しているということです。高度なマルウェアともなれば、セキュリティ防御を感知して無力化するという、生物としてのウイルスなみの性質まで備えている場合があります。

クラウドアプリケーションの導入が広がり、従業員が使うモバイルデバイスも急増するなかで、ハッカーがこれほど執拗な活動を続けている以上、企業は増え続ける高度なマルウェア攻撃から身を守る手段を、新しく見いださねばなりません。これはかなり厄介な問題です。デバイスやアプリケーション、ユーザーによって異なる脅威にどこからでも対処できるソリューションは、どこにあるのでしょう。その答えは、空を見上げていて見つかるものではありません。しかし、視線を雲に、クラウドに転じれば、企業向けの革新的なセキュリティソリューションをどこで探せばいいのか、手がかりがそこにあります。

問題: 進化し続ける脅威の性質

ネットワークセキュリティが進化するように、マルウェアも進化します。今まで以上に認識能力と適応性が高くなり、新しい拡散経路を探りながら、動作検出を回避するように変質しているのです。具体的な進化の例をあげてみましょう。

仮想マシンの認識 ―仮想のサンドボックス環境で動作していることを感知でき、自身を偽装できるマルウェアを作成する攻撃者が増えています。

ファイルも URL も多形態に ―マルウェアファイルは、感染性ウイルスのように形態変化や変異をとげ、シグネチャベースの検出をすり抜けるようになってきました。自動化したシステムを利用して、攻撃者は絶えずファイルの見かけを変え、そのファイルをユーザーの防衛線に向けて大量に送りつけます。どれかが防衛線を突破し、動き始めることを期待しているわけです。ドメイン生成アルゴリズム(DGA)を利用して数学的に新しいドメインを計算すれば、URL でも同じような操作ができ、ブラックリストのような技術では対処できなくなります。

多段階、多経路の攻撃 ―巧妙なサイバー犯罪者になると、多段階の攻撃を用意して企業の防衛網を突破します。攻撃者は Web ベース、メール、ファイルベースの侵入を選んで自由に組み合わせ、狙った結果を達成しています。

通信の暗号化 ― ネットワークセキュリティシステムの大部分は、暗号化されたデータをスキャンしてマルウェアを検出する機能を備えていません。そこに目をつけた攻撃者は、組み込んだマルウェアと、リモートのコマンド & コントロール(C&C)サーバーとの間で通信トンネルを確立する際に SSL を使うようになりました。

紛らわしいファイル形式 ―マルウェアは、無害なファイルに偽装することがあります。たとえば、JPEG に偽装し、実際には内部に実行可能ファイル(.exe)が仕込まれたマルウェアファイルが知られています。あるいは、後から実行可能ファイルに変化し、ネットワークにマルウェアをまき散らすマルウェアファイルもあります。

ユーザー操作による起動 ―正規のソフトウェアになりすましたマルウェアは、わかりやすく親切そうなダイアログボックスを表示して、ソフトウェアのインストールを求めます。ユーザーがインストールを許可してしまうと、すかさず動作し始めるという仕組みです。  

標的を限定した独自のマルウェア ―標的を限定した「スピア型フィッシング」攻撃に組み込まれるマルウェアもあります。あるユーザーに狙いを定めると、その標的だけに特有の情報を利用してファイルを開かせようとします。ファイルが開かれると、攻撃者は特定の情報を探し始めます。

クラウド(クラウド型セキュリティ)、登場

こうして脅威が高度に発達してくると、それに対処するために、脅威に対する防衛策の見直しが必要になってきます。しかもその防衛策は、企業が Web や企業向けアプリケーションをどのように利用しているのかという現実に即したものでなければなりません。従業員が広範囲に広がると、ラップトップやモバイルデバイスを使って直接インターネットに接続し、SaaS アプリケーションを利用するようになります。そうなれば、クラウド型のセキュリティと脅威防止を視野に入れることが必要になってきます。クラウド型セキュリティは、プロビジョニングも簡単で、あらゆる Web トラフィックについてセキュリティと脅威防止に取り組むことができます。サブスクリプションベースのサービスなので、需要の増減に合わせてスケールアップとスケールダウンが容易だというメリットもあります。配備が簡単とは言え、必要な範囲で最高レベルの脅威防止を提供できるよう配慮が必要です。シマンテックによるクラウド型セキュリティサービスを詳しくご覧になれば、シマンテックのソリューションが真にエンタープライズクラスと評価されている理由をご理解いただけるでしょう。

解決策: シマンテックのクラウド型セキュリティ、マルウェア解析サービス

シマンテックの研究開発部門は、進化し続ける新しい攻撃技術に対処するために、シマンテックを強化することに全力を注いでいます。高度な解析手法から、検出技術をすり抜けようとするマルウェアの特定と無効化まで、多層のシステムをシマンテックは開発しました。こうした多層技術で、既知の脅威を遮断し、新しい未知の脅威も解析して、進化した攻撃に備えます。システム全体が、エンタープライズクラスの保護を提供しつつ、誤認率を最小限に抑えるという前提で設計されています(セキュリティやインシデント対応の担当者が、誤報への対処で貴重な時間を無駄にしないために)。

SymantecCloud_JA_0.png

Symantec Global Intelligence Network を活用する Web セキュリティサービス

シマンテックがクラウドで提供する Web セキュリティサービス(WSS)には、GIN(Global Intelligence Network)からデータが供給されています。GIN は、民間として世界最高峰のサイバー防衛用脅威インテリジェンスサービスです。GIN のデータをもとに、企業は細分化されたカテゴリに URL を分類し、所定のリスクスコアを確認することができます。ネットワークには、これまでに確認も分類もされていない Web サイトが 10 億単位で存在し、消費者が送受信するメールは 1 日あたり 20 億通を超えています。シマンテックは、15,000 社の企業と 1 億 7,500 万の消費者およびエンタープライズエンドポイントから集められた脅威情報と遠隔測定データを利用して、それを分類し解析します。シマンテック独自の専門技術と解析手法でそうした情報を利用して、「既知の不良」ファイルや、企業が避けるべきサイトが定義されていきます。Web とファイルアクセスに関する制御ポリシーを Symantec WSS で設定すれば、「既知の不良」は入り口でとどめられ、社内に害が及ぶことはありません。Symantec WSS では、コンテンツ解析機能も利用します。二重のマルウェアエンジンを使い、ブラックリスト/ホワイトリストのファイルも比較して、危険性のあるファイルについてさらに詳しい解析が実行されます。

シマンテックのマルウェア解析サービス

マルウェアの作成者が仮想環境とエミュレーション環境をどちらもすり抜けることはきわめて困難なので、シマンテックのマルウェア解析サービスは、Symantec WSS と連携して動作解析とサンドボックス処理機能を備え、高度な脅威の検出と防止に対応しています。ここで使われるのが、エミュレーションと仮想化を組み合わせて悪質なコードを識別する強力な機能です。仮想化が実行される仮想マシンはフルライセンス版の Windows なので、ユーザーはどんなアプリケーションでもインストールできます(Office、Adobe、Quicken、さらにはカスタムアプリケーションも)。この仮想マシンを、シマンテックは Intelligent VM(iVM)と呼んでいます。エミュレーションによるサンドボックス環境は Windows ソフトウェアではなく、Windows ライクな API に基づいて完全に再設計されたコンピューティング環境です。完全制御されたこの人口環境であれば、マルウェアにも本当のコンピュータに侵入したと思い込ませることができます。

クラウドなら簡単。ぜひお試しください

急速な進化をとげながら連日ネットワークを攻撃してくる高度な脅威に対処する―そのときに必要な保護機能を提供するというのが、Symantec WSS と、そこに統合される Symantec Malware Analysis Service の設計思想です。企業の資産を保護するサブスクリプションサービスについて詳しくは、ぜひお問い合わせください。「既知の良品」を通過させ、「既知の不良品」を遮断するとともに「未知のもの」は正確に解析する信頼性。シマンテックにお任せください。

詳しくはこちらをご覧ください。

【参考訳】

The Growing Cyber Challenges in Education

$
0
0
Background Image on Blogs "Quilted" Page: 
Publish to Facebook: 
No
Twitter カードのスタイル: 
summary

The public sector is filled with cybersecurity challenges, but it is interesting how the needs change when you move from the federal government to state governments to education. The education sector sometimes gets overlooked because the information collected by schools is not imperative to national security like that in the federal government, but the security challenges are still incredibly important. 

The education sector is third, just behind healthcare and retail, of the industries that face the largest number of cyberattacks. That makes sense. School systems hold a wealth of personally identifiable information (PII) of not only students, but teachers, administrators and other school staff. Hackers want this valuable information.  

As the Trump administration sets its cybersecurity priorities for the upcoming four years many of the policies will focus on the federal government. Other parts of the public sector, though, will need help from the federal government, especially the education market.  

Schools need a comprehensive approach to security. This security strategy needs to cover physical, virtual and cloud platforms, along with safely managing confidential data and other digital assets. Let’s look at some areas where education institutes need to look at going forward to improve cybersecurity. 

Threat protection: Sophisticated cyber criminals constantly come up with new ways to attack. Thankfully, large cyber networks can help protect against these types of threats. The Symantec Global Intelligence Network monitors threat activity in more than 157 countries and records thousands of events per second. This information is used to inform future actions. 

Information protection. Data is the most important part of any IT network. Schools need to be able to get deep visibility into how their users access data in order to properly control it. In today’s computing world, traditional on-premises boundaries are meaningless. Schools today need to be able to control data no matter where it is used or where it travels throughout its lifecycle. 

Mobility. Education today is also not done in one place. Schools have embraced mobile technology, but those devices need protection at the endpoint, app and data layers. School systems need to look to edge app-wrapping technology that allows education apps to sit side-by-side with personal apps without intermingling. Doing that helps keep information on devices secure. 

Schools face a delicate challenge. Their mission is not to protect data, but teach students. As technology plays a larger part in learning, data security grows in importance as well. The right solutions and right policies can help schools keep student data safe while utilizing the latest in learning technology. As the new administration grapples with its cybersecurity policies, a focus on securing PII in the education system should be a major consideration.

For additional information on how to protect PII in an education environment, read this data sheet.

The Changing World of Work and Stepping Up for Gender Equity

$
0
0
Celebrating Women’s History Month and Symantec’s Efforts to Bridge the Gender Gap
Publish to Facebook: 
No

While the moral arguments for gender equity are clear, the broader economic benefits are becoming much clearer – for individuals, families, communities, companies and our world as a whole. For example, closing the gender gap could generate $12 trillion for global GDP[1] according to McKinsey Global Institute and a recent report by the United Nations and BNY Mellon projects the “return on equality” for achieving gender equity across five key sectors such as water and energy has the potential to increase annual spending by over $300 billion by 2025[2]

In the technology and cyber security industries, the need for more representation of women hits home hard. While women represent half of our global population, studies show that only 10%[3] of the global cyber security workforce are female, while projections estimate there will be an excess of 1.5 million cyber security jobs in 2020.

Last week, in honor of International Women’s Day, the United Nations shone a light on the changing role of women in the world of work, and how our rapidly developing world is creating opportunities for females while exacerbating already existing divides. Today, we offer a look at what Symantec is doing to make our mark on gender equity –for our company, cyber security, and the broader technology industry. From educating and engaging women of all ages, to building the skills women need to move into cyber security careers, to promoting equity within our business walls, diversity is a cause we care deeply about and one in which we continue to deeply invest. 

The Changing World of Work at Symantec

We've made investing in diversity a priority not only because it’s the right thing to do but also because it translates to a higher performing industry, company and bottom line.

Our strategy to address diversity across all backgrounds, including the representation and empowerment of women, is based on a four-pronged approach:

  • Attracting, retaining, and developing diverse employees
  • Ensuring an inclusive experience for our entire value chain
  • Investing in STEM education to grow a diverse talent pipeline, and
  • Promoting equality on a national and global level

Growing the pipeline of talented female technology professionals: We partner with nonprofits to channel the passion of girls and close the STEM gender gap from a young age. For example, through our partnership and grant with Project CS Girls, a nonprofit working to close the technology gender gap, we support the organization's annual nationwide computer science competition, the largest computer science competition for middle school students in the United States. In partnership with the American Association of University Women (AAUW), we support the organization's national Tech Trek Program, week-long camps that expose rising American 8th grade girls (13-14 years of age) to cyber security and other STEM careers while providing them with valuable STEM training and skills.

“Tech Trek was a once in a lifetime opportunity and it has opened up my eyes to a whole new idea of what my future career can be. It’s also given me broader confidence and taught me that as long as you make yourself familiar with something, learn more about it, anything is possible. I will always remember my Tech Trek experience and it really has – and will continue to - impact my life.” – Grace Beal, Tech Trek participant

Additionally, our signature Symantec Cyber Career Connection Program (SC3) program is building the cyber security workforce of tomorrow. At the end of FY16 24% of participating students were female.

Women on Walls.png

Symantec offices celebrate International Women’s Day and Women’s History Month by joining the Women on Walls campaign and celebrating inspiring female talent. 

Attract and retain diverse talent and create a culture where females can thrive: To make the world a safer place, we need a team with the expertise and experience to protect against threats both known and unknown. This starts with a diverse workforce. By 2020, our goal is to increase the percentage of women globally and underrepresented minorities in the United States by 15% respectively, using FY14 as a baseline year. 

We promote internal awareness of female talent through campaigns such as Women on Walls where offices from Mountain View to Dublin are currently showcasing portraits of inspiring female Symantec professionals.

Our Symantec Women’s Action Network (SWAN) is one of five employee resource groups (ERGs) and plays an integral role for women at Symantec by building cultural awareness and providing opportunities to serve as cultural community ambassadors, mentor females in cyber security, volunteer and advocate on issues. For example, this year, in honor of International Women’s Day, our Cape Town SWAN chapter held a self-defense session for women and our Pune SWAN chapter celebrated their first anniversary with a “build your own legacy” event attended by 150 employees and featuring best-selling author Sudha Menon discussing stories of female societal influencers.

Additionally, we continually offer opportunities to develop and accelerate female talent. For the 8th consecutive year, Symantec provided leading female employees the opportunity to attend the annual Grace Hopper Celebration of Women in Computing, joining 18,000 primarily female attendees for the largest gathering of women in computing today.

“I would say I found the conference to be extraordinary on many fronts – the sea of incredibly talented women in tech, the rich content which provided valuable insights and mechanisms for these participants to take back with them, and the opportunity to network and experience the collective power, thought leadership and energy at a conference with 18,000 participants. I also personally loved getting to know more of our Symantec talent as we worked together to greet the multitudes of conference attendees at our booth. Amazed at our strength and ingenuity.” – Amy Cappellanti-Wolf, Senior Vice President and Chief Human Resources Officer

Promoting equality nationally and globally: By collaborating with key research, nongovernmental organizations, public policy and education partners, we are supporting conversations and creating a voice internally and externally for women in tech. We are proud to be a founding signatory of the Women’s Empowerment Principles (WEP), through which we apply and share best practices contributing to one of the world’s leading global dialogues on gender equality.

Additionally, our #iamtech Medium publication provides a platform for minorities and women in technology to share their stories. This year, Aleatha Parker-Wood, Principal Research Engineer at Symantec spoke about how she is breaking down biases in engineering and the need to encourage female engineers and inventors. Of her daughter, she said:

“I don’t have any idea what future career she’ll choose, but I do know this: If she goes into tech, as a woman she won’t be alone anymore.” - Aleatha Parker-Wood, Principal Research Engineer, Symantec

The World Economic Forum’s Global Gender Gap Index estimates that 68% of the global gender gap has been closed; however, it will take another 170 years to reach full gender equity[4] at our current pace. Significant progress is being made every day and we are proud to be a part of this. But, we recognize there is still far to go and will continue to work through our business and global network to advocate for a culture of equality.  

SWAN.jpg

150 employees in Symantec’s Pune office celebrate the one-year anniversary of their Symantec Women’s Action Network (SWAN) chapter. SWAN chapters worldwide play an integral role in promoting female diversity within and outside the company.

[2] United Nations & BNY Mellon, Return on Equality (Report looks at the economic benefits of achieving gender equity to products and services across five sectors - water, contraception, telecommunications, energy, and child care)

[4] World Economic Forum, “The Global Gender Gender Gap Report 2016”. Study covers 144 countries and quantifies the magnitude of gender disparities and progress over time, with a focus on four key areas: health, education, economy and politics. 

 
 

シマンテック、10 年連続してデータ漏えい防止に関する Gartner Magic Quadrant でリーダーに選出

$
0
0
Background Image on Blogs "Quilted" Page: 
Publish to Facebook: 
No

DLP が主流に

Gartner の新しいレポートによると、データ漏えい防止(DLP)の市場は 2017 年も引き続き拡大する勢いを見せています。企業が規制順守の達成と知的財産の保護を必要とし、またクラウドアプリケーションのような新しいデータ漏えい経路を見極めたいと望んでいるからです。

DLP ビジネスは、前年比 9.8% で成長を続け、2016 年の 8 億9,400 万ドルから、2020 年には 13 億ドルになると推測されています。

シマンテック、DLP のリーダーに選出

購入決定の基準について 12 ベンダーを評価したうえで、Gartner は Magic Quadrant for Data Loss Prevention(データ漏えい防止に関するマジッククアドラント)でシマンテックをリーダーに選出しました。

世界有数の調査会社が、情報の保護という観点でシマンテックを選んだ理由を、いくつか挙げておきます。

  • シマンテックは、クラウドと Web のアプリ、エンドポイント、データリポジトリ、ネットワーク通信(SSL 暗号化された通信も含む)など「データ漏えいの経路を最も広く網羅」
  • シマンテックは、データのフィンガープリンティングから画像解析まで、「最も包括的なコンテンツ対応の検出」技術を提供。PII(個人情報)、顧客の記録、保健情報、知的財産などを含むコンテンツを識別できます。
  • 「DLP の管理と配備が容易」。強力な管理コンソールと、柔軟性の高い配備オプションで、オンプレミスからプライベートクラウド、ハイブリッドクラウド、パブリッククラウドにまで広く対応します。

シマンテックの次なる一歩: クラウドと情報中心のセキュリティ

この 1 年間、シマンテックは DLP Cloud Service for EmailDLP Cloud Service for CASB, and DLP Cloud Service for Cloud Proxyなどの新サービスを投入して、クラウドセキュリティのプラットフォームを築いてきました。そのすべてが、クラウドアプリケーションに出入りする重要なデータに関する可視性を引き上げます。

シマンテックのエンジニアは、次世代 DLP の開発に全力をあげています。データセキュリティの未来は、データ漏えい防止、クラウドセキュリティ、ID 管理、暗号化といった複数の専門分野を組み合わせることにある、シマンテックはそう考えています。こうした別々の技術を統合することで、シマンテックはクラウドとセキュリティ中心のセキュリティをお客様にお届けできるのです。

お客様とパートナー様に、心より感謝いたします

DLP 分野でのリーダーシップが、このように連続して Gartner に評価されたことを、たいへん感謝しております。これこそ、シマンテックがセキュリティのイノベーションに取り組み続けていることの証であり、お客様とパートナー様のご愛顧にお応えしようとしてきた成果にほかなりません。これからの 10 年間も同様に成功を収められるよう尽力してまいります。

Gartner Magic Quadrant レポートの全文は、こちらからお読みいただけます

【参考訳】

Click to Tweet: 
Symantec gets recognized as a leader in @Gartner_inc’s #MagicQuadrant. Find out more. #DataLossPrevention
その他の投稿者: 

Personalized spam campaign targets Germany

$
0
0
A new spam campaign targeting German users uses victims’ real details and installs banking malware on compromised computers.

続きを読む

Integration and the Improvements it Brings to You

$
0
0
Publish to Facebook: 
No
Twitter カードのスタイル: 
summary

Just four and half months ago, I was asked to take on Symantec’s Worldwide Partner Business and it’s been an incredible ride. We have been very focused on completing the work to fully integrate our partner community and our partner business. I’m thrilled to share that on 1 APR, 2017, Symantec goes live as one company with one, powerful partner community.

This just might be the Symantec you’ve been waiting for. We’re recommitting to our partner community and putting into place new tools, processes, and programs that will help you drive growth in your Symantec business. These will all be live on the 10 APR 2017.

I think you’ll like this new Symantec:

  • Fully Committed to Channel Partners: You play an even more integral role in our GTM
  • Easy to Do Business With: We are simplifying our business and go-to-market operations
  • Innovative Solutions that Sell: Our Integrated Cyber Defense Platform is second to none
  • Rewards Investment: We’re building true partnerships—you invest, we invest. You grow, we invest.

What does it mean to be fully committed to channel partners? We’re approaching the market with a “Channel-first Strategy”. We recognize the value you provide to our mutual customers at all stages of the sales cycle and we’ll work together with you to service these customers successfully.

And what does it mean to be easy to do business with? Just like it sounds. As we looked to integrate our partner business, we saw that there were many opportunities to simplify our channel operations, to make it more streamlined to do business with us.  Streamlining business operations is always beneficial—it can lower your cost of sales, speeds up time to close, which speeds up growth, strengthens your competitiveness because you’re responding faster to your customers, and ultimately helps you provide the best solutions to your customers’ cyber security challenges.

What changes are we making, specifically?  We will share much more detail on all these changes and provide your Order Operations teams with detailed training in early April 2017. For now, know that we have streamlined several processes and integrated several tools. Here are the top-level changes we have made:

  • Integrating our Distribution partner landscape, which will result in more support for our Channel partners as Distributors invest in more resources to support you in efforts like:

                  -   Proof of Concepts (POCs)

                  -   Training

                  -   Order Operations that makes ordering and fulfillment fast and easy

  • Consolidated to one global Corporate price list with a simplified SKU structure

  • Strengthened our compliance capabilities and processes

  • Optimizing the process of renewals orders, which will require separate quotes for new licenses and maintenance renewals. This will take place in August 2017.

  • Using “SymOrder” (formerly known as “Blue Store”) to place orders, including automated non-standard pricing acceptance as well as automated Opportunity Registration acknowledgement(s) of accepted front-end discounts

  • Taking Secure One, our newly integrated partner program live on April 10, 2017, which includes Opportunity Registration moving to solely a front-end discount. For an overview of Secure One and how it works, watch this short video: [LINK TO VIDEO]

  • Created a single partner portal in PartnerNet, live on April 10, 2017

All of these changes will be effective in early April. We will continue the flow of information so you know how each change may impact your own operations.

INTERMITTENT SERVICE ON BOTH PARTNER PORTALS

As we transition to our newly integrated partner portal, we’ll need to bring the system down temporarily. During that process, there will be limited capability to PartnerNet and on the Blue Coat partner portal, starting 1 APR 2017.

Blue Coat Partner Portal

You will still be able to review any content that we have posted on the portal, but you won’t be able to:

  • Enroll in the partner program
  • Register and manage deals in our Opportunity Registration program
  • Access and manage your MDF

Symantec PartnerNet

You will still be able to read and download content, take any partner training courses and register deals in our Margin Builder program, but you won’t be able to:

  • Change your partner profile
  • Enroll/Add secondary contacts
  • Enroll in the Secure One partner program
  • Access the partner locator
  • Access Partner Benefits (PBA)
  • Register and manage deals in our Opportunity Registration program
  • Access and manage SPDF through Birch

PartnerNet will come back in full on 10 APR 2017. If you were previously a Blue Coat partner, you’ll need to log in with the same credentials you used on the Blue Coat partner portal. Previous Symantec partners can simply log in with their original PartnerNet logins. More instructions will come to you on the 10 APR 2017, when PartnerNet comes back up.

CLOSING THE YEAR STRONG

We are very excited to pass this important milestone in our integration efforts and while we’ve shared a top-line view of all the changes that will happen in early April, we are very focused on continuing to serve customers with the market’s most comprehensive cyber security portfolio. We’ll work with you to ensure you get all the support you need to continue to win in the market.


Symantec achieves a decade of recognition as a World’s Most Ethical Company

$
0
0
Publish to Facebook: 
No

Symantec is proud to announce a full decade on the World's Most Ethical Companies list. See below for a message from Symantec's Office of Ethics & Compliance.

ethics_0.png

We are very excited to be recognized for the tenth consecutive year as one of the World’s Most Ethical Companies by the Ethisphere Institute, a global leader in defining and advancing the standards of ethical business practices.

Ethisphere and the World’s Most Ethical Companies designation recognizes companies that promote ethical business standards, enable employees and managers to make good choices, and shape industry standards by introducing best practices today. The scores are weighted in five categories:

  1. Ethics and Compliance
  2. Corporate Citizenship and Responsibility
  3. Culture of Ethics
  4. Governance
  5. Leadership, Innovation and Reputation

Ethisphere helps us benchmark our internal programs, showcase what we do right, and identify where we can improve. Symantec always strives to be better corporate citizens and we are delighted that our efforts have once again been recognized by the Ethisphere Institute.

“We should all be extremely proud that Symantec has been recognized by the Ethisphere Institute as one of the World’s Most Ethical Companies for the tenth consecutive year. It is our great responsibility to earn and maintain the trust of our customers around the world as we secure their information and identities. Operating with integrity and a commitment to the highest standards of ethical behavior is incredibly important in maintaining that trust. This award reflects that commitment.” - Scott Taylor, Executive Vice President, General Counsel and Chief Compliance Officer

“Our employees come to work every day committed to making the world a safer place. Their passion and purpose are redefining the cyber security industry, and we’re doing it with a commitment to the highest standards of integrity and ethical operation. This recognition – which marks a full decade of being recognized as one of the World’s Most Ethical Companies – is a testament to our employees’ commitment and drive to do the right thing for our customers, our communities, and each other.” - Amy Cappellanti-Wolf, Senior Vice President and Chief HR Officer

This year, Ethisphere recognized 124 companies spanning five continents, 19 countries, and 52 industry sectors. Symantec was recognized along with other well-known tech companies, such as Dell, Intel and LinkedIn. For a complete list of the 2017 World's Most Ethical Companies, see Ethisphere's full honoree list.

Cybersecurity and the Trump Administration’s First 100 Days

$
0
0
A blog series focused on the people, policies and technologies impacting the government marketplace
Cross Post Blogs: 
Products and Solutions
Publish to Facebook: 
No
Twitter カードのスタイル: 
summary

The first 100 days of a presidential administration serve as an important introduction to how the next four years might play out. Along with learning how the new administration governs, significant attention should be paid to the people, policies and technology priorities shaping the White House agenda as they look to make their mark on government and the country.

While the Trump administration’s first 100 days will bring about a number of notable policies and changes, one area that we are keenly interested in is cybersecurity. The government continues to be under constant attack from adversaries, both known and unknown, as a result of external and internal vulnerabilities. Not only do they want our information and our secrets, but to remove the technology backbone that enables government to run effectively and serve its citizens.

In the last few years, we’ve seen the importance of cybersecurity. The breach at the Office of Personnel Management continues to impact the federal government technologically and financially (stay tuned for our next blog on this topic). The same is true elsewhere in the public sector. State and local governments find themselves under constant attack and school systems must somehow protect the mountain of personally identifiable student information they house. Recently, state governments, like those in South Carolina and Utah, saw themselves the victims of major breaches. And schools, like the University of Maryland, lost tens of thousands of student records.

This is not to point blame at any of these organizations. Far from it. Instead, it is to learn and look at the seriousness of cybersecurity. As technology becomes an even bigger part of the government’s mission delivery, poor cybersecurity has the ability to disrupt all of our lives like never before. The Obama administration made great strides in protecting the nation’s networks, but this is a fight that is never over. The Trump administration has been handed an environment where security is incredibly important, but one that must be maintained and improved upon – not just during the first 100 days, but for every day forward.

These first 100 days of the Trump administration will undoubtedly have an impact on the cybersecurity foundation across all segments – including federal, state, local and education markets. Join us in the coming weeks as we follow the policy, technology and personnel changes in the Trump administration, while providing our perspective on what we see as major issues in this space.

At Symantec, we work with organizations from across the world to help them secure important information. We know the importance of an administration’s first 100 days and look forward to seeing the steps the Trump administration takes to protect federal networks during this critical time of transition. The Trump administration has a great challenge ahead of itself, and we plan to look at it from all angles during this blog series. Please check back regularly for updated posts and share with your colleagues that might be fighting a similar cyber battle.

新品发布:Symantec Advanced Threat Protection应用程序现已登录Splunk

$
0
0
赛门铁克最近发布了新版Symantec™ Advanced Threat Protection (ATP)。与此同时,Splunk用户现可获取免费的赛门铁克ATP。
Background Image on Blogs "Quilted" Page: 

集成Splunk

Symantec Advanced Threat Protection (ATP)用户若将Splunk作为安全信息和事件管理(SIEM)工具使用,则现在便可免费在Splunk应用程序商店中获取免费的Symantec ATP。他们还可将ATP发现的威胁事件输出至Splunk®。ATP Splunk 可使用默认的用户安全信息板,对所有威胁事件进行观察。与此同时,用户还可利用Symantec ATP的众多威胁数据,轻松地在Splunk创建并定制安全信息板。他们能够通过Splunk进一步查看有关特定事件的所有文件哈希值, 并执行即席查询。

如果用户有多个Symantec ATP 模块,便还可使用不同搜索字段(如端点、网络、电邮或漫游事件)在Splunk控制台上过滤ATP事件。此外,Symantec ATP 应用程序可利用Splunk企业安全应用程序中的适应反应框架,使事件响应者能够从Splunk管理控制台直接修复和隔离受入侵端点,从而对相关威胁进行相应。这种集成使用户能够观察多个控制点,还可自动执行IR响应任务。

该应用程序可在以下网址下载:https://splunkbase.splunk.com/app/3453/

Splunk 2_2_0.png

 

最新版本的在主要功能上有所增强

  • 事件创建规则增强- 用户现在可以基于以下方法轻松识别相关事件:1) 检测在端点处没有修复的恶意文件。2) 对任何恶意文件进行沙箱检测。3) 与已知恶意站点或命令和控制站点进行通讯。

  • ATP性能改进:电邮- 立即查看电邮详细信息和相关性。事件创建没有任何延迟。

  • 可疑文件检测功能改进- 赛门铁克持续精细调整机器学习算法,以改善对可疑文件的识别。

  • 通过Cynic沙箱提交和检测RTF文件中恶意软件的能力- 由于RTF文件术语普通文档文件类型,用户现可提交RTF文件进行沙箱检测。

获取更多信息,请访问:http://atp.symantec.com

资源:

下载ATP数据表:Splunk和ServiceNow集成

下载ATP:平台数据表

Symantec Advanced Threat Protection 2.3 发布通知

个性化垃圾邮件攻击活动将目标瞄准德国

$
0
0
一场新垃圾邮件攻击活动将目标瞄准德国用户,使用受害者的真实信息,并在受入侵计算机上安装银行恶意软件。

続きを読む

新しいアプリをリリース: Symantec Advanced Threat Protection アプリが Splunk に登場

$
0
0
シマンテックはこのたび、Symantec™ Advanced Threat Protection(ATP)の新バージョンをリリースし、同時に無料版の Symantec ATP アプリも Splunk ユーザー向けに公開しました。
Background Image on Blogs "Quilted" Page: 

Splunk との統合

Symantec Advanced Threat Protection(ATP)をご利用のお客様が、SIEM ツールとして Splunk をお使いであれば、Splunk のアプリサイト Splunkbase から Symantec ATP を無料でご利用いただけるようになりました。ATP センサーで感知される脅威イベントを、Splunk® にエクスポートすることができます。ATP Splunk ユーザーは、デフォルトのセキュリティダッシュボードを使えるようになり、あらゆる脅威イベントを簡単に確認できます。また、Symantec ATP から送られてくる豊富な脅威データを活用すれば、Splunk セキュリティダッシュボードの作成とカスタマイズも簡単です。ドリルダウンして、特定のインシデントに関連するファイルハッシュを閲覧したり、Splunk 経由でアドホッククエリーを実行したりすることもできます。

顧客が複数の Symantec ATP モジュールを所有している場合は、Splunk コンソールで、エンドポイントやネットワーク、メール、ローミングイベントといった検索フィールドを使って ATP イベントを絞り込むことも可能です。また、Symantec ATP アプリは Enterprise Security アプリで Splunk Adaptive Response のフレームワークを利用するため、インシデントレスポンス(IR)担当者は脅威への対応として、Splunk 管理コンソールから直接、侵害されたエンドポイントを修復し、分離することができます。こうした統合によって、複数の制御ポイントが可視化され、IR の対応タスクが自動化されます。

Symantec ATP アプリは、https://splunkbase.splunk.com/app/3453/からダウンロードできます。

Splunk 2_2_0.png

 

最新バージョンで強化された主な機能

  • インシデント作成のルールを強化 - 顧客は、インシデントを容易に識別できるようになりました。その基準となるのは、1)エンドポイントで修復されていない悪質なファイルの検出、2)任意の悪質なファイルのサンドボックス検出、3)既知の悪質なサイト、またはコマンド & コントロールサイトとの通信です。

  • ATP のパフォーマンス向上: メール- メールの詳細と相関関係をただちに確認し、インシデントとイベントは、遅延なく作成されます。

  • 疑わしいファイルの検出が向上 - シマンテックは、疑わしいファイルの識別を改善するために、マシンラーニングのアルゴリズムを常に調整し続けています。

  • Cynic サンドボックスを介して RTF ファイルを発行し、そこに存在するマルウェアを検出する機能 - RTF は一般的な文書ファイル形式なので、発行してサンドボックス処理できるようになりました。

詳しくは、http://atp.symantec.comをご覧ください。

参考資料:

ATP データシート: Splunk & ServiceNow Integrationをダウンロード

ATP: プラットフォームデータシートをダウンロード

Symantec Advanced Threat Protection 2.3 リリースノート

【参考訳】

個人情報を記載したスパム攻撃、ドイツのユーザーも標的に

$
0
0
ドイツのユーザーを標的にした新しいスパム活動は、被害者に関する正しい情報を利用して、侵入先のコンピュータにオンラインバンキングを狙うマルウェアをインストールしようとします。

続きを読む

SMP 8.0 HF6 release allows Enable/Disable action for multiple policies

$
0
0
SMP 8.0 HF6: Enable/Disable action for multiple policies simultaneously
Publish to Facebook: 
No

Starting from ITMS 8.0 HF6 release, you can perform "Enable"/"Disable" action for multiple selected policies at once

ITMS 8.0 HF6 release notes

Added possibility to perform actions on multiple items in  the search results list:
In the Symantec Management Console, you can now select multiple items in the search results list and perform actions on them.
For example, you can select multiple policies in the search results list, and then enable or disable them at once

1. You can find required Item using "Search" field in Symantec Management Console 8.0 HF6

Type in search field click on "View All Search Results"

Search_1.jpg

Now you can select multiple policies and perform Enable/Disable at once

Search_2.jpg

2. You can do not use a "Search" field from SMP Console and just find a root folder where all required policies and perform Enable/Disable

For example:

  • Click on "Maintenance Windows" root folder now you see all policies from there multiple selection and mouse right click you can enable/disable them at once

Search_3.jpg

Note:

Also same approach can be used for "Managed Delivery" or "Patch Update" policies as well as for other policies

Search_4.jpg

Search_5.jpg


WEBINAR: ZERO-DAY ATTACKS AND WHAT TO DO ABOUT IT

$
0
0
March 23, 2017
Publish to Facebook: 
No

WEBINAR: ZERO-DAY ATTACKS AND WHAT TO DO ABOUT IT

TIME: 10:00 AM PST / 1:00 PM EST

SPEAKER: CHRIS CANDAFFIO, SYSTEM ENGINEER, SYMANTEC

5-Part Webinar Series: Endpoint Protection…what really matters?



Part 3 of 5: Zero-Day Attacks and What To Do About It?



All applications have vulnerabilities and attackers are incented to find them. Once the vulnerability has been discovered, the longer it remains unpatched, the greater the risk of a breach, potential loss of information, and damage to reputation.  



Join us to learn what can be done to block exploit attacks on day zero:



• What behaviors and techniques are used to block attacks

• Why exploit prevention plays a critical part in endpoint protection 

• How Memory Exploit Mitigation works



Then see Memory Exploit Mitigation in action with a demo Symantec Endpoint Protection. 

TO VIEW/REGISTER: CLICK HERE



 

Planting the Seeds for a Safer Future

$
0
0
Celebrating Earth Hour and Actions Today Changing our Tomorrow
Publish to Facebook: 
No

This Saturday, March 25th at 8:30 pm you may notice your world is a little darker. This is because millions across the world in 178 countries will turn off their lights for one hour to “shine a light on the need for climate action” as part of the global Earth Hour celebration.

Coordinated by the World Wildlife Fund and numerous volunteer organizations, Earth Hour is celebrating its tenth year and continues to be the world’s largest grassroots movement for the environment. Last year, over 12,700 landmarks and monuments turned off their lights for Earth Hour and over 2.4+ million actions were taken to help climate change.

Today, in honor of Earth Hour, we are happy to highlight one of Earth’s ambassadors, an organization protecting the planet’s vital resources – trees. We look at how through our software donation program with TechSoup Symantec’s security protection is enabling the organization to thrive.

The Fruit Tree Planting Foundation (FTPF) is a nonprofit dedicated to planting edible, fruitful trees and plants to benefit the environment and all its inhabitants. The organization has a mission to plant and help others plant 18 billion fruit trees around the world. These community orchards not only enrich the environment and provide hunger relief, but also bring together neighbors to care for their trees, encourage communities to get outside and inspire families to experience nature—all of which contribute towards healthier, happier communities.

“Safety isn’t the first thing you think of when planting fruit trees, but it is an important motivator for our work. It has been widely recorded that communities with increased green spaces and leaf cover see a decrease in criminal activity and increase in both individual and community wellbeing,” said Lizzy Rainey, special projects coordinator at the Fruit Tree Planting Foundation

Working both globally and domestically, FTPF collects and stores vast amounts of sensitive data related to their many clients and projects—including information on schools, parks and community gardens, low-income neighborhoods and international hunger relief sites, Native American reservations, health centers and animal sanctuaries—as well as personal information about their employees and volunteers. 

FTPF recognized the importance of securing their data and infrastructure. After learning about Symantec through the company’s software donation partnership with TechSoup, FTPF deployed Norton Small Business to protect the organization’s data from viruses, spyware, malware and other security threats.

FruitTree1.png

Symantec and TechSoup are helping the Fruit Tree Planting Foundation reach their goal of planting 18 billion fruit trees worldwide through a partnership with the Symantec Software Donation program.

“On many of our trips, we are constantly reminded of the importance of our safety, and even though we cannot always be sure that the streets will be safe, we always feel secure as we work on our computers because we know Symantec is keeping our important information and documents safe and secure. And just as our staff and volunteers feel safe at our desks and in our homes by using Symantec Norton Security, we are beginning to see the burgeoning sense of safety in the streets of rural communities. We are planting the seeds, quite literally, for a safer future, where neighbors come together to plant, maintain, and harvest their fruit trees for generations to come,” said Rainey.

FruitTree2.png

Communities with increased green spaces and leaf cover see a decrease in criminal activity and an increase in both individual and community wellbeing.

The FTPF’s efforts align with Symantec’s longstanding commitment to environmental responsibility. Last year, Symantec established a new, ambitious science-based GHG emissions reduction goal to reduce its GHG emissions by 30 percent by 2025 (FY15 baseline). Additionally, in 2016 alone, Symantec employees spent countless hours cleaning up beaches, preserving wetlands building community gardens and engaging in other volunteer efforts to protect the environment and the communities where we live and work.

Through its mission to plant 18 billion fruit trees, FTPF is an inspiring example of the power of taking action, creating a safer community, safer planet and enriching the lives of many.

As Earth Hour emphasizes “your action today can change our tomorrow”.  We can all begin by turning off our lights in honor of Earth Hour this weekend; if over twelve thousand landmarks can go without light for an hour, what is stopping you? However, it shouldn’t stop here. Every day we can think about turning off unnecessary lights and conserving resources where we can. Together every little bit creates a large impact. 

About Symantec’s Product Donation Program

Product donation is Symantec’s largest mechanism to support the nonprofit community and help nonprofits fulfill their missions. In partnership with TechSoup, each year Symantec provides cybersecurity solutions to more than 25,000 organizations across 55 countries worldwide, allowing them to secure their most important data wherever it lives. Since launching the software donation program in 2002, Symantec has helped more than 93,000 nonprofits solve today’s biggest security challenges and protect against the ever-evolving threat landscape.

Learn more about some of the many nonprofits utilizing Symantec products through Symantec’s partnership with TechSoup:

Symantec Backs Its CA

$
0
0
Cross Post Blogs: 
Products and Solutions
Publish to Facebook: 
No
Twitter カードのスタイル: 
summary

At Symantec, we are proud to be one of the world’s leading certificate authorities. We strongly object to the action Google has taken to target Symantec SSL/TLS certificates in the Chrome browser. This action was unexpected, and we believe the blog post was irresponsible. We hope it was not calculated to create uncertainty and doubt within the Internet community about our SSL/TLS certificates.  

Google’s statements about our issuance practices and the scope of our past mis-issuances are exaggerated and misleading.  For example, Google’s claim that we have mis-issued 30,000 SSL/TLS certificates is not true. In the event Google is referring to, 127 certificates – not 30,000 – were identified as mis-issued, and they resulted in no consumer harm. We have taken extensive remediation measures to correct this situation, immediately terminated the involved partner’s appointment as a registration authority (RA), and in a move to strengthen the trust of Symantec-issued SSL/TLS certificates, announced the discontinuation of our RA program. This control enhancement is an important move that other public certificate authorities (CAs) have not yet followed. 

While all major CAs have experienced SSL/TLS certificate mis-issuance events, Google has singled out the Symantec Certificate Authority in its proposal even though the mis-issuance event identified in Google’s blog post involved several CAs.    

We operate our CA in accordance with industry standards. We maintain extensive controls over our SSL/TLS certificate issuance processes and we work to continually strengthen our CA practices. We have substantially invested in, and remain committed to, the security of the Internet.  Symantec has publicly and strongly committed to Certificate Transparency (CT) logging for Symantec certificates and is one of the few CAs that hosts its own CT servers.  Symantec has also been a champion of Certification Authority Authorization (CAA), and has asked the CA/Browser Forum for a rule change to require that all certificate authorities explicitly support CAA.  Our most recent contribution to the CA ecosystem includes the creation of Encryption Everywhere, our freemium program, to create widespread adoption of encrypted websites. 

We want to reassure our customers and all consumers that they can continue to trust Symantec SSL/TLS certificates.  Symantec will vigorously defend the safe and productive use of the Internet, including minimizing any potential disruption caused by the proposal in Google’s blog post.  

We are open to discussing the matter with Google in an effort to resolve the situation in the shared interests of our joint customers and partners.

 

Symantec Backs Its CA

$
0
0
Cross Post Blogs: 
Products and Solutions
Publish to Facebook: 
No
Twitter カードのスタイル: 
summary

Symantecは業界をリードする認証局の一つであることを誇りに思っています。私たちはGoogle社がChromeブラウザにおいてSymantec SSL/TLSサーバ証明書をターゲットとして行なうアクションに強く反論します。この行為は想定外のものであり、かつブログに書かれた内容は無責任なものであると考えます。私たちは、この行為がSSL/TLSサーバ証明書に対するインターネットコミュニティの不確かな状況や不信感を生じさせるために行われたものではないことを願います。

私たちの証明書発行業務ならびに過去の不適切な発行の影響範囲に関するGoogle社のステートメントは誇張されており、誤解を助長するものです。例えば私たちが3万枚の証明書を不適切に発行したとするGoogle社の主張は正しくありません。Google社が言及する事象において、3万枚ではなく、127枚の証明書が不適切に発行されましたが、これによる被害は消費者には及んでいません。私たちはこれらの状況を改善するために大規模な改善策を執り行い、問題に関わったパートナーに対してRegistration Authority(RA)としての指定を即刻解除し、またSymantecのSSL/TLSサーバ証明書の信頼を強化するためにRAプログラムの終了を発表しています。この管理の強化は非常に重要なものであり、他のパブリック認証局が未だ追従できていないものです。

全ての大手認証局がSSL/TLSサーバ証明書の不適切な発行という事態を経験している中、Google社はブログの中でいくつかの認証局における問題の存在を指摘しつつ、Symantecの認証局のみをその提案の対象としています。

私たちは業界標準に従って認証局を運営しています。私たちはSSL/TLSサーバ証明書の発行業務に対する厳格なコントロールを維持しており、認証局としての業務内容を継続的に強化しています。私たちはこれまでにインターネットのセキュリティに対して多大な投資をし、今後も同様に責任を負っていきます。Symantecは公にかつ積極的にSymantec証明書のCertificate Transparency(CT;証明書の透明性)へのログの登録を推進しており、自らCTサーバを抱える数少ない認証局の一つです。Symantecは、Certificate Authority Authorization (CAA;認証局の指定)の推進者であり、CA/Browser Forumにすべての認証局がCAAの順守をするようルールの変更を働きかけてきました。直近では、私たちが作り出したフリーミアムプログラムであるEncryption Everywhereによって、暗号化されたウェブサイトの広範囲な拡大をサポートすることで、認証局のエコシステムに対して貢献しています。

私たちはSymantecのSSL/TLSサーバ証明書を全ての消費者と私たちの顧客が継続して信頼頂けるように願っています。Symantecは、Google社のブログ記事の提案によって引き起こされ得る混乱があったとしても、安全で生産的なインターネットの利用を精力的に守ります。

私たちは共通の顧客とパートナーの利益の為に、この現状解消する努力の一環として、Google社とこの件について継続して議論します。

赛门铁克支持其CA

$
0
0
Publish to Facebook: 
No
Twitter カードのスタイル: 
summary

作为全球最大的证书颁发机构之一,我们赛门铁克非常自豪。我们强烈反对谷歌针对赛门铁克SSL/TLS证书在Chrome浏览器中所采取的行动。这一行动让人出乎意料,而且我们认为谷歌的博文是不负责任的。我们希望这一计划的目的不是为了在互联网社区造成对我们的SSL/TLS证书的不确定性与怀疑。

谷歌对于我们的颁发实践以及我们过去误颁发范围的声明是言过其实且具有误导性的。例如,谷歌声称我们已经误颁发了30,000个SSL/TLS证书,这不是事实。在谷歌所提到的事件中,有127个证书—而不是30,000个证书—被认定为误颁发的证书,而且它们没有对消费者造成伤害。我们已经采取了广泛的补救措施以纠正这一情况,我们立即终止了对涉事合作伙伴的注册机构(RA)任命,而且为了加强对赛门铁克所颁发的SSL/TLS证书的信任,我们已经宣布终止我们的RA项目。这种管控的强化是其他公共证书颁发机构(CA)尚未遵循的重要举措。

所有主要的CA都经历过SSL/TLS证书误颁发事件,尽管谷歌的博文中所认定的误颁发事件涉及多个CA,但是谷歌在其计划中只将赛门铁克证书颁发机构挑选出来单独对待。

我们根据行业标准管理我们的CA。我们对自己的SSL/TLS证书颁发流程保持着广泛的管控,而且我们一直努力以不断加强我们的CA实践。我们已经对互联网的安全性进行了大量投资,而且我们仍然会致力于保护互联网的安全性。赛门铁克已经公开、坚定地致力于对赛门铁克证书进行证书透明度(CT)日志记录,而且赛门铁克是为数极少的拥有自有CT服务器的CA之一。赛门铁克还是证书颁发机构授权(CAA)的拥护者,并且已经要求CA/浏览器论坛更改规定,以要求所有证书颁发机构明确支持CAA。我们对CA生态系统的最新贡献是我们的免费增值项目—加密无处不在,该项目旨在推动加密网站的广泛采用。

我们想要让我们的客户与所有消费者放心,他们能够继续信任赛门铁克的SSL/TLS证书。赛门铁克将大力捍卫对互联网的安全与有效的使用,包括将谷歌博文中的计划所可能引发的任何干扰降低到最小程度。

我们愿意与谷歌探讨这一问题,从而以符合我们共同的客户与合作伙伴的共同利益的方式努力解决这一情况。

Viewing all 5094 articles
Browse latest View live


Latest Images