Marianne recently surpassed 2,500 solutions in the forums. In other words, she has solved more than 2,500 questions you have asked on the site.

Please join me in congratulating Marianne and thanking her for her expertise, her service, and her all-around awesomeness.

We promised to keep you updated on the progress of Backup Exec 2014. Today, I am excited to confirm that Backup Exec 2014 will reach general availability (GA) on 2 June 2014!

As indicated in my last update, we closed the Beta program a little over a week ago. I wanted to share some additional customer feedback we received since that time:

• “Love the redesign on the UI- specifically the Job Monitor.”
• “Happy that I have so much flexibility to see what is happening, without having to navigate between screens.”
• “Very pleased with it. Very smooth installation and it works very good.”

Thank you for your continued support.

Understanding how NetBackup writes to tapes and what happens when images expire will help you better manage your tapes.

Tapes are linear - meaning that they write from the front to the back.

if we look at a tape.
BOT|day1image|day2image|blankspace|EOT

now the day1image expires on the tape - the assigned date does not change and you have this.

BOT|expiredimage|day2image|blankspace|EOT

if you try to write to this tape again it will ONLY write in the blankspace as tapes are Linear - meaning they can only append (tapes cannot write here and there like a disk can)

Now day2image expires - the assigned date of the tape goes blank - no assigned date

-------

Now look at it with multiplexing.

you use the tape - it gets an assigned date.

BOT|server1part1|server2part1|server1part2|server2part2|blankspace

if the backup for server1 fails or if the backup image expires then you have this

BOT|expiredimage|server2part1|expiredimage|server2part2|blankspace

remember tape is linear it cannot go back and write in those spaces where the failed image went.

So if a tape is full it cannot be written to again until ALL the images on the tape have expired.

expire the image and expire the tape are two different things.

when NetBackup goes to use a tape and mounts it, it gets assigned -
assigned means that NetBackup took a scratch tape with no assigned date and tried to use the tape today - does not mean that it wrote to it.

Now when NetBackup writes to the tape it gets an images ( this does not change the assigned date).

if the backup is good then the tape has an assigned date, and has a good images.

now say you use the SAME tape tomorrow - the assigned date does NOT change - but the tape does get a new image.  So now you have this (no multiplexing)

BOT|day1image|day2image|blankspace|EOT

now the day1image expires on the tape - the assigned date does not change and you have this.

BOT|expiredimage|day2image|blankspace|EOT

if you try to write to this tape again it will ONLY write in the blankspace as tapes are Linear - meaning they can only append (tapes cannot write here and there like a disk can)

Now day2image expires - the assigned date of the tape goes blank - no assigned date

-------

Now look at it with multiplexing.

you use the tape - it gets an assigned date.

BOT|server1part1|server2part1|server1part2|server2part2|blankspace

if the backup for server1 fails or if the backup image expires then you have this

BOT|expiredimage|server2part1|expiredimage|server2part2|blankspace

remember tape is linear it cannot go back and write in those spaces where the failed image went.

so you do lose space on a tape when a backup fails or expires.

a tape will stay assigned until all images on the tape have expired.
so if you want the tape to be unassigned, you need to expire all the images on it.

Now expiring a tape has to do with the Physical tape.
Not everybody puts an expiration date on a tape.
If you only want to use a tape for 3 years then you can put a date on the tape that sets it for 3 years.  After that date NetBackup will not longer use the tape to do backups on, but the tape can still be used for restores.
To see this you would right click on the media in the console.
that stuff at the top has to do with the expiration of the physical tape, people new to NetBackup quite often get this confused with expiring all the images on the tape.

Understanding how NetBackup writes to tapes and what happens when images expire will help you better manage your tapes.

Welcome back to the "Android Mobile Application Penetration Test Tricks" blog series! We'll continue to examine techniques that you can use while performing your own mobile application penetration tests. In our last installment we configured BusyBox, and in this installment we'll utilize BusyBox functionality in order to monitor filesystem changes during mobile application execution. Let's jump right in! First launch the emulator with the "partition-size" and "no-snapshot" options:

    $ emulator64-arm -avd myEmulator -partition-size 512 -no-snapshot

As discussed in the last installment, setting the "partition-size" option to a large value such as 512 MB will allow us to make changes to the "/system" partition. Including the "-no-snapshot" option prevents hardware configuration conflicts introduced by the "partition-size" option. By default the /system partition is mounted read-only, so you'll need to remount this partition read/write by launching the ADB (Android Debug Bridge) shell and executing the following command:

    $ adb shell
    root@android:/ # mount -o rw,remount -t yaffs2 /dev/block/mtdblock0 /system

Now you can create a file with the current time of last modification

    root@android:/ # touch /mnt/sdcard/timestamp

The touch command creates a file if it does not exist, or updates the time of last modification if the file already exists. Next you can perform some action within your Android application. In this case I will simply use the Android Contacts application in order to add a new contact. Now you can utilize BusyBox's find command in order to search the filesystem for files that have been modified. The basic command uses the "newer" option and looks like this:

    root@android:/ # find / -newer /mnt/sdcard/timestamp

However, this command will return massive amounts of extraneous output from the /proc and /sys directories. These directories can be filtered with the "prune" option. In addition, let's also filter the /dev directory and polish the output using the grep command:

    root@android:/ # find / \( -type f -a -newer /mnt/sdcard/timestamp \) -o -type d -a \( -name dev -o -name proc -o -name sys \) -prune | grep -v -e "^/dev$" -e "^/proc$" -e "^/sys$"
    /data/data/com.android.inputmethod.latin/files/contacts.en_US.dict
    /data/data/com.android.providers.contacts/databases/contacts2.db
    /data/data/com.android.providers.contacts/databases/contacts2.db-journal
    /data/data/com.android.providers.contacts/shared_prefs/ com.android.providers.contacts_preferences.xml
    /data/system/dropbox/system_app_strictmode@1364420115012.txt
    /data/system/dropbox/system_app_strictmode@1364420064936.txt

This gnarly looking command finds all files that have been modified since we touched the timestamp, filtering out the /dev, /proc, and /sys directories. Note that in rare instances random subdirectories may happen to be named "dev", "proc", or "sys". These subdirectories will appear within the output, but the find command will not descend into these directories. Keep this in mind if you see an entry with one of these names. Consider the following example:

    root@android:/ # mkdir /data/proc
    root@android:/ # touch /data/proc/sneakyFile
    root@android:/ # find / \( -type f -a -newer /mnt/sdcard/timestamp \) -o -type d -a \( -name dev -o -name proc -o -name sys \) -prune | grep -v -e "^/dev$" -e "^/proc$" -e "^/sys$"
    /data/proc
    /data/data/com.android.inputmethod.latin/files/contacts.en_US.dict
    /data/data/com.android.providers.contacts/databases/contacts2.db
    /data/data/com.android.providers.contacts/databases/contacts2.db-journal
    /data/data/com.android.providers.contacts/shared_prefs/ com.android.providers.contacts_preferences.xml
    /data/system/dropbox/system_app_strictmode@1364420115012.txt
    /data/system/dropbox/system_app_strictmode@1364420064936.txt

In this case the /data/proc subdirectory should be manually searched for files that have been modified:

    root@android: # find /data/proc -newer /mnt/sdcard/timestamp    
    /data/proc
    /data/proc/sneakyFile

Now you can monitor what local files your Android application is modifying! Next you could manually inspect these files in order to determine exactly what information your application is storing. Alternatively, BusyBox's find command can directly invoke the grep command for powerful functionality. For example, consider an application that might be storing authentication credentials within the filesystem. You can use the following command to search modified files for authentication credentials:

    root@android: # echo username:password > /data/badApplication.txt
    root@android: # find / \( -type f -a -newer /mnt/sdcard/timestamp -exec grep -l password {} \; \) -o -type d -a \( -name dev -o -name proc -o -name sys \) -prune
    /data/badApplication.txt

Let's wrap up by creating functions to simplify command line syntax:

    root@android:/ # vi /system/vendor/modified-functions

Now copy and paste the following content into the modified-functions file:

modified-list()
{
  find / \( -type f -a -newer /mnt/sdcard/timestamp \) -o -type d -a \( -name dev -o -name proc -o -name sys \) -prune | grep -v -e "^/dev$" -e "^/proc$" -e "^/sys$"
}
 
modified-search()
{
  find / \( -type f -a -newer /mnt/sdcard/timestamp -exec grep -l $1 {} \; \) -o -type d -a \( -name dev -o -name proc -o -name sys \) -prune
}

Next source the functions file:

    root@android:/ # source /system/vendor/modified-functions

That's it! Now you can list files that have modified after /mnt/sdcard/timestamp with the dramatically simpler modified-list function:

    root@android:/ # modified-list
    /data/data/com.android.inputmethod.latin/files/contacts.en_US.dict
    /data/data/com.android.providers.contacts/databases/contacts2.db
    /data/data/com.android.providers.contacts/databases/contacts2.db-journal
    /data/data/com.android.providers.contacts/shared_prefs/ com.android.providers.contacts_preferences.xml
    /data/system/dropbox/system_app_strictmode@1364420115012.txt
    /data/system/dropbox/system_app_strictmode@1364420064936.txt

And you can search files that have been modified after /mnt/sdcard/timestamp with the dramatically simpler modified-search function, passing the desired search string as the parameter:

    root@android:/ # modified-search password
    /data/badApplication.txt

Pretty cool, eh? Well that's all for this installment the "Android Mobile Application Penetration Test Tricks" blog series! Soon we'll be back to examine more techniques that you can use while performing your own mobile application penetration tests. Cheers!

Beginning June 1, 2014 we will no longer be awarding points for comments posted to the Symantec Connect site-- this includes comments on forum discussions, blogs, and any other kinds of content posted on Symantec Connect. (Comments have previously been awarded at the rate of 1 point per comment.) In addition, the number of points awarded for a verified solution to a forum discussion will increase from 35 points to 50 points. All other points for content will remain the same.

We believe that this creates an incentive for all Symantec Connect users to provide thoughtful, useful feedback on the site. In addition, this will help minimize any "comments for points" behaviors that may be occuring. 

As always, we thank you for your participation on the Connect community. 

Large swathes of infrastructure owned by the attackers behind the financial fraud botnet and Cryptolocker ransomware network seized by authorities.

Everyone hates getting bills, and with each new one it seems like the amount due just keeps getting higher and higher. However, Symantec recently discovered an energy bill currently being emailed to people that will hit more than just your bank account.

A recent spam campaign sending out emails masquerading as an Australian energy company is serving up the Cryptolocker malware…or at least that’s what the spammers want you to think. Once users become infected, they are told they are infected with Cryptolocker (Trojan.Cryptolocker) however, upon further research, Symantec discovered that the malware is not related to the original Cryptolocker virus and is merely a copycat attempting to cash in on the hype and infamy of Cryptolocker.

Energy bill gives users a shock
This particular spam campaign requires a lot of work from the victim to work but once it does, the user’s files will be encrypted and all the spammers have to do is wait for their ransom payment.

To infect users with the crypto malware, the spammers use a fake bill to lure recipients to a malicious website; however, the malware is not hosted here and it is just an evasive manoeuvre to evade any link-following technologies.

The email appears to be a legitimate electronic bill from an Australian energy company, complete with a balance outstanding. The recipient just has to click a link to view their bill.

Figure 1. Energy bill spam email

Once the link is clicked the user is directed to a website that appears to be a CAPTCHA entry page, but the numbers never change. Once the user enters the fake CAPTCHA and hits submit, they are directed to the next page, which contains a link to download the energy bill.

Figure 2.Fake CAPTCHA page

Figure 3. Download page

Clicking on the download link will save a zip file to the user’s computer. The folder contains an executable file disguised with a PDF icon in an effort to trick unsuspecting users into opening it. Opening this malicious file will cause all files on the compromised computer to be encrypted. Following this, a text file opens, informing the user that they have been hacked and that they must send an email to a specific address in order to get their files decrypted.

Figure 4.Text file

Figure 5.Notification of compromise

The malware also checks to see if Outlook or Thunderbird is installed on the compromised computer and, if so, harvests the email addresses in the user’s contact list. The addresses, which are presumably used to further spread the malware, are uploaded to the following remote location:

[https://]royalgourp.org/[REMOVED].php

Protection
Symantec advises users to be cautious of emails that request new or updated personal information. Users should also avoid clicking on links in suspicious messages.

Symantec detects this malware as Trojan.Cryptolocker.F

Messaging gateway and .cloud customers are protected from this spam campaign.

With the 7.5 release being so close I decided to check whether the 7.1 based Patch Automation tools I have written will work in 7.5.

And I'm glade to report here that everything (so far) is working properly. The only important thing here is that you need to take a copy of the 7.1 Altiris.PatchManagementCore.Web.dll [1].

I'll probably do more detailed testing in the coming few days but I guess there'll be a lot of (positive) noise about the 7.5 release. So I decided to bit it by a few days ;).

Finally, here's a screen shot of ZeroDayPatch version 8 running on my 7.5 server, just for the fun of it:

[1] If you cannot find the correct DLL version please send me a direct message and I will get it to you.

We're happy to announce today the general availability of ITMS 7.5 SP1.

Some of the highlights for this release include:

1.   Server and Client-side platform support updates

• New visual builder
• Immediate result verification
• Enhanced import and export capabilities

Thank you.

I am really excited to announce that Backup Exec 2014 is generally available!

What’s New in Backup Exec 2014?

• Windows Server 2012 and 2012 R2 support: Backup Exec now fully supports Windows Server 2012 and Windows Server 2012 R2.
• Superior visibility into backup jobs: We heard you loud and clear. The Backup Exec job monitor is back. You can monitor the status of all backup jobs from a single view, giving you visibility into the status of your backup jobs. In addition, save time and simplify the creation of backup jobs by backing up and managing multiple servers with a single backup job.
• Simplified upgrade/migration process: Many of you asked us to simplify the migration process to the latest version. If you are using Backup Exec 12.5, 2010 or 2012 you can upgrade and keep your jobs and settings intact, simplifying the move to Backup Exec 2014.
• Granular recovery for Exchange 2013 and SharePoint 2013: Backup Exec granular recovery technology (GRT) is now available for Exchange 2013 and SharePoint 2013. From a single-pass backup, you can quickly recover granular objects such as Exchange email and SharePoint documents.
• Optimized performance: In our internal testing, Backup Exec 2014 has shown up to 100%[1] faster backup and deduplication speeds compared to previous versions of the software.

What about Cloud Capabilities?

Over the past several months, many of you have been asking about cloud capabilities. I’m excited to announce that Backup Exec 2014 also supports:

• Riverbed Whitewater Appliance
• Quantum Q-Cloud

Please stay tuned on this front - we plan to announce support for an additional cloud platform shortly.

What Are Customers Saying?

Thank you to the more than 3,700 customers and partners who registered to participate in the Beta program this spring. Below is some of the most recent feedback we’ve received:

• “Our backups complete with near 100% reliability and restores are consistently successful with zero fuss.” – Brandon Mosak, IT Director, Task Force Tips, Inc.
• “It Just Works!” – Terry Green, IT Manager, Autochair
•  “I’ve used other backup solutions on a virtualized environment with varying degrees of success. But for me, the ability to back up a virtual machine image as well as the files inside it—or restore an entire virtualized application or the granular data in it, whether it’s Exchange or SharePoint or SQL—that’s what makes Backup Exec 2014 far more compelling than its competitors.” – Paul Flatt, Infrastructure and Support Manager, Mitre 10 NZ

But don’t just take their word for it, download Backup Exec 2014 today and let me know what you think. I look forward to hearing about your experience.

What’s Next?

We will continue to release service packs every 90 days, and the current target for Backup Exec 2014 Service Pack 1 is September 2014. In addition, we’ll keep you updated as we have more information to share about future product plans.

If you’d like to read more about the journey to Backup Exec 2014, check out the post from Pablo Stern, Senior vice President for Symantec Backup and Recovery, here.

Thank you for your continued support of Backup Exec.

To access a 60-day trial of Backup Exec 2014, go to:

www.backupexec.com/trybe

––––––––––––––––––––––––––

[1] Symantec internal testing.

Today's release of Backup Exec 2014 nearly doubles the size of BEMCLI from 222 to 395 cmdlets, with 72 of the original cmdlets enhanced with new parameters and functionality.

Here's a quick list of what's new:

- Native PowerShell v2 and v3+ support

- Full support (create/edit/rename/delete) for all backup job types (BackupDefinition, OneTimeBackupJob, and SyntheticBackupDefinition)

- All agent selection types supported for backup jobs (including virtual machines)

- Full support for mulit-server selections per backup job

- Support for centralized and managed server configuration

- Push-install of windows agents

- Support for all applications and server types

- Enhanced scheduling support

- Full support for notification recipients

Over the coming days and weeks, I'll be blogging about the new features in depth.  Stay tuned!

I’m thrilled to share that three executives here at Symantec – May Mitchell, Tricia Atchison and Sue Fossnes – have been recognized by CRN for its 2014 “Women of the Channel” list. CRN’s annual list highlights the accomplishments of female executives within vendor, distribution and solution provider organizations, and the impact they are having on the advancement of the IT channel industry as a whole. Additionally, May and Tricia were selected to be a part of CRN’s “Power 100,” the top 100 most powerful women in the channel.

May Mitchell has helped to champion Symantec’s transformation toward a partner-centric model. As Symantec’s Vice President for North America Marketing, she has taken a market-led approach in the development of new market-pull and market-push campaigns and programs, product roadmaps and enablement tools to support our key priorities. This year, May is helping to lead the charge with our partners to grow with us through the redesigned Partner Program.

Tricia Atchison, Senior Director, North America RTM & Channel Marketing at Symantec, worked to unveil our Global Channel Strategy, which has positioned us to invest more time and resources into our partner community. Currently, she’s working to educate partners on our go-to-market priorities and provide them with market intelligence to plan their business with Symantec. Tricia is helping our partners drive awareness and demand with their customers by providing critical marketing programs and tools they need to be successful.

Sue Fossness, Senior Director, Global Channel Operations, also worked to introduce Symantec’s Global Channel Strategy and to develop our redesigned Partner Program, which was based on the input of our partners. Over the next year, she will continue to guide partners through the transition period, and help drive long-term growth and profitability. Additionally, Sue is committed to building a stronger channel-focused culture at Symantec, as part of our company transformation.

Thanks to May, Tricia and Sue for their fantastic work and commitment here at Symantec. You’ve helped to shape an incredible channel program. To read more about these key leaders at Symantec, be sure to check out CRN’s “Women of the Channel” list. Also, you can learn more about Symantec’s commitment to global diversity and inclusion.

The discovery of the Heartbleed bug in April, 2014 exposed a serious vulnerability in OpenSSL, an open-source cryptographic library often used with applications and web servers like Apache and Nginx. This latest high profile, targeted attack allowed infiltrators access to the memory of web servers running vulnerable versions of the library. Heartbleed quickly compromised the privacy for communications applications on the Web such as e-commerce, banking, email, and instant messaging, and opened the door to the interception of user information, passwords, and identities.

While the world now knows of the widespread havoc Heartbleed has caused to both businesses and individuals, it begs the question, “What happens when the next Heartbleed (or worse) comes along, and what can an organization do to weather yet another chapter in an all-too-familiar string of debilitating attacks?”

As a worldwide leader in information protection, Symantec not only has a comprehensive suite of solutions to discover and remediate vulnerabilities today––no matter their origin––but also has the thought leadership and world-class expertise to stay ahead of the next “Heartbleed.” With industry leading security solutions coupled with a global team of security engineers, threat analysts, and researchers to safeguard businesses from malicious attacks, Symantec is poised to help protect organizations by helping them discover the vulnerabilities, remediating the damage through effective patching and repair, then helping to further protect critical data and resources from future incursions.

Symantec security solutions include:
Symantec Control Compliance Suite
Symantec Certificate Intelligence Center
Symantec SSL Certificates
Symantec Validation and ID Protection Service
Symantec IT Management Suite powered by Altiris technology
Symantec Endpoint Protection

We’ve made available both a webinar recording and a white paper to help you better understand how to implement a ‘discover, remediate, and protect’ plan at your organization. Also, stay up to date on Heartbleed news from Symantec, and get at advice on how to limit your exposure.

We're pleased to update you that Symantec DLO 7.6 Beta (Windows + Mac) has moved to the next stage, with a full feature build now available for download.

Please login to SymBeta (https://symbeta.symantec.com/login.html) to access access the build.

If you haven’t already registered for the Beta program, you’ll need to register here https://symbeta.symantec.com/callout/?callid=86FFCE8379A949318C954A79957EF283.

Top features available in this build include

•          Backup Interruption Tolerance
•          Support for Open file Backup
•          Enhanced De-Duplication – Improved Reliability, Scalability and Performance
•          Lotus Notes 9.x Support
•          Support for Lotus Notes NSF files Deduplication.
•          Support for MAC Clients.
•          Alerts/Notifications Usability Improvements
•          Automatic Integrity Checker
•          CPU Process Priority Throttling
•          Backup Completion & Last Successful Backup Report
•          VIP Users File Restrictions
•          Restricted Admin privileges (  Multi Level DLO Admins )
•          Windows Server 2012 R2 Support
•          Backup MAC agents
•          Field defects, bug-fixes and stabilization

Points to note:

This build has all DLO 7.6 features, Support for Mac and Upgrade support from released versions of Symantec DLO 7.0, 7.5, 7.5 SP1, BE DLO 2010 R3 and NBU DLO 6.1 MP7.

Note: This build ( Both Server and Client ) should not be upgraded from the previous Mac BETA build.

Queries:

If you have any trouble with downloading the build or  have any queries, please post in the Forum. You may also contact us at Ramadas_Menon@symantec.com OR SymantecDLO_Beta@mindtree.com

Look forward to your active participation and feedback!

Regards,

DLO Program Management Team

New Symantec System Recovery 2013 supports the Backup and Restore of UEFI based system.

The following document is intended to walk through the restore procedure of UEFI based systems.

The following screenshot gives a glimpse of disk structure of a UEFI based system:

The Highlighted area or the partitions/volumes are the critical ones and must be backed up in order to do a Disaster Recovery of the UEFI based system.

Once the system is booted into the SSR 2013 SRD mode please select ‘Recover My Computer’ option on the home screen.

On the ‘Select a Recovery Point to Restore’ SSR 2013 provides 3 options to choose from:

1. Recover System by date/time.
2. Recover System by Filename.
3. Recover System by System (view).

1. Recover System by date/time.

When this option is selected SSR 2013 scans all the available storage locations for the available backups and lists them by sorting them into date/time format.

   This helps to restore the system to specific point-in-time when the backup was taken.

   Also SSR 2013 smartly detects the type of the system that was backed up (BIOS/UEFI)

1)    Recover System by Filename:

This option helps in selecting the specific v2i/iv2i backup files for the Recovery.

Please note that to restore using the iv2i file(incremental backup file) last full and all the subsequent incremental backup files are required.

1. Recover System by System(View):

Unless the backup is not taken using the Cold backup method Every Backup Creates and Updates the sv2i file (System information files containing all the backup details) for each system backup taken.

Using this file ensures the system is restored with the same settings and disk layout as previous one.

This doesn’t mean that disk layout or system recovery options cannot be changed while configuring recovery.

If the system is being restored to a RAW disk SSR 2013 smartly prompts to initialize the disk to one of the 2 methods (GPT/MBR).

In case of UEFI based system Recovery it is mandatory to restore the drives on GPT initialized disk.

In case UEFI system restore no additional options are required to be selected in case of any drive.

SSR 2013 detects the EFI partition and boots with the help of EFI partition after the recovery.

As per the users wish additional options can be configured for Restore Anyware feature (dissimilar Hardware restore) by pressing the ‘Ctrl’ key and selecting the option ‘use Restore Anyware’.

• Delete existing drivers : This option deletes all the existing drivers after restoring the backup.
• Prompt for drivers: This option scans the target hardware and available drivers, SSR 2013 prompts for any unavailable hardware drivers.
• Run Windows mini-Setup: This option runs the Windows sysprep.

Once the configuration of recovery options is done just follow the wizard to next screens and Recovery would start.

Reboot after finished can be chosen optionally if no addition recovery options are intended.

After rebooting, the system should successfully boot into the restored OS.

I’m thrilled to share that three executives here at Symantec – May Mitchell, Tricia Atchison and Sue Fossnes – have been recognized by CRN for its 2014 “Women of the Channel” list. CRN’s annual list highlights the accomplishments of female executives within vendor, distribution and solution provider organizations, and the impact they are having on the advancement of the IT channel industry as a whole. Additionally, May and Tricia were selected to be a part of CRN’s “Power 100,” the top 100 most powerful women in the channel.

May Mitchell has helped to champion Symantec’s transformation toward a partner-centric model. As Symantec’s Vice President for North America Marketing, she has taken a market-led approach in the development of new market-pull and market-push campaigns and programs, product roadmaps and enablement tools to support our key priorities. This year, May is helping to lead the charge with our partners to grow with us through the redesigned Partner Program.

Tricia Atchison, Senior Director, North America RTM & Channel Marketing at Symantec, worked to unveil our Global Channel Strategy, which has positioned us to invest more time and resources into our partner community. Currently, she’s working to educate partners on our go-to-market priorities and provide them with market intelligence to plan their business with Symantec. Tricia is helping our partners drive awareness and demand with their customers by providing critical marketing programs and tools they need to be successful.

Sue Fossness, Senior Director, Global Channel Operations, also worked to introduce Symantec’s Global Channel Strategy and to develop our redesigned Partner Program, which was based on the input of our partners. Over the next year, she will continue to guide partners through the transition period, and help drive long-term growth and profitability. Additionally, Sue is committed to building a stronger channel-focused culture at Symantec, as part of our company transformation.

Thanks to May, Tricia and Sue for their fantastic work and commitment here at Symantec. You’ve helped to shape an incredible channel program. To read more about these key leaders at Symantec, be sure to check out CRN’s “Women of the Channel” list. Also, you can learn more about Symantec’s commitment to global diversity and inclusion.

John Eldh is Symantec's VP, Channel Sales, Americas

Symantec MSS Threat Landscape Update – Gameover Zeus/Cryptolocker Takedown

EXECUTIVE SUMMARY:

Today, June 2nd 2014, Symantec’s Security Response team released a blog detailing the takedown of two of the most notorious financial fraud malware to date; Cryptolocker and the Gameover Zeus variant. The takedown was an international collaboration between agencies such as the FBI, UK’s National Crime Agency and other law enforcement agencies. Symantec, among other private sector companies, assisted the FBI in seizing a large portion of the malicious infrastructure.

The Gameover variant of Zeus has infected millions of computers since September 2011. This trojan is used to intercept banking transactions that are made by unsuspecting users. The transaction details are then used to defraud those users of their monetary assets. Symantec has created a removal tool to assist users in removing Gameover Zeus.

Cryptolocker is the latest form of ransomware. If a user falls victim to this trojan, it will encrypt files stored on the the hard drive. The encryption used is strong and there is no method currently available to decrypt the data. The user is told that they must pay a ransom in order to receive the decryption key to recover their files. If a user decides not to pay the ransom, then they risk losing their personal files.

For more information on the takedown, please see Security Response’s blog post:
http://www.symantec.com/connect/blogs/international-takedown-wounds-game...

As part of the newly redesigned Partner Program and in partnership with Global Consulting, Technical Sales, and Education Services, I am pleased to announce the successful completion of Symantec’s first set of performance-based Partner Expert Competency Validations.

http://www.symantec.com/tv/news/details.jsp?vid=3595771933001

This video is a preview of Symantec’s Expert Competency Validation technical panel review process with examples of candidates giving a presentation, whiteboarding, and discussing questions & answers.

According to Symantec’s Internet Security Report, targeted attack campaigns rose by 91% in 2013, with a 62% increase in the number of successful breaches. A total of 23 new zero-day vulnerabilities were discovered, which is 23 golden opportunities for attackers to breach your exposed servers. Thankfully, there are relatively simple ways to protect your critical systems against the disaster of zero-day attacks

We have released version 4.5 of Symantec Data Insight! This release enables information governance automation by providing greater insight, customization, and work-flow capabilities.

Read this blog for more on how Data Insight enables more effective Information Governance.

Symantec Data Insight helps organizations improve unstructured data governance through actionable intelligence into data ownership, usage and access controls.

• Expanded discovery– Data governance for new platforms
• In-depth analysis– Immediate and industry relevant metadata driven insights
• Scalable workflow– Self-service portal to empower data owners

Key new features in Data Insight 4.5

• Self-Service Portal enables IT and Risk/ Compliance teams to engage business data owners with actionable intelligence to reduce risk of data loss, align access to business need and verify ownership.
• File server and NAS coverage extends data governance capabilities to NetApp clustered DataONTAP, EMC Isilon and Windows Server 2012.
• Ad-Hoc Report Templates provide immediate insights for risk, compliance, data management and operations efforts.
• Report Exchange powered by the Symantec Connect community to share and exchange ad-hoc query reports and templates with industry peers.
• Query Interface provides more flexible data extraction including a web-services API for integration with external systems and 3rd party applications.
• Data Ownership enhancements increase the accuracy of data ownership identification along with flexibility to map to organizational structure.
• User Reporting enhancements help visualize user activity and access permissions with improved tracking across user lifecycle events.
• Product Operations provides enhanced tracking and visualization of the topology, data processing and disk space usage.

Check out the data sheet and what's new document to learn more about this release.