Florida taps Symantec for security tools

[InfoSec News <isn () c4i org>]

http://www.fcw.com/geb/articles/2003/0407/web-fla-04-11-03.asp

By Dibya Sarkar 
April 11, 2003 

Already quite proactive in cybersecurity, Florida's state government 
is using two Symantec Corp. software tools to beef up its enterprise 
network security, according to company officials.

NetRecon is a vulnerability assessment tool, which Tom Resau, 
Symantec's public sector spokesman, described as a "hacker in a box" 
that scans, analyzes, and reports security holes in the network. 

The second tool is the Enterprise Security Manager (ESM), which is 
essentially a policy compliance tool that constantly assesses a 
network's performance based on the organization's security policies, 
he said.

Brian Finan, the company's strategic programs and homeland security 
director, said Symantec's recently released Internet security threat 
report showed that about 2,524 new information technology product 
vulnerabilities were discovered in 2002, about 81.5 percent higher 
than in 2001.

He also said the ESM tool would ensure that an organization's policies 
--such as how often passwords are changed or the length of passwords 
-- are followed. It provides a baseline for every system and then 
automates repetitive operations to ensure those policies are being 
enforced. He said both tools are generally used in tandem to give a 
government or other organization a high-level security view.

"Given our large network environment supporting agencies across the 
state, holding systems to policy is crucial for preventing weaknesses 
that could result in compromised systems during a network attack," 
said state Chief Information Officer Kimberly Bahrami in a statement.

The state is also using a Symantec application module that allows 
agencies to automate and centralize security policy management and 
assessments in accordance with the Health Insurance Portability and 
Accountability Act, a federal law that ensures the privacy and 
security of individuals' electronic health information.

Security companies, said Finan, need to provide more education and 
training awareness about increasing threats and vulnerabilities. 
Cutbacks in funding resources, he said, impact an organization's 
ability to shore up security even if it has cybersecurity policies. 
Combining products or ones with greater capabilities can reduce costs, 
he said.

Florida began working on its cybersecurity problem in 1999, and then 
created the Office of Information Security, a unit of the state 
technology office, two years later. The state takes a proactive 
statewide approach to security, including using another third-party 
vendor to handle statewide security audits. The model does not allow 
any agency to be exempt and includes possible reprimands for 
noncompliance.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.