Proactive Security Management - Large Enterprise Business - HP

program identifies and prioritizes critical patches. It conducts system audits to ensure compliance and
calculates business risks associated with newly identified vulnerabilities. HP can provide the right level
of solution for any business requirement.
Active Countermeasures
Organizations need to be prepared to deal with unpreventable, fast-spreading attacks. Known
problems, whether fast or slow, can be prevented. Organizations experiencing slow, unknown
problems normally have adequate response time. As Figure 3–5 illustrates, the problem space occurs
when an attack is unknown and quick to spread.
Figure 3–5
Matrix for Speed of Attack and Vulnerability Identification
When vulnerabilities are known, tactics such as patches, anti-virus software, perimeter defenses, and
scanning can help. On the other hand, slow-spreading attacks can be handled with human-mediated
responses, such as generating and distributing threat signatures, monitoring for intrusions, and changing
firewall rules. The biggest concern is preventing new, fast-spreading attacks. In most IT environments today,
these attacks run rampant until IT staff intervenes. This is where HP can help.
HP has invented a vulnerability scanning and mitigation technology named Active Countermeasures—a
powerful tool for identifying and managing vulnerable systems in an enterprise network. HP has employed
Active Countermeasures to protect HP's corporate network since 2002, and the technology has assisted in
protecting HP from a number of major Internet worm attacks. Active Countermeasures is an HP patented
technology and is available from HP Services.
History
In July of 2001, a destructive worm known as Code Red attacked the Internet. It spread rapidly, caused
widespread service delays, and cost millions of dollars due to lost productivity and cleanup efforts. HP,
like other major companies, suffered as the worm saturated HP's worldwide computer networks.
In response to the Code Red attack, a team of HP Labs researchers in the Bristol Trusted Systems Laboratory
isolated the Code Red worm, reverse engineered its payload, and then constructed their own
countermeasure intended to identify and disable vulnerable systems on HP's network. HP IT Security,
working alongside HP Labs researchers, introduced this countermeasure across HP's entire corporate
network to find and mitigate vulnerable systems.
Proactive Security
Management
3–19