Cisco warns UC users of limited support for Windows 7

Cisco (NASDAQ: CSCO) is warning customers of its unified communications products that support for Windows 7 won't be forthcoming until the product's 8.0 release scheduled for the first quarter of 2010. About a dozen more UC products will not support Windows 7 until version 8.5, in the third quarter of 2010 and at that time, only the 32-bit version of Windows 7 will be supported. 7 tools for Windows 7 rolloutsDennis Hartmann on Cisco Unified Communications Only three Cisco UC products among a list of about 50 published by Cisco Subnet blogger Brad Reese specifically promised 64-bit support, and this only through the use of a 32-bit emulator. These products are the Cisco UC Integration for Microsoft Office Communicator, Cisco IP Communicator and Cisco Unified Personal Communicator. One CCIE, who asked not to be identified, is frustrated with the delay. The Communicator products are the client-side multimedia applications used with Cisco Unified Communications. He tells Network World that Cisco became a Windows supplier when it developed desktop UC applications such as the Unified Attendant Console, one of the applications that is not yet slated to support 64-bit Windows 7. The spotty roadmap for 64-bit support makes it difficult to see Cisco's UC as a good fit for companies wanting to upgrade to Windows 7, he says.

However another expressed frustration. One reader posted a comment on Reese's blog that said it is possible to run UC products on Windows 7 right now. This anonymous reader wrote, "I realize many of the Cisco UC products will probably work on Win 7 32-bit. Microsoft 64-bit OS has been available since Win XP although 64-bit processors have only been available for the masses for a few years. I'm concerned about the Cisco UC applications working on Win 7 64-bit.

However, most desktop and notebook computers purchased in the last 2-3 years included 64-bit processors. They provide many applications for the standard desktop computer. Cisco is now a desktop software application vendor. They have a responsibility to support the most current corporate desktop OS!" Microsoft released Windows 7 to manufacturing on July 22, 2009. At that point developers of Windows applications had access to the final code included Windows 7. It was released to the general public on October 22.  According to Microsoft's Windows 7 Compatibility Center, four Cisco desktop Windows applications have been certified as compatible with Windows 7. These are the Cisco VPN client version 5, the Cisco EAP-FAST Module, the Cisco LEAP Module, the Cisco PEAP Module. The Cisco Anyconnect 2.4 SSLVPN client actually does support both 32-bit and 64-bit versions of Windows 7. The Cisco VPN client 5.0.6 supports only the 32-bit version, according to Microsoft's compatibility information. These modules are methods to securely transmit authentication credentials and are used with a VPN. Cisco Subnet blogger Jamey Heary asserts that Cisco is the first major VPN vendor to support Windows 7 (as well as Mac OSX 10.6 clients). Cisco's VPN support for Windows 7 covers both its IPSEC client and SSLVPN client software.

Follow all Cisco Subnet bloggers on Twitter.

Hijacked Web sites attack visitors

Here's the scenario: Attackers compromise a major brand's Web site. The issue goes unnoticed until it's exposed publicly. But instead of stealing customer records, the attacker installs malware that infects the computers of thousands of visitors to the site. Such attacks are a common occurrence, but most fly under the radar because the users never know that a trusted Web site infected them, says Brian Dye, senior director of product management at Symantec Corp.

But word can get out, leaving the Web site's customers feeling betrayed, and seriously damaging a brand's reputation. When his company tracks down the source of such infections, it often quietly notifies the Web site owner. Attackers, often organized crime rings, gain entry using techniques such as cross-site scripting, SQL injection and remote file-inclusion attacks, then install malicious code on the Web server that lets them get access to the end users doing business with the site. "They're co-opting machines that can be part of botnets that send phishing e-mail, that are landing sites for traffic diversion and that host malware," says Frederick Felman, chief marketing officer at MarkMonitor. That possibility is one of Lynn Goodendorf's biggest worries as global head of data privacy at InterContinental Hotels Group. "I worry about attacks that use a combination of malware and botnets," she says, adding that she has watched this type of activity increase steadily over the past two years. "That's very scary," says Goodendorf. But because the business's Web site isn't directly affected, the administrators of most infected Web sites don't even know it's happening.

Most victims haven't associated such attacks with the Web sites that inadvertently infected them. The latest versions of Microsoft's Internet Explorer browser and Google's search engine detect sites infected with malware, issue a warning and block access to the site. "To me, this is serious online brand damage," says Garter analyst John Pescatore, and it can be disastrous for small and midsize businesses that totally depend on search engine traffic. But that may be changing. The next frontier, says Dye, may be attackers who use these types of exploits against the Web sites of high-profile brands and then publicize - or threaten to publicize - what happened. But Pescatore sees a more fundamental problem: rushing through Web site updates and ignoring development best practices designed promote security. Preventing attacks like SQL injections requires using enterprise-class security tools, such as intrusion-prevention and -detection systems, with a focus on behavioral analysis to spot attacks, Dye says.

Most organizations follow formal processes for major upgrades, but not for the constant "tinkering" that takes place. The result: Vulnerabilities creep into the code. "Security groups often are forced to put Web application firewalls in front of Web servers to shield [these] vulnerabilities from attack," says Pescatore.

Unisys service uses the cloud to manage mobile devices

Unisys is introducing a new service on Wednesday that will allow its customers to better manage, secure and support mobile devices carried around by employees, company executives said on Tuesday. CIOs are concerned about corporate data "roaming the streets," he added. Staff now expect to use their choice of devices anytime and anywhere, and this causes problems for CIOs around cost, the cost of support, and the security of applications and data, said Tony Doye, president of Unisys' Global Outsourcing and Infrastructure Services group, in a telephone interview. The service framework for the new end-user productivity services will support Windows Mobile phones and BlackBerry devices, with support for the iPhone and other devices available in later releases.

Some early-adopter customers, mainly in Central Europe, are already using the mobile-device management framework, he said. Currently organizations generally manage devices with specific technologies that only work with a specific platform, rather than with a consistent framework across a variety of devices, said Sam Gross, Unisys' vice president for global IT outsourcing solutions. The framework is managed by Unisys for customers, and the management and support of the devices is also done from the company's services delivery centers around the world, he added. Unisys is also offering access to standard office suites by subscription through a service called Virtual Office as a service from the Unisys Secure Cloud. The new service will enable CIOs to reduce end-user costs by providing support for different devices, desktop PCs, applications and mobile data access through a mix of traditional, virtualized and secure cloud-based service delivery models, Unisys said.

The Unisys Secure Cloud has technology that protects both data in mobile devices and in storage, using a combination of encryption and dispersion of data. "The model that we are delivering is server-side virtualization services, and in this situation the data never ends up on the end-point," Gross said. Unisys' Unified Communications as a Service, also delivered through Unisys Secure Cloud, offers Microsoft Exchange, Microsoft Office SharePoint Server and Microsoft Office Communicator applications in a multi-tenant environment. Unisys is also offering generic services such as the ability to destroy the image on a device if it is reported lost, he added. Besides offering these productivity applications, customers can also provide their employees with access to other applications running at the company, through the Unisys cloud, Gross said.

Symantec ties DLP software to third-party security tools

Symantec has updated its Data-Loss Prevention Suite so that if the software finds a data issue that needs fixing, it can apply third-party encryption and digital-rights management controls to the problem. Announced today, Symantec DLP Suite v. 10 adds what's called the "Flex-Response" capability to find sensitive data that has been left unprotected in the enterprise and apply security controls through encryption and DRM products from vendors such as PGP, Oracle, GigaTrust, Liquid Machines and Microsoft. Watch a slideshow of this product. Symantec is also publishing a set of open APIs and a software development kit (SDK) to facilitate support for security controls through additional products, says Rob Greer, senior director of product management at Symantec. "Suppose I scan a file server, finding information not secured, not encrypted.

The data can also be brought under the control of various DRM products so there can be controls placed on viewing, printing or adding to content.  Symantec DLP v.10, expected to ship in December, will have a workflow process that can alert managers to data that's out of compliance with corporate DLP policies; let them choose to apply encryption and DRM; and confirm that security policies have been enforced. For remediation I could apply PGP encryption," Greer says. Other changes in DLP Suite v. 10 are expected to tighten ties with other Symantec products. There will also be integration with Symantec's Control Compliance Suite for risk assessment of operating systems and applications. "You will get a full risk position view," Greer says. For instance, the updated version will be integrated with Symantec Security Information Manager for centralized collection and correlation of event and log data to determine security status.

Symantec has already begun adding ways to trigger policy-based DLP actions on its Symantec Endpoint Protection security software, such as "making [a desktop] a brick" if it's determined sensitive data is at high risk, Greer says. Symantec DLP v.10 starts at $25,000. Other automated actions are also being added to DLP v. 10 to allow interaction between Symantec's DLP and its flagship security software.

TomTom, Navigon update iPhone apps

Navigation vendors TomTom and Navigon this week announced significant updates to their respective turn-by-turn navigation apps for the iPhone. The new version adds a number of oft-requested features, first among them being text-to-speech directions, which allows the app to read aloud the names of places and streets, and an iPhone-app implementation of the company's Advanced Lane Guidance, which gives you detailed, 3-D images of complex intersections for easier navigation. TomTom on Thursday revealed a major update to the company's $100 TomTom US & Canada.

Also included in the latest version are map and safety-camera updates; a new Help menu that provides direct access to emergency numbers and directions to emergency providers; in-app control of iPod playback; and customizable audio warnings for events such as exceeding the speed limit and approaching safety cameras. Meanwhile, Navigon has announced the availability of an update to the company's $90 MobileNavigator North America iPhone app. The free TomTom update has been submitted to Apple for approval. The new version includes several minor enhancements, including an extended-destination search that helps find a destination even if you don't have the full address, and the capability to manually move your destination pinpoint at any time. Available as an in-app purchase, Traffic Live takes advantage of real-time traffic information-gathered from current Navigon iPhone users, commercial fleets, and other GPS systems, as well as data from ClearChannel's Total Traffic Network-to determine the fastest route, update travel times, and warn of accidents, construction, and other incidents. But the biggest new feature is the availability of Navigon's Traffic Live feature.

For the first four weeks of release, the Traffic Live in-app purchase will carry a price tag of $20; the price will then increase to $25. There are no ongoing service charges for Traffic Live, although Navigon notes that if your iPhone service doesn't include a data plan-a possibility outside the U.S.-additional data charges may occur when using the Traffic Live feature.

Microsoft turning configuration management “on its side”

Microsoft is changing up the next version of its System Center Configuration Manager so instead of managing devices it will manage users and their activities across multiple devices. "It will focus on… providing them an appropriate profile for information access based on the job function of the user together with the device they are using," says Bob Muglia, the head of Microsoft's server and tools division. But the change fits into one of Microsoft's recent occurring themes of providing application support across phones, PCs and browsers. While he did not name the version he was talking about, Microsoft is slated to ship the Windows Server-based Configuration Manager 2007 R3 late in the first three months of 2010. Windows 7: 10 Best Features  Muglia admitts that it is a big change for the software that has been around since 1996 when it started life as Systems Management Server. "When I look at the changes we need to do [with Configuration Manager] that is one of the biggest ones that is coming," he says. "It is really turning configuration management on its side and I look at that with both anticipation and a little trepidation because we know it will take customers time to make that key transition." Muglia says Microsoft is gearing up to help customers through that change, although, he did not give details on how that might happen.

And it aligns with the company's intent to provide an integration between security and identity. Muglia said the data center is where things are booming for System Center, now the fastest growing business in the Server and Tools division with 30% improvements year-over-year. In the Configuration Manager case, data access policies could be paired with identity credentials and awareness of the user's current device. He said virtualization is driving growth, as well as, strong uptake with Operations Manager. "Over time what we expect to see is us transitioning our data center offerings to a more complete integrated product which pulls all these things together," says Muglia. "It will help enable these cloud deployments, these on-premise private cloud deployments. You need configuration management, you need operational monitoring, you need virtualization management and you need backup and archiving." Muglia says organizations need all those things together, "and that is sort of the direction in which we are heading." He also says the long awaited System Center Service Manager will finally be out in the first half of next year, but that Microsoft is beginning to take a different angle on that software. We think you need all those components working together.

Service Manager, formerly called Service Desk, helps administrators work through trouble tickets but also anchors automated, pro-active service requests initiated via other system management tools, and can aid in compliance auditing. "We are now really looking at Service Manger as something that deeply integrates across everything to provide business process integration in the context of systems management,"  Muglia says."We look forward to getting the first release out, but the future of that product will be much more around compliance management and policy management associated with business process and business process compliance. That is the direction we will take that over a longer period of time. " Follow John on Twitter

Piracy's global economic impact debated

There's no question that software piracy is a global problem with a heavy financial impact. A May 2009 report by the Business Software Alliance and IDC estimated that 20% of software programs installed in the U.S. last year were unauthorized copies. But just how heavy it is is a matter of debate. Worldwide, the figure is 41%, with an estimated financial impact of $53 billion - a figure based on the retail value of the pirated PC software.

If it were, the BSA's global loss figure of $53 billion would drop sharply, they maintain. "Obviously, not every piece of pirated software will be replaced immediately with legitimate software if underlicensing is addressed or sources of pirated stuff dry up," acknowledges Dale Curtis, the BSA's vice president of communications. But critics of the study say it fails to account for the possibility that pirated software could be replaced with Linux or other open-source options. But he says that over the years, IDC has found "a very strong correlation between piracy rates and software sales. One country that wasn't included is Canada - and that doesn't sit right with Michael Geist, a professor at the University of Ottawa. "What the BSA did not disclose is that the 2009 report on Canada (whose piracy rate declined from 33% to 32% in the study) were guesses since Canadian firms and users were not surveyed. In country after country, as the piracy rate falls, legitimate sales go up." A second criticism of the report is that its country-by-country figures are partly based on the results of an annual survey that in 2009 covered 24 countries. While the study makes seemingly authoritative claims about the state of Canadian piracy, the reality is that IDC . . . did not bother to survey in Canada," Geist wrote in a May 27 blog post.

Further, he says Canadian users were surveyed the previous year, and "there is no reason to assume large changes in results from one year to the next." Ivan Png, a professor of information systems and economics at the University of Singapore, says the BSA and IDC should explain how they applied the results from the 24 countries surveyed to all of the other countries not surveyed. "IDC should make the methodology transparent," Png says. Curtis responds that the study "is not a guess, nor is it a scientific measurement, nor is it based primarily on a survey of software users, as Geist suggests." A survey of 6,200 users is only a piece of the model, Curtis says.