Day: February 4, 2017

Posted on

New COBIT 5/CMMI Tool Goes Beyond Traditional Mapping

ISACA and CMMI each have a deep well of expertise and rich sources of guidance and leading models in the areas they cover: ISACA in the world of governance of enterprise IT (GEIT) with COBIT, and CMMI in the world of enterprise process maturity.

Together, we have teamed up to create a new product that leverages the deep guidance available within each of the models. Specifically, COBIT 5 and the CMMI maturity models each have extensive guidance in establishing practices that permit users to better align stakeholder requirements with the utilization of IT-enabled investments; using them both together can yield a resultant value that is greater than the sum of their respective parts.

Many users of framework products look for mapping tools to assist them in using both models or to reduce initial planning and implementation resources needed to bring the second model into use. Mapping tools serve a useful purpose in that regard but have always had one significant drawback: They only attempt to reveal direct connection points between the models being mapped. That serves to speed up implementation time for the second model, but is limiting in the degree to which it unlocks the additional value that using that second model could bring.

The other issue that comes up with traditional mapping tools is that they are designed to be used in one direction only. That is, a user looks up an element in model A and finds which element or elements in model B relate are related. What if you want to start with an element in model B? That element likely exists in multiple places throughout the map and isn’t easy to isolate to determine what in model A is related. These traditional maps are unidirectional.

ISACA and CMMI saw an opportunity in this gap to produce a tool between COBIT 5 and the CMMI maturity model. Called the COBIT 5 CMMI Practices Pathway Tool, users will now be able to quickly and easily navigate from either COBIT 5 or CMMI and uncover relevant guidance in the other model. This bidirectional capability is unique and will permit users greater flexibility in deriving value from the tool.

The tool is built in Excel to provide access to a larger number of people. It takes advantage of native functionality in Excel and uses filtering to provide a quick and easy means of selecting elements of interest. There also is a guidance document with the tool to better describe its function and use.

The end result will be the ability for business IT practitioners to deliver additional value to their stakeholders.

Peter Tessin, Technical Research Manager, ISACA

[ISACA Now Blog]

Posted on

Traps Named A Visionary in Gartner’s Magic Quadrant for Endpoint Protection Platforms

Gartner has just released its 2017 Magic Quadrant for Endpoint Protection Platforms (EPP), and we’re honored that Palo Alto Networks is named a Visionary in this report. This marks the first year that Palo Alto Networks has been included in the EPP report – we believe this is further proof of Traps’ recognition by top-tier, independent third parties and analysts.

Here are a few highlights from the report that should be of interest to endpoint security professionals:

  1. Gartner’s report cautions customers against overreliance on reactive indicators of compromise. According to Gartner, “With the exception of some of the emerging Visionary vendors, too many EPP solutions’ malware detection techniques remain overly reliant on reactive indicators of compromise (i.e., IP address, URL, file hash, partial hash, registry key values). These static indicators are the easiest part of the kill chain for the attackers to change rapidly.”
  2. The report offers guidance to customers on what endpoint protection capabilities they should assess when evaluating potential solutions. Gartner observes that “Most attacks exploit well-known unpatched vulnerabilities, use social engineering to trick users to install trojan malware, or use interpreted code such as Java or Visual Basic to download and install malware.“
  3. Gartner reflects on the utility of standard testing and the need for improvements in their test by stating that, “Standardized testing, such as AV comparatives and AV tests, are still the best indicators of effectiveness; however, they still overreward reactive solutions and undertest detection of new attacks.”

Our view at Palo Alto Networks is that enterprises will continue to seek more effective endpoint security offerings that can prevent security breaches, whether they are initiated through the exploitation of application vulnerabilities or via new and unknown malware.

I encourage you to read the complete Magic Quadrant report to learn about all of Gartner’s findings.

Gartner Magic Quadrant for Endpoint Protection Platforms, Eric Ouellet, Ian McShane, Avivah Litan, January 2017. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

[Palo Alto Networks Research Center]

English
English
Exit mobile version