XYPRO Technology Corporation

From the CEO's Desk

2012-01-22T20:36:00.000-08:00

It’s been a while since I’ve had the time to write this column because of how busy we have been at XYPRO over the last year. In part, this was fueled by the HP decision to bundle our XYGATE Merged Audit (XMA) software with the HP NonStop Operating System Mission-Critical Edition software package.

While we cannot speak for HP or the NonStop product group, I can tell you that we have seen tremendous growth in the market for our products. So much so, that we outgrew our website, our staff, and even our building.

After 26 years in the same building, taking over more and more space as other tenants moved out, we finally took over the last bit of space that was available to us. We had another challenge; because of the great range of NonStop servers we support, we were about to exceed the maximum weight that our second floor computer room could support.

So this past November, over the long American Thanksgiving weekend, we packed up our bags and our systems and moved to a 15,000 square foot ground floor suite with a larger datacenter capable of supporting our accelerated growth. This office is twice the size of the old one, positioning us for the future.

Some old-timers may remember that Jimmy Treybig tried for years to get the city of Cupertino to rename Tantau Avenue to Tandem Avenue. Well Jimmy, we hope we made you proud because our new office is located on Guardian Street. Even better, our new datacenter is non-stop, with redundant power, dedicated climate control and connectivity. Now how cool is that?

As I said earlier, we also outgrew our staff, allowing us to hire from the outside and promote from the inside. Lisa Partridge has assumed day-to-day responsibilities for XYPRO and was named President. Barry Forbes was promoted to VP, Sales and Jim Hinsch to architect. We hired Andrew Price as our Director of Product Management, Rob Lesan as our Manager of Professional Services, Dave Teal joined as a pre-sales support and education specialist, Gabe Alvarez joined our Sales Team in Latin America and we even welcomed our summer intern, Rayna Burgess on as a full time member of our QA staff. Most recently, we extended a heartfelt welcome to Mr Feng Lin to represent XYPRO in Asia Pacific.

Scott Uroff is still part of the management team as our Chief Architect, and several of our employees passed the new PCI SSC Internal Security Assessor Program (ISA). At our upcoming internal Kick-Off event, one employee will receive a plaque in recognition of 5 years of service at XYPRO and three employees will receive their 10 year plaques. Add those milestones to the 4 of us who already have our 20 year plaques and everyone in between! All the better to serve our rapidly enlarging number of customers.

Our website is completely new too, with easier navigation to the information that you want to see, including access to our datasheets, whitepapers, and on-demand webinars.

I would like to move to our products for a moment. HP understood for a long time that separation of duties is important to help prevent insider attacks. This was the main driver for the multiple levels of security administration within the Safeguard security software. But HP couldn’t fund every possible feature that customers wanted or needed, so XYPRO stepped up our game to help keep NonStop servers secure from hacking, even by insiders.

We like to say that we wrote the book on NonStop security (twice!), because it is true. But we could only write the books after we spent a lot of time determining the current and future product functionality required for NonStop customers to be successful in their industries. At the time we didn’t think of it as predicting the future, but of course HP is now bundling some of our products within the NonStop OS to help protect our customers from the rise in cybercrime, so I guess we were.

And the insider threat has only gotten stronger, which is why XYPRO took separation of duties to its logical conclusion within XYGATE Access Pro. Our peerless auditing capabilities within each XYGATE module, and collectively within our Merged Audit module, allow all NonStop server audit information to be sent to off-board and Enterprise audit logging solutions, such as those from ArcSight® an HP Company and RSA® enVision. XYPRO’s ability to work with virtually any of the SIEM devices and enterprise audit consolidators allows companies that use these systems to manage audit records generated by their NonStop servers, and preventing the audit from being changed after the fact.

We hope that you will visit with XYPRO staff either by attending a class or by coming by our booth at the dozens of HP NonStop server and security-related events that we attend all over the world. We love meeting our customers so that we can better understand and serve your security needs. Remember to visit our blog, and follow us on our many social media channels, such as Facebook, Twitter, and LinkedIn.

Finally, while I cannot tell you who these companies are, or what the arrangements will entail, I am happy to announce that we are in the process of forging partnering agreements with several other vendors in the NonStop space. While Larry Ellison is trying to take out HP by dropping support for Oracle on Itanium, we know that HP has a secret weapon called NonStop SQL and we have the tools to properly secure this advanced database. It’s certainly one of many reasons we are excited to be part of the NonStop community and intend to take full advantage of this evolving market.

No matter how you measure it, 2011 was our best year ever. Revenue, customers, professional services, partners, products, head count - all grew at rates greater than previous years. Important to our customers is that our expansion this year is based on executing long term growth plans. So, as the economy continues to recover, we will have more solutions to protect your precious business information and reputation that will help grow the NonStop community beyond anything that has been seen before.

I hope that all NonStop community members join us and have as good a year as we have planned for ourselves.

Sheila Johnson
CEO, XYPRO Technology Corporation

XYPRO Opens New Headquarters

2011-12-13T17:47:00.000-08:00

XYPRO Technology Corporation proudly announces the grand opening of its new, larger Headquarters located at 4100 Guardian Street, Suite 100, Simi Valley, California, 93063 USA.

XYPRO Technology has experienced tremendous growth over the past few years and is forecasting a continued positive growth rate for the next 5 years and beyond. We had been at our original Cochran Street location since 1986.

After expanding as much as we could there, we are excited to work every day in our new home. It was more than a great street name that prompted us to choose this particular new location, XYPRO employees enjoy the benefit of a modern, 15,000 sq. ft, ground floor suite, a larger datacenter capable of supporting accelerated growth with redundant power and connectivity. Our new digs also offer enhanced telecommunications and wireless infrastructure, expanded training/education and conference room facilities and room to grow……

The property at 4100 Guardian St. is a beautifully maintained, two-story, 136,000-square-foot office building built in 1999, on 10.3 acres in the foothills of Simi Valley, California.

XYPRO Presents: A Witham Laboratories Presentation:

2011-11-29T11:52:00.001-08:00

PCI DSS - Lessons from the Field

If you were unable to attend our webinar on November 1st, please visit our website to view the recorded presentation featuring Dr. Sajal Islam, a Qualified Security Assessor (QSA) from Witham Laboratories, that focuses on what QSAs look for in a when assessing PCI DSS compliance in a NonStop environment. Witham Laboratories is a leading independent provider of information security evaluations, offering specialist consultancy and advice in payment industry security.

This Webinar provides specific scenarios from the field and covers the following:

• Views and experiences gathered by Witham Laboratories from numerous PCI DSS assessments for NonStop clients.

• A detailed breakdown of the PCI DSS with specific focus on how the PCI DSS requirements apply to the NonStop.

• What issues and areas QSAs typically look for when performing PCI DSS assessments on NonStop.

Achieving PCI Data Security Standard (PCI DSS) compliance is critical for every organization that stores, processes, or transmits card holder data, from the smallest merchants to the largest card issuers. In short, this Webinar will give you valuable information to help you with your next PCI DSS assessment.

View our recorded webinars here: https://www.xypro.com/xypro/webinars

Representatives from XYPRO are available after your viewing to help explain how XYPRO’s XYGATE suite of security solutions assist you in meeting your PCI DSS obligations.

Barry Forbes

Verizon 2011 Data Breach Investigation Report – breaches down, or are they?

2011-10-17T12:12:00.000-07:00

The 2011 Data Breach Investigation Report (DBIR) from Verizon (http://bit.ly/pt5xV9 ) now incorporates data from the United States Secret Service and the Dutch National High Tech Crime Unit as well as Verizon’s own data. It is a comprehensive report, extensively covering data breach activity in 2010, and it draws some interesting, and sometimes almost contradictory, conclusions.

2008 saw a record number of 361 million records compromised, 2009 saw a reduction to 144 million, and in 2010 that number dropped to 4 million. Hang on, 144 million -> 4 million? As the report says, that’s almost a rounding error! Not to say that 4 million records compromised is good, that’s still 4 million more than we’d ideally have to deal with, but it’s a pretty radical reduction. So, one question might be “Why?”. As it turns out, the main reason is that, for some reason, 2010 had virtually no “mega” attacks, which typically bump the numbers up by a million or more. But let’s continue to look…

In actual fact, now that we are more than 9 months through this year, we know enough to determine whether 2010 was part of a long term trend of data breach reduction, or an anomaly. And with Sony, Espilon, RSA and Citi breaches already behind us in 2011, the unfortunate news is that the numbers this year are likely to be back up. In fact, numerous industry observers are now saying that 2011 is likely to be the worst year on record, in terms of number of records compromised.

So perhaps a better idea is to look at the trends indicated by the Verizon report, along with the knowledge of the 2011 breaches, to identify what we could and should be doing better.

One of the interesting facts from the Verizon report is that, even though total number of records compromised was (WAY) down, the actual number of breaches was up (761 in 2010, versus a total from 2004-2009 of 900). This is partly due to the inclusion of the Dutch data, but it also shows that cybercriminals are now willing to perform their exploits for smaller returns, which itself is a little worrying.

Another interesting statistic - 83% of all attacks were opportunistic, meaning the victim was identified because they exhibited a weakness or vulnerability that the attacker could exploit. Often these were due to POS and other systems being installed with default user information, which became known within the criminal community. Put another way, closing down these relatively simple (and obvious) loopholes could drastically reduce the occurrence of data breaches.

The other 17% of attacks were targeted, meaning that the victim was first chosen as the target, then a method of exploitation was determined. Unfortunately, but not surprisingly, the financial industry was most represented in the ranks of the targeted attack victims.

Following on from the targeted attack point, 96% of all records compromised were card numbers and/or card data, a truly worrying figure.

So, what can we learn from this?

We know from the number of attacks in the first half of this year that cybercrime is not decreasing. Both the number of attacks, and the cost of those attacks, continues to rise. Cybercriminals utilise opportunistic attacks for relatively small gains in many cases, and targeted attacks on financial institutions. Card numbers continue to be stolen, in large volumes.

It remains critical to protect sensitive data, both at rest, and in transit.
• Use SSL and file encryption solutions when possible.
• Ensure that the platforms/applications receiving the sensitive data also protect it.
• Get to know the security administrators on those platforms and ask them to do the same with the applications/platforms they share data with.

Remove as many areas of opportunistic attack as possible:
• Don’t use default userids and passwords.
• Put granular access control and auditing in place.
• Feed your audit data (from all platforms and applications) into a SIEM device to get an enterprise-wide view of your security events.

XYPRO’s XYGATE security suite can address all these areas, and more. For more information on how XYGATE can help secure your HP NonStop platform, applications and data, please see our website www.xypro.com, or email me at andrew_p@xypro.com

Andrew Price

XYPRO Technology Corporation

www.xypro.com

EDB Card Services AB Brings its HP NonStop™ Audit Into The Enterprise

2011-09-07T09:00:00.000-07:00

SIMI VALLEY, California – XYPRO® today announced that, as part of its PCI-DSS project, EDB Card Services AB has successfully implemented its XYGATE Merged Audit (XMA) tool to integrate EBD’s HP NonStop™ servers with its RSA® enVision SIEM (Security Information and Event Management) system.

EDB Card Services AB, part of EDB ErgoGroup, is one of the leading payments services companies in Scandinavia. It provides a wide range of card-related services including issuing, acquiring, processing, switching, national card blocking etc. for banks and payment operators in Sweden, as well as greater Scandinavia and Europe.

XYGATE Merged Audit (XMA) gathers security audit data from various sources on HP NonStop systems (such as EMS, Safeguard, ODBC, BASE24, XYGATE tools, custom programs etc.) and intelligently merges the security audit data together to form a single SQL database. Log Adapters then export that data to almost any SIEM or central compliance repository. XMA provides extensive reporting capabilities as well as customisable real-time alerts.

“As part of our PCI-DSS (Payment Card Industry Data Security Standard) compliance project, we had to bring our HP NonStop security audit data into the enterprise” said Sissel Johnsen Head of Production & Operation at EDB Cards Services AB. “Our previous log tool wasn’t suitable, so we selected XYGATE Merged Audit, which has a far more user-friendly interface and gave us exactly what we needed in terms of collecting the necessary data from our NonStop systems. XYPRO’s RSA Log Adapter ensures all NonStop audit data feeds seamlessly to our RSA enVision SIEM.”

Barry Forbes, XYPRO’s VP of Sales and Marketing said, “We are very happy that EDB Card Services selected XMA as its PCI-DSS NonStop audit solution. Since HP selected XMA in 2010 , as the NonStop operating system recommended Audit Solution, we’ve seen a large expansion in our XMA customer base. As our most recent European customer, we know that EDB Card Services will continue to enjoy the same security benefits and efficiencies XYGATE customers around the globe are accustomed to.”

About XYPRO

Founded in 1983, XYPRO Technology Corporation is the market leader in HP NonStop server security, FIPS-validated, cross-platform encryption, audit and compliance solutions.

www.xypro.com

Contacts

XYPRO Technology Corporation
Barry Forbes, 705-799-0247
VP-Sales and Marketing
barry_f@xypro.com

Cybercrime Costs Continue to Dramatically Rise

2011-08-10T14:14:00.000-07:00

The recent HP-sponsored study on cybercrime costs (“The Second Annual Cost of Cybercrime Study”, conducted by the Ponemon Institute http://bit.ly/ql8JXP) produced a wealth of interesting and valuable data on the increasing costs of cybercrime. Some of the key points of the study, which looked at a sample of 50 US organizations, included:

The average annualised cost of cybercrime to each company was $5.9M, ranging from $1.5M to $36.5M
These figures represent a 56% increase over the inaugural study conducted last year
The number of attacks increased by 45% from last year’s study. The companies studied were affected by a total of 72 attacks each week – an average of 1.4 attacks per company per week
90% of all cybercrime costs were caused by malicious code, denial of service, stolen devices and web-based attacks
Average time to resolve cyber attacks was 18 days, with an average cost of $416,000 per attack – a 67% increase from 2010
Smaller companies are not immune from cyber attacks, and in fact these attacks cost smaller companies more on a per capita basis
Deploying SIEM solutions can mitigate the impact of cyber attacks. Organizations with SIEM solutions in place realized a saving of 25% because of the ability to quickly detect and contain cybercrimes.
Companies that deployed a Governance, Risk and Compliance (GRC) program saw significantly reduced costs associated with cyber crime when companies that did not have a GRC program. Average costs for the GRC group were $6.8M versus $9.4M for the non-GRC group

Perhaps the most interesting fact to come from the study was:

…recovery and detection are the most costly internal activities, highlighting a significant cost-reduction opportunity for organizations that are able to automate detection and recovery through enabling security technologies.

Reading between the lines of this summary, a few things come to light. A large number of cyber attacks are “inside jobs”. Malicious code, stolen devices and other forms of attack are only practical when conducted by insiders. As such, putting controls in place within the enterprise is critical. As mentioned in my last blog, ensuring that employees have the ability to do the tasks related to their jobs, and nothing more, is of utmost importance. Tracking commands issued and security events at a granular level to allow for quick identification of cyber attacks is key to reducing the number and duration of attacks, and therefore the cost. SIEM devices, whilst extremely useful, need to have data fed to them from all systems and applications in the enterprise to ensure early detection of issues.

Additional methods of detection should also be considered – have critical files had attributes changed? Have users been given access that they previously did not have? Have privileged programs, that may be malicious, been installed?

In the NonStop environment, only the XYGATE security suite from XYPRO provides all these capabilities, in an integrated, centrally managed solution. XYGATE Access Control ensures that only the necessary levels of access to system resources are granted. All commands and subcommands are audited. XYGATE Merged Audit integrates consolidated audit data on the NonStop, to give a unified view of all security activity. It optionally feeds that data to SIEM devices, allowing the NonStop to participate in the single view of the enterprise.

Perhaps most importantly, XYGATE Compliance PRO monitors a wide range of data on your NonStop, and alerts you when aspects of your system configuration fall outside previously defined boundaries, including unauthorised PROGID’ed programs, users with unauthorized access and unauthorized files on system volumes. Compliance PRO can also compare files from one scan to another, alerting the security administrator if the file size changes, or if the security configuration from two systems that previously matched are now different.

So, as the incidence and costs of cybercrime continue to rise, it becomes even more important to pay attention to your critical data and applications, and the users who are able to access them. Automating as much of this process as possible is important in reducing the time for detection, and therefore the costs of these incidents. XYPRO can help with this – please contact me at andrew_p@xypro.com or your local XYPRO representative for more information.

Andrew Price

Director, Product Management

XYPRO Technology Corporation

www.xypro.com

*Be sure to complete our updated survey! You’ll be automatically entered for a chance to win a TouchPad.

Please note that you’re still eligible to win even if you completed the survey last quarter.

Simply click here : http://www.xypro.com/survey

Hard on the outside, soft and chewy on the inside…

2011-07-11T12:14:00.000-07:00

The title refers to a great quote from a recent Tom Kemp article on Forbes.com http://blogs.forbes.com/tomkemp/2011/07/05/as-hacks-proliferate-new-security-technology-emerges-to-monitor-privileged-it-users/, explaining that the old way of securing a computer system (let only trusted people logon, then let them do whatever they want), no longer suffices. Of course, on NonStop we’ve always had more control over our users than that, but it’s worth considering whether further improvements to security are in order.

These days, with SOX, HIPAA and PCI regulations insisting that we more closely monitor all actions performed by all users, the “hard on the outside, chewy on the inside” approach is not enough. Guardian and Safeguard allow some level of control over file access, and utility program execution, but do not give the fine-grained access control, nor the necessary level of auditing, that is required.

The XYGATE Access PRO suite, and the Access Control module it includes, greatly extend the basic access control capabilities providing by the native NonStop security subsystem. NonStop security administrators can control the specific commands and subcommands that each user can issue from any NonStop utility program. Users can also be granted access to specific commands that would normally be outside their capabilities, meaning that shared access to Super and Manager IDs is no longer required for those users to be able to do their job. All commands are audited, and full keystroke logging is also supported.

Once you have implemented more granular access control, the next step in securing your system is to put a good level of auditing in place. The PCI Data Security Standard (DSS) requirement 10, for example, states “Track and monitor all access to network resources and cardholder data”. What this means will be specific to your application and environment, but again, it will require more than the standard Guardian/Safeguard levels of security to achieve compliance.

XYGATE Access PRO supports all this functionality, and has done so since 1990, back when PCI was just a glimmer in someone’s eye. Whilst the NonStop has always had an enviable security record, my new colleagues at XYPRO have constantly been thinking of ways to ensure that our customers reduce their risk of finding themselves on the front page due to a security incident. For more information on XYGATE Access PRO, see https://www.xypro.com/index.php?id=24 or contact me at andrew_p@xypro.com.

Andrew Price

Director, Product Management

XYPRO Technology Corporation

Large European Payment Processor Selects XYPRO to Meet its HP NonStop Server Security and PCI-DSS Requirements.

2011-07-07T08:51:00.000-07:00

(July 6, 2011) Simi Valley, CA – XYPRO today announced that Equens SE has successfully implemented its XYGATE suite of security and compliance solutions. Equens will leverage XYGATE to improve its HP NonStop security and achieve PCI-DSS (Payment Card Industry Data Security Standard) compliance.

Equens is one of the largest pan-European payment processors, leading the market for future-proof payments and card processing solutions. With clients and partnerships in multiple European countries and an annual processing volume of 9.7 billion payments and 3.9 billion POS and ATM transactions, Equens SE has a European market share of more than 12.5%.

“When our security team started its PCI-DSS compliance project, we faced the same dilemma as many other large firms,” said, Stefan Dusée, Equens’ Security and Control Manager. “We needed a solution that would allow us to meet PCI-DSS as cost-effectively as possible, but also went well above the minimum standards set out by PCI-DSS, thus potentially future-proofing our security standards.”

Equens created a detailed list of requirements, prioritised from “essential” to “desired” and developed a comprehensive RFP. Equens determined that XYPRO’s XYGATE security, compliance and auditing suite offered the best solution to meet their existing and future security and audit needs.

The XYGATE security suite includes role-based access control (RBAC), keystroke audit, user management, real-time alerts, user authentication and the most comprehensive audit and compliance software available for the NonStop server. Equens is using XYGATE security software not only to make its systems as secure as possible, but also for essential, time/labor-saving functionality.

“We’re confident we made the right choice in selecting XYPRO for our HP NonStop security and compliance enhancements,” said Dusée. “Configuring such an extensive range of products presented quite a challenge, but XYPRO has provided excellent support and training services and the new tools are proving to be worthy investments.”

Barry Forbes, XYPRO’s VP of Sales and Marketing said “We are thrilled to announce Equens’ selection of XYGATE for its PCI-DSS security requirements. As a valued customer, we know that Equens will continue to enjoy the same security benefits and efficiencies all XYGATE customers are accustomed to.”

About XYPRO

Founded in 1983, XYPRO Technology Corporation is the market leader in HP NonStop server security, encryption, audit and compliance solutions.

www.xypro.com

www.equens.com

Barry Forbes, XYPRO VP of Sales and Marketing

XYPRO Recent Events: Mobility, Passion, Sir Paul, NFC

2011-06-22T21:11:00.000-07:00

HP Discover '11

HP Discover opened with a bang – over 12,000 attendees together in the first general session. We heard Leo Apothekar’s views on mobility, WebOS, and the cloud – a recurring topic for the week. Those of us coming to the show from a NonStop background were wondering how much airplay the NonStop would get in the general sessions, and with at least four mentions in the keynotes, along with almost forty NonStop-specific sessions, most of us left feeling pretty good about the platform and its future. From my perspective, coming back to the NonStop after a few years away, I was impressed at the continuing passion and enthusiasm within the group, and levels of NonStop representation at the show from HP, ISVs and users. Of course, it’s easy to feel good about participating in such a large show when one of the side benefits is a concert by Paul McCartney, just for conference attendees!

XYPRO had an extremely positive conference, with many good meetings with our customers and our partners at HP. A number of the NonStop-focussed sessions spent time on the importance of security, auditing and compliance, and the role that the XYGATE product suite can help in these critical areas. Our VP of Sales and Marketing, Barry Forbes, is now officially famous, having been video interviewed by one of the bloggers at the show – see http://bit.ly/jgJ91L for more.

The show finished in an even bigger way than it started, with that incredible show from Sir Paul. There was hardly a single person in the MGM Grand Garden Arena remaining in their seats for the two encores that Paul and his band played. Simply awesome.

Andrew Price

Director, Product Management

ACE 2011

XYPRO Technology attended ACE, the ACI User Groups Conference at the Del Coronado Hotel (The Del) in San Diego in June. The conference boasted more than 200 attendees representing more than 70 companies. Exhibitors represented 22 companies.

The conference began with introductory presentations by the product managers of the various ACI products, followed by a Q&A session. ACI confirmed that BASE24 will be sunset in November, however only 80 customers out of approximately 300 BASE24 users have migrated or are transitioning to BASE24-eps. An interesting statistic is that out of 2,185 employees, ACI has 700 developers & 600 people dedicated to services.

The keynote speaker, Brett King, gave a very interesting presentation affirming the notion that the future of banking is mobile. He stressed that banks need to change their approach regarding checking accounts, advertising, and local branches due to younger generations' expectations of mobile transactions. Mr King also stressed the importance of social media for banks. No amount of advertising can overcome bad experiences recorded on Facebook, Twitter, and other social media sites.

There is a new trend to use NFC (Near Field Communication) devices in the industry. These devices are contactless and passive as their function is triggered by an Initiator sending a RF signal that powers the Target device, which does not require batteries. The Initiator can read the contents of the Target and in some cases write to it.

Nick Puetz from Fishnet Security and Gregory Rosenberg from Trustware gave an valuable presentation covering PCI Best Practices & Securing Sensitive Data, two topics of the utmost importance for the financial industry. Greg Brett from Opera Solutions explained the statistical techniques used to detect credit/debit card fraud on-line prior to a transaction’s approval. These techniques, which are used with BASE24 and BASE24-eps, are helping reduce the amount of fraud experienced by financial institutions running those solutions.

Barry Forbes

Vice President, Sales & Marketing

XYGATE Compliance Pro Now Available from HP

2011-05-31T12:58:00.001-07:00

XYGATE Compliance PRO simplifies compliance of HP Integrity NonStop server environments

Simi Valley, Calif. – May 26, 2011 – XYPRO Technology Corporation, a leading provider of security software and services for HP NonStop server environments, today announced its security and policy compliance solution, XYGATE Compliance PRO, is now available directly from HP on HP Integrity NonStop servers – including the recently released, HP Integrity NonStop BladeSystem NB54000c.

With Compliance PRO, HP NonStop customers can effectively manage aspects of security compliance on their HP NonStop server systems. XYGATE Compliance PRO is a powerful and sophisticated software solution specifically designed for the NonStop platform to better monitor the state of mission-critical systems. It enables enterprises to:

· Analyze system security settings and configurations;

· Gather extensive system data to compare changes in the system from different points in time;

· Track and audit security settings to address risks and protect valuable mission-critical data and intellectual property;

· Build an efficient governance, risk and compliance program that can address regulations, such as PCI, SOX, and HIPAA, across NonStop systems.

“Around the world there are more than 20,000 security and compliance regulations that businesses must meet and more are emerging every year,” said Barry Forbes, vice president, Sales and Marketing at XYPRO. “Organizations today are looking for solutions that simplify risk management and increase the effectiveness of system monitoring in complex information security environments. Compliance PRO does just that, and with this solution now available we have made it even easier to implement security solutions that meet mandated compliance requirements such as PCI.”

“For enterprises, complying with government and commercial regulations while protecting valuable mission-critical data is imperative,” said Bob Kossler, director, strategy and planning, NonStop Business Division, Business Critical Systems at HP. “XYGATE Compliance PRO on NonStop environments help clients adhere to these regulations and safeguard the data that keeps their businesses up and running.”

Customers who purchase XYGATE Compliance PRO license and support contracts through HP will receive product support from HP. In addition, XYGATE Compliance PRO is available for individual purchase and direct support from XYPRO.

About XYPRO
XYPRO Technology offers more than 27 years of knowledge, experience and success in providing HP NonStop information systems tools and services. Businesses that manage and transport business-critical data turn to XYPRO for a variety of solutions. XYPRO helps businesses to better manage security risks, protect assets and gain a competitive edge through compliance while improving efficiency. www.xypro.com

XYPRO Technology’s XYGATE/ESDK Achieves NIST Validation for FIPS 140-2 Government Standard

2011-05-18T21:07:00.001-07:00

Simi Valley, California, USA – May 18, 2011 - XYPRO Technology Corporation, a leading provider of security software and services for HP NonStop server environments, today announced the XYGATE Encryption Library (XEL) module XYGATE/ESDK achieved Federal Information Processing Standards Publications (FIPS) 140-2 Validation: Security Requirements for Cryptographic Modules.

FIPS 140-2 validation is mandatory for any cryptographic product that is used in a U.S. government agency network. The standard is a joint effort by the National Institute of Standards and Technology (NIST) in the United States, and the Communications Security Establishment Canada (CSEC), under the Canadian government. The Cryptographic Module Validation Program (CMVP), headed by NIST, provides module and algorithm testing for FIPS 140-2, which applies to Federal agencies using validated cryptographic modules to protect sensitive government data in computer and telecommunication systems. FIPS 140-2 provides stringent third-party assurance of security claims on any product containing cryptography that may be purchased by a government agency.

To expedite the FIPS 140-2 validation process, XYPRO partnered with Corsec Security, Inc., a consulting firm with over 13 years of validation experience. "Corsec is delighted to work with XYPRO on their latest FIPS 140-2 validation," said Matthew Appler, CEO of Corsec. "The FIPS 140-2 process is very detailed and time consuming and only well designed products can make it through validation. This clearly demonstrates XYPRO’s devotion to provide its customers with a higher level of security assurance."

“Over the past several years, XYPRO has expanded the number of platforms on which we received FIPS validation for our encryption library,” said Lisa Partridge, XYPRO President. “This most recent validation is a testament to our unwavering commitment to security and compliance. FIPS 140-2 validation of the XEL XYGATE/ ESDK demonstrates XYPRO’s determination to continue providing customers with a secure and dependable solution.”

The FIPS standard, which is mandated by law in the U.S. and strictly enforced in Canada, is also being reviewed by ISO to become an international standard. FIPS 140-2 is gaining worldwide recognition as an important benchmark for third party validations of encryption products of all kinds.

About XYPRO

XYPRO Technology offers more than 27 years of knowledge, experience and success in providing HP NonStop information systems tools and services. Businesses that manage and transport business-critical data turn to XYPRO for a variety of solutions. XYPRO helps businesses to better manage security risks, protect assets and gain a competitive edge through compliance while improving efficiency. www.xypro.com

ABOUT CORSEC SECURITY, INC.

Corsec Security, Inc. specializes in helping companies navigate through the complex process of receiving FIPS 140 and Common Criteria (CC) certifications. Corsec’s consulting, document creation, and laboratory services deliver unmatched expertise in achieving government validation efforts at a firm, fixed price. Corsec partners with companies around the world to achieve local and international certification and to add security functionality to a wide range of products. Corsec minimizes the time, effort and money a vendor needs to invest in validation while ultimately maximizing the return on that investment. For further information, please visit www.corsec.com.

Raymond James Selects a Clear Standout for its Mission Critical Security Needs

2011-03-14T23:16:00.000-07:00

Raymond James is a diversified financial services holding company with subsidiaries engaged in investment and financial planning, in addition to investment banking and asset management. As with any company that stores private, sensitive data, they required industry-leading security and audit solutions that would seamlessly integrate with their HP NonStop environment. “We had multiple challenges from multiple sources,” said John Anderson, Manager of the NonStop Engineering department at Raymond James. “We wanted to enhance our overall security control on the NonStop, continue to meet specific privacy requirements from our internal and external auditors, and increase logging of user activity: All of these had to fall within our standard enterprise security model.”

After reviewing several security-related products, XYGATE emerged as the stand-out solution that could address Raymond James' comprehensive security and audit needs.

A Clear Standout

Raymond James turned to XYGATE Merged Audit to fulfill its requirements to increase its logging, monitoring and reporting of activity on the HP NonStop. In addition to being an industry leader with an excellent reputation and outstanding customer support, Raymond James selected XYGATE for its comprehensive security features and ease of use. The company also favored the solution’s simple integration.

Moreover, in Raymond James’ specific HP NonStop environment, the ability to send in SYSLOG format to its security data collection device is critical. “Each of the SIEM (Security Information and Event Management) solutions are fully supported by XYGATE Merged Audit with its ability to send all audit in SYSLOG format,” said Anderson. “We were able to confidently move forward with the XYGATE Merged Audit product knowing whatever choice we made for the SIEM, XYGATE Merged Audit would integrate with it.”

Benefits Across the Board

“Rule Based Security with the XYGATE Object Security has saved us an enormous amount of time and effort. A straightforward requirement from our auditors was going to require the implementation of hundreds, and maybe thousands, of complex Safeguard ACLs to meet this requirement,” said Anderson. “With XYGATE, we met the same requirement with a single rule. XYGATE Object Security makes it easier to design, implement, and maintain security for our NonStop servers.”

Anderson also notes that the overall security enhancement project using XYGATE has provided further management of the security environment on the NonStop. “The added control and oversight provided by XYGATE allows for requirements to be met and has afforded us peace-of-mind not previously enjoyed.”

Looking Ahead

As with any change and especially the implementation of added security measures and controls, Raymond James is still learning XYGATE’s countless features and functionalities. “After meeting our initial requirements, we continue to find that new needs are also easily met with XYGATE,” said Anderson.

Moving forward, the company is reviewing additional XYGATE solutions. For their administrative needs, Raymond James is looking at the sophisticated capabilities of Safeguard Manager and for its compliance and integrity checking requirements; they are looking at Compliance Pro.

About Raymond James

Founded in 1962 and a public company since 1983, Raymond James is a diversified financial services holding company with subsidiaries engaged primarily in investment and financial planning, in addition to investment banking and asset management. Its stock is traded on the New York Stock Exchange (RJF).

Through its three broker/dealer subsidiaries, Raymond James Financial has more than 5,300 financial advisors serving 1.9 million accounts in 2,300 locations throughout the United States, Canada and overseas. In addition, total client assets are approximately $262 billion, of which approximately $33 billion are managed by the firm’s asset management subsidiaries.

Raymond James has been recognized nationally for its community support and corporate philanthropy. The company has been ranked as one of the best in the country in customer service, as a great place to work and as a national leader in support of the arts.

www.xypro.com

XYPRO Announces HP CI-Ready Certification

2011-03-09T09:54:00.000-08:00

XYPRO is pleased to announce its recent HP CI-Ready verification. XYGATE Merged Audit (XMA) and XYGATE Compliance PRO have been validated in the HP Converged Infrastructure environment.

What Is HP CI?
The HP Converged Infrastructure helps businesses overcome the inflexibility and high costs created by IT sprawl to shift more resources to innovation and strategic initiatives – creating the ideal foundation for an instant-on enterprise. This is achieved through an architectural blueprint that eliminates silos and integrates technologies (e.g. servers, storage and network) into shared pools of interoperable resources – all managed through a common management platform and all based on standards and customer choice.

The result is a data center of the future, today, that delivers a whole new level of simplicity, integration, and automation whereby the IT environment is synergistically aligned to the needs of the business: Faster time to revenue; lower costs of acquisition and implementation; more quickly and flexibly respond to business changes; and, lower risks. And as your business grows, a Converged Infrastructure will accelerate your move to an Instant-On Enterprise. This type of organization shortens the time needed to provision infrastructure for new and existing enterprise services to drive competitive and service advantage.

What is Merged Audit & Compliance PRO?
XYPRO's Merged Audit and Event Monitoring module (XMA) collects data from multiple sources of Audit and intelligently merges them together to form a single NonStop SQL audit database. XMA will also deliver all collected audit data vis SYSLOG to remote logging devices or SIEMs.
XYGATE Compliance PRO enables you to easily research the state of security on your HP NonStop server, report on the information found, build policies that monitor the state of the security rules in your environment, compare your existing security against Best Practice and custom Policy recommendations, and verify the integrity of your system objects.

Learn more about HP CI by visiting www.hp.com/solutions/allianceone/ciready

To learn more about XYGATE Merged Audit and Compliance PRO, visit www.xypro.com

Lisa Partridge
XYPRO Technologies
www.xypro.com

Win an iPad!

2011-02-24T14:43:00.000-08:00

At XYPRO, we are committed to not only improving our existing product line but also paying close attention to our customers’ requests. We’ve always enjoyed an open communication with our customers and the market and in 2011 we plan even more dedication to that cause. One of the ways we’re doing that is through our Quarterly Surveys. They’re short (5 questions) and painless. But what’s in it for you? Well, besides helping us to continue providing you with the best HP NonStop security, auditing, Fips-validated encryption and compliance products on the market, you get a chance to win a shiny new iPad. And unlike your odds for appearing on X Factor or American Idol, you have a great chance to win! Give us your feedback at www.xypro.com/survey.

Hurry, drawing for the first quarter iPad winner is on March 9^th

Lisa Partridge
www.XYPRO.com

From The CEO’s Desk

2011-01-19T08:51:00.000-08:00

As we look back on 2010, we see a year that’s had the most amazing changes to the NonStop platform’s security profile in many years. By now, everyone should know that HP is bundling XYGATE Merged Audit (XMA) software in the HP NonStop Operating System Mission-Critical Edition software package. This means that many HP NonStop customers no longer need to ask for audit waivers due to missing security functionality.

The NonStop server now meets many more compliance requirements, making it easier to justify it as the core of any mission-critical application. In fact, payment industry specialist and Qualified Security Assessor (QSA), Witham Laboratories, in cooperation with Knightcraft Technology, has created the most comprehensive HP NonStop Payment Card Industry Data Security Standard (PCI DSS) white paper in existence.

This document was created to assist HP NonStop users in their PCI compliance projects by showing how Safeguard and Guardian can be configured to meet PCI DSS and highlighting the requirements where compliance cannot be achieved without the use of third party solutions (solutions mentioned in the paper are from the XYGATE suite). For a copy of this document, visit www.knightcraft.com.

Because of our geographically diverse customer base, XYPRO sales reps and security specialists travel hundreds of thousands of miles a year so that we can support our customers, HP, and the many HP user groups around the world. Last year, XYPRO had a presence at the HP NonStop Symposium, CTUG (Canada), BITUG (United Kingdom), OZTUG (Australia), SATUG (South Africa), SUNTUG, GTUG, OTUG, and many, many other regional NonStop User Groups around the world.

Additionally, we attended several other industry conferences, such as the PCI Europe Annual Meeting (Netherlands), ACI Customer Events in Asia, Africa, Europe and North America and as new members of PCI Security Standards Council (https://www.pcisecuritystandards.org) we proudly took part in both their European and North American Meetings.

While we also enjoyed success with our new Webinar series in 2010, attending conferences like the (incredibly successful) NonStop Symposium and EXPO in San Jose, is our primary way to meet directly with our customers. Far more than a marketing opportunity, these conferences provide an in person forum for informal conversation, direct exchange of information with customers about what works, and what needs to be improved, and what new features and solutions they need so that they can ensure the security of the information on their HP NonStop servers.

What We See for 2011

We predict 2011 will bring as much excitement and good things as 2010. There’s a lot of talk and trends occurring, and we’re keeping our finger on the pulse.

As we kick 2011 into high gear, we certainly plan to address these issues and more. So be sure to follow us on our Blog, Tweets, Facebook, LinkedIn or visit us at any of this year’s NonStop RUGs, HP Discover, ACI User Group Meetings, PCI Security Standards Council gatherings and other industry events. We’ll keep our events page updated at www.xypro.com so keep checking back!

Also, be sure to fill out our short five question survey and be entered into our quarterly drawing to win an iPad.

Sheila Johnson
CEO, XYPRO Technology Corporation
www.XYPRO.com

Lessons from Data Breaches of 2010

2010-12-21T10:48:00.000-08:00

SecurityWeek recently published “Lessons from the Most Interesting Data Breaches of 2010” and some of the article’s highlights may really surprise you. For example, the article states that there has been a 93.7% drop in the volume of data stolen from 2009 to 2010. An analysis from the Privacy Clearinghouse, a public database which records all breaches of personal and sensitive information belonging to US citizens, shows that about 230 million data records were taken in 2009 and only 13 million so far this year. It’s a positive number, but keep in mind that 2009 saw two major breeches with Heartland and the Veteran’s Administration. Of course, this drop also underscores the security investments companies have made over the past few years. Indeed, such efforts and investments have paid off in greatly enhanced security, helping to make data breaches extremely difficult.

Another interesting and key finding of the article touches on the value of data shifting from lower to higher. We here at XYPRO have seen this trend for quite some time!

2 Key Lessons from the article
So, what can be done to avoid data loss and breaches as we move into 2011? Below are two key lessons to consider:

1. Enforce data is accessed only by authorized parties. At a minimum, they should block access from former staff and from employees attempting to access data beyond their need-to-know level.

XYGATE customers easily achieve this role-based access control goal with the Access PRO software solution. Access PRO functionality provides the core of a well-secured HP NonStop system. With this software in use, Individual accountability with full keystroke audits is achieved, while restricting each user to a list of authorized actions based on that user's job functions.

2. Block access from any illegitimate application. Security controls should be able to block an unauthorized process (the malicious code).

XYGATE customers rely on the ability to restrict all NonStop SUPER and Sensitive user access to “least privilege” based on multiple criteria, including IP address.

Like many of our clients who use XYGATE, you too can implement XYGATE for Role Based Access Control, keystroke auditing, and SSO authentication. FIPS validated encryption and automated compliance analysis completes the solution. Indeed, as we enter a new year, it’s a great time to reflect on where your security measures stand now, and what you need to do to safeguard yourself in the future.

Companies from across the globe have relied on XYGATE to cover all of their HP NonStop security requirements. In fact, XYGATE is used by six of the world’s top 10 bank processors*.

Click here to read the entire SecurityWeek article.
*As reported in the 2010 FinTech 100

The PCI Security Standards Council Updates PCI DSS (V2.0)

2010-11-12T09:37:00.000-08:00

Changes are logging-focused & intended to help businesses improve compliance and security

The PCI Security Standards Council (XYPRO is a member) officially unveiled updated versions of compliance with changes meant to clarify the requirements organizations face. The changes are coming as a direct result of the feedback the PCI Security Standards Council has received, and should help your business with its security and compliance efforts.

The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. This comprehensive standard is intended to help organizations proactively protect customer account data.

The key revisions cover areas such as log management and scoping the environment to understand where cardholders reside. In fact, the council is pushing hard for centralized logging, stating that:

“If you don’t use a centralized logging facility your auditors will have to look in more places, and chances are, if they have to look in more than one place...you’ll wind up missing some of this stuff. It is a "proven fact that every time we find a breach, it’s always found in the log.”

This change also coincides with HP adding XYGATE Merged Audit Software with every new NonStop server order.

This centralization of NonStop Audit can also be sent Off-box to a centralized logging facility like HP's CLW and Arcsight offerings, meeting the Centralized Logging Facility requirement at the Enterprise Level.

There were also revisions meant to enable organizations to develop a risk-based assessment approach based on their specific business circumstances as well as changes designed to appeal to small merchants to simplify their compliance efforts.

The new versions will become effective Jan. 1. For more information, you can click here.

For more information about the XYGATE Solution, visit www.xypro.com.

CTUG 2010

2010-11-03T13:49:00.001-07:00

The much anticipated CTUG (Canadian Tandem User Group) has come and gone and, as expected, was a great success for all in attendance. Content for this year’s event was excellent with a great update from Randy Meyer on the state of HP NonStop, growth, and technology advancements. It is always great to hear from the proverbial “Horse’s Mouth” and also reassuring that HP NonStop is not only surviving, but thriving!

Naresh Bangia of AJB Software delivered an interesting and informative presentation on the exciting results of their port of .NET to NonStop. With a “Live” demo which included a “drag and drop” example of NonStop code to Windows that executed perfectly on both OS’s! All this with a weak signal on a mobile wireless internet stick that required some comedic and creative physical positioning within the conference room to maintain connectivity.

Jim Johnson of the Standish group also presented on their recent paper “Roadmap to the Megaplex” covering the overall CTUG theme of Modernization and showed just how profitable modernizing applications and utilities can be.

As always, the Q and A session highlighted some interesting facts and brought up many discussion points. Dick Bird, Michelle Bates, and Randy Meyer all provided answers which inevitably lead to more questions. The end to the Q and A session was achieved only by the enticement of the much anticipated CTUG prize draw where all 20 partners who participated in the “Passport to Prizes” program, HP Canada, and CTUG had donated fabulous gifts as appreciation to those attending the event.

XYPRO was among the 9 partner presentations which were held throughout the day and Kevin Boham provided modernizing insight on Security for the NonStop to an attentive and interactive audience.

CTUG and XYPRO were glad to welcome those out of province attendees from Quebec as well as the many faithful and new from Ontario. Their attendance from near and far indicates the continued need for NonStop events such as CTUG. With attendance nearing 140, CTUG had exceeded its capacity and were glad the Fire Marshalls didn’t pay an unexpected visit.

The day’s closing reception also kept the majority of attendees into the evening for some socializing, good food, and drinks to cap off an excellent day.

More indicative of the continued commitment to NonStop was the record attendance for the education day where CTUG had 44 registered students for a one-day class on Java Servlets/NSJSP in the NonStop.

As a CTUG board member as well as a Partner for the event, I now have the short term opportunity to decompress after months of planning and executing. …short term as XYPRO is planning their next attendance at a regional event… NENUG in the Boston area on November 9th.

Barry Forbes

XYPRO Technologies, Director of Sales, Eastern USA and Canada
President, CTUG

San Jose – let’s not forget the way...

2010-10-07T14:51:00.000-07:00

Well, the Big Event is over. The vendors have packed up their booths, the booze is all gone, and the HP product managers, developers, and execs are safely home in their remote offices. And even though the weather was almost the same, everyone in attendance overwhelmingly preferred San Jose to that other city. The HP NonStop Symposium and EXPO turned out to exceed everyone's expectations not only in terms of Customer attendance but also HP and Partner involvement.

Yes, this was the biggest and best NonStop event in years (and with a killer Tandem-style beer bust) where we proved beyond a doubt that there is still life in the NonStop family and the platform that runs mission critical applications for the world's largest companies. This year we were also able to spend time with customers that we have not seen in a while and the attitude was very much like the old (ITUG) days. Far more Europeans, Latin Americans and Asian customers were present than at HPTF in 2009 – several of whom were actively seeking tools to aid PCI compliance projects.

There were dozens of business and technical sessions, including standing-room-only customer how-to's, NonStop software and hardware roadmaps, and presentations from Vendor Partners. PCI compliance was a common theme throughout the event and it’s only going to increase. Packed presentations by end-users Netherlands-based Equens and Wells Fargo Bank and HP’s Karen Copeland and Wendy Bartlett show just how in tune the NonStop Community is with PCI Compliance. That illustrates just how much of our mission critical and confidential information is trusted to a NonStop! It's amazing how much customers are willing to share their experiences because of the pride they have in their NonStop server applications tuned to perfection, secure and protected from disaster.

XYPRO specifically enjoyed an unprecedented amount of coverage at this event as we were lucky enough to have it take place right around the time our XYGATE Merged Audit software solution begins automatically shipping on all new H and J systems. The interest level is extremely high and we are thrilled at the positive response!

Yes, a pleasant time was had by all and I hope that we remember it for a long time. The level of international customer attendance was inspiring! The XYPRO customer dinner was very well received and we would like to thank everyone who attended.

It may seem a disappointment hearing that next year’s event will be part of the HP Software / Tech Forum conference at the Venetian hotel in Vegas, but your voices may have been heard. In his keynote, Winston Prather said that this event would be restructured to retain the strong community feel that this Symposium displayed. The big question is whether or not HP will be sending the same number of NonStop product managers and developers and it will be interesting to see how the big tent event achieves the incredible dynamic we all experienced in San Jose. The amount of interaction with HP staff and customers was simply something we hadn't enjoyed in years and everyone seemed to revel in the long overdue opportunity.

But hey, the next event is 9 months away and if customers take the time to communicate their preference - another NonStop Symposium in San Jose? You never know...

Lisa Partridge

ITUG 2010

2010-09-28T07:08:00.000-07:00

ITUG 2010 (also called The Connect NonStop Symposium and Expo) opened with an amazing dinner hosted by XYPRO at Scotts seafood restaurant in San Jose. Among the 130+ attendees was a real cross-section of the HP NonStop community. Aussies, South Africans, South Americans, Asians, and Europeans joined the North Americans for a most amazing 3-course meal with dessert and entertainment.

For those who managed to get out of bed on Tuesday, 499 other show attendees joined them at the San Jose convention center-and the mood was incredible. Everyone was happy to be back in San Jose at a NonStop show instead of in Las Vegas in the middle of Summer!

It was really heartwarming to some and interesting to others that even with HPTF (the heretofore-described show in Las Vegas), people came to this event. I personally know of several NonStop customers who never intended to come to San Jose but went to Las Vegas. They determined the NonStop symposium was the place to be and are here with bells on and very happy they came.

The San Francisco bay area is in the middle of a heatwave, so people can close their eyes and pretend that they're in Vegas, then open them up to see dozens of NonStop product managers, developers, and execs who find it a lot more pleasant to drive the 5 miles down highway 280 from Cupertino than to take a 90-minute flight to Vegas after waiting an hour in the security line.

What happens in Vegas stays in Vegas, but what happens in San Jose has a big influence in Cupertino, helping build better products for the best computer system in the world. And isn't that a grand thing?

Lisa Partridge
XYPRO

XYGATE Software Exceeds Regulatory Auditing Requirements for HP NonStop Systems

2010-09-17T08:36:00.001-07:00

State of the art auditing & compliance solution to ship with latest HP Integrity NonStop operating system

(September 14, 2010) Simi Valley, CA – XYPRO Technology Corporation, a leading provider of security software and services for HP NonStop server environments, today announced its audit and reporting solution, XYGATE Merged Audit (XMA) software, will be included in the HP NonStop Operating System Mission-Critical Edition software package.

This XMA software addition will allow customers to better monitor the state of their mission-critical systems. XMA collects, filters, normalizes, and writes audit data from a variety of sources across dozens of systems in an HP NonStop system network. The software then writes data to a consolidated NonStop SQL database. These advances will allow security administrators to efficiently produce reports based on audit data from one or multiple sources, create real-time alerts for specific events, and feed many off-box central audit logging devices or SIEMs (Security Incident Event Monitor), such as the HP Compliance Log Warehouse (CLW), facilitating Integrity NonStop server participation in an Enterprise Security Program.

“Security has changed drastically over the last five years,” said Sheila Johnson, XYPRO’s CEO. “Starting in September, customers who purchase new HP NonStop servers running on the J Series or H Series platform will receive XMA on their system.”

HP NonStop customers who wish to upgrade their existing systems can purchase an OS upgrade package that includes XMA software and entitles them to new versions of the product going forward. XMA software also continues to be available for individual purchase and direct support from XYPRO.

“In the current climate, many businesses are under increasing pressure to comply with regulatory audit standards – all while protecting their mission-critical data and resources,” said Randy Meyer, Director of NonStop Product Management, Strategy and Technology at HP. “HP is working with XYPRO to provide clients with solutions that simplify risk management and increase effectiveness of system monitoring in complex information security environments.”

“Bundling XMA software as part of the OS distribution provides customers with greater consistency, significant savings, comprehensive audit consolidation, and reporting,” said Lisa Partridge, XYPRO’s Vice President of Sales & Marketing. “We are excited to work with HP to bring best-of-class security to the HP NonStop user community.”

From the CEO's Desk

2010-09-08T11:55:00.000-07:00

We all know that the sun never sets on the HP NonStop server empire—especially in the financial industry. Worldwide, a large number of credit card and funds transfer transactions are either switched or cleared by NonStop servers. And since the bulk of those mission-critical NonStop servers protect their confidential information with XYPRO software, we felt that it was time that we had a seat at the payments processing table.

But rather than sitting back and listening, we wanted to have an active voice, to ensure that the needs of our users were addressed as new standards were implemented. To get that seat, XYPRO joined the PCI Security Standards Council as a participating member, which allows us to work with the Council to evolve the PCI Data Security Standard (DSS) and other payment card data protection standards.

Anyone who has read the PCI DSS knows that many of the requirements are aimed at so called “industry standard” servers and not big iron like the NonStop server. How many times have you been asked what anti-virus software is running on your server? Wouldn’t it be nice to stop hearing that question from your auditors?

In other news, the traditional NonStop Summit is back. Rather than hopping a plane to Las Vegas in summer, walking what seems like 4 miles from the hotel to the convention center every day, and fighting the crowds of gamblers and tchotchke divers hanging out at the Mandalay Bay, we get to be back among our own circle of friends just minutes from NonStop Central (or Cupertino, as Google Maps calls it). All of your favorite vendors have booths and are just as excited to be back in San Jose as I know all of you are. HP will be sending dozens of NonStop developers and product managers who can spend time with you to understand how to make their products better by meeting your needs.

In my last blog entry, I alluded to a number of exciting activities that I could not talk about—until now. If you’ve attended one or more Security SIGs, you’ll remember that the same requests get made over and over and every time HP recognizes that there are opportunities for improvement. Unfortunately, the development dollars just aren’t there to address every issue and HP needs to prioritize.

A substantial number of security upgrades have been made by HP, including longer passwords, better user management, a more secure password encryption algorithm, and so on. HP has been listening to you and over the past year, they quietly have been working to bundle selected third party products into the base NonStop OS.

At the summit, HP and XYPRO will jointly announce and demonstrate some of the most frequently requested security functionality being added to the NonStop OS at a low cost to customers. Current XYPRO customers don’t need to worry about past decisions or future support, since we have a migration path for you.

Watch for our press release later in September and be sure to drop by our booth at the Summit to see what’s cooking. If you just can’t wait, you can read Scott Uroff’s article in the July/August issue of Connect Magazine for a clue.

Before I close, I wanted to mention “The Most Significant Breach Of U.S. Military Computers Ever.” This has nothing to do with NonStop servers, or even HP. It began when an infected flash drive was inserted into a U.S. military laptop at a base in the Middle East. The flash drive's malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network run by the U.S. Central Command. That code spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control.

It was a network administrator's worst fear: a rogue program operating silently, poised to deliver operational plans into the hands of an unknown adversary. There is only one protection against rogue software or a rogue user in the enterprise and that is encryption at a very granular level. It will take an attacker a lot longer to steal your information if they need to do it one small piece at a time as it is displayed on someone’s screen than if they can just download an entire unencrypted file in one shot.

Scott Uroff wrote an article in the January/February issue of The Connection magazine that can help you understand the importance of selecting the right encryption algorithm and how to properly implement it. If you have questions, Scott will be at the XYPRO booth and the Summit to answer them.

Don’t pick up an unknown flash drive and connect it to your network, but do come to the NonStop Summit. See you there!

Sheila Johnson
XYPRO, CEO

Product Spotlight: Safeguard PRO

2010-08-27T13:05:00.000-07:00

SAFECOM is the original user interface to Safeguard, the native HP NonStop™ server security program. Both were developed at a time when highly trained HP NonStop technical staff managed HP NonStop security exclusively. However, today’s security requirements are not only more complex and scrutinized, but security is often managed by an information security department whose staff rarely consists of single-platform experts. Instead they are information security specialists with responsibilities across many different computer platforms.

Why Safeguard PRO?
Safeguard PRO brings together all the capabilities of the XYGATE Safeguard enhancement modules to offer you a single source for achieving your Safeguard-related security requirements. A friendly and intuitive user interface adds to the ease of use and allows the Security Administrator, whose responsibilities can span several computer platforms, to take care of the HP NonStop platform with ease.

What Do I Get with Safeguard Pro?
The XYGATE Safeguard PRO package consists of 5 integrated modules, each addressing specific Safeguard security requirements. Every aspect of Safeguard Administration, Audit, Authorization, and Authentication (including interfacing to LDAP) is enhanced and made efficient with XYGATE Safeguard PRO.

XYPRO’s Safeguard PRO is an enhanced Safeguard manage¬ment, configuration and reporting package that extends the capabilities of Safeguard with unrivaled user authentication, password quality and object security power.

How Do I Learn More about Safeguard PRO?
Click here to learn more. You can download free product information and view a product demo.

Donkey Rodeo SIG, London.

2010-08-12T23:15:00.001-07:00

At the start of the recent BITUG (British Isles Tandem User Group) DR SIG in London, NTI’s Dave Ross asked the attendees to think about what the letters D.R. stood for, with prizes for the most creative suggestions. More on the results of that at the end.

As you’d expect from a DR SIG, the day was focused on Disaster Recovery or Data Replication as is becoming more commonly used, because of the multi-purpose uses for modern DR set-ups. The list of attendees was a little longer than usual, which I’m thinking is down to two possible reasons. The first could be that DR is a fairly hot topic and people want to keep up to speed. The second might have been NTI’s exclusive booking of a London Eye (huge Ferris wheel on the Thames) capsule for a post SIG hurrah. Either way, it was great to see a good turn-out.

By the end of the day, it was time for the D.R. Suggestions to be aired. Around ten made the final cut with Digital Renaissance being one, Demand Ransom was possibly another, but Deny Responsibility was deemed the winner! I can’t remember if the prize was a crisp £20 note or a Tandem T-Shirt, as there were a few mini competitions during the day. Either way, everyone went home happy, especially those with extra cash/clothing and those who got an invite to the post SIG London Eye trip.

The next BITUG SIG covers Migration and Solutions, 13th October.
www.bitug.com

Dan Lewis
XYPRO, Europe

XYPRO TECHNOLOGY CORPORATION joins PCI Security Standards Council as newest Participating Organization

2010-08-06T09:19:00.000-07:00

XYPRO to participate in key standards setting body protecting payment cardholder data

FOR IMMEDIATE RELEASE

Simi Valley, CA/USA, August 6, 2010 —XYPRO Technology Corporation, a leading provider of data security software and services for HP NonStop Server environments, announced today that it has joined the PCI Security Standards Council as a new participating organization. As a Participating Organization, XYPRO will work with the Council to evolve the PCI Data Security Standard (DSS) and other payment card data protection standards.

The PCI DSS, endorsed by American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc., requires merchants and service providers that store, process or transmit customer payment card data to adhere to information security controls and processes that ensure data integrity. More information on the council and the standard can be found at www.pcisecuritystandards.org.

As a Participating Organization, XYPRO will now have access to the latest payment card security standards from the Council, be able to provide feedback on the standards and become part of a growing community that now includes more than 500 organizations. In an era of increasingly sophisticated attacks on systems, adhering to the PCI DSS represents an entity’s best protection against data criminals. By joining as a Participating Organization, XYPRO is adding its voice to the process.”

“The PCI Security Standards Council is committed to helping everyone involved in the payment chain protect consumer payment data,” said Bob Russo, General Manager of the PCI Security Standards Council. “By participating in the standards setting process, XYPRO demonstrates they are playing an active part in this important end goal.”

“XYPRO is dedicated to helping businesses achieve unified security and compliance within their HP NonStop server environments,” said Sheila Johnson, CEO at XYPRO. “We are extremely excited to participate in the PCI Security Standards Council, as it further demonstrates our mission and commitment to closing the security gap.”

About PCI Security Standards Council
The mission of the PCI Security Standards Council is to enhance payment account security by driving education and awareness of PCI security standards. For more information, please visit www.pcisecuritystandards.org

About XYPRO
XYPRO Technology offers more than 27 years of knowledge, experience and success in providing HP NonStop information systems tools and services. Businesses that manage and transport business-critical data turn to XYPRO for a variety of solutions. XYPRO helps businesses to better manage security risks, protect assets and gain a competitive edge through compliance while improving efficiency. www.xypro.com

# # #
Media contacts

XYPRO Technology                    PCI Security Standards Council
Lisa Partridge                       Ella Nevill
805-583-2874               781-876-6248
Lisa_P@xypro.com                   enevill@pcisecuritystandards.org

Security Breaches: Do Companies Need to See It Get Worse Before It Gets Better?

2010-07-29T13:13:00.000-07:00

One would think that with all of today’s security standards and compliance requirements that data leaks and security breaches would be few and far between. Of course, one would be wrong to think that. Indeed, in the healthcare sector alone the numbers are staggering. In a recent report published by Healthcare Info Security the official federal list of major healthcare information breaches dating back to last September included 119 incidents affecting almost 5 million Americans. About 20 incidents were added to the list in the last 30 days.

The total of those affected by major breaches grew by approximately 1.5 million in the past month, primarily as a result of two large cases.

In one case, South Shore Hospital in South Weymouth, Mass. reported that unencrypted backup computer files containing personal, health and financial information on about 800,000 people may have been lost by a company that a Massachusetts Hospital hired to destroy the files. On the breach list, the business partner involved is identified as Iron Mountain Data Products Inc.

In the other case, WellPoint Inc., which owns Blue Cross and Blue Shield plans in 14 states, announced in late June that it was notifying 470,000 people who applied for individual health insurance coverage that their information may have been breached on a website.

Don’t Make the List
Organizations that suffer from security breaches can’t hide and pretend it didn’t happen. Under the Health Information Technology for Economic and Clinical Health Act's breach notification rule, which went into effect last September, breaches affecting more than 500 individuals must be reported to the Department of Health and Human Services' Office for Civil Rights and the news media as well as the individuals affected within 60 days. It’s definitely a list you don’t want to be on.

Get Informed & Get Secure with XYPRO
For more than 25 years, XYPRO has been helping businesses, including healthcare organizations secure their mission-critical systems and information. We help ensure that our customers never make lists like the ones mentioned above. You can learn more about how we do it from our webinar archive at www.xypro.com/webinars.

The Secret to Fitness...

2010-07-15T15:28:00.000-07:00

I may have found the key to improving my overall health, when recently I had the good fortune of teaching a one-week XYGATE class for one of XYPRO's customers in Porto Alegri, which is the capital of Rio Grande do Sul and is Brazil's southernmost state. Porto Alegri is a pretty city, with tree-lined streets and colorful sunsets over Lake Guaíba.

The company, along with a number of other international high-tech businesses, including HP, leases buildings on the campus of the Pontifical Catholic University of Rio Grande do Sul (PUCRS). The companies agree to accept students for internships and on-the-job training. The companies pay rent, which supplements the university's income. In addition, all of the extra people on campus makes having a big variety of restaurants and other businesses, including a fairly large mall on campus, feasible. This is such a wonderful idea—I’m surprised more universities aren't doing it.

This was my first experience teaching where more than half of the students were watching via video conference from multiple time zones. However, the Brazilian folks were experts on setting everything up, and the class came off without any problems.

I also had my first taste of the yerba mate tea and saw how it is brewed. Perhaps that is the secret to their fitness! Some studies have shown that this tea has anti-obesity, cholesterol lowering and antioxidant properties. All I know is the vast majority of citizens appeared extremely fit regardless of age or gender. Well, I'll let you know how it goes in a few months...

Terri Hill
XYGATE Security Specialist

XYGATE is Profiled in the Roadmap to the Megaplex

2010-07-09T11:23:00.001-07:00

High-profile guide by Standish Group highlights XYGATE’s sophisticated security features

(July 8, 2010) Simi Valley, CA – XYPRO Technology Corporation, a leading provider of security software and services for HP NonStop™ Server environments, today announced that it has been included in the Standish Group’s Roadmap to the Megaplex. The guide offers timely information to help organizations maximize their current investment in HP NonStop server applications. The Roadmap to the Megaplex also offers return on investment scenarios and provides compelling reasons to modernize the NonStop applications and environment.

XYPRO’s security and access control suite, XYGATE, is highlighted in the Roadmap’s Security Modernization section. XYGATE is a comprehensive security, compliance, auditing and FIPS 140-2 validated encryption software solution for HP NonStop environments. Security modernization is the process of changing the traditional security and protection systems from passive to proactive. Government and industry regulations mandate much of this change. The Standish Group reports that 69 percent of organizations have an active and concentrated effort to meet regulatory compliance. Investment in security is minimal when compared to the financial penalties levied for non-compliance or the monetary impact of a breach.

The Roadmap to the Megaplex highlights XYGATE’s ability to greatly enhance an organization’s security environment and enable protection of their intellectual property and confidential information. “The security process is challenging and ever-evolving as organizations strive to protect our personal data, their corporate assets and meet regulatory compliance,” said Sheila Johnson, XYPRO CEO. “One way to make the process simpler is to deploy a centralized security management system with highly sophisticated security capabilities but that is straightforward to use, such as XYGATE.”

XYGATE’s implementation is simple and requires little training for the experienced NonStop security administrator. XYGATE’s intuitive wizards are designed to help security administrators set up rules and roles quickly. The XYGATE suite has been efficiently designed to meet organizations’ goals to protect data and improve productivity while achieving granular security, audit and compliance mandates.

“The Roadmap to the Megaplex is a critical document for organizations seeking to maximize their investments in NonStop applications,” said Lisa Partridge, XYPRO Vice President. “We are thrilled that XYGATE’s rich security, audit and compliance features have been profiled as an avenue for organizations to enhance and protect their HP NonStop server environment.”

About XYPRO
XYPRO Technology offers more than 27 years of knowledge, experience and success in providing HP NonStop information systems tools and services. Businesses that manage and transport business-critical data turn to XYPRO for a variety of solutions. XYPRO helps businesses to better manage security risks, protect assets and gain a competitive edge through improved efficiency. www.xypro.com

About the Standish Group
The Standish Group is based in Boston, Massachusetts and is the Information Technology leader in project and value performance. We are a group of highly dedicated professionals with years of practical experience in assessing risk, cost, return and value for Information Technology (IT) Investments.
www.standishgroup.com

Viking Longtrip

2010-06-22T14:55:00.000-07:00

Three days at the end of May saw Sean Bicknell and I head to the ninth annual VNUG (Viking NonStop User Group) conference held this year at Gällöfsta Manor, about half an hour north of Stockholm.
Day one was either an education day, or a golf tournament. I was looking forward to a round of golf, but striking British Airways cabin staff had other ideas. Our rescheduled flight meant I’ll have to wait until next year to play my first golf in Sweden. At least with an extra year to practice I’ll increase my chances of not coming last!

The real business began on the morning of day two. Around 10 vendors set up their booths and a range of HP updates, vendor pitches and user presentations kicked off at 9.30am. Our presentation was originally scheduled to be the final one of the event on day three, but a last-minute cancellation by one of the speakers meant we were moved to the afternoon of day two – no complaints there.

For XYPRO’s 20 minute slot we took a look at a few of the PCI-DSS requirements which can’t be met on a NonStop with native software. This scenario applies to far more requirements than we had time to cover, but it was more than enough time to take a high-level look at three of the key PCI-DSS related tools we have to offer.

The first was XUA (XYGATE User Authentication) which provides logon controls via IP address, thus ticking the PDC-DSS 1.3.2 box: Limit inbound Internet traffic to IP addresses within the DMZ. XUA also provides far more functionality with the likes of LDAP-integrated Single Sign On, granular log-on control, time-related log-on restriction, full audit and more – not only providing extra uses, but also covering other PCI-DSS requirements including (but not limited to) 7.2, 8.1 and 8.5.13.

Following the theme of using one XYGATE solution to crack several different PCI-DSS nuts, were XSW (XYGATE Security Compliance Wizard) which is by far the best file-integrity/change-detection tool on the market and XMA (XYGATE Merged Audit) which chiefly consolidates and exports NonStop audit data and provides real-time alerts. XSW and XMA apply to a long list of PCI requirements, so if you’re just starting a PCI project, be sure to take a look sooner rather than later.

PCI-DSS is a fairly hot topic in Europe right now and Sean and I thought his presentation was well received at the time. Those thoughts were backed up a few days after the event, when the delegate feedback forms were returned, showing the XYPRO presentation to have scored the highest of the event – no mean feat when HP’s Mittal Parekh is in town – the man is so passionate he could talk about a paint drying process and I’d still be riveted!

It’s a VNUG tradition to have some sort of group activity on the evening of day two. This year’s was kept under secret until they’d got everyone herded into a large empty conference room: line dancing! I won’t deny that my heart sank when they first announced it, but I don’t mind admitting it was actually great fun – never thought I’d find myself saying that! I’ll also admit that it’s far more difficult than it looks!

The event drew to a close at around 3.30pm on day three, giving us time to reflect on a well attended and very friendly VNUG event. Our thanks to Tommy and the rest of the VNUG board for putting on another great conference. With 2011 being the tenth anniversary, they’ve promised us an even more memorable event next year – we’re looking forward to it already.

www.vnug.biz
http://blog.xypro.com/

Dan Lewis
XYPRO European Marketing Manager
Register today for the Global HP NonStop Symposium & Expo, 26-29th September - www.NonStopSymposium.com

In Memoriam: Lauren Uroff

2010-06-17T14:02:00.000-07:00

- Sheila Johnson, CEO

When professionals join XYPRO, we like to think that they are joining more than just a software corporation; they are joining a close-knit family. To be sure, it’s close to impossible not to get incredibly attached to the wonderful, talented people that comprise the XYPRO family. So, it is with great sadness that we had to say goodbye to one of our long-time XYPRO family members, Lauren Uroff. We are indeed in deep mourning, but at the same time, trying to celebrate the wonderful and rich life Lauren led. Over the past few weeks, we have heard so many touching and uplifting stories about Lauren—she simply made a positive, lasting impact on everyone she knew.

Kristie Rusk is one of the many people who Lauren deeply touched.
Below, Kristie offers her memories and tribute to our Lauren.

I’ve been an employee of XYPRO since 1987. I’ve been here longer than any other XYPRO employee, except for Sheila Johnson, our CEO. When I look back at these past 23 years, each year has it’s own “memorable moment” associated with it, some of them good and some of them bad. In 1994, we had the infamous Northridge earthquake and I have memories of us all ducking under the conference room table during aftershocks. In 2001, it was the 9/11 attacks while the ITUG conference was being held in Anaheim. We scrambled to find places for our customers to stay who were unable to fly home. In 2006, we had two “XY-babies” born within a few weeks of each other and two more babies were born in 2008. This year promises to have its share of good memories for XYPRO. But sadly, the one event that I will remember 2010 for is the loss of my co-worker and friend, Lauren Uroff.

Lauren joined XYPRO in 1992 as a QA Analyst and later that year, her husband Scott also joined XYPRO. They quickly became vital members of the XYPRO team. Together, they helped build the XYPRO Security products to become the leading edge products they are today. Lauren was intensely proud of her work. When we began to offer XYGATE classes here at the XYPRO offices, Lauren was key to the building and teaching of those class materials. She loved working with customers and if she met you, either on the phone or in person, she never forgot your name! As valuable an asset Lauren was to XYPRO, for me, she was one of my closest friends here at the office. Lauren and I shared many things over the years. We held down the fort by ourselves at the office while everyone was attending ITUG Conferences, we laughed in the lunchroom about the latest “news of the day”. Lauren was bright, witty, an avid reader, a seeker of knowledge – from the silly to the sublime. Our conversations ranged from deep and philosophical to arguments about who we liked better on “Top Chef”.

As proud as Lauren was of her work, her greatest pride was her family, her husband Scott and her son James. After James was born, she changed her status at XYPRO from full-time employee to that of an independent contractor, so that she could have the flexibility in her schedule to play an active role in his life. She spent many hours volunteering at his school and never missed a concert or karate practice. She was determined that he be a well-rounded and polite young man.

In 2009, Lauren was diagnosed with cancer. She worked from home as often as she could, but her presence at the office became less and less. In December, while preparing to come back to the office on a regular basis, we got the devastating news that the cancer had spread. Three months later in March 2010, we lost her.

It is sad to think that the newer employees here at XYPRO will never get the opportunity to know or work with Lauren. But, it helps to know that Lauren’s legacy will live on in the quality of the XYPRO products that she helped build, the customers who she helped support and most importantly in the lives of her family.

Kristie Rusk
-Vice President of Finance

Flat Screens, Light Bulbs and IBM, Oh My……

2010-05-10T08:10:00.000-07:00

For me personally, EBUG (European BASE24 User Group) is quite a significant event for two reasons. Firstly it’s EMEA’s premier gathering for anyone with an interest in BASE24 and other related ACI products. And secondly, because it marks my first year of involvement/employment in the HP NonStop field – the 2009 EBUG in Prague last year was my first day on the job!

The big talking point from last year was ACI’s announcement that BASE24 ‘classic’ would be phased out within a couple of years and its new collaboration with IBM. It’s safe to say that this announcement wasn’t greeted with the warmth that ACI had expected.

A year later, we’re in Madrid, Spain, and there was far less controversy. ACI had obviously taken its customer’s feedback on board and stances have changed and relaxed. Deadlines for BASE24’s ‘sun-setting’ have been extended and it’s now talked about as the end of ‘support’ for BASE24 classic, as opposed to the product itself. It’s no huge surprise that ACI was still keen for as many of its customers as possible to migrate to BASE24-eps, pointing out that over 20 customers have now made the switch.

From what I gather, the IBM situation hasn’t seen the exodus from HP NonStop that certain parties might have been hoping for – I may be wrong, but I don’t know of any HP NonStop users who have jumped ship to IBM. In fact, I dare say that ACI/IBM bringing hardware to the fore has actually resulted in a few NonStop Blade upgrades for existing HP customers. I can only see that as a good thing. But don’t go thinking that IBM has admitted defeat, would there have been a ‘stand of the show’ award, IBM would have won it with ease...

In the XYPRO booth there were less plasma TVs and halogen light bulbs, but that didn’t mean there was any less activity. Many thanks to all those who dropped by for a chat, to pick up product info and to enter their business card to win an HP Netbook. The drawing was held at the gala evening meal and was won by Attila Biro of Comparex, so congratulations to him!
Overall it was another successful EBUG event and we look forward to next year’s, which we hear will be taking place in Germany.
XYPRO’s next few European events are a one day BITUG SIG on 19th May in London and a much larger Viking NonStop User Group (VNUG) annual meeting in Stockholm during the last week the month. If you’re going to either, we look forward to saying hi and perhaps sharing a beer or two in the bar...

Dan Lewis
European Marketing Manager

Product Spotlight:SQLXPress

2010-04-22T10:49:00.000-07:00

SQLXPress Can Help You Manage Your HP NonStop SQL Databases

In November, 2009, we announced our strategic partnership with Merlon. Since that time, we have really enjoyed educating our customers about the beneficial tools Merlon offers.

In today’s blog, we’d like to highlight a tool that provides comprehensive support for managing large, complex database environments. The solution, SQLXPress, is an essential companion product for SQL/MX and SQL/MP.

Simplify with SQLXPress
SQLXPress supports all standard DDL operations, and offers several advanced features that are not available with the command line interface, such as compare data definition language (DDL), two-way object relationship browsing, multi-object commands and partition key data analysis.

SQLXPress offers benefits database administrators, software developers, quality assurance analysts and technical support staff. With SQLXPress, users can benefit from the following:

•         Simplified Database Administration

•         Improved Application Performance

•         Increased Productivity

•         Easy-to-use Modern Graphical User Interface

•         Simplified Data Browsing

•         Easy Statistics Management

To learn more about this sophisticated database management tool click here.

Or look for our upcoming webcasts that feature all of our database and security tools.

And the Winner is….

2010-04-11T22:05:00.000-07:00

The winner of XYPRO’s Events survey drawing is:

Michael Crispyn, Vice President
Group Manager, Tandem Online Systems
Fifth Third Processing Solutions, LLC

Scott won the $100 Gift Card drawing for filling out our recent survey.

As promised, here are the results of XYPRO's Survey about which upcoming shows our customers/prospects will be attending.
75% of those who responded are going to the NonStop Summit in San Jose
25% of those who responded are going to HP Tech Forum - Las Vegas

Anastasia Valentine asked: Lisa-how many in total responded?

Lisa Responded:
48 people replied, about which show they or people from their company would be attending, speaking on behalf of about 60 individual attendees.

6 additional responders didn't say which show because they weren't sure yet.
3 said they no plans to attend either show.

We had several international "Yes" answers - which is also encouraging.

A couple of interesting comments in the "free form" field - 3 people said they weren't aware that the NonStop event in September was happening due to the lack of marketing,
but they were all aware that HPTF was happening.

So those percentages match up with Ernie Guerrera's poll of his customer base, if I recall correctly.

So if roughly 70-75% of those going to a show are coming to San Jose, we just have to make sure enough people know about the NonStop event to consider it. So please pass the word around!

Product Spotlight:Encryption PRO

2010-03-29T09:24:00.000-07:00

Don’t Let this Be You!
As you’ve probably already heard, a hacker was able to break into the database of RockYou, which provides applications and services for social networking sites like Facebook and MySpace. This hacker obtained 32 million clear-text passwords! For whatever reason, the passwords of RockYou’s customers were not encrypted and were an easy target. RockYou is now encrypting all passwords and reviewing their current data security features to ensure that they meet industry standards and best practices. Of course, they’re undoubtedly wishing they would have taken this approach 32 million passwords sooner.

Protect Passwords with Encryption PRO
XYGATE Encryption PRO provides encryption for just about any type of communications between computer systems. These components enable you to encrypt interactive sessions, transaction sessions, file transfer sessions and databases or fields. Using software-based mechanisms, XYGATE provides encryption for not only HP NonStop servers and PC workstations, but also Unix, IBM OS390 and Z/OS, and many more....

XYGATE Encryption is the ideal solution set for protecting data in transit. A variety of components provide privacy for many types of sessions:

• Between your HP NonStop servers,
• Between HP NonStop servers and your PC workstations
• Many other platforms.

Protecting the privacy of data at rest is achieved via encrypting files and databases. XYGATE makes it practical to encrypt files for online storage, entire databases, or just selected fields that contain sensitive information. Learn more at www.xypro.com

XYPRO Recognized for Outstanding Support with Two Awards

2010-03-18T18:16:00.000-07:00

Thank you to everyone we visited at the recent SATUG. It was a pleasure to meet with all of you and we look forward to our future partnerships. We are honored to announce that XYPRO received two awards at the event. The first was for Outstanding Support of SATUG and the second was presented to our regional representative, Morne Conradie. Morne received an individual recognition award for his Outstanding Contributions over the years. Thank you to everyone involved, as we continually strive to exceed your NonStop security, compliance and encryption needs.

See you in the SUN!
Please visit us at the Sunshine Summit in Tampa, Florida.

SUNTUG Conference- Friday, 19 March 2010 at Embassy Suites
Tampa - Airport/Westshore - 555 N. Westshore Blvd. - Tampa Florida 33609 - 813-875-1555

SATUG and DUST 2010

2010-03-08T09:18:00.000-08:00

XYPRO is Gearing Up for SATUG!
The SATUG 2010 Summit & AGM will take place on the 9th and 10th March 2010, followed by a training session on the 11th. SATUG will take place at the Emerald Casino and Hotel Resort in Vanderbijlpark, South Africa, and XYPRO is gearing up for this wonderful event. Along with gaining and sharing critical user group knowledge, attendees will have the opportunity to discover the newest solutions on the market!

Also, join XYPRO at the next DUST meeting - Tuesday 16 March!
The next DUST Meeting will be held on Tuesday, March 16th, at CVS Caremark in Scottsdale, AZ. The continental breakfast sponsored by XYPRO will start at 8:30 am with the meeting starting at 9:00 am. Lunch is sponsored by ACI Worldwide and will be brought in after the meeting. NTI will be giving an HP Mini again and there will be other door prizes.

The presentations are:
User Presentation from Wells Fargo on security. Chris Draper will be showing some of the things WFB does on the Tandem: user/HR processing, personnel info in the SAFEGUARD profile, separation of duties, etc. Mark Hammett is a contractor at Wells and will be discussing an alternative implementation of XYGATE Merged Audit and how it could be used to full advantage to achieve PCI compliance.

Jim Bowers of ACI Worldwide will present ACI and HP - 35 Years of NonStop.

Network Technologies International will do a short presentation on the latest with NTI and DRNet and their customer trends for 2010.

Please RSVP to Cathy (480-766-5440 or cathy.meurer@usfood.com) for both the meeting and lunch.

From the CEO's Desk

2010-02-19T16:40:00.000-08:00

I hope everyone is getting a good start on 2010. We have received a large amount of positive customer feedback on our reseller relationship with Merlon and we thank you for that.

Traditionally at XYPRO, we begin each February with a week of Kick-Off sessions. All of us gather at our California headquarters to assess the previous year and set plans for the future. It’s a time of concentrated information exchange and collaborative brainstorming, with all teams participating ‘across all the aisles’. It’s an opportunity to discuss changes in the market and our customers’ needs. We go over feedback from customers and partners regarding current requirements and anticipate what security functions will be needed, both to meet future compliance regulations and to thwart security threats. A high priority includes looking at our products and evaluating how to improve and repackage them so that customers can easily purchase the modules that they need and use them to their best advantage.

There are a number of exciting activities afoot with us, some of which we can share, and some of which we need to keep secret for just a bit longer. What I can tell you is that we cut our first deal with a Neoview customer, so we’re now protecting a high profile decision support system built from the ground up on the most scalable and available data warehouse platforms.

After my last column, an HP press release announced enhancements to our favorite system, the NonStop Server. It quoted Diederick de Buck, technical architect for NonStop systems at Rabobank, who said that, “Rabobank looks to HP NonStop technology to handle our mission-critical financial services applications and help mitigate risks associated with virtual banking.”

As you might imagine, the best way to mitigate the risks associated with any online application is through the implementation of secure systems, secure networks, and secure applications. With NonStop as the foundation, all that remains is to protect your application and network communications – and we’re here to help you do that with products and consulting services.

The release also mentioned the new NonStop BladeCluster Express 1.2, which allows the creation of complex enterprise data center systems spanning a large geographic area and thousands of processors. Other enhancements include the capability for improved business decision-making by aggregating “islands” of information across an enterprise. Can you say, “cloud computing?”

While other companies are just starting to talk about the cloud, XYPRO customers, like a large travel booking site, have been building clouds out of NonStop servers for many years. And not just any cloud, but a scalable, available, and secure cloud. So when a C-level exec drops by and asks what you are doing about cloud computing, just point to your NonStop Servers and let him or her know that everything is under control.

In other news, a hacker was able to break into the database of RockYou, which provides applications and services for social networking sites like Facebook and MySpace, and obtained 32 million clear-text passwords. For whatever reason, the passwords of RockYou’s customers were not encrypted and were an easy target. Now that the horse has left the barn, RockYou has found religion and is encrypting all passwords and reviewing their current data security features to ensure that they meet industry standards and best practices. Do you have ENCRYPTPASSWORD set for your UserID file? Have you upgraded from DES to HMAC256 encryption? Call our tech support line if you want assistance with either of these.

And speaking of encryption, watch for our own Scott Uroff’s article in the next issue of Connection magazine. This article will describe the various types of encryption algorithms and how they work, point out the limitations when using specific encryption methods, and address how important it is for companies to use approved and certified encryption modules within their infrastructure.

To close, I want to mention that just like XYPRO, the US government also is working on advancements in data protection. The FIPS 140-2 Level 2 standard to which we certify our encryption products dates back to May 2001. This is one year after the Zero Latency Enterprise (ZLE) was first introduced and the same year that HP announced the merger with Compaq. This is pre-NonStop SQL/MX and well before Integrity NonStop. As you can imagine, we could not agree more that the standard needs to be updated and our cryptographers are already evaluating any changes needed to comply with this new standard when it is published next year.

Sheila Johnson

XYPRO to Sponsor & Present at MEXTUG

2010-02-04T13:41:00.000-08:00

XYPRO is muy entusiasmados to be sponsoring and presenting at the upcoming MEXTUG. The one-day event is scheduled for 24, February and will be held at the HP offices in Mexico City, Mexico.
MEXTUG is packed with informative, timely presentations, not only from product experts, but also users themselves. See Agenda

Here’s a sneak peak
An educational presentation on the Native NonStopSecurity provided by Guardian, Safeguard and Atalla.
A representative from Raymond James will explain how they currently comply with HP NonStop security requirements, and future plans going forward.

A representative from Banorte will give a presentation on their successful experience monitoring & controlling of their operational environment as well as their ATM & POS network.

Attendees will also have the chance to participate in an interactive survey about future MEXTUG content.
Last but not least, XYPRO is sponsoring the raffle. Attendees have the chance to win an HP NetBook (must be present to win)—so be sure to register! View Agenda.

Lisa Partridge

Product Spotlight: Access PRO

2010-01-28T12:58:00.000-08:00

Software that Addresses Your Auditing Concerns

How happy would you be to be able to solve NonStop PCI Requirements 7, 7.1, 7.2, 8, 8.1, 8.2, 8.5, 8.5.6, 8.5.8, 8.5.15, 8.5.16, 10, 12.3.8, and 12.3.9,with a single package from XYPRO?

XYGATE Access PRO software was designed with the fundamental HP NonStop security requirements in mind and addresses those issues most likely to concern an experienced security analyst or auditor as well as being required by compliance regulations.

Why Access PRO?

XYGATE Access PRO provides you with the following:

Individual accountability, restricting each user to authorized actions based on that user's job function, all without the use of any shared user ids.
Auditing as detailed as you need it to be (down to the keystroke)
Logon to logoff session controls and load-balancing
A convenient single spooler and peruse utility with advanced security and archiving functions.

Passing your audits will become a routine experience. Users will have the access and privileges they need to do their jobs, increasing resources available to focus on other areas that also affect profitability.

Detailed benefits of XYGATE Access PRO and the entire suite of XYGATE Security and Access Control software are highlighted in the free solutions papers available on our website: “PCI Compliance”, "SOX Compliance " and "HIPAA Compliance ". Visit www.xypro.com

Overwhelmed with PCI reporting requirements? XSW (part 3 of 3)

2010-01-25T08:03:00.000-08:00

PCI compliance requires a diverse set of specific checks and reports on many different parts of an HP NonStop system; databases, security access, application models, networks, encryption, users, and so on. Manual HP tools each have unique export formats; some in a report-type format, but most as unstructured text, which is usually helpful at all. In fact, trying to create manual PCI reports for an HP NonStop system is a recipe for losing your hair!

Using XYPRO’s Security Compliance Wizard (XSW) you can load this diverse data into a consistent and query-able format, cutting PCI reporting down to size. XSW can then be used to create PCI reports in a standard printable format, regardless of whether the data concerns Users, Safeguard, disk files, PATHWAY, OSS files and directories, SQL/MX or Network information.

To start off, XSW provides you with over a hundred standard PCI reports and cross-references the PCI naming conventions to HP NonStop terminology, making it easier for you to complete the PCI reporting task. For cycles of compliance, as required for PCI, XSW automatically provides this service and gives consistency to the reporting and checking. So save your hair and time and get XSW!

-Ellen Alvarado
NonStop Security Specialist

Powerful software for managing disk resources on HP NonStop servers

2010-01-15T14:46:00.000-08:00

In November 2009, XYPRO announced its strategic partnership with Merlon Software Corporation of Toronto, Canada. This partnership has already proven successful and we are very happy to be aligned with a company that provides the NonStop community such effective products.

XYPRO represents Merlon’s database management software solutions on a global scale, and today we would like to highlight their disk management solution, Discover.   Discover provides a safe and efficient mechanism for monitoring disk resource usage on HP NonStop servers. It replaces manual methods of tracking disk and file growth, reduces the risk of human error, and frees up operations and support staff for other tasks.

Why Discover?
Most applications depend on the availability of sufficient disk space in order to function correctly. If a disk volume becomes short of free space, an application may not be able to allocate the disk space required in order to continue running.

In addition, individual disk files may only grow to a pre-configured size. If an application continually adds new data to a file it will eventually encounter a "no space" error condition - even if there is free space available on the disk.

Either of these situations can cause part, or all, of an application to become unavailable. Discover enables you to avoid these conditions by taking corrective actions before they occur.

Discover continuously monitors disk and file usage, and predicts potential disk full and file full conditions before they occur. You can configure Discover to automatically invoke corrective actions, or to alert an operator that manual intervention is required.

Discover’s key features include the following:
•   Prevention of application outages due to disk or file full conditions
•   Continuous monitoring of disk utilization
•   "SpaceMaker" technology for improved disk space allocation
•   File attribute monitoring
•   Automatic reload of key sequenced files
•   User disk space quotas
•   Corrective measures initiated automatically
•   Comprehensive reporting
•   Worksheets
•   Discover Utilities
•   The Recycle Bin
•   Backup and Archive Support

In addition, Discover is work-flow oriented. It organizes "action items" which are required in order to ensure the availability of your data. You can learn more about Discover and all of Merlon’s products by clicking here.

-Lisa Partridge

Use XSW create Safeguard access reports

2010-01-07T19:44:00.000-08:00

(part 2 of 3)
If you are trying to make sense out of your tens of thousands of Safeguard records and ACLs, don’t expect Safeguard to help you. There is no HP tool that provides any level of extraction, except streamed text, and none to analyze access maps from Safeguard.

Using XYPRO’s Security Compliance Wizard (XSW) can create Safeguard access maps in minutes! XSW can generate Safeguard access maps for users or user groups and the access that is granted or denied across Safeguard ACL types, including patterns. These reports are a primary requirement of PCI, SOX and HIPAA.

-Ellen Alvarado
NonStop Security Specialist

MRTUG, NENUG, SCTUG, RMTUG and DUST

2009-12-31T08:55:00.001-08:00

XYPRO representatives recently attended MRTUG, NENUG, SCTUG, RMTUG and DUST. At DUST, we presented “You Cannot Be PCI Compliant without XYGATE”. Interest in security remains high in the NonStop space, and while presenting at these three user groups, we were fortunate to have interactive discussions with everybody in attendance. Many open questions and discussions took place, which is the primary intention of user groups. Overall, attendance has been as expected, i.e., vendors have outnumbered users. We are happy to see optimism from the users, vendors and HP involving NonStop Blades, based upon the number of customers upgrading.

We believe it’s vital for the NonStop community to continue to have these types of meetings. Going to the user gives a broader group of people a chance to participate in learning what is going on in the HP NonStop space. Furthermore, the Connect meeting next fall should bring a sense to the community that HP still values the NonStop and users. It will not have the feeling of being shuffled in with everybody else, which is the impression many got when including this event with the HP Technology Forum.

Unfortunately, SCTUG was not very well attended with a ratio of 5 to 1 vendors vs. customers. We did, however, have some very good side conversations with the customers. We will be presenting at the next SCTUG which sounds like it will be at the end of March.

On the other hand, the RMTUG meeting in Denver had the biggest turnout we have ever seen. There were several current customers as well as some new faces and companies that we have not heard of, which is great to see.

In all of the meetings, we have chatted with folks about the “ITUG” that will be happening in September and it is like a big revival and everyone is excited again that there will be a Non-Stop conference again in San Jose!

Jay Price
Kevin Boham

BITUG: A “HOME GAME” for XYPRO

2009-12-16T11:48:00.000-08:00

After a run of recent European RUGs, visiting places like Madrid, Frankfurt and Stockholm, it was nice for XYPRO’s very busy European office to play a home game and visit a NonStop event that didn’t involve any air travel. In fact this year’s BITUG (British Isles Tandem User Group) Big SIG, held on the 2nd and 3rd December, was just half an hour from XYPRO’s London office.

Day one was a CLIM-themed education day, held at HP’s offices. Day two was the main event and the location was the magnificent Grade I listed, Crown Estate owned, Institute of Directors building on Pall Mall. A walk up the grand staircase led the 196 attendees (103 Non-Stop specific attendees including 40+ NonStop specific end users) up to the first floor, virtually all occupied by the Big SIG/Connect event. The largest room in the building was home to the vendor exhibition and also doubled as the coffee and dining room. The vendor room was slightly smaller than usual, and so space was limited. The 20 exhibitor spots went quickly, on a first-come-first-served basis, leaving a few NonStop Vendor Partners disappointed.

Those who weren’t disappointed were the attendees, who received free entry if they were BITUG members. The vendors didn’t have much to complain about either, with only modest, non-profit fees to pay.

With XYPRO having had its UK office open for well over a decade, the Big SIG was a great opportunity to catch up with many of our British customers. Because there was a BITUG Security SIG earlier this year, there was no specific presentation from XYPRO. There hadn’t been a BITUG Performance SIG in 2009, so a good portion of the vendor presentations were performance based. With five different tracks available, the day was packed with opportunities for all of the attendees.

After a great day with a very friendly atmosphere, it was very nice to have time to visit an English pub before the short journey home, rather than trekking to an airport departure lounge!

For those looking forward to the next BITUG event, the first of around five BITUG SIGs planned for 2010 has a system modernisation theme and the date is 17/02/2010.

For more information on BITUG and its events visit www.bitug.com

Dan Lewis
XYPRO

From the CEO's Desk

2009-12-10T13:15:00.000-08:00

It’s that time of year again. What this really means to you depends on your location and your culture. It might be the middle of summer, a time to bring gifts, a time to relax a bit while your systems are locked down, or a time supporting record high end-of-year transaction volumes.

Speaking of systems, this year is the 35th anniversary of the first Tandem T16 computer, later called the NonStop I. Its 96 kilobytes of main memory and 700 KIPS (thousand instructions per second) bit-slice processor were as impressive then as the current generation NonStop Blade Servers are now, with 48 gigabytes of main memory, 18 megabytes of level 3 cache and 1.66 GHz dual-core Itanium® 9100 series processors.

The first NonStop systems were designed with a few basic principles: modularity, fault tolerance, fail-fast of individual components, and online maintenance. In 1983 XYPRO was formed to develop products for this excitin’ new machine (as Tandem’s founder, Jimmy Treybig, would say) and in 1984 we were named as one of the original Tandem Alliance members. The photo shows Jimmy with XYPRO’s founder, Dale Blommendahl, at an ITUG Summit some 20 years ago.

Since then, neither company has rested on its laurels, both expanding worldwide and supporting some of the most mission critical applications at some of the world’s largest and most prestigious organizations.

While XYPRO’s headquarters is in sunny southern California, our employees are as diverse as our customers. At last count, people from 13 different countries work here. But no matter where we are from or what we believe, the holiday season is the time of year when many of us take some time off to spend with our families, recharge our batteries and ring in the new year. Even so, we will have enough people on hand to support you 24x7 just as we do the rest of the year. Because even when our staff or your staff are on holiday, we know that your NonStop servers are still working around the clock.

Along with work, Decembers at XYPRO include a contest. Each person decorates their office door to reflect how they celebrate. Historically, the halls have been decked with doors made to look like a gingerbread house, a fireplace, a New Year celebration in India, and an ice skating scene. Over the years, we’ve seen themes executed with hand-made dreidels, a brightly lit cactus, snow babies, and even Christmas stockings arranged to represent ‘SOX Compliance’. And Scott Uroff, our Chief XYGATE Engineer, is also known for decorating our NonStop systems.

In addition to an annual holiday lunch and gift exchange, we traditionally take time to reflect on the rewards we receive throughout the year, from our co-workers as well as our valued customers. And as much as I would love to unwrap some of our biggest customers to show them off, I’m afraid those packages will have to remain sealed. Companies whose products are used to protect some of the most important secrets in the world sometimes need to stay under the radar. What I can tell you is that XYGATE users are all in very good company, amongst a customer base of international leaders in government and private industry.

If you want to rub shoulders with these leaders, you don’t need an invitation. Nor do you need to be cleared by the Secret Service. Simply attend one of the dozens of TUG or Connect meetings around the world and you can take advantage of the personal interaction that we love so much.

For example, XYPRO was present at the Connect Germany / GTUG IT Symposium in Darmstadt, celebrating the 35th Anniversary of NonStop and at the prestigious Institute of Directors premises in Pall Mall, London for the BITUG Big SIG meeting. If you were at either event, you would have seen us talking to some of the biggest names in Europe. Some of each event’s highlights are captured at http://blog.xypro.com/.

But we don’t want to forget other parts of the world. Recently, XYPRO has been at meetings in the United States, such as SCTUG in California, DUST in Arizona, and SunTUG in Florida. We also paid a visit to our neighbors to the north at CTUG in Toronto. It’s not too early to think about booking travel to SATUG so that you can rub shoulders with the leading companies in South Africa – who also happen to be our customers!

I would like to close this message with a request. We wonder what family or work traditions you find meaningful and what you like to do when you take time off of work. We would love to hear from you in the comments section. Take as much space as you like to let us know about what’s special to you this time of year.

Sheila Johnson

GTUG

2009-12-02T21:12:00.000-08:00

The 2009 German Tandem User Group (GTUG) was held November 18-20th, and the idea behind this event was a sound one: Take the traditional GTUG event and open it up to all of Europe, meaning more vendors for the end users to talk to and vice versa.

The ten different conference tracks (nine in English and one in German) ensured that there was plenty going on for the 150ish people attending. Most of the content was NonStop based, but with the Connect link, it did mean that some elements weren’t relevant to us NonStop folk. The exhibition section was somewhat of a who’s who in the NonStop vendor world, with around 15 different firms all lined up with their matching shell schemes. A visit to the XYPRO booth revealed this was the first event where XYPRO and Merlon’s new collaboration was evident (see https://www.xypro.com).

With this year being the 35th anniversary of Tandem, there was an interesting mix of content. You’d be sitting in one talk where everyone was reminiscing about the ‘good ol’ days’ when Tandem did everything very differently and how being different was best... then you’d find yourself in an HP presentation where they’d be talking about the many benefits of utilizing as much industry standard blade hardware as possible. One thing is for sure, a modern day NonStop is spectacularly smaller and more powerful than its early Tandem predecessors. The best presentation was just before the coffee break on Thursday though: XYPRO’s Audit, Alerting and Compliance slot!

I attended Karen Copeland’s NonStop Security SIG before lunch on Thursday and was a little surprised by the low number of attendees – maybe 12 of us in total? I’m thinking there could be two explanations for this, the first could be that Bernd Ullmann’s “SCRUM - Do's and Don’ts” presentation was unmissable (nothing personal, Bernd) the second could be that for many, security only really becomes a serious issue when a breach threatens to cost millions of dollars or when a regulator demands action... Whatever the catalyst, you know where to find us.

Thursday evening promised a ‘traditional beer bust at a Darmstadt brewery’. The XYPRO team was bracing ourselves for a heavy night of beer lairyness, so we made sure we’d all packed our drinking hats before we got on our respective planes. But the reality was more ‘dinner in a pub’ than ‘beer bust in a brewery’. Not that I’m complaining, because I wanted to be in good shape for the Security Workshop on Friday the 20th.

Big key-note sessions aside, Friday’s Security Workshop was one of the more heavily attended group meetings of the event, with around 20-25 people. The four vendors present, XYPRO being one of them, had all agreed to give talks which were 100% devoid of product mentions. Everyone stuck to this, but my personal opinion is that it occasionally served to confuse, as it seemed to leave a couple of people with more questions than answers. All in all though, it was a very useful session and worth staying the extra day for.

Our Friday afternoon flight back to the UK signaled the end to a busy couple of days at what was probably the biggest NonStop event in Europe. Hats off to the organizers who had clearly put a lot of time and effort into arranging a very well run show.

Dan Lewis
European Marketing Manager

From the CEO's Desk

2009-11-18T13:54:00.000-08:00

Thanksgiving was celebrated last month in Canada where it is also called Jour de l'Action de grace and represents the end of the harvest. In the United States, we celebrate in November and give thanks to the Native Americans for keeping the English colonists from starving in the dead of winter.

The end of October saw us wrapping up two weeks of classes on the topic of NonStop security in our southern California office. Professionals attended from Malaysia, Mexico and the USA, representing manufacturing, energy and financial companies. Both our Securing Your HP NonStop Environment with Safeguard and XYGATE and the follow-on Comprehensive HP NonStop Security courses were sold out, confirming that protection of corporate information is essential, even in a down economy.

We enjoy hosting customers in our office because, like our products, it supports our mission of contributing to the protection of corporate information on the computing platform that outperforms all others. Furthermore, our education program gives our developers and technical staff a better feel for what it is that our customers need to make them successful. We welcome the partnership that results from direct interaction and exchange of information with our customers and fellow vendors and hope you find it as rewarding as we do.

Speaking of partnering, and Canada, we recently took another strategic step forward by signing an agreement with Merlon Software, based in Toronto. The agreement entitles XYPRO to represent Merlon’s products worldwide. This was a serious decision for us, and we found the business case is compelling.

Where XYPRO is aimed at protection of data, Merlon focuses on database management. Merlon’s products allow you to automate management of your file and disk space, monitor and correct database degradation, analyze key-sequenced files for proper partitioning, and increase your productivity when working with SQL/MP and SQL/MX tables. And just like many XYPRO products, Merlon products allow you to manage and monitor your NonStop server from a graphical user interface on a PC, freeing you from the drudgery of looking up commands and syntax that you might use only once in a great while. In sort, this partnership helps you do more with less, and with a lot less stress for you and your staff.

Our companies have in common a dedication to excellence in customer service and the ability to build products that improve efficiency, productivity and performance in today’s complex IT environments. This partnership represents a natural progression for both companies and a great way to bring more value to the NonStop user community.

In the spirit of Thanksgiving, I would like to express my gratitude to all of our wonderful employees and partners for their dedication to making XYPRO a leader in the industry and a great place to work. And a special Thank You goes to all of our customers too, who have put their security needs our hands.

Happy Thanksgiving everyone!!

-Sheila Johnson

Auditing the HP NonStop Server: Stop the Bad Dreams!

2009-11-11T12:16:00.000-08:00

Ever had a bad dream about an upcoming audit? The one in which you’re told you must be prepared to assist the auditors? The HP NonStop Server is not familiar territory to many auditors, which can cause a lot of anxiety for them and you. Moreover, there are times when an auditor must tackle the audit of a NonStop server immediately, without adequate time to read the appropriate reference manuals: HP NonStop Security: A Practical Handbook, Securing HP NonStop Servers In An Open Systems World: TCP/IP, OSS and SQL and The Security Management Guide. You may have read them, or looked up a topic or two – but you probably don’t know them by heart, which only adds to your stress level.

You are not alone. The following is intended to help you educate your auditor, and lead you toward gathering the pertinent information that will be needed to conduct the audit—so you can say goodbye to your bad dreams!

The Basics
Security on the NonStop server starts with the operating system, Guardian. Guardian provides a basic level of security that deals with users and diskfiles and provides limits on the READ, WRITE, EXECUTE and PURGE operations. Users in system management, operations, security, and change control generally deal with Guardian environment using the TACL command interpreter program. Guardian supports the OSS ‘personality’ which is a UNIX-like extension that can be used in place of the TACL environment using a program called OSS Shell or osh.

Safeguard is the HP supported security system that can be used to manage users, object access control lists (ACLs), auditing and security event exit processes (SEEPs). XYPRO’s proven products allow for easy use of Safeguard to manage users and object ACLsand for use of SEEPs to significantly extend Safeguard functionality. Many companies in all industries around the globe use these products to not only reduce stress but to also boost security administration accuracy and productivity.

$CMON is an optional Guardian extension that allows for control of the logon operation and the program run operation. It does not require Safeguard to be used. $CMON must either exist on the NonStop server or there must be security controls to prevent its use.

Users are given access by creating Guardian or Safeguard userids. Guardian is no longer recommended because it does not support many features available in Safeguard, most important of which is Password Expiration. Userids are specified as a groupnumber, usernumber and as a groupname, username. The groupnumber is between 0 and 255 and once the first user has been assigned to a group, the groupname will be set for all userids in the group. The usernumber is between 0 and 255, and the username must be unique within the group. There is one userid that must be on the system: 255,255, which is usually called SUPER.SUPER.

For More Info:
You can view the complete article highlighting the questions and answers surrounding some of the most common problems found on the HP NonStop server by emailing lisap@xypro.com , enter “Audit NonStop Server” in the subject line.

When a more thorough audit is planned you may want to consider using a checklist where each Security Requirement is clearly identified, and the sources of such requirement are provided. You will find a complete checklist on https://www.xypro.com//. If you follow it closely and are able to “check” every item…you may find yourself PCI, SOX (Cobit), HIPAA, and SB1386 compliant and happy to invite your Auditor in. Isn’t that a dream?!

Lauren Uroff
XYPRO Technology Corporation

XYPRO® Announces Strategic Reseller Relationship with Merlon

2009-11-04T08:27:00.000-08:00

Los Angeles, Calif. (4, November 2009) XYPRO Technology Corporation, a leading provider of security software for HP NonStop™ Server environments, today announced a strategic partnership with Merlon Software Corporation of Toronto, Canada. Effective immediately, XYPRO will represent Merlon’s database management software solutions on a global scale.

“XYPRO offers a superior security solution set for businesses running on HP NonStop servers. With Merlon’s expertise and comprehensive offering in database management on the same computing platform, this partnership made complete sense,” said Rick Pettifer, CEO at Merlon. “XYPRO is a leader in the NonStop space, offering worldwide distribution channels as well as unmatched customer service to every client around the globe. With economies of scale, this really presented itself as a natural progression and a great fit for both of us.”

“Merlon products provide companies who rely on NonStop servers for storing and processing vast amounts of data with the means to efficiently administer even the most complex database environments. Demand for these solutions is high because they introduce operational simplicity and consistency vital to strengthening productivity and performance,” said Sheila Johnson, CEO at XYPRO. “We are very pleased to offer their unparalleled database management solutions. By partnering with Merlon, we can offer our clients a more robust portfolio of solutions to address their mission-critical needs.”

Successful Security SIG

2009-10-28T21:37:00.000-07:00

Thursday the 8th of October saw XYPRO’s British contingent (Sean and myself, Dan) heading to London for the fourth British Isles Tandem User Group (BITUG) Special Interest Group (SIG) of the year – the subject matter being very close to our heart: security.

The location was Hewlett Packard’s Wood Street offices in Moorgate, central London. If you’re a fan of Google Earth and ever find yourself visiting those offices, make sure you take a quick trip up to the top floor in one of the glass elevators – you’re assured a great view! Back to business: HP deserve a special thanks for providing their facilities, food and refreshments.

The day started off with a Connect/GTUG update (event in Germany on 18th and 19th November, with optional Security Workshop on the 20th). The two day conference element appears to have a feature-packed schedule of around seven different tracks. For any non-German speakers considering a visit, just one of those tracks is in German, so the vast majority will be in English and ideal for international visitors. We’ll update the XYPRO news feeds as soon as the schedule is completed.

Next up was an HP Security update from Iain Liston Brown who covered several products, including the use of XYPRO’s XYGATE Merged Audit (XMA) when using HP’s Compliance Log Warehouse (CLW) with NonStop servers. This was followed by an interesting presentation by James Tomaney of Barclays. Most of the ears in the room pricked up when he broached the successful move from IBM to NonStop for Barclays’ ATM network.

The afternoon saw three vendor presentations, including XYPRO’s Audit in the Enterprise. An interesting point raised was the submissions made to the DataLoss Database website, point your browser toward http://datalossdb.org/ for some rather alarming reading.

Last up was Ron LaPedis’ Volume Level Encryption presentation, exploring the various potentials for NonStop data loss and what can be done to prevent the loss and/or encrypt the data.

It was a shame that the PCI Qualified Security Assessor (QSA) had to pull out of his presentation, as I’m sure that would have made for some useful information, but that didn’t take anything away from what was still a very useful day. Fingers crossed we’ll revisit the subject of PCI compliance on NonStop in a future event – the next one being the BITUG ‘Big SIG’ on 3rd December in London (and education day on 2nd).

With the Security SIG now out of the way, the BITUG team will be turning their attention to dotting the Is and crossing the Ts on the Big SIG plans. Keep your eye on the XYPRO news feeds (LinkedIn, Facebook, Twitter, XYPRO.com etc.) and www.bitug.com for more info.

Dan Lewis
European Marketing Manager
XYPRO Technology Corporation

Stockholm Calling

2009-10-21T22:17:00.000-07:00

The last four months of 2009 sees a relative flurry of activity for the NonStop community in Europe. The first of six different outings in the space of three months started with the Viking NonStop User Group’s (VNUG) annual event. This year it was held in Sweden at the Vidbynäs Slott golf hotel in Nykvarn. That’s about an hour from Stockholm, or more like an hour and a half if you had our taxi driver, whose aptitude for navigation was matched only by our grasp of Swedish - what goes around comes around I guess!

This is XYPRO’s sixth visit to the well run and very friendly VNUG event, which has never been held in the same location twice and switches between Finland and Sweden – sometimes literally, as was the case of the ferry-based conference a couple of years ago!

Day one (28th September) was an optional education or golf day. The accredited education (Troubleshooting in the NonStop OSS Environment) was provided by HP at its Solna office and the golf was on the very picturesque course next to the conference hotel. We were unable to attend either this year, arriving late in the evening on the 28th, but on talking to the golf participants in the bar, it sounds like we were spared a tough afternoon of searching through aggressive rough and the loss of several balls to tricky water hazards!

Days two and three (29th, 30th September) saw the conference proper. A busy agenda of eight vendor presentations, two slots from HP (interesting to hear about the launch of quad core blades in 2010/2011) user presentations, and an HP Q&A session.

XYPRO’s PCI compliance and enterprise auditing presentation was scheduled in for just after lunch on the 29th. That turned out to be great timing, as everyone left lunch in an upbeat mood after having had some very good food.

Later that day saw all participants divided into teams for the VNUG competition. This involved walking the Vidbynäs Slott grounds answering NonStop-based quiz questions. An expertly timed beer stop after question four ensured everyone had enough lubrication to complete the full ten questions without any hardship. Proving that my team was paying full attention during the day’s presentations, I found myself in the joint winning team (9 out of 10 correct) and recipient of a rather splendid chopping board and carving kit – which later resulted in a fine from British Airways for overweight baggage, but that’s a different story! More great food and wine at dinner set the scene for a good evening of business networking and competitions in the pool lounge upstairs...

Day three picked up where the conference part of day two had ended. HP’s NonStop Programs Marketing Manager, Diana Cortes’ update made for some interesting viewing, including news of the Connect Global NonStop Summit being planned for October or November 2010 in California – exact details are still being finalised. The conference came to an end mid afternoon on the 30th, with presentation of various vendor and VNUG competition prizes – congratulations to Esa from Nordic Processor who won XYPRO’s prize, a wireless iPod dock.

Our thanks to Tommy Johansson and everyone at VNUG for putting on another excellent event. We’ll hopefully see you again in December for the unofficial ‘VNUG Christmas Beers’ I was talking to Sami about! Failing that, we look forward to VNUG 2010.

See the XYPRO calendar for all upcoming European and global events we’ll be attending.

Dan Lewis
European Marketing Manager
XYPRO Technology

Use XSW to save time and money for HP NonStop file reports and compliance

2009-10-14T18:54:00.000-07:00

Part 1of 3

Why would you even think of using DSAP for PCI, SOX, HIPAA or other security compliance reports? Yes you can create DSAP reports on HP NonStop Guardian files, such as PROGID, LICENSE, files greater than some size, security settings or owners, but killing hours and hours of your time. Creating these reports for a just a single node would take hours and what you would have is a pile of useless paper! I feel sorry for the wasted trees.

Using XYPRO’s Security Compliance Wizard (XSW) can save you all that grief and time to generate PCI, SOX, HIPAA or other security compliance reports. Don’t waste your time! XSW can automatically create these custom reports for you in minutes, instead of hours or days. In addition, it can be streamlined to identify only changed files, thus saving many hours of analysis work. XSW can collect from multiple systems and generate combined reports from the multiple systems, something you just can’t do with any other tool.

- Ellen Alvarado
NonStop Security Specialist

How to Resist a Dictionary Attack:

2009-10-07T14:06:00.000-07:00

Password Quality is Key
If you’re a security or network administrator, then you probably already know that withstanding a dictionary attack is a common security requirement. For those who may not know, a dictionary attack refers to the general technique of trying to guess some secret, usually a password, by running through a list of likely possibilities, often a list of words from a dictionary.

So, what type of password can resist a dictionary attack? Well, one that is not a word that can be found in any dictionary, of course! Simply put, the best defense against a dictionary attack is a strong password composed of a combination of different types of characters.

Password Quality is Key!
Password quality is so critical that it is a PCI compliance requirement. Further, password quality plays a key role in resisting even a brute force attack because password cracking programs, used for such attacks, work by applying all the common variations of every word in the dictionary. They generate character sequences working through all possible one-character passwords, then two character, then three character, etc. The variations of words are encrypted and then the resulting hashes are compared to the hashes in the password file being cracked. If the hashes match, the password is known

Our Solution
XYPRO’s Password Quality (XPQ) software has helped numerous users effectively resist a dictionary attack. XPQ provides a wide range of password strengthening techniques, forcing users to create passwords that are able to withstand a dictionary attack. XPQ can be configured to require the following of users when creating or changing their passwords:

• Include both upper and lower case characters
• Include special characters in the password
• Include control characters in the password
• Include letters and numbers in the password
• Do not include any part of the user’s logon ID in the password
• Use password length of up to 64-characters long

What’s more, the rules can be mixed and matched to meet any site’s password quality requirements. Along with a minimum password length, periodic password expiration, and password history tracking, passwords created with XPQ-enforced rules would be virtually unbreakable via a dictionary attack.

In addition to enforcing Password Quality rules, XPQ offers yet another approach to withstanding a dictionary attack – generated passwords. If XPQ is configured to take advantage of this function, the generated passwords always match your configured quality rules and, therefore, are not vulnerable to a dictionary attack. Because many dictionary attacks target privileged userids such as SUPER.SUPER or the application owners, companies could establish a policy of always using generated passwords for their privileged userids.

The Proof is in the Numbers
The table below shows the amount of time* a successful brute force attack takes, depending on the combination of characters used in the password.

*The numbers should not be interpreted as actual time. The speed of the attack depends on multiple factors including computing resources, password encryption level, etc. However the table is a good illustration of how important enforcing password quality rules is for brute force attack resistance. Source for statistics and calculations: http://geodsoft.com/howto/password/cracking_passwords.htm

As the table shows, cracking a “simple” seven-character password would take 22.3 hours, while the same seven-character password composed of mixed case characters extends the attack time to 3.91 months. Adding numbers and symbols to the password, extends the time needed to process all possible combinations to more than two years. So, if a password is also changed regularly, this can mean an extended state of security against an attack.

Bottom line: Don’t let your system and critical data be left vulnerable to attack due to easily decoded passwords. Maximize XPQ to keep your passwords up to par!

Want to learn more? Visit us at www.xypro.com

From the CEO's Desk - September 28, 2009

2009-09-28T16:16:00.001-07:00

From The CEO's Desk

For many years, XYPRO's security and compliance solutions have been the choice of leading organizations using the NonStop server. While I have met many of you at TUG meetings and Connect events, these venues are too few and far in between to support frequent discussions. So, XYPRO is in the process of opening up several new channels of communications that we believe will let us keep in closer contact with you, our customers and partners.

We are announcing our LinkedIn group, facebook, and if you want something a bit more real time you can follow us on Twitter. The intent of these channels is to let us provide timely general information to our customer base.

We know that resources are especially tight these days and we want to ensure that we are providing value to our customers in everything that we write. To this end, I am pleased to announce that XYPRO will be publishing several blogs on a regular basis. You can sign up for one or for all of them and our RSS feed will notify you when an update is available.

In From The CEOs Desk, I plan to talk about topics of general interest to the NonStop community around security, blades, cloud computing, virtualization, and compliance. This column will be published every month.

The Voice of the Customer will invite guest authors to talk about their challenges and how they have worked to meet them. It will cover real-life stories and real solutions. It may be edgy at times, and customers who cannot speak freely may be published anonymously. If you wish to submit an idea for a customer or topic, or you are a customer with a topic in mind, please send me an email. This column will be published monthly.

The third column we plan to publish should be a very interesting read. Based on the volume and kind of questions that our technical staff receives, they will be putting together a Tips and Tricks column which should increase your productivity and success in meeting your company’s security and compliance goals with XYPRO products. If there is something you just can't figure out, or want to know if there is a better way to perform a function, this column is for you. It will be published monthly as well.

Finally, XYPRO will participate in many upcoming TUG and Connect events. Some of these are CTUG, DUST, GTUG, INUG, SunTUG, VNUG and the BITUG Security SIG. Our updated events list is always available here.

Historically, TUGS have had some pretty interesting names and to launch this column properly, we're holding a contest. Anyone who sends me an email before October 30th, with the correctly expanded names of the TUGs listed above will be entered into a drawing for a USB encrypted memory stick. Due to US regulations, this contest is not open to government employees in any country.

Talk to you soon!
Sheila Johnson