Tag Archive for SYMC

Symantec Sold

Updated 01/08/2020 – Broadcom is selling off parts Symantec less than 2 months after closing the deal. Reports have consulting giant Accenture buying Symantec’s Cyber Security Services unit for an undisclosed amount.

Under the deal, Accenture will take over Symantec’s global network of six security operations centers located in the U.S., the U.K., India, Australia, Singapore, and Japan. The SOC’s provide threat monitoring, analysis, and incident response services. Accenture says it will use the Symantec business unit to boost its managed security services.

Updated 09/17/2019 – As predicted below, Symantec has started slashing jobs. According to reports, up to 230 Symantec employees will be terminated on October 15, 2019.

Symantec SoldI could have saved a bunch of people a bunch of money– IF you had read this post – you would already have a doubt about this deal – before professional prognosticators Forester said the same thing on August 9th. In their report analyzing the deal, the market researcher cited Intel’s 2010 acquisition of McAfee and subsequent $3 billion loss spinning the security company to private equity in 2016. They said the deal should serve as a warning to CISO’s about the future of Symantec’s product portfolio under Broadcom. Well NO DUH

Broadcom (AVGO) has acquired Symantec‘s (SYMC) enterprise security business for $10.7 billion in cash. The two firms consummated their hot-and-cold bromance M&A discussions in writing today (08/08/2018).

Symantec logoThe deal is expected to bring in over $2 billion in annual revenue for the San Jose, CA-base firm. Broadcom intends to fund the transaction with proceeds from new committed debt financing. The transaction is expected to close in Q1 of Broadcom’s fiscal year 2020.

Broadcom, historically a semiconductor business has been on an M&A tear in the past few years, buying its way into a broader market position. First, with the 2016 – $5.9 billion purchase of network equipment vendor Brocade. Next was the 2018 – $18.9 billion acquisition of CA Technologies. Followed by today’s $10.7 billion pick-up of Symantec. In the presser Broadcom CEO Hock Tan called the Symantec purchase, “... the next logical step in our strategy … expanding our footprint of mission-critical infrastructure software within our core Global 2000 customer base.

Broadcom logoRumors of the purchase first appeared in the press on July 03, 2019, with “advanced talks” happening on July 15th for purchase all of Symantec for $22 Billion, but by July 15, Symantec had reportedly walked away from the table. Reports (which appear to be true) at the time were that Broadcom was after just the enterprise-cybersecurity software business; leaving the consumer the business as an independent company or a spin-off to somebody else.

ChannelE2E says the potential deal makes sense on paper. Broadcom is known for acquiring struggling or slow-growth enterprise technology businesses, stripping out costs and boosting profitability. They explain that Broadcom’s secret to M&A success is clearly communicating staff reduction plans to acquired businesses, investors, and associated end customers. Broadcom is known for swift M&A staff cuts that include reasonable severance packages for employees — rather than long, drawn-out, torturous headcount reductions.

ChannelE2E also correctly predicted the Symantec team could face job cuts, layoffs, or potential business spin-offs as a result of the deal. Right on queue, Symantec announced layoffs of roughly 7% of its more than 11,000 employees during FY 2020. The company also plans to downsize, vacate or close certain facilities and data centers in connection with the restructuring plan.

The Symantec name will be sold to Broadcom as part of the transaction. Interim Symantec CEO Rick Hill said the remaining consumer business contributed 90% of the company’s total operating income, and the company expects to be able to continue to grow revenue for its Norton LifeLock business in the mid-single digits going forward. CEO Hill tried to spin the sale as a win in a presser.

This is a transformative transaction that should maximize immediate value to our shareholders while maintaining ownership in a pure play consumer cyber safety business with predictability, growth and strong consistent profitability.

Symantec SoldSymantec’s struggles in recent years which may have lead to the buy-out are chronicled by Channele2e. Former CEO Greg Clark resigned in May 2019 amid weak enterprise cybersecurity software revenues. Executive team departures over the past year have also included Symantec’s CFO, chief operating officer, chief marketing officer and the head of its go-to-market teams. Board member Rick Hill has been interim president and CEO of the company since that time.

Symantec was late to cloud-and mobile-centric cybersecurity services, and faced intense competition from next-generation endpoint protection providers, including:

rb-

Deja Vu All Over Again

Deja Vu All Over Again

The sense of deja-vu all over again you are experiencing is real. Intel and McAfee tried this nearly a decade ago. Intel purchased top Symantec competitor McAfee for $7.7 billion. The expected “synergies” (WTF that means) never materialized. Intel ended up spinning off McAfee to private equity firm TPG in a 2016 sale that valued the business at $4.2 billion.

Related Posts

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Browser Security Updates

Browser Security UpdatesIf you bank, shop, or work on the Intertubes your security is changing. Your browser Security is changing because Symantec is selling its Website Security and related PKI business to PKI encryption solutions to DigiCert for nearly $1 Billion.

SSL and TLS logoExperts estimate that Symantec (SYMC) owns 40% of the SSL certificate market. SSL/TLS certificates are used to encrypt the connections between browsers and HTTPS-enabled websites. The certificates are used to verify that users are actually visiting the websites they intended to and not spoofed versions. Certificates are issued by organizations known as certificate authorities that are trusted by default in browsers and operating systems.

As a result of the sale, many firms are going to have to reissue SSL/TLS server certificates. The reissued certs will ensure browser security and make sure there is no impact on your online experiences. These certificates are essential to ensure secure, encrypted communication for user interaction on the Intertubes.

Google Chrome browser security

Google (GOOG) has led the effort to decrease the disruption that could come along with this change. Google posted a plan back in July of 2017 regarding Symantec-issued SSL/TLS server certificates.

• In March 2018 Google Chrome (Chrome 66 Beta) will show a warning for sites secured with SSL/TLS certificates issued before June 1, 2016. Your security is at risk and data encryption will function normally, but your transactions will be disrupted by a warning in Chrome.
• Google has also stated that all SSL/TLS certificates that had been issued by Symantec before December 1, 2017, will not be trusted starting in September 2018 (Chrome 70 Beta). Doing transactions at sites that have not been updated will put your security at risk, and you will get a warning in Chrome.

Mozilla Firefox

Mozilla, publisher of the Firefox web browser says that it intends to follow the same timeline proposed by Google.

rb-
This change is a normal procedure for typical certificate renewal. There should be no service disruption when the new certificates are issued as long as your web browser is up to date. There is no reason to have an out-of-date browser anymore. All three major browsers will auto-update. Other keys to staying safe online include:

  • Always check for HTTPS when you plan on providing personal data to a website. Always check for HTTPS
  • Pay attention to any security warnings you receive when you visit a website. Although you can almost always trust the HTTPS you see in your browser URL, any additional warnings from your browser should show that there may be a problem with the connection, so you should proceed with caution.

Nearly 54% of all U.S. web browsers will be affected by these changes. Statista says that Chrome held almost 50% of the browser market share and Firefox held over 5% of the share in December 2017. 41% of Internet users are not covered by this change (Safari 32.7% and IE/Edge 9%).

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Slam the Door on Hackers

Slam the Door on HackersLast year two white-hat hackers Charlie Miller and Chris Valasek, remotely compromised a Jeep Cherokee. The cybersecurity researchers used  existing functionality in the car to take control.  They were able to disable the car’s transmission and brakes, while the vehicle was in reverse, and take over the steering wheel.

Karamba SecurityThe Verge reports the researchers are back and have compromised their Jeep Cherokee, fooling the car into doing dangerous things. Things like turning the steering wheel or activating the parking brake at highway speeds. This year’s attack requires physical access to the car.

Hackers use the diagnostic port

The team used a laptop connected to the OBD II engine diagnostic port to control even more vehicle systems. The Verge says the researchers were able to update the electronic control unit. This allowed them to take control of the steering at any time. They could turn the steering wheel at any speed, activate the parking brake, or adjust the cruise control settings.

Electronic control unit

Most operations in a car have their own designated electronic control unit (ECU) controller. Some ECU’s manage things like a car’s navigation and entertainment systems. Others manage more critical systems like braking and fuel injection.

Radio are a gateway for attackersA connected car’s ECUs all operate on one network, self-contained within the vehicle. Tel Aviv start-up Karamba co-founder David Barzilai, warns. “If hackers gain access to just one of these controllers, they can get to all of them.

Harden ECU

The Israeli company hopes to sell Carwall Detroit automakers. Carwall is a tool that installs anti-hacking technology into chip-bearing auto parts before they hit the assembly line. Rgis could prevent hackers from crashing your new connected car. Mr. Barzilai told TechCrunch the startup’s technology can head off hackers at the pass. Carwall “hardens” the controllers, or small computers, within a vehicle that are externally connected.

Carwell, a tool that installs anti-hacking technologyKaramba’s Carwall is installed on the controllers, either as a retrofit or before the controllers are built into new cars. The software locks in the factory settings, and prevents any foreign code or banned behaviors from running on them. This essentially blocks a hackers ability to reach into a car’s CAN Bus, and mess with the car’s critical functions.

If indeed we are successful – if all hacks are blocked – then [you] don’t have to worry,” said Karamba’s Barzilai. “A hack that crashes your software is bad enough. A hack that crashes your car takes it to a whole new level.

Karamba’s technology is designed to monitor every bit of code that tries to run on the ECUs and to make sure it comes from legitimate sources. “We are the gatekeepers,” Mr. Barzilai told MiTechNews.

Out of stealth mode

monitor every bit of code that tries to runTechCrunch says Karamba has not yet scored a contract with top automotive suppliers that make ECU’s. They are targeting firms like Continental, Robert Bosch, Delphi Automotive, or Panasonic. But it has only just emerged from stealth and begun to shop its security software around.

YL Ventures has invested $2.5 million to fund Karamba’s growth, MiTechNews reported. Compared with the funding that some Silicon Valley security companies pick up, that’s not a huge amount. But it’s enough to move CEO Ami Dotan to Ann Arbor, where he’ll start making sales calls.

Karamba isn’t alone in attacking car security. Symantec (SYMC), the old school antivirus firm is working on auto security within its “internet of things” unit. Symantec recently released a  white paper “Building Comprehensive Security into Cars,” (PDF) detailing the many electronics and sensors that have to be protected.

rb-

Chrysler is doing a small part to reduce connected car hacking. They recently launched a bug bounty program with Bugcrowd that will pay out as much as $1,500 per bug found. On the other hand, Apple is offering a bug bounty of up to $200,000 for bugs that won’t kill you.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Back to School Cybersafety Resources

Back to School Cybersafety ResourcesThe new school year is here. If cybersafety is not on your “back to school” checklist, it should be. SecureWorld offered up a list of resources to help parents have a meaningful conversation about “cyber-safety” with their children. Parents need to talk with their kids about what they can do to protect themselves from the threats that are lurking online.

There are a variety of resources available that can help parents teach their children about the importance of Internet safety and privacy. Here are some recommended in the article.

threats lurking onlineIn 2009, President Obama asked the Department of Homeland Security to create the Stop.Think.Connect. Campaign to help Americans understand the dangers that come with being online. The program stresses that cybersecurity is a shared responsibility. Parents can download a Cybersecurity for Kids tip card (PDF) that offers helpful hints and advice designed specifically for children.

ConnectSafely.org is a nonprofit organization dedicated to educating users of connected technology about safety, privacy and security. The website offers a number of Parent Guides, written by parents for parents, including:

Back to school

The National Cybersecurity Alliance is an industry-led group, founded by the likes of Symantec (SYMC), Cisco (CSCO), Microsoft (MSFT), and EMC (EMC), whose mission is to educate and therefore empower a digital society to use (rb- their products) the Internet safely and securely at home, work and school.

Parents and teachers can download tips and resources from their website StaySafeOnline.org. The tip sheets are created specifically for different age groups ranging from kindergarten to college students. This site offers resources like:

Free Security Check-Up and Tools – Which has download locations for tools from A to W – Avast to Webroot. (as always use at your own risk).

Tip Sheets for:

The author states that industry professionals are also placing a high priority on preparing children for life in cyberspace. For instance, the (ISC)2 Foundation’s Safe and Secure Online program was introduced in 2006 in conjunction with Childnet International. They offer resources for parents which include Top 10 Tips for Parents (PDF) and the Parent-Child Commitment to Safety Agreement (PDF).

The Business Insider polled and a bunch of industry cyber security experts about what they teach their kids about the internet. The experts working in the field recommend you:

  • Start discussing online safety at an early age.
  • If you wouldn’t do it face to face – Don’t do it online.
  • Once you’ve written something you can’t delete it.
  • Not just to tell them the rules but also to spend the time/

You can read the rest of the tips at Business Insider here.

rb-

Good luck, you will need it.

Talk to your students about cyber safety – Staysafe.org’s guide on Internet Safety for Teens: https://www.staysafe.org/teens/

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

25% of Employees Access Past Employers Work Docs

25% of Employees Access Past Employers Work Doc'sMore than 25% of file-sharing service users report still having access to work documents from their previous employer, according to a “Rogue Cloud in Business” survey of 2,000 U.S. adults by Harris Interactive for Egnyte, an enterprise file-sharing platform provider.

uncontrolled file-sharingAccording to FierceITSecurity, the survey highlights the security risks uncontrolled file-sharing practices pose to the work place from these practices are obvious. An Egnyte presser claims The survey results illustrate a major exposure for today’s businesses when it comes to the transfer and storage of data through unapproved and insecure cloud-only file-sharing services.

The new survey uncovers deep issues around the rogue usage of consumer-based cloud services and illustrates the need for IT to deploy a secure enterprise-grade solution that meets the file-sharing needs of employees while protecting sensitive business data from the risks associated with insecure file sharing through the cloud

The survey found that:

  • easy to take sensitive business documents51% agree that collaborating on file-sharing services (such as Dropbox and YouSendIt) is secure for work documents;
  • 46% agree that it would be easy to take sensitive business documents to another employer;
  • 41% agree that they could easily transfer business-sensitive data outside the company using a file-sharing service;
  • 38% have used file-sharing services have transferred sensitive files on an unapproved file-sharing service to someone else at least once; 10% have done it 6 or more times;
  • 31% agree that they would share large documents that are too big for email through a file-sharing service without checking with their IT departments;
  • 27% of file-share service users report still having access to documents from that previous employer.

mobile users are willing to bypass IT policiesAnother report from Workshare paints a grimmer picture for those of us tasked with protecting a firm’s intellectual property. The report titled “Workforce Mobilization” shows the true extent to which mobile users are willing to bypass IT policies and use unsanctioned applications to share large files and collaborate on documents outside of the office.

  • 72% of workers are using free file-sharing services without authorization from their IT departments.
  • 62% of knowledge workers use their personal devices for work.
  • 69% of these workers also use free file sharing services to collaborate and access shared documents.
  • At companies with fewer than 500 employees only 24% of employees using authorized file sharing solutions.

Robert Hamilton, director of information risk management at Symantec (SYMC) in Mountain View, CA also told FierceCIO a continued threat to the company’s data comes from employees who feel like they live in a “finder’s keepers” environment.

Not encouraging

The results of the survey report, entitled “What’s Yours Is Mine,” were not encouraging to IT security professionals and IT management. According to the Symantec survey of employees:

  • "finder's keepers" environment68% of their company doesn’t take proper steps to protect sensitive work information;
  • 56% do not believe it is a crime to use a competitor’s trade secrets;
  • 40% download work files to personal devices;
  • 40% plan to use old company information in a new job role.

Symantec’s Hamilton told FierceCIO:

Employees are taking increasing amounts of data outside the company, and most people do not believe using corporate data for themselves is wrong … The attitude is that ownership lies with the person that created it, not with the company that employs them.

rb-

All three of these firms sell products they claim that can stop a firm’s intellectual property from leaking out through public file-sharing services. But before you engage any firm, some basic steps should be taken.

  1. Develop a technology acceptable use policy.
  2. Include public file-sharing services in the AUP.
  3. Incorporate the AUP in the staff handbook, and make sure staff sign it before they are given network access.
  4. Train staff on the risks associated with using public file sharing services for sharing corporate documents. Risks include HIPAA violations, PII release, Malware, PCI-DSS violations, and Government “Snooping.” Only then –
  5. Engage a service provider to implement an enterprise-approved alternative to the free file-sharing services.
What's Your is Mine

Symantec Infographic

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.