Here’s the resources: http://www.test104.com/en/misc/all.asp
When you think about security, is protecting the privacy of your customers and the security of your data at the top of your list of concerns?
You might be quick to answer yes, but CTO Ron Ben Natan said in his session at the Collaborate ‘10 conference on Monday that for most people, compliance is usually the bigger worry — not whether your data is protected, but whether or not you’re going to pass your audit.
But to stay compliant, one must understand the many aspects of Oracle 10g and 11g security, a topic which Ben Natan of Guardium discussed with the approximately 20 people in attendance. He talked about the long process of securing your Oracle data — including hardening, assessing, classifying, monitoring, auditing, enforcing and encrypting — and offered tips for making it through each of these steps successfully.
This process is different for Oracle databases compared to Oracle applications, Ben Natan said. He pointed out that it’s much more difficult to know all of the user privileges and entitlements in an Oracle database environment, thus making the database more vulnerable to breaches involving the “unknown factor.”
What’s the “unknown factor”?
According to Ben Natan, nine out of 10 breaches involve:
• A system unknown to the organization
• A system storing data that the organization did not know existed
• A system that had unknown network connections
• A system that had unknown accounts or privileges
Oracle also has a highly complex privilege model, he said. Privileges grant users the right to run a specific type of SQL statement or perform a certain database operations. These privileges are grouped into user roles, and the high number of roles Oracle has can make it difficult to keep track. However, Oracle 11g only has 30 roles, compared to the 120 that were in 10g.
But some of these privileges, especially system privileges, of which Oracle has over 100, are very risky. Nearly any system privilege can be used by an attacker to assume DBA privileges, Ben Natan said. Oracle even notes this in its own documentation:
“Caution:
System privileges can be very powerful, and should be granted only when necessary to roles and trusted users of the database.”
What’s the best way to combat such vulnerabilities?
Ben Natan stressed the importance of installing quarterly Oracle’s Critical Patch Updates, a practice that not everyone agrees is as critical as Oracle claims. However, he said that “the only way to address vulnerability is to apply these patches,” even when it comes to simple attacks (of which the majority of security attacks are) like password breaches.
Still, the security decisions you make depend on many unique factors within your organization. Where do your security priorities lie? How do you assign roles and privileges in your company? What are your own experiences with applying Oracle’s patch updates?
For more news, please access http://www.test104.com/en/tech/
2010年4月27日星期二
Oracle unveils Enterprise Manager 11g and 'integrated stack'
Here’s the resources: http://www.test104.com/en/misc/all.asp
Oracle has rolled out Enterprise Manager 11g, continuing to push the idea of a full IT stack owned and managed by Oracle.
Oracle's notion of an "integrated stack" is that all products -- from the application layer to the hardware -- come from Oracle; in return, Oracle promises these components will can better communicate with one another, use a single management console and, eventually, all lead to one entity to point to when support is needed. The question is whether data center managers run enough Oracle to need such integration.
Integration throughout the stack could make Oracle Enterprise Manager beneficial for Oracle users who buy into the application-to-disk concept Oracle is trying to sell. But for those with heterogeneous environments, Enterprise Manager won't provide the same level of support.
Other features Oracle touted with Enterprise Manager 11g include business-driven application features that help companies connect and track a business transaction to the underlying IT that supports it. It also announced full support for newer in-house products such as Oracle Database 11g Release 2, Exadata Version 2, and Sun servers. .
Do data centers need an integrated stack
The Oracle acquisition of Sun Microsystems Inc. could bring some IT management benefits to those running Sun servers, or at least, that's what Ajit Solomon hopes. A database administrator at a major financial institution, Solomon said a prior version of Enterprise Manager doesn't provide enough insight into OS operations, and as a result he often ends up jumping between interfaces to get information. His shop runs Oracle databases and apps on Sun servers running Solaris. The new version promises tighter integration with all Oracle products, which now includes Solaris, but it's unclear whether it will solve Solomon's problems.
"I'd like to see more details on the operating system," he said. "If I did, I wouldn't have to manually go into the OS logs to get some of the information."
Solomon runs Solaris on Sparc servers, and so Oracle's integration promises could pay dividends. Forrester analyst JP Garbani said the integration is part of a future state called enterprise management 2.0. Garbani, who spoke at the Oracle launch of the new version of Enterprise Manager in New York on Thursday, said that in many data centers today, you're buying servers from one vendor, custom middleware applications, databases from another vendor, and management tools from some or all of them. According to him, that breeds complexity.
"You're putting it all together, and it's consuming a lot of resources and a lot of time," he said.
Oracle President Charles Phillips also addreseed that concept, saying that with integrated support, there is "no finger pointing" and "we figure it out."
That's all well and good, but the fact remains that most Oracle customers don't run the complete IT stack that Oracle is selling. As a result, they can't expect the IT management features of Oracle Enterprise Manager to be as comprehensive.
"With the Oracle stack, we can do deeper configuration work," said Richard Sarwal, the vice president of server performance at Oracle. "We certainly support a wide variety of non-Oracle hardware and software, but it's just a matter of the depth of management possible."
For more news, please access http://www.test104.com/en/tech/
Oracle has rolled out Enterprise Manager 11g, continuing to push the idea of a full IT stack owned and managed by Oracle.
Oracle's notion of an "integrated stack" is that all products -- from the application layer to the hardware -- come from Oracle; in return, Oracle promises these components will can better communicate with one another, use a single management console and, eventually, all lead to one entity to point to when support is needed. The question is whether data center managers run enough Oracle to need such integration.
Integration throughout the stack could make Oracle Enterprise Manager beneficial for Oracle users who buy into the application-to-disk concept Oracle is trying to sell. But for those with heterogeneous environments, Enterprise Manager won't provide the same level of support.
Other features Oracle touted with Enterprise Manager 11g include business-driven application features that help companies connect and track a business transaction to the underlying IT that supports it. It also announced full support for newer in-house products such as Oracle Database 11g Release 2, Exadata Version 2, and Sun servers. .
Do data centers need an integrated stack
The Oracle acquisition of Sun Microsystems Inc. could bring some IT management benefits to those running Sun servers, or at least, that's what Ajit Solomon hopes. A database administrator at a major financial institution, Solomon said a prior version of Enterprise Manager doesn't provide enough insight into OS operations, and as a result he often ends up jumping between interfaces to get information. His shop runs Oracle databases and apps on Sun servers running Solaris. The new version promises tighter integration with all Oracle products, which now includes Solaris, but it's unclear whether it will solve Solomon's problems.
"I'd like to see more details on the operating system," he said. "If I did, I wouldn't have to manually go into the OS logs to get some of the information."
Solomon runs Solaris on Sparc servers, and so Oracle's integration promises could pay dividends. Forrester analyst JP Garbani said the integration is part of a future state called enterprise management 2.0. Garbani, who spoke at the Oracle launch of the new version of Enterprise Manager in New York on Thursday, said that in many data centers today, you're buying servers from one vendor, custom middleware applications, databases from another vendor, and management tools from some or all of them. According to him, that breeds complexity.
"You're putting it all together, and it's consuming a lot of resources and a lot of time," he said.
Oracle President Charles Phillips also addreseed that concept, saying that with integrated support, there is "no finger pointing" and "we figure it out."
That's all well and good, but the fact remains that most Oracle customers don't run the complete IT stack that Oracle is selling. As a result, they can't expect the IT management features of Oracle Enterprise Manager to be as comprehensive.
"With the Oracle stack, we can do deeper configuration work," said Richard Sarwal, the vice president of server performance at Oracle. "We certainly support a wide variety of non-Oracle hardware and software, but it's just a matter of the depth of management possible."
For more news, please access http://www.test104.com/en/tech/
Microsoft makes Windows HPC Server more Linux friendly
Here’s the resources: http://www.test104.com/en/misc/all.asp
Microsoft remains a peon in Linux-dominated supercomputing, but the software giant has tried to gain ground with a more reliable, scalable and interoperable HPC operating system. The question is: will Linux users give it a chance?
Since the release of its first HPC operating system in 2006, Microsoft has worked to make Windows a respectable player in high-performance computing (HPC). But Microsoft's market share hasn't increased much. Only 5% to 6% of the HPC market use Windows, while about 75% of HPC systems run on Linux, followed by Unix, according to IDC data.
And in the latest Top500.Org list of supercomputing sites, more than 78% of systems listed ran Linux (391 in all), while only 1% (five systems) use Windows HPC Server 2008.
"Windows has been not strong in this space. Most HPC users are loyal Linux users because it is reliable and their legacy apps are designed for it," said Jie Wu, IDC's research director for technical computing. "Microsoft also has a large perception issue to overcome."
Microsoft: A leg up in HPC market?
Linux has a long history of reliability, solid performance, and most applications are designed to work with it. Plus, Linux can be cheap. Windows, on the other hand, has none of these advantages in the HPC space, which makes many administrators unwilling to try it.
An IT operations manager at a Seattle-based data center, for example, said he won't give Microsoft a shot on his HPC systems because "Windows always seems to require way more hardware resources than the Unix alternatives do to perform the same task."
Sam Fulcomer, the associate director at Brown University's Center for Computation and Visual Computing, said that, historically, the availability of computational software for Windows lags Linux and the older mainstream Unix variants. Plus, Windows has had an issue with native client support for high-performance parallel file systems.
Fulcomer runs a CentOS Linux build on an IBM supercomputer that Brown University deployed late last year. At the time, he did not consider Windows a viable candidate and said it would take a strong incentive to use such an "unusual" OS.
One administrator who runs a server cluster for a university in the U.K. has Windows HPC Server in-house in case he needs it but runs it only in a sandbox environment. It isn't in production because most software users served by the HPC system "want and need to run Linux."
Microsoft's HPC strategy
That sort of Linux loyalty is not lost on Microsoft, and the company has taken an If-you-can't-beat-'em-join-'em attitude with Windows HPC Server 2008 R2, which became available in Beta 2 this month. The final release is scheduled for later this year.
Microsoft added a "hybrid" option in the R2 version so Linux users can run Windows without disposing of their tried-and-true OS. Users can run Windows and Linux on a cluster at the same time or switch back and forth between Linux and Windows nodes.
"There are certainly cases where even the most devoted Linux user will want to run a Windows app, and now they can do that without ripping and replacing their existing Linux," said Ryan Waite, head of Microsoft's Windows HPC Server engineering team.
By tapping into its massive installed x86 and desktop customer base, Microsoft will also gain customers. Existing Windows shops may be more willing to give their familiar OS a try -- especially if these shops run Windows 7 on desktops.
In Windows HPC Server 2008 R2, Microsoft added the ability to repurpose Windows 7 workstations as compute nodes so that idle PCs can be designated to HPC clusters to perform computational workloads.
The ability to remotely run jobs has been around forever but Windows HPC Server 2008 R2 takes things a step further by integrating that capability into its cluster management software, said Microsoft.
The next HPC OS will also support Visual Studio 2010 for parallel development of HPC applications, and it integrates with a new HPC version of Excel 2010 that runs in parallel and drastically cuts down the time it takes to run data, Waite said.
Though still in beta, Windows HPC Server 2008 R2 appears to be much more stable and scalable, which has caught the attention of more original equipment manufacturers and independent software vendors that have developed Windows-friendly apps and products for it, IDC's Wu said.
"Microsoft is very serious about the HPC space, because it is growing faster than the x86 space," Wu said. "They are doing things to make Windows a real option."
For more news, please access http://www.test104.com/en/tech/
Microsoft remains a peon in Linux-dominated supercomputing, but the software giant has tried to gain ground with a more reliable, scalable and interoperable HPC operating system. The question is: will Linux users give it a chance?
Since the release of its first HPC operating system in 2006, Microsoft has worked to make Windows a respectable player in high-performance computing (HPC). But Microsoft's market share hasn't increased much. Only 5% to 6% of the HPC market use Windows, while about 75% of HPC systems run on Linux, followed by Unix, according to IDC data.
And in the latest Top500.Org list of supercomputing sites, more than 78% of systems listed ran Linux (391 in all), while only 1% (five systems) use Windows HPC Server 2008.
"Windows has been not strong in this space. Most HPC users are loyal Linux users because it is reliable and their legacy apps are designed for it," said Jie Wu, IDC's research director for technical computing. "Microsoft also has a large perception issue to overcome."
Microsoft: A leg up in HPC market?
Linux has a long history of reliability, solid performance, and most applications are designed to work with it. Plus, Linux can be cheap. Windows, on the other hand, has none of these advantages in the HPC space, which makes many administrators unwilling to try it.
An IT operations manager at a Seattle-based data center, for example, said he won't give Microsoft a shot on his HPC systems because "Windows always seems to require way more hardware resources than the Unix alternatives do to perform the same task."
Sam Fulcomer, the associate director at Brown University's Center for Computation and Visual Computing, said that, historically, the availability of computational software for Windows lags Linux and the older mainstream Unix variants. Plus, Windows has had an issue with native client support for high-performance parallel file systems.
Fulcomer runs a CentOS Linux build on an IBM supercomputer that Brown University deployed late last year. At the time, he did not consider Windows a viable candidate and said it would take a strong incentive to use such an "unusual" OS.
One administrator who runs a server cluster for a university in the U.K. has Windows HPC Server in-house in case he needs it but runs it only in a sandbox environment. It isn't in production because most software users served by the HPC system "want and need to run Linux."
Microsoft's HPC strategy
That sort of Linux loyalty is not lost on Microsoft, and the company has taken an If-you-can't-beat-'em-join-'em attitude with Windows HPC Server 2008 R2, which became available in Beta 2 this month. The final release is scheduled for later this year.
Microsoft added a "hybrid" option in the R2 version so Linux users can run Windows without disposing of their tried-and-true OS. Users can run Windows and Linux on a cluster at the same time or switch back and forth between Linux and Windows nodes.
"There are certainly cases where even the most devoted Linux user will want to run a Windows app, and now they can do that without ripping and replacing their existing Linux," said Ryan Waite, head of Microsoft's Windows HPC Server engineering team.
By tapping into its massive installed x86 and desktop customer base, Microsoft will also gain customers. Existing Windows shops may be more willing to give their familiar OS a try -- especially if these shops run Windows 7 on desktops.
In Windows HPC Server 2008 R2, Microsoft added the ability to repurpose Windows 7 workstations as compute nodes so that idle PCs can be designated to HPC clusters to perform computational workloads.
The ability to remotely run jobs has been around forever but Windows HPC Server 2008 R2 takes things a step further by integrating that capability into its cluster management software, said Microsoft.
The next HPC OS will also support Visual Studio 2010 for parallel development of HPC applications, and it integrates with a new HPC version of Excel 2010 that runs in parallel and drastically cuts down the time it takes to run data, Waite said.
Though still in beta, Windows HPC Server 2008 R2 appears to be much more stable and scalable, which has caught the attention of more original equipment manufacturers and independent software vendors that have developed Windows-friendly apps and products for it, IDC's Wu said.
"Microsoft is very serious about the HPC space, because it is growing faster than the x86 space," Wu said. "They are doing things to make Windows a real option."
For more news, please access http://www.test104.com/en/tech/
2010年4月26日星期一
Oracle’s virtualization support policy, technologies may get a makeover in wake of Sun deal
Here’s the resources: http://www.test104.com/en/misc/all.asp
Oracle’s virtualization support policy just might get a makeover in the wake of the company’s $7.4 billion purchase of beleaguered IT giant Sun Microsystems -- and experts say that’s just one of several virtualization-related considerations Oracle is facing as it works to integrate Sun’s technology and customer base.
In addition to a possible reexamination of its virtualization support rules, Oracle should quickly address the concerns of existing Sun customers that want better virtualization functionality, analysts say. Oracle also faces the mammoth tasks of bringing Sun’s virtualization technologies in line with its own while simultaneously presenting a clear and unified marketing message to current and potential customers – a process that is already in full swing.
“If you look at virtualization, [Oracle] now has several different pieces of software that they’re going to need to integrate into one,” said Donald Feinberg, analyst with Stamford, Conn.-based research firm Gartner Group. “How long it’s going to take, I really don’t know. But it’s a pretty good bet that they’ll do it. Oracle has yet to screw up an acquisition.”
Oracle announced that it finalized the Sun deal in late January. Sun, a company famous for its Java programming language and “mainframe-like” servers that run on SPARC processors, lost business in recent years owing to the rise of Linux and relatively inexpensive x86-based hardware.
While Oracle offers comprehensive virtualization support services for customers running its own Xen-based hypervisor, Oracle VM, the company officially refuses to support third-party virtualization tools like VMware and Microsoft Hyper-V. But the purchase of Sun and its popular Unix-based Solaris operating system could lead Oracle to rethink its support policy, according to analysts.
Along with Sun, Oracle inherited a significant number of customers that run “Solaris for x86” in third-party virtualization environments. Meanwhile, the ranks of users running Oracle databases and business applications on third-party virtualization tools are growing all the time. The point, analysts say, is that Oracle today serves all kinds of virtualization technology users and those customers may demand increased support for non-Oracle virtualization deployments over time.
“Oracle doesn’t fully support anybody else’s virtualization, but I think that is going to change,” said Dan Olds, a research analyst with Gabriel Consulting Group in Beaverton, Ore. “Virtualization has become too prevalent, and there are simply too many customers that are out there using non-Oracle virtualization.”
To be sure, some analysts think Oracle is unlikely to declare all-out support for the likes of VMware anytime soon, but they say the company could eventually cut deals or create programs that make it easier to get some level of Oracle support for non-Oracle virtualization environments.
“I think there are lots of folks that would like to see them play better with allowing Oracle to run on other [virtualization] platforms, but I don’t think that is currently in the plan,” said Barb Goldworm, founder, president and chief analyst with Focus Consulting in Boulder, Colo. “Ellison’s vision is to own the full stack and tune it to run better with their operating system environments, their virtualization environment and their hardware.”
Sun’s virtualization capabilities lacking?
Oracle is also facing questions from customers who feel that Sun’s SPARC-based virtualization capabilities are lacking, said Tony Iams, an operating systems and virtualization technology analyst with Ideas International in Rye Brook, N.Y.
At a recent Oracle virtualization technology event in New York, Iams spoke with several end users who expressed concerns over Sun’s virtualization track record.
“There was a sense that Sun had not really kept up with improving virtualization technology on SPARC -- that it had fallen behind what you could get on x86 from folks like VMware,” he said.
One popular feature of high-profile virtualization systems is what VMware calls Live Migration -- the ability to move a virtual machine from one server to another without any downtime. Oracle VM, Hyper-V and some other Unix vendors, such as IBM, offer similar capabilities, but Iams said Sun never made it happen for Solaris on SPARC users.
“[Live Migration] is really a key piece of the foundation of VMware’s entire platform, and it’s a really powerful function,” he explained. “When you combine [Live Migration capabilities] with availability and load balancing, power management and so on, it unlocks a lot of the power of virtualization by letting you shift the workloads around and match them to the right resources without interrupting processing.”
Oracle’s marketing machine is already working to send the message that it intends to improve virtualization on SPARC. Oracle began this process recently when it changed the name of Sun’s hardware virtualization technology from Logical Domains (Ldoms) to Oracle VM Server for SPARC, Iams said.
“By giving it the same name, they’re kind of laying out the expectation that [SPARC and x86 users] are going to have equivalent functionality on both platforms,” he said.
The Oracle-Sun virtualization technology integration challenge
With the Oracle-Sun deal finalized, analysts say Oracle must now unify both the technological capabilities and the marketing messages associated with its growing portfolio of virtualization software products. That list of products includes Oracle VM; Virtual Iron, a company Oracle acquired last year; Sun’s XVM virtualization product line; and Sun’s VirtualBox product line.
“The Sun XVM hypervisor never really made it out the door in a standalone version in the kind of form that could compete directly with VMware,” Iams said. “It’s really Oracle VM that is going to be their strategic platform on x86. That is the hypervisor that they’ll take to market and use to compete against VMware and Hyper-V and so on.”
Oracle Enterprise Manager (OEM) will become a key part of Oracle’s virtualization messaging going forward, he said. OEM is slated to become the central management console for the various virtualization technologies that make up the Oracle VM product line, according to the company.
“The hypervisor itself is getting less important, and people are caring more and more about managing the virtual infrastructure,” Iams said. “That’s where you get most of the added value.”
Virtualization of mission-critical systems remains an issue
Analysts cite the slowly increasing use of virtualization for mission-critical deployments like databases as one possible reason why Oracle might want to revisit its virtualization support policy, but end users say they still prefer virtualization for less important systems.
“Anything that is mission critical to me needs its own box,” said John Chaney, IT project manager with JanPak Inc., a Davidson, N.C.-based distributor of janitorial and packaging supplies. “That’s just my [philosophy].”
JanPak previously ran an Oracle Database 9i-based fleet coordination application in a VMware ESX Server virtualization environment. The company ultimately decided to migrate to Microsoft SQL Server 2005 after the logistics application officially ended support for Oracle 9i. Today, JanPak runs the logistics application in a standalone box but still uses VMware for other tasks.
Chaney says he prefers to use the virtualization layer to store images and templates that basically remain unchanged over time. Any dynamic, mission-critical information that finds its way to the virtualization layer should be properly and frequently backed up -- or better yet, moved to a standalone box, he said.
“VMware is really for our Web order entry front end,” Chaney explained. “The next plan is to [deploy] a standby VMware system with all our [static] images ready to boot up.”
As part of that plan, Chaney will spend time making sure that images stored on the standby VMware system do not contain too much information.
“That is my biggest thing about VMware,” he said. “It’s nice to have the image there, but really I want the VMware [layer to consist of just] the operating system and the application front.”
For more news, please access http://www.test104.com/en/tech/
Oracle’s virtualization support policy just might get a makeover in the wake of the company’s $7.4 billion purchase of beleaguered IT giant Sun Microsystems -- and experts say that’s just one of several virtualization-related considerations Oracle is facing as it works to integrate Sun’s technology and customer base.
In addition to a possible reexamination of its virtualization support rules, Oracle should quickly address the concerns of existing Sun customers that want better virtualization functionality, analysts say. Oracle also faces the mammoth tasks of bringing Sun’s virtualization technologies in line with its own while simultaneously presenting a clear and unified marketing message to current and potential customers – a process that is already in full swing.
“If you look at virtualization, [Oracle] now has several different pieces of software that they’re going to need to integrate into one,” said Donald Feinberg, analyst with Stamford, Conn.-based research firm Gartner Group. “How long it’s going to take, I really don’t know. But it’s a pretty good bet that they’ll do it. Oracle has yet to screw up an acquisition.”
Oracle announced that it finalized the Sun deal in late January. Sun, a company famous for its Java programming language and “mainframe-like” servers that run on SPARC processors, lost business in recent years owing to the rise of Linux and relatively inexpensive x86-based hardware.
While Oracle offers comprehensive virtualization support services for customers running its own Xen-based hypervisor, Oracle VM, the company officially refuses to support third-party virtualization tools like VMware and Microsoft Hyper-V. But the purchase of Sun and its popular Unix-based Solaris operating system could lead Oracle to rethink its support policy, according to analysts.
Along with Sun, Oracle inherited a significant number of customers that run “Solaris for x86” in third-party virtualization environments. Meanwhile, the ranks of users running Oracle databases and business applications on third-party virtualization tools are growing all the time. The point, analysts say, is that Oracle today serves all kinds of virtualization technology users and those customers may demand increased support for non-Oracle virtualization deployments over time.
“Oracle doesn’t fully support anybody else’s virtualization, but I think that is going to change,” said Dan Olds, a research analyst with Gabriel Consulting Group in Beaverton, Ore. “Virtualization has become too prevalent, and there are simply too many customers that are out there using non-Oracle virtualization.”
To be sure, some analysts think Oracle is unlikely to declare all-out support for the likes of VMware anytime soon, but they say the company could eventually cut deals or create programs that make it easier to get some level of Oracle support for non-Oracle virtualization environments.
“I think there are lots of folks that would like to see them play better with allowing Oracle to run on other [virtualization] platforms, but I don’t think that is currently in the plan,” said Barb Goldworm, founder, president and chief analyst with Focus Consulting in Boulder, Colo. “Ellison’s vision is to own the full stack and tune it to run better with their operating system environments, their virtualization environment and their hardware.”
Sun’s virtualization capabilities lacking?
Oracle is also facing questions from customers who feel that Sun’s SPARC-based virtualization capabilities are lacking, said Tony Iams, an operating systems and virtualization technology analyst with Ideas International in Rye Brook, N.Y.
At a recent Oracle virtualization technology event in New York, Iams spoke with several end users who expressed concerns over Sun’s virtualization track record.
“There was a sense that Sun had not really kept up with improving virtualization technology on SPARC -- that it had fallen behind what you could get on x86 from folks like VMware,” he said.
One popular feature of high-profile virtualization systems is what VMware calls Live Migration -- the ability to move a virtual machine from one server to another without any downtime. Oracle VM, Hyper-V and some other Unix vendors, such as IBM, offer similar capabilities, but Iams said Sun never made it happen for Solaris on SPARC users.
“[Live Migration] is really a key piece of the foundation of VMware’s entire platform, and it’s a really powerful function,” he explained. “When you combine [Live Migration capabilities] with availability and load balancing, power management and so on, it unlocks a lot of the power of virtualization by letting you shift the workloads around and match them to the right resources without interrupting processing.”
Oracle’s marketing machine is already working to send the message that it intends to improve virtualization on SPARC. Oracle began this process recently when it changed the name of Sun’s hardware virtualization technology from Logical Domains (Ldoms) to Oracle VM Server for SPARC, Iams said.
“By giving it the same name, they’re kind of laying out the expectation that [SPARC and x86 users] are going to have equivalent functionality on both platforms,” he said.
The Oracle-Sun virtualization technology integration challenge
With the Oracle-Sun deal finalized, analysts say Oracle must now unify both the technological capabilities and the marketing messages associated with its growing portfolio of virtualization software products. That list of products includes Oracle VM; Virtual Iron, a company Oracle acquired last year; Sun’s XVM virtualization product line; and Sun’s VirtualBox product line.
“The Sun XVM hypervisor never really made it out the door in a standalone version in the kind of form that could compete directly with VMware,” Iams said. “It’s really Oracle VM that is going to be their strategic platform on x86. That is the hypervisor that they’ll take to market and use to compete against VMware and Hyper-V and so on.”
Oracle Enterprise Manager (OEM) will become a key part of Oracle’s virtualization messaging going forward, he said. OEM is slated to become the central management console for the various virtualization technologies that make up the Oracle VM product line, according to the company.
“The hypervisor itself is getting less important, and people are caring more and more about managing the virtual infrastructure,” Iams said. “That’s where you get most of the added value.”
Virtualization of mission-critical systems remains an issue
Analysts cite the slowly increasing use of virtualization for mission-critical deployments like databases as one possible reason why Oracle might want to revisit its virtualization support policy, but end users say they still prefer virtualization for less important systems.
“Anything that is mission critical to me needs its own box,” said John Chaney, IT project manager with JanPak Inc., a Davidson, N.C.-based distributor of janitorial and packaging supplies. “That’s just my [philosophy].”
JanPak previously ran an Oracle Database 9i-based fleet coordination application in a VMware ESX Server virtualization environment. The company ultimately decided to migrate to Microsoft SQL Server 2005 after the logistics application officially ended support for Oracle 9i. Today, JanPak runs the logistics application in a standalone box but still uses VMware for other tasks.
Chaney says he prefers to use the virtualization layer to store images and templates that basically remain unchanged over time. Any dynamic, mission-critical information that finds its way to the virtualization layer should be properly and frequently backed up -- or better yet, moved to a standalone box, he said.
“VMware is really for our Web order entry front end,” Chaney explained. “The next plan is to [deploy] a standby VMware system with all our [static] images ready to boot up.”
As part of that plan, Chaney will spend time making sure that images stored on the standby VMware system do not contain too much information.
“That is my biggest thing about VMware,” he said. “It’s nice to have the image there, but really I want the VMware [layer to consist of just] the operating system and the application front.”
For more news, please access http://www.test104.com/en/tech/
Open source options expanding for Microsoft world
Here’s the resources: http://www.test104.com/en/misc/all.asp
Developers and testers looking for open source tools for Microsoft platforms and technologies have increasingly more choices than in the past. Indeed Microsoft itself has become a contributor over the past few years, and last year was the founding sponsor of the CodePlex Foundation, which has the stated goal of increasing participation in open source community projects.
"The percent of open source software that is Windows compatible has been climbing steadily for the last five years," said Scott Collison, chief product officer and head of corporate development for the online network Geeknet Inc., which includes the SourceForge open source hosting site. "More than 80% of open source software today is Windows compatible," he said, based on data collected from Geeknet's Ohloh.net open source directory. While the majority of new OSS projects starting today are operating system agnostic, according to Collison, Windows is the only OS that runs all 10 of the top 10 all-time most-downloaded projects on SourceForge.
In the .NET arena, Collison said the Mono project, a cross-platform .NET development framework, has the largest set of tools that support .NET. "Microsoft also offers some open source tools around .NET, and there's also DotNetNuke," he cited as examples. "There's a good ecosystem of development tools that target .NET."
It wasn't always that way, said Charles Poole, an independent software developer and consultant focusing on the .NET environment, and one of the developers of NUnit, an open source unit-testing framework for .NET languages. When Poole started working on open source, "the open source folks weren't terribly welcomed by Microsoft, and the people working in Microsoft tools weren't very welcome among the mainstream open source folks. It was the open source people who have more a political orientation, who think working with Microsoft software at all disqualifies you, but I see signs that it's changing."
One important thing Microsoft did was to support PHP on the Windows platform, Collison said. "It was a good decision on their part. There are so many PHP applications being written, that not supporting it on the platform would be foolish strategically. That's the biggest commitment Microsoft has made to open source."
Poole said there are still more OSS tools for the Linux world than the Microsoft world, "but there is a lot of choice now. The movement ALT.NET has been a big push among Microsoft developers, but pushing to use a lot of different tools and have more choice."
Over the past few years, Microsoft has steadily increased its participation in open source, according to Brian Goldfarb, director, Developer Platform and Tools at Microsoft. "Microsoft engineers have contributed to more than 300 open source projects," he said, including Windows Installer XMLWiX; Apache Stonehenge, a set of example applications for service-oriented architecture that spans languages and platforms and demonstrates best practice and interoperability; and Web Sandbox, a framework for developing secure standards-based Web applications. Also, he added, "We have invested in systems to support open source development such as CodePlex.com and Snakebite. We provide technical support to projects ranging from Samba to Eclipse to Firefox."
He continued, "From my team alone, we've made a number of investments in open source in the last year. These include contributions to the jQuery JavaScript Library, the Silverlight Media Framework (SMF), the Silverlight Analytics Framework (SAF), the Silverlight Control Toolkit, the AJAX Control Toolkit and Project Orchard."
Goldfarb said Microsoft sees the CodePlex Foundation as an opportunity to participate more actively in open source development. "The CodePlex Foundation has been set up with a unique purpose–to build a set of practices and processes that facilitate better collaboration among the participating software companies, industry partners, and open source communities. We are excited about the opportunities that the CodePlex Foundation will provide–for Microsoft and other organizations–in creating a forum for commercial and community developers alike."
The CodePlex Foundation uses a museum-like model with "galleries" that represent technology themes, said Executive Director Paula Hunter. Currently there are two project galleries, ASP.NET and Systems Infrastructure and Integration.
There are three projects in the ASP.NET gallery: the ASP.NET Ajax Library Beta for building database-driven Web applications that execute in the Web browser; Orchard, aimed at delivering applications and reusable components on the ASP.NET platform; and MVC Contrib, to provide enhancements and alternative implementations to the ASP.NET MVC framework. MVC Contrib is the first project donated to the CodePlex Foundation by an independent group of developers backed by an independent software development company, Headspring. There is one project in the Systems Infrastructure and Integration gallery: Network Monitor Parsers Project, contributed by Microsoft.
Hunter said in addition to getting a technical director in place, near-term goals for CodePlex are to "encourage more contributors, expand the diversity of projects and add new galleries, and add additional sponsors to the mix."
"We anticipate the CodePlex Foundation will act as a mediating, neutral party that can facilitate better collaboration between the participating companies, industry partners and open source communities," Goldfarb said.
Clearly, it's a heterogenous world, and open source is part of that mix. "In my work as a consultant and coach for agile teams, I encourage companies to get the standard edition of Visual Studio which costs a lot less and supplement it with open source tools," Poole said, such as NUnit and NAnt, a .NET build tool. He also encourages some of his clients to consider Mono instead of Visual Studio.
Goldfarb said mixed environments like this are the reality. "Microsoft is open to open source … and shares the common industry view that software users will continue to see a mixed IT environment of open source and proprietary products for years to come." He added, "open source software can represent healthy competition and an opportunity to complement or enhance Microsoft technologies and products. Microsoft's open source strategy recognizes the value of openness to working with others—including open source communities—to help customers and partners succeed in today's heterogeneous IT environments."
While "there's always a certain skepticism around what Microsoft is doing around open source," said Jay Lyman, an analyst at 451 Group, "they have a significant number of projects on SourceForge; a couple years ago they got their license approved as an OSI license; [they] work with the PHP community, [they] work with Apache … and now the CodePlex Foundation is largely following the blueprint of IBM/Eclipse."
Jeffrey Hammond, principal analyst for application development at Forrester Research, added: "I think they've [Microsoft] realized at this point that they have more to gain in some areas by embracing and promoting open source rather than pushing back against it. There are ways they can use open source for competitive advantage, which is reflective of the changes in behavior. Look at what they've done to embrace Linux running on top of Hyper-V; it makes sense because they can compete with VMware. And with the acquisition of Teamprise [which enables developers using the Eclipse IDE or operating on multiple operating systems to build applications with Microsoft Visual Studio Team Foundation Server] they're competing with Eclipse."
Hammond concluded, "Where they've gotten to is a pragmatic outlook on open source software that views it as a potential competitive advantage."
For more news, please access http://www.test104.com/en/tech/
Developers and testers looking for open source tools for Microsoft platforms and technologies have increasingly more choices than in the past. Indeed Microsoft itself has become a contributor over the past few years, and last year was the founding sponsor of the CodePlex Foundation, which has the stated goal of increasing participation in open source community projects.
"The percent of open source software that is Windows compatible has been climbing steadily for the last five years," said Scott Collison, chief product officer and head of corporate development for the online network Geeknet Inc., which includes the SourceForge open source hosting site. "More than 80% of open source software today is Windows compatible," he said, based on data collected from Geeknet's Ohloh.net open source directory. While the majority of new OSS projects starting today are operating system agnostic, according to Collison, Windows is the only OS that runs all 10 of the top 10 all-time most-downloaded projects on SourceForge.
In the .NET arena, Collison said the Mono project, a cross-platform .NET development framework, has the largest set of tools that support .NET. "Microsoft also offers some open source tools around .NET, and there's also DotNetNuke," he cited as examples. "There's a good ecosystem of development tools that target .NET."
It wasn't always that way, said Charles Poole, an independent software developer and consultant focusing on the .NET environment, and one of the developers of NUnit, an open source unit-testing framework for .NET languages. When Poole started working on open source, "the open source folks weren't terribly welcomed by Microsoft, and the people working in Microsoft tools weren't very welcome among the mainstream open source folks. It was the open source people who have more a political orientation, who think working with Microsoft software at all disqualifies you, but I see signs that it's changing."
One important thing Microsoft did was to support PHP on the Windows platform, Collison said. "It was a good decision on their part. There are so many PHP applications being written, that not supporting it on the platform would be foolish strategically. That's the biggest commitment Microsoft has made to open source."
Poole said there are still more OSS tools for the Linux world than the Microsoft world, "but there is a lot of choice now. The movement ALT.NET has been a big push among Microsoft developers, but pushing to use a lot of different tools and have more choice."
Over the past few years, Microsoft has steadily increased its participation in open source, according to Brian Goldfarb, director, Developer Platform and Tools at Microsoft. "Microsoft engineers have contributed to more than 300 open source projects," he said, including Windows Installer XMLWiX; Apache Stonehenge, a set of example applications for service-oriented architecture that spans languages and platforms and demonstrates best practice and interoperability; and Web Sandbox, a framework for developing secure standards-based Web applications. Also, he added, "We have invested in systems to support open source development such as CodePlex.com and Snakebite. We provide technical support to projects ranging from Samba to Eclipse to Firefox."
He continued, "From my team alone, we've made a number of investments in open source in the last year. These include contributions to the jQuery JavaScript Library, the Silverlight Media Framework (SMF), the Silverlight Analytics Framework (SAF), the Silverlight Control Toolkit, the AJAX Control Toolkit and Project Orchard."
Goldfarb said Microsoft sees the CodePlex Foundation as an opportunity to participate more actively in open source development. "The CodePlex Foundation has been set up with a unique purpose–to build a set of practices and processes that facilitate better collaboration among the participating software companies, industry partners, and open source communities. We are excited about the opportunities that the CodePlex Foundation will provide–for Microsoft and other organizations–in creating a forum for commercial and community developers alike."
The CodePlex Foundation uses a museum-like model with "galleries" that represent technology themes, said Executive Director Paula Hunter. Currently there are two project galleries, ASP.NET and Systems Infrastructure and Integration.
There are three projects in the ASP.NET gallery: the ASP.NET Ajax Library Beta for building database-driven Web applications that execute in the Web browser; Orchard, aimed at delivering applications and reusable components on the ASP.NET platform; and MVC Contrib, to provide enhancements and alternative implementations to the ASP.NET MVC framework. MVC Contrib is the first project donated to the CodePlex Foundation by an independent group of developers backed by an independent software development company, Headspring. There is one project in the Systems Infrastructure and Integration gallery: Network Monitor Parsers Project, contributed by Microsoft.
Hunter said in addition to getting a technical director in place, near-term goals for CodePlex are to "encourage more contributors, expand the diversity of projects and add new galleries, and add additional sponsors to the mix."
"We anticipate the CodePlex Foundation will act as a mediating, neutral party that can facilitate better collaboration between the participating companies, industry partners and open source communities," Goldfarb said.
Clearly, it's a heterogenous world, and open source is part of that mix. "In my work as a consultant and coach for agile teams, I encourage companies to get the standard edition of Visual Studio which costs a lot less and supplement it with open source tools," Poole said, such as NUnit and NAnt, a .NET build tool. He also encourages some of his clients to consider Mono instead of Visual Studio.
Goldfarb said mixed environments like this are the reality. "Microsoft is open to open source … and shares the common industry view that software users will continue to see a mixed IT environment of open source and proprietary products for years to come." He added, "open source software can represent healthy competition and an opportunity to complement or enhance Microsoft technologies and products. Microsoft's open source strategy recognizes the value of openness to working with others—including open source communities—to help customers and partners succeed in today's heterogeneous IT environments."
While "there's always a certain skepticism around what Microsoft is doing around open source," said Jay Lyman, an analyst at 451 Group, "they have a significant number of projects on SourceForge; a couple years ago they got their license approved as an OSI license; [they] work with the PHP community, [they] work with Apache … and now the CodePlex Foundation is largely following the blueprint of IBM/Eclipse."
Jeffrey Hammond, principal analyst for application development at Forrester Research, added: "I think they've [Microsoft] realized at this point that they have more to gain in some areas by embracing and promoting open source rather than pushing back against it. There are ways they can use open source for competitive advantage, which is reflective of the changes in behavior. Look at what they've done to embrace Linux running on top of Hyper-V; it makes sense because they can compete with VMware. And with the acquisition of Teamprise [which enables developers using the Eclipse IDE or operating on multiple operating systems to build applications with Microsoft Visual Studio Team Foundation Server] they're competing with Eclipse."
Hammond concluded, "Where they've gotten to is a pragmatic outlook on open source software that views it as a potential competitive advantage."
For more news, please access http://www.test104.com/en/tech/
HP-3Com acquisition: An integrated networking portfolio emerges
Here’s the resources: http://www.test104.com/en/misc/all.asp
HP outlined its 3Com integration plans Monday, including an edge-to-core networking portfolio with a unified data center fabric that executives promise will be less expensive and more power efficient than Cisco's, fueling the ongoing HP-Cisco war. The question remains, however, just how integrated the equipment can be, given how little time HP has had to work with 3Com equipment.
HP's integrated portfolio, announced just a week after the $2.7 billion HP-3Com acquisition closing, combines HP's ProCurve LAN edge products with 3Com's enterprise security, core switching and routing offerings. The new integrated portfolio will be sold under the name HP Networking (both the ProCurve and 3Com brands will be retired). HP doesn't plan to discontinue any 3Com product in the short term -- though it's unlikely that 3Com switches that overlap with ProCurve will be around for long. The integrated portfolio does not yet include new technology.
Waving the ever-popular convergence flag, HP executives said during a media webcast that the goal of the portfolio is to eliminate IT silos and unify networking, servers and storage in a single fabric with one management system. Taking aim at Cisco's strikingly similar offering, executives promised open standards and the ability for customers to transition their networks without the need to rip and replace. The Cisco Unified Computing System (UCS) strategy ultimately requires that users build from the ground up.
Enterprise clients are currently "working with fragile network infrastructure" in "management environments that are hard to manage, vulnerable and expensive to maintain," said Marius Haas, senior vice president and general manager of HP networking. "With HP, clients will have a network that is open, flexible and robust," he said, and one with collapsed network layers to enable ease of automation and a flexible pool of resources.
Real integration in the HP-3Com acquisition so quickly?
Considering that Cisco spent years planning its UCS and that the Juniper Stratus data center plan has been in the works for many months and won't be available until 2011, some find it hard to believe that HP can actually have a tightly integrated networking portfolio with a true unified fabric involving 3Com's equipment.
Many believe the HP-3Com acquisition was more a move to gain ground in the hot Chinese market, where 3Com's H3C brand is beating Cisco. In fact, most analysts believed it to be more of an account control move than one that was especially tech savvy. With Cisco's launch into the server space, HP needed to hold ground against Cisco and the possibility that IBM would push back through stronger partnerships with Juniper and Brocade or, even worse, rebuild its own networking portfolio, according to Tom Nolle, president of CIMI Corporation.
"But the buyer isn't interested in sales goals," Nolle said. "You have to create some meaningful integration here. This seems to be facile … that they would have all this done so quickly."
Meaningful integration doesn't necessarily mean just using existing open standards and patching together management systems across the product sets, he added.
David Yen, Juniper's executive vice president and general manager of fabric and switching technologies, speaking to SearchNetworking.com on Monday from the Cloud Computing Expo in New York, also questioned the speediness of HP Networking's integrated portfolio.
"Juniper has been working on this for three years," Yen said, adding that he assumes that HP is promising heavily tested integration. "I am skeptical. Once you remove the marketing façade, it can't come anywhere close. Their first challenge is trying to integrate the two companies' product lines, which have significant overlap … and then trying to integrate the two organizations together. Even for large players with sufficient time and prioritization, it takes time to put together a useful set and get customers started on trying them and giving feedback."
For its part, HP said the networking portfolio has already been deployed in a few major companies, including BMW. And HP drank its own Kool-Aid, announcing Monday that it had opened its own "Cisco-free" data center using 34 3Com routers, four TippingPoint intrusion detection and protection devices, and more than 300 ProCurve switches. The new architecture saves the company 50% in consumption levels, executives said.
The HP Networking portfolio breakdown
Specifically, the HP Networking portfolio can be broken into four categories: a security solution, and product sets for the enterprise, midmarket, and smaller businesses.
The A Series will focus on the large enterprise data center and is most likely to go head-to-head with Cisco. It promises a virtual switching fabric and includes a mixture of 3Com's H3C switches, routers and wireless equipment along with the ProCurve edge 6600 switches and the 6120 blade switch. The E Series focuses on the midsized market and includes wired and wireless LAN integration and wireless access technology, as well as 3Com's VoIP product set and a series of switches. The V Series includes a wireless firewall, security and plug-and-play switches for companies with little or no IT staff. Finally, the S Series includes TippingPoint security products, including intrusion detection and prevention systems.
HP executives said the company is currently developing products that support converged enhanced Ethernet and FCoE, but they didn't elaborate. They also said major storage products would not be introduced as part of the portfolio.
HP's Marius Haas summed up the company's position saying, "We believe storage partnerships are the way to go."
For more news, please access http://www.test104.com/en/tech/
HP outlined its 3Com integration plans Monday, including an edge-to-core networking portfolio with a unified data center fabric that executives promise will be less expensive and more power efficient than Cisco's, fueling the ongoing HP-Cisco war. The question remains, however, just how integrated the equipment can be, given how little time HP has had to work with 3Com equipment.
HP's integrated portfolio, announced just a week after the $2.7 billion HP-3Com acquisition closing, combines HP's ProCurve LAN edge products with 3Com's enterprise security, core switching and routing offerings. The new integrated portfolio will be sold under the name HP Networking (both the ProCurve and 3Com brands will be retired). HP doesn't plan to discontinue any 3Com product in the short term -- though it's unlikely that 3Com switches that overlap with ProCurve will be around for long. The integrated portfolio does not yet include new technology.
Waving the ever-popular convergence flag, HP executives said during a media webcast that the goal of the portfolio is to eliminate IT silos and unify networking, servers and storage in a single fabric with one management system. Taking aim at Cisco's strikingly similar offering, executives promised open standards and the ability for customers to transition their networks without the need to rip and replace. The Cisco Unified Computing System (UCS) strategy ultimately requires that users build from the ground up.
Enterprise clients are currently "working with fragile network infrastructure" in "management environments that are hard to manage, vulnerable and expensive to maintain," said Marius Haas, senior vice president and general manager of HP networking. "With HP, clients will have a network that is open, flexible and robust," he said, and one with collapsed network layers to enable ease of automation and a flexible pool of resources.
Real integration in the HP-3Com acquisition so quickly?
Considering that Cisco spent years planning its UCS and that the Juniper Stratus data center plan has been in the works for many months and won't be available until 2011, some find it hard to believe that HP can actually have a tightly integrated networking portfolio with a true unified fabric involving 3Com's equipment.
Many believe the HP-3Com acquisition was more a move to gain ground in the hot Chinese market, where 3Com's H3C brand is beating Cisco. In fact, most analysts believed it to be more of an account control move than one that was especially tech savvy. With Cisco's launch into the server space, HP needed to hold ground against Cisco and the possibility that IBM would push back through stronger partnerships with Juniper and Brocade or, even worse, rebuild its own networking portfolio, according to Tom Nolle, president of CIMI Corporation.
"But the buyer isn't interested in sales goals," Nolle said. "You have to create some meaningful integration here. This seems to be facile … that they would have all this done so quickly."
Meaningful integration doesn't necessarily mean just using existing open standards and patching together management systems across the product sets, he added.
David Yen, Juniper's executive vice president and general manager of fabric and switching technologies, speaking to SearchNetworking.com on Monday from the Cloud Computing Expo in New York, also questioned the speediness of HP Networking's integrated portfolio.
"Juniper has been working on this for three years," Yen said, adding that he assumes that HP is promising heavily tested integration. "I am skeptical. Once you remove the marketing façade, it can't come anywhere close. Their first challenge is trying to integrate the two companies' product lines, which have significant overlap … and then trying to integrate the two organizations together. Even for large players with sufficient time and prioritization, it takes time to put together a useful set and get customers started on trying them and giving feedback."
For its part, HP said the networking portfolio has already been deployed in a few major companies, including BMW. And HP drank its own Kool-Aid, announcing Monday that it had opened its own "Cisco-free" data center using 34 3Com routers, four TippingPoint intrusion detection and protection devices, and more than 300 ProCurve switches. The new architecture saves the company 50% in consumption levels, executives said.
The HP Networking portfolio breakdown
Specifically, the HP Networking portfolio can be broken into four categories: a security solution, and product sets for the enterprise, midmarket, and smaller businesses.
The A Series will focus on the large enterprise data center and is most likely to go head-to-head with Cisco. It promises a virtual switching fabric and includes a mixture of 3Com's H3C switches, routers and wireless equipment along with the ProCurve edge 6600 switches and the 6120 blade switch. The E Series focuses on the midsized market and includes wired and wireless LAN integration and wireless access technology, as well as 3Com's VoIP product set and a series of switches. The V Series includes a wireless firewall, security and plug-and-play switches for companies with little or no IT staff. Finally, the S Series includes TippingPoint security products, including intrusion detection and prevention systems.
HP executives said the company is currently developing products that support converged enhanced Ethernet and FCoE, but they didn't elaborate. They also said major storage products would not be introduced as part of the portfolio.
HP's Marius Haas summed up the company's position saying, "We believe storage partnerships are the way to go."
For more news, please access http://www.test104.com/en/tech/
Newly Updated Resources (Microsoft, CISCO, SUN, CCSP, Win7)
Here's the resources http://www.test104.com/en/misc/all.asp
News
Microsoft 70-519 Q&A 85 questions updated.
CISCO 640-816 Q&A 132 questions updated.
SUN 310-878 Q&A 166 questions updated.
SUN 310-877 Q&A 103 questions updated.
CISCO 642-611 Q&A 101 questions updated.
SUN 310-875 Q&A 89 questions updated.
CISCO CCSP 642-504 Q&A 62 questions updated.
Microsoft Win7 70-680 Q&A 124 questions updated.
Microsoft 70-526 Q&A 126 questions updated.
Microsoft 70-528 Q&A 111 questions updated.
Recent Updates:
Microsoft 70-519 Q&A 85 questions updated. (2010/4/22)
CISCO 640-816 Q&A 132 questions updated. (2010/4/22)
SUN 310-878 Q&A 166 questions updated.(2010/4/21)
SUN 310-877 Q&A 103 questions updated. (2010/4/20)
CISCO 642-611 Q&A 101 questions updated. (2010/4/20)
SUN 310-875 Q&A 89 questions updated.(2010/4/19)
CISCO CCSP 642-504 Q&A 62 questions updated.(2010/4/19)
Microsoft Win7 70-680 Q&A 124 questions updated.(2010/4/17)
Microsoft 70-526 Q&A 126 questions updated.(2010/4/16)
Microsoft 70-528 Q&A 111 questions updated.(2010/4/16)
New Demo
Microsoft 70-519
Microsoft 70-433cn
SUN 310-875
For more details, please access http://www.test104.com/en/news/news.asp
News
Microsoft 70-519 Q&A 85 questions updated.
CISCO 640-816 Q&A 132 questions updated.
SUN 310-878 Q&A 166 questions updated.
SUN 310-877 Q&A 103 questions updated.
CISCO 642-611 Q&A 101 questions updated.
SUN 310-875 Q&A 89 questions updated.
CISCO CCSP 642-504 Q&A 62 questions updated.
Microsoft Win7 70-680 Q&A 124 questions updated.
Microsoft 70-526 Q&A 126 questions updated.
Microsoft 70-528 Q&A 111 questions updated.
Recent Updates:
Microsoft 70-519 Q&A 85 questions updated. (2010/4/22)
CISCO 640-816 Q&A 132 questions updated. (2010/4/22)
SUN 310-878 Q&A 166 questions updated.(2010/4/21)
SUN 310-877 Q&A 103 questions updated. (2010/4/20)
CISCO 642-611 Q&A 101 questions updated. (2010/4/20)
SUN 310-875 Q&A 89 questions updated.(2010/4/19)
CISCO CCSP 642-504 Q&A 62 questions updated.(2010/4/19)
Microsoft Win7 70-680 Q&A 124 questions updated.(2010/4/17)
Microsoft 70-526 Q&A 126 questions updated.(2010/4/16)
Microsoft 70-528 Q&A 111 questions updated.(2010/4/16)
New Demo
Microsoft 70-519
Microsoft 70-433cn
SUN 310-875
For more details, please access http://www.test104.com/en/news/news.asp
2010年4月22日星期四
Windows-based attack bypasses file restrictions, network detection
Here’s the resources: http://www.test104.com/en/misc/all.asp
Functionality in Microsoft Windows that allows for backwards compatibility can allow an attacker to bypass file restrictions or network security defenses such as intrusion detection systems, a security researcher said today at SOURCE Boston 2010.
Dan Crowley, a tech support engineer at Core Security Technologies, presented several means of bypassing these protections in the Windows versions of four Web servers: Nginx; Cherokee; Mongoose; and LightTPD. The most glaring is through the use of 8.3 aliases in Windows. These aliases are DOS-compatible aliases created every time a file is created in Windows. Both file names can be accessed, even though they aren't the same.
The 8.3 filesystem pseudonym vulnerability was reported in February by Core Security.
8.3 aliases are eight-character filenames followed by a three-character file extension name. In Windows, these are the first six characters of a filename, followed by a tilde, a digit, a period and the file extension (exampl~1.txt). All other characters in the filename are truncated by Windows. This greatly increases the effectiveness of brute-force attacks because the time and resources needed to guess a filename would be greatly reduced, Crowley said. Theoretically, an attacker could call a file via its alias, view source code, manipulate it by uploading malware, and the next time the file is called legitimately, the system would be owned.
He added that all of his testing was done on Web-based platforms, but he said any application that accepts user input would be vulnerable as well.
"Applications do string-based analysis of filepaths," Crowley said. "This is done to decide how to handle files, deny access or determine if input is malicious. These alternate file names, or even mangled file names, can bypass or break a lot of things. The operating system interacts with the file system, not the application. Because of this, it does a string-based analysis and passes that on to the file system if it is satisfied with what it sees, rather than asking the file system if this is OK."
Problems arise with IDS rules, for example, if they are tuned to look for example.php, exampl~1 would not be flagged. An attacker would be able to access files or send remote code.
Crowley says one mitigation technique is to disable the use of 8.3 aliases.
Ideally, he said, the best mitigation is to stop the practice of string-based analysis of filepaths, acknowledging the performance hit other techniques would impose on systems.
For more news, please access http://www.test104.com/en/tech/
Functionality in Microsoft Windows that allows for backwards compatibility can allow an attacker to bypass file restrictions or network security defenses such as intrusion detection systems, a security researcher said today at SOURCE Boston 2010.
Dan Crowley, a tech support engineer at Core Security Technologies, presented several means of bypassing these protections in the Windows versions of four Web servers: Nginx; Cherokee; Mongoose; and LightTPD. The most glaring is through the use of 8.3 aliases in Windows. These aliases are DOS-compatible aliases created every time a file is created in Windows. Both file names can be accessed, even though they aren't the same.
The 8.3 filesystem pseudonym vulnerability was reported in February by Core Security.
8.3 aliases are eight-character filenames followed by a three-character file extension name. In Windows, these are the first six characters of a filename, followed by a tilde, a digit, a period and the file extension (exampl~1.txt). All other characters in the filename are truncated by Windows. This greatly increases the effectiveness of brute-force attacks because the time and resources needed to guess a filename would be greatly reduced, Crowley said. Theoretically, an attacker could call a file via its alias, view source code, manipulate it by uploading malware, and the next time the file is called legitimately, the system would be owned.
He added that all of his testing was done on Web-based platforms, but he said any application that accepts user input would be vulnerable as well.
"Applications do string-based analysis of filepaths," Crowley said. "This is done to decide how to handle files, deny access or determine if input is malicious. These alternate file names, or even mangled file names, can bypass or break a lot of things. The operating system interacts with the file system, not the application. Because of this, it does a string-based analysis and passes that on to the file system if it is satisfied with what it sees, rather than asking the file system if this is OK."
Problems arise with IDS rules, for example, if they are tuned to look for example.php, exampl~1 would not be flagged. An attacker would be able to access files or send remote code.
Crowley says one mitigation technique is to disable the use of 8.3 aliases.
Ideally, he said, the best mitigation is to stop the practice of string-based analysis of filepaths, acknowledging the performance hit other techniques would impose on systems.
For more news, please access http://www.test104.com/en/tech/
Microsoft pitches cloud to help manage PCs
Here’s the resources: http://www.test104.com/en/misc/all.asp
Microsoft is trying to help midsize business keep their PCs in tune.
On Monday, the software maker is set to launch a beta for Windows Intune, a service that uses the cloud to offer management, patching, and antivirus capabilities for a company's PCs. When it launches in final form, the Intune service will also include upgrade rights for a company to move its PCs to the enterprise edition of Windows 7. It will also include the Microsoft Desktop Optimization Pack, a collection of asset management, virtualization, and other services that typically are only available for large businesses that have a Software Assurance contract with Microsoft.
Sandrine Skinner, a director in Microsoft's Windows unit, said that Windows Intune is aimed at companies that have up to 500 PCs that are looking to manage their machines with just a small IT staff.
"They aspire to have enterprise-class infrastructure, but don't necessarily have the means," she said.
One of the key features of the service is its ability to schedule and manage updates of Windows and other Microsoft software, a capability that in the past required Windows Server Update Services or another management tool.
"We're removing the need to have such a server," Skinner said. Although the Intune service can manage updates to Microsoft software, it can't update third-party software, nor can it handle the initial deployment and installation of programs.
On the anti-malware front, Intune uses the same engine that powers Microsoft's Forefront business software and its free Windows Security Essentials consumer product.
A single Silverlight-based Web console can show an overview of a company's entire fleet of PCs, showing which machines do and don't have the latest updates as well as any issues with malware.
The beta for the online services part of Intune will start this week, Skinner said, with Microsoft aiming to sign up about 1,000 businesses, all in North America. Customers will get a free trial of the online tools, but not the Windows 7 upgrade rights or the desktop optimization pack.
Intune can only manage PCs that are running one of the business versions of Windows XP or later. Windows XP machines must be running at least Service Pack 2, though Service Pack 3 is recommended.
Skinner said that Microsoft hopes to launch the final version of Intune within the next 12 months, although it is still working on a number of issues, including how to price the service.
"We're still working on it, honestly," Skinner said. The company hopes to sell it similar to the way it sells other Microsoft Online services, with businesses signing up for a one-year initial contract and then month to month after that.
In a March interview with CNET, Microsoft's head of small- and midsize business efforts said that the cloud has the potential to be a great equalizer for small and midsize businesses that are looking for enterprise-type capabilities but that have limited budgets and IT staff.
"Cloud computing, from a pure economics standpoint, is a more efficient way of servicing small business," Steen said. "It's not a one-time thing. It's pay as you need it," Birger Steen said in the interview.
The announcement of the Intune beta comes just days after Microsoft launched "Fix it Center"--a more basic automated troubleshooting service for consumers and small businesses.
For more news, please access http://www.test104.com/en/tech/
Microsoft is trying to help midsize business keep their PCs in tune.
On Monday, the software maker is set to launch a beta for Windows Intune, a service that uses the cloud to offer management, patching, and antivirus capabilities for a company's PCs. When it launches in final form, the Intune service will also include upgrade rights for a company to move its PCs to the enterprise edition of Windows 7. It will also include the Microsoft Desktop Optimization Pack, a collection of asset management, virtualization, and other services that typically are only available for large businesses that have a Software Assurance contract with Microsoft.
Sandrine Skinner, a director in Microsoft's Windows unit, said that Windows Intune is aimed at companies that have up to 500 PCs that are looking to manage their machines with just a small IT staff.
"They aspire to have enterprise-class infrastructure, but don't necessarily have the means," she said.
One of the key features of the service is its ability to schedule and manage updates of Windows and other Microsoft software, a capability that in the past required Windows Server Update Services or another management tool.
"We're removing the need to have such a server," Skinner said. Although the Intune service can manage updates to Microsoft software, it can't update third-party software, nor can it handle the initial deployment and installation of programs.
On the anti-malware front, Intune uses the same engine that powers Microsoft's Forefront business software and its free Windows Security Essentials consumer product.
A single Silverlight-based Web console can show an overview of a company's entire fleet of PCs, showing which machines do and don't have the latest updates as well as any issues with malware.
The beta for the online services part of Intune will start this week, Skinner said, with Microsoft aiming to sign up about 1,000 businesses, all in North America. Customers will get a free trial of the online tools, but not the Windows 7 upgrade rights or the desktop optimization pack.
Intune can only manage PCs that are running one of the business versions of Windows XP or later. Windows XP machines must be running at least Service Pack 2, though Service Pack 3 is recommended.
Skinner said that Microsoft hopes to launch the final version of Intune within the next 12 months, although it is still working on a number of issues, including how to price the service.
"We're still working on it, honestly," Skinner said. The company hopes to sell it similar to the way it sells other Microsoft Online services, with businesses signing up for a one-year initial contract and then month to month after that.
In a March interview with CNET, Microsoft's head of small- and midsize business efforts said that the cloud has the potential to be a great equalizer for small and midsize businesses that are looking for enterprise-type capabilities but that have limited budgets and IT staff.
"Cloud computing, from a pure economics standpoint, is a more efficient way of servicing small business," Steen said. "It's not a one-time thing. It's pay as you need it," Birger Steen said in the interview.
The announcement of the Intune beta comes just days after Microsoft launched "Fix it Center"--a more basic automated troubleshooting service for consumers and small businesses.
For more news, please access http://www.test104.com/en/tech/
Microsoft to fix IE8 cross-site scripting problem, again
Here’s the resources: http://www.test104.com/en/misc/all.asp
Microsoft will plug a hole in a built-in filter in Internet Explorer 8 that can be used to launch the very types of attacks on Web sites it was designed to help prevent, the company said on Tuesday.
The company will update the IE cross-site scripting (XSS) filter in June to fix a hole that researchers warned about at the Black Hat Europe conference in Barcelona last week. The researchers showed how problems with the filter could be used to inject malicious code onto sites including Google, Microsoft's Bing search site, and Twitter.
"A June release is what's usual for the testing involved for updates," a Microsoft spokesperson said.
This will be Microsoft's third attempt to fix security issues with the XSS Filter in IE8.
"The XSS Filter related Blackhat EU presentation discussed a vulnerability that was previously disclosed and addressed in the January security update to Internet Explorer (MS10-002)," David Ross wrote on the Microsoft Security Response Center blog.
That was followed by a critical update in March. (MS10-018)
The update scheduled for June "will address a SCRIPT tag attack scenario described in the Blackhat EU presentation," Ross wrote. "In the case of the Internet Explorer XSS Filter, researchers found scenarios that are generally applicable across XSS filtering technologies in all currently shipping browsers with this technology built-in."
For more news, please access http://www.test104.com/en/tech/
Microsoft will plug a hole in a built-in filter in Internet Explorer 8 that can be used to launch the very types of attacks on Web sites it was designed to help prevent, the company said on Tuesday.
The company will update the IE cross-site scripting (XSS) filter in June to fix a hole that researchers warned about at the Black Hat Europe conference in Barcelona last week. The researchers showed how problems with the filter could be used to inject malicious code onto sites including Google, Microsoft's Bing search site, and Twitter.
"A June release is what's usual for the testing involved for updates," a Microsoft spokesperson said.
This will be Microsoft's third attempt to fix security issues with the XSS Filter in IE8.
"The XSS Filter related Blackhat EU presentation discussed a vulnerability that was previously disclosed and addressed in the January security update to Internet Explorer (MS10-002)," David Ross wrote on the Microsoft Security Response Center blog.
That was followed by a critical update in March. (MS10-018)
The update scheduled for June "will address a SCRIPT tag attack scenario described in the Blackhat EU presentation," Ross wrote. "In the case of the Internet Explorer XSS Filter, researchers found scenarios that are generally applicable across XSS filtering technologies in all currently shipping browsers with this technology built-in."
For more news, please access http://www.test104.com/en/tech/
2010年4月15日星期四
Newly Updated Resources (CCNA, Microsoft, CISCO)
Here’s the resources http://www.test104.com/en/misc/all.asp
News
CISCO ISCW 642-825 Q&A 247 questions updated.
Microsoft 70-504 Q&A 186 questions updated.
Microsoft 70-510 Q&A 76 questions updated.
Microsoft 70-502 Q&A 115 questions updated.
Microsoft 70-503 Q&A 145 questions updated.
Microsoft 70-350 Q&A 115 questions updated.
Microsoft 70-448 Q&A 100 questions updated.
Microsoft 70-582 Q&A 74 questions updated.
CISCO CCNA 640-802 Q&A 340 questions updated.
CISCO 642-654 Q&A 50 questions updated.
Microsoft 70-623 Q&A 130 questions updated.
Recent Updates:
CISCO ISCW 642-825 Q&A 247 questions updated. (2010/4/15)
Microsoft 70-504 Q&A 186 questions updated. (2010/4/14)
Microsoft 70-510 Q&A 76 questions updated.(2010/4/14)
Microsoft 70-502 Q&A 115 questions updated. (2010/4/13)
Microsoft 70-503 Q&A 145 questions updated. (2010/4/13)
Microsoft 70-350 Q&A 115 questions updated.(2010/4/12)
Microsoft 70-448 Q&A 100 questions updated.(2010/4/12)
Microsoft 70-582 Q&A 74 questions updated.(2010/4/12)
CISCO CCNA 640-802 Q&A 340 questions updated.(V24)(2010/4/9)
CISCO 642-654 Q&A 50 questions updated.(2010/4/9)
Microsoft 70-623 Q&A 130 questions updated.(2010/4/8)
New Demo
Microsoft 70-582
CISCO 642-654
CISCO 642-892
CISCO 642-812
For more details, please access http://www.test104.com/en/news/news.asp
News
CISCO ISCW 642-825 Q&A 247 questions updated.
Microsoft 70-504 Q&A 186 questions updated.
Microsoft 70-510 Q&A 76 questions updated.
Microsoft 70-502 Q&A 115 questions updated.
Microsoft 70-503 Q&A 145 questions updated.
Microsoft 70-350 Q&A 115 questions updated.
Microsoft 70-448 Q&A 100 questions updated.
Microsoft 70-582 Q&A 74 questions updated.
CISCO CCNA 640-802 Q&A 340 questions updated.
CISCO 642-654 Q&A 50 questions updated.
Microsoft 70-623 Q&A 130 questions updated.
Recent Updates:
CISCO ISCW 642-825 Q&A 247 questions updated. (2010/4/15)
Microsoft 70-504 Q&A 186 questions updated. (2010/4/14)
Microsoft 70-510 Q&A 76 questions updated.(2010/4/14)
Microsoft 70-502 Q&A 115 questions updated. (2010/4/13)
Microsoft 70-503 Q&A 145 questions updated. (2010/4/13)
Microsoft 70-350 Q&A 115 questions updated.(2010/4/12)
Microsoft 70-448 Q&A 100 questions updated.(2010/4/12)
Microsoft 70-582 Q&A 74 questions updated.(2010/4/12)
CISCO CCNA 640-802 Q&A 340 questions updated.(V24)(2010/4/9)
CISCO 642-654 Q&A 50 questions updated.(2010/4/9)
Microsoft 70-623 Q&A 130 questions updated.(2010/4/8)
New Demo
Microsoft 70-582
CISCO 642-654
CISCO 642-892
CISCO 642-812
For more details, please access http://www.test104.com/en/news/news.asp
2010年4月8日星期四
Newly Updated Resources (IBM, Microsoft,CISCO)
Here’s the resources http://www.test104.com/en/misc/all.asp
News
Microsoft 70-623 Q&A 130 questions updated.
CISCO CCNP 642-892 Q&A 344 questions updated.
CISCO BCMSN 642-812 Q&A 241 questions updated.
IBM 000-085 Q&A 45 questions updated.
Microsoft 70-445 Q&A 92 questions updated.
Microsoft 70-444 Q&A 95 questions updated.
Recent Updates:
Microsoft 70-623 Q&A 130 questions updated. (2010/4/8)
CISCO CCNP 642-892 Q&A 344 questions updated. (2010/4/7)
CISCO BCMSN 642-812 Q&A 241 questions updated.(Pic revised)(2010/4/7)
IBM 000-085 Q&A 45 questions updated. (2010/4/1)
Microsoft 70-445 Q&A 92 questions updated. (2010/3/26)
Microsoft 70-444 Q&A 95 questions updated.(2010/3/26)
New Demo
IBM 000-085
CISCO 642-892
CISCO 642-812
For more details, please access http://www.test104.com/en/news/news.asp
News
Microsoft 70-623 Q&A 130 questions updated.
CISCO CCNP 642-892 Q&A 344 questions updated.
CISCO BCMSN 642-812 Q&A 241 questions updated.
IBM 000-085 Q&A 45 questions updated.
Microsoft 70-445 Q&A 92 questions updated.
Microsoft 70-444 Q&A 95 questions updated.
Recent Updates:
Microsoft 70-623 Q&A 130 questions updated. (2010/4/8)
CISCO CCNP 642-892 Q&A 344 questions updated. (2010/4/7)
CISCO BCMSN 642-812 Q&A 241 questions updated.(Pic revised)(2010/4/7)
IBM 000-085 Q&A 45 questions updated. (2010/4/1)
Microsoft 70-445 Q&A 92 questions updated. (2010/3/26)
Microsoft 70-444 Q&A 95 questions updated.(2010/3/26)
New Demo
IBM 000-085
CISCO 642-892
CISCO 642-812
For more details, please access http://www.test104.com/en/news/news.asp
订阅：
博文 (Atom)
