IBM to Acquire Red Hat

IBM and Red Hat have announced they have reached a definitive agreement under which IBM will acquire all of the issued and outstanding common shares of Red Hat for $190.00 per share in cash, representing a total enterprise value of approximately $34 billion.

More simply put, IBM is acquiring Red Hat.

“The acquisition of Red Hat is a game-changer. It changes everything about the cloud market,” said Ginni Rometty, IBM Chairman, President and Chief Executive Officer. “IBM will become the world’s #1 hybrid cloud provider, offering companies the only open cloud solution that will unlock the full value of the cloud for their businesses.

“Most companies today are only 20 percent along their cloud journey, renting compute power to cut costs,” she said. “The next 80 percent is about unlocking real business value and driving growth. This is the next chapter of the cloud. It requires shifting business applications to hybrid cloud, extracting more data and optimizing every part of the business, from supply chains to sales.”

This acquisition brings together the best-in-class hybrid cloud providers and will enable companies to securely move all business applications to the cloud. Companies today are already using multiple clouds.

However, research shows that 80 percent of business workloads have yet to move to the cloud, held back by the proprietary nature of today’s cloud market. This prevents portability of data and applications across multiple clouds, data security in a multi-cloud environment and consistent cloud management.

“Open source is the default choice for modern IT solutions, and I’m incredibly proud of the role Red Hat has played in making that a reality in the enterprise,” said Jim Whitehurst, President and CEO, Red Hat. “Joining forces with IBM will provide us with a greater level of scale, resources and capabilities to accelerate the impact of open source as the basis for digital transformation and bring Red Hat to an even wider audience –  all while preserving our unique culture and unwavering commitment to open source innovation.”

BM and Red Hat will be strongly positioned to address this issue and accelerate hybrid multi-cloud adoption. Together, they will help clients create cloud-native business applications faster, drive greater portability and security of data and applications across multiple public and private clouds, all with consistent cloud management.

In doing so, they will draw on their shared leadership in key technologies, such as Linux, containers, Kubernetes, multi-cloud management, and cloud management and automation. 

IBM’s and Red Hat’s partnership has spanned 20 years, with IBM serving as an early supporter of Linux, collaborating with Red Hat to help develop and grow enterprise-grade Linux and more recently to bring enterprise Kubernetes and hybrid cloud solutions to customers.

These innovations have become core technologies within IBM’s $19 billion hybrid cloud business. Between them, IBM and Red Hat have contributed more to the open source community than any other organization.

With this acquisition, IBM will remain committed to Red Hat’s open governance, open source contributions, participation in the open source community and development model, and fostering its widespread developer ecosystem. In addition, IBM and Red Hat will remain committed to the continued freedom of open source, via such efforts as Patent Promise, GPL Cooperation Commitment, the Open Invention Network and the LOT Network.

IBM and Red Hat also will continue to build and enhance Red Hat partnerships, including those with major cloud providers, such as Amazon Web Services, Microsoft Azure, Google Cloud, Alibaba and more, in addition to the IBM Cloud. At the same time, Red Hat will benefit from IBM’s hybrid cloud and enterprise IT scale in helping expand their open source technology portfolio to businesses globally.

New IBM Linux-only Mainframe Delivers Breakthrough Security

IBM has unveiled the IBM LinuxONE Emperor II, the next generation of its family of Linux-only enterprise systems, which delivers new capabilities aimed at helping organizations achieve very high levels of security and data privacy assurance while rapidly addressing unpredictable data and transaction growth.

A key feature of the new LinuxONE Emperor II, IBM Secure Service Container is an exclusive LinuxONE technology that represents a significant leap forward in data privacy and security capabilities.

Last year, more than four billion data records were lost or stolen, a 556 percent increase over 2015. Of the more than nine billion records breached during the past five years, only four percent were encrypted – or securely scrambled — leaving most of that data exposed and vulnerable to attackers.

With IBM Secure Service Container, for the first time, data can be protected against internal threats at the system level from users with elevated credentials or hackers who obtain a user’s credentials, as well as external threats.

Software developers benefit by not having to create proprietary dependencies in their code to take advantage of these advanced security capabilities. An application only needs to be put into a Docker container to be ready for Secure Service Container deployment, and the application can be managed using the Docker and Kubernetes tools that are included to make Secure Service Container environments easy to consume.

Developers and clients can learn more and apply to participate in the beta at: http://ibm.biz/sscbeta. Developers can access new technologies, open source code and documentation on containers, mainframe development and more with IBM Developer Journeys: https://developer.ibm.com/code/journey/.

The most advanced enterprise Linux platform for data

The new LinuxONE Emperor II is the world’s most advanced enterprise Linux platform, featuring the industry’s fastest microprocessor and a unique I/O architecture with up to 640 cores dedicated to I/O processing. The vertical scale, shared-everything system design allows LinuxONE Emperor II to:

• Scale-up a single MongoDB instance to 17 TB in a single system and get 2.4x more throughput and 2.3x lower latency on LinuxONE Emperor II leveraging the additional memory available compared to LinuxONE Emperor – providing applications faster, more secure access to data while enabling greater scale at reduced complexity.
• Provide up to 2.6x better Java performance than x86 alternatives, and integrated hardware for pause-less garbage collection, enabling mission-critical Java workloads — which require consistent high-throughput and low-latency processing — to minimize unpredictable transaction delays due to garbage collection.
• Provide a Docker-certified infrastructure for Docker EE with integrated management and scale tested up to two million Docker containers – allowing developers to compose high-performance applications and embrace a micro-services architecture without latency or scale constraints.

Learn more about IBM LinuxONE.

Warning Against Your Insecurities: The 2011 IBM X-Force Trend And Risk “Poltergeist”

WARNING: This is an exceptionally long post intended for security and privacy geeks everywhere, including sys admins, Internet security hawks, CIOs, and innocent but interested bystanders everywhere.  No web servers were hacked in the preparation of this report: at least, none by me!

Okay, troopers, it’s that time of year again.  You know, the time when IBM releases its report card for security incidents, the X-Force Trend and Risk Report.

Google has the search “Zeitgeist” every year, we have the security “poltergeist!”

This time around, we’re looking back at the wild and wacky 2011, a year which showed surprising improvements in several areas of Internet security. Improvements, you ask?  Surely you jest, Turbo.

This figure from the 2011 IBM X-Force Trend And Risk Report shows a steady decline in the instances of input control related vulnerabilities such as cross-site scripting (XSS) and SQL injection since X-Force began recording these statistics in 2007. In 2011, the statistics suggest that the likelihood of encountering XSS in a given test continues to decrease but shows signs of leveling out at approximately a 40 percent chance of occurring. Injection vulnerabilities and specifically SQL injection appears to have leveled out at around a 20 percent chance of occurring in a given test.

No, no, there IS some good news.  Like a reduction in application security vulnerabilities, exploit code and spam.

But, good news leads to less good news on this front, as many of you who follow security well know, because the bad guys are being forced to rethink their tactics by targeting more niche IT loopholes and emerging technologies such as social networks and mobile devices.

The Top Line: Less Spam, More Adaptation

To get specific, the X-Force 2011 Trend and Risk Report demonstrated a 50 percent decline in spam email compared to 2010.

2011’s poltergeist saw a diligent patching of security vulnerabilities by software vendors, with only 36 percent of those vulnerabilities remaining unpatched in 2011 (compared to 43 percent in 2010).  The year also saw a higher quality of software application code, as seen in web-app vulnerabilities called “cross-site scripting” that were half as likely to exist in clients’ software as they were four years ago.

So, the net is, the bad guys are adapting their techniques to the changing tech environment. The report uncovered a rise in emerging attack trends including mobile exploits, automated password guessing, and a surge in phishing attacks.

It also witnessed an increase in automated shell command injection attacks against web servers, which may well be a response to successful efforts to close off other kinds of Web app vulnerabilities.

The Security Landscape Glass Half Full: Decrease In Unpatched Vulnerabilities, Exploit Code, And Spam

Getting even more specific, according to the report, there are several positive trends as companies adjusted their security policies in 2011:

• Thirty percent decline in the availability of exploit code. When security vulnerabilities are disclosed, exploit code is sometimes released that attackers can download and use to break into computers. Approximately 30 percent fewer exploits were released in 2011 than were seen on average over the past four years. This improvement can be attributed to architectural and procedural changes made by software developers that help make it more difficult for attackers to successfully exploit vulnerabilities.
• Decrease in unpatched security vulnerabilities. When security vulnerabilities are publicly disclosed, it is important that the responsible software vendor provide a patch or fix in a timely fashion. Some security vulnerabilities are never patched, but the percentage of unpatched vulnerabilities has been decreasing steadily over the past few years. In 2011 this number was down to 36 percent from 43 percent in 2010.
• Fifty percent reduction in cross site scripting (XSS) vulnerabilities due to improvements in software quality. The IBM X-Force team is seeing significant improvement in the quality of software produced by organizations that use tools like IBM AppScan OnDemand service to analyze, find, and fix vulnerabilities in their code.  IBM found XSS vulnerabilities are half as likely to exist in customers’ software as they were four years ago. However, XSS vulnerabilities still appear in about 40 percent of the applications IBM scans. This is still high for something well understood and able to be addressed.
• Decline in spam. IBM’s global spam email monitoring network has seen about half the volume of spam email in 2011 that was seen in 2010. Some of this decline can be attributed to the take-down of several large spam botnets, which likely hindered spammers’ ability to send emails. The IBM X-Force team witnessed spam evolve through several generations over the past seven years as spam filtering technology has improved and spammers have adapted their techniques in order to successfully reach readers.

The Security Landscape Glass Half Empty: Attackers Adapt Their Techniques in 2011

Even with these improvements, there has been a rise in new attack trends and an array of significant, widely reported external network and security breaches.

This figure from the 2011 IBM X-Force Trend And Risk Report shows an increase in mobile operating system exploits in 2011 due to an uptick in malicious activity targeting mobile devices. Because of the two-tiered relationship between phone end users, telecommunications companies, and mobile operating system vendors, disclosed mobile vulnerabilities can remain unpatched on phones for an extended period of time, providing a large window of opportunity to attackers.

As malicious attackers become increasingly savvy, the IBM X-Force documented increases in three key areas of attack activity:

• Attacks targeting shell command injection vulnerabilities more than double. For years, SQL injection attacks against web applications have been a popular vector for attackers of all types. SQL injection vulnerabilities allow an attacker to manipulate the database behind a website. As progress has been made to close those vulnerabilities – the number of SQL injection vulnerabilities in publicly maintained web applications dropped by 46 percent in 2011– some attackers have now started to target shell command injection vulnerabilities instead. These vulnerabilities allow the attacker to execute commands directly on a web server. Shell command injection attacks rose by two to three times over the course of 2011. Web application developers should pay close attention to this increasingly popular attack vector.
• Spike in automated password guessing – Poor passwords and password policies have played a role in a number of high-profile breaches during 2011. There is also a lot of automated attack activity on the Internet in which attacks scan the net for systems with weak login passwords. IBM observed a large spike in this sort of password guessing activity directed at secure shell servers (SSH) in the later half of 2011.
• Increase in phishing attacks that impersonate social networking sites and mail parcel services – The volume of email attributed to phishing was relatively small over the course of 2010 and the first half of 2011, but phishing came back with a vengeance in the second half, reaching volumes that haven’t been seen since 2008. Many of these emails impersonate popular social networking sites and mail parcel services, and entice victims to click on links to web pages that may try to infect their PCs with malware. Some of this activity can also be attributed to advertising click fraud, where spammers use misleading emails to drive traffic to retail websites.

Emerging Technologies Create New Avenues for Attacks

New technologies such as mobile and cloud computing continue to create challenges for enterprise security.

• Publicly released mobile exploits rise 19 percent in 2011. This year’s IBM X-Force report focused on a number of emerging trends and best practices to manage the growing trend of “Bring your Own Device,” or BYOD, in the enterprise. IBM X-Force reported a 19 percent increase over the prior year in the number of exploits publicly released that can be used to target mobile devices. There are many mobile devices in consumers’ hands that have unpatched vulnerabilities to publicly released exploits, creating an opportunity for attackers. IT managers should be prepared to address this growing risk.
• Attacks increasingly relate to social media – With the widespread adoption of social media platforms and social technologies, this area has become a target of attacker activity. IBM X-Force observed a surge in phishing emails impersonating social media sites. More sophisticated attackers have also taken notice. The amount of information people are offering in social networks about their personal and professional lives has begun to play a role in pre-attack intelligence gathering for the infiltration of public and private sector computing networks.
• Cloud computing presents new challenges – Cloud computing is moving rapidly from emerging to mainstream technology, and rapid growth is anticipated through the end of 2013. In 2011, there were many high profile cloud breaches affecting well-known organizations and large populations of their customers. IT security staff should carefully consider which workloads are sent to third-party cloud providers and what should be kept in-house due to the sensitivity of data. Cloud security requires foresight on the part of the customer as well as flexibility and skills on the part of the cloud provider. The IBM X-Force report notes that the most effective means for managing security in the cloud may be through Service Level Agreements (SLAs) because of the limited impact that an organization can realistically exercise over the cloud computing service. Therefore, careful consideration should be given to ownership, access management, governance and termination when crafting SLAs. The IBM X-Force report encourages cloud customers to take a lifecycle view of the cloud deployment and fully consider the impact to their overall information security posture.

The IBM X-Force 2011 Trend and Risk Report is based on intelligence gathered by one of the industry’s leading security research teams through its research of public vulnerability disclosures findings from more than 4,000 clients, and the monitoring and analysis of an average of 13 billion events daily in 2011.

“In 2011, we’ve seen surprisingly good progress in the fight against attacks through the IT industry’s efforts to improve the quality of software,” said Tom Cross, manager of Threat Intelligence and Strategy for IBM X-Force. “In response, attackers continue to evolve their techniques to find new avenues into an organization. As long as attackers profit from cyber crime, organizations should remain diligent in prioritizing and addressing their vulnerabilities.”

You can learn more about IBM Security Solutions here.

IBM’s Virtual Desktop

Happy Monday.

I never published my picks for this week’s AFC and NFC championship games for the NFL, but I’m going to tell you them after the fact, and just to prove what an Honest Abe I am, I’m going to tell you the good and the bad.

First, I picked Green Bay over the Bears.  Chicago, you’re a wonderful city, if cold this time of year, but I just figured Green Bay QB Aaron Rodgers had the mo going into this game, and I was right.

However, I don’t agree that quickly replacing 2nd stringer Collins with Hanie was a bad idea, as Collins wasn’t getting it done, Cutler was already out, and Hanie went on to complete 13 of 20 passes for 153 yards AND lead two scoring drives.

As for the Jets and the Steelers, well, I had that one all wrong.  But then again, the Jets that showed up in ‘Burgh country were not the same team I saw beat up on the New England Patriots last week.  I don’t know what happened to that team, but my cheer for “Jets, Jets, Jets” was transformed into “Crash, Crash, Crash” to my friends on Facebook.

So, the Pittsburgh Steelers and the Green Bay Packers will play Superbowl XLV at Jerry’s House in Dallas.  Looking forward to it (and, as always, to the TV commercials, silly though many of them will likely be).

Now, back to business.  IBM made an announcement today worthy of a few pixels when we announced the Virtual Desktop for Smart Business, a new mobility offering that provides anytime, anywhere access to personal desktops from mobile devices (including tablets, netbooks, laptops, and thin clients).

This new IBM Virtual Desktop lets Windows or Linux desktops be hosted and managed centrally, which as most IT administrators would concede, can help lower the cost and complexity of managing PC environments as they deploy new apps and automagic software updates (and, in turn, help reduce help desk requests).

The new solution is flexible, in that the Virtual Desktop for Smart Business can be deployed on a customer’s own infrastructure or through an IBM Business Partner’s “private cloud” hosted environment.

IBM Virtual Desktop: Self-Configuring, -Healing, and -Protecting

The IBM Virtual Desktop has self-configuring, self-managing and self-protecting features that enable easy installation and management, plus continuous backup and recovery.

“IBM continues to tackle the needs of smaller companies with powerful solutions that are easy to install, easy to manage and priced right,” said Ken Espiau, Operations Director, Northcom Technologies, an IBM Business Partner. “With IBM’s Virtual Desktop offering, there’s only one console, one system and one implementation to make managing desktops much easier. Our clients can realize benefits of cost savings from the desktop of up to 40% while we’re able to gain a recurring revenue stream on back end management.”

The solution is offered as a pre-integrated, ready-to-run software package priced at $150 per user per year for a one year contract.

IBM Virtual Desktop will be delivered through IBM Business Partners who will provide local consulting, networking and software infrastructure skills to ensure smooth installation. An early adopter program drew strong channel interest with well over 100 IBM Business Partners actively providing feedback and preparing to use the program to tap into the growing demand for desktop virtualization solutions.

IBM Virtual Desktop for Smart Business is available today in North America, the UK, Germany, France, Italy, Spain, Belgium, Netherlands, Luxembourg and Poland (although the $150/user cost is subject to pricing variance local market depending).

IBM plans to make the offering available in China, India, Singapore, Australia and New Zealand at the end of the first quarter of 2011.

IBM Business Partners can take advantage of Virtual Desktop training and sales enablement resources here to get started providing solution bundles with System x server and storage configurations.