DATABASE SCANNER MANAGES SECURITY OF MICROSOFT SERVERS.

Internet Security Systems (ISS) (Nasdaq: ISSX), Atlanta, a provider of adaptive network security solutions, has introduced a new product, Database Scanner 2.0 for Sybase (NASDAQ: SYBS) Adaptive Server Enterprise, an innovative solution for proactively securing critical information assets stored in Sybase database management systems (DBMS). This additional support builds on Database Scanner's ability to automatically manage the security of Microsoft (NASDAQ: MSFT) SQL Servers. Database Scanner, an integral component of ISS' family of security assessment products, enables customers to proactively secure database servers, protecting critical electronic commerce and enterprise applications and services. Database Scanner 2.0 extends and complements ISS' leading network and host-based assessment systems to provide enterprise-wide vulnerability management. "ISS' Database Scanner will help our customers augment the existing features of their Sybase Adaptive Server installations to secure critical enterprise solutions, giving them better piece of mind and assurance that their

security is working," said Thomas Parenty, director of data and communications security for Sybase. "In addition, Database Scanner's ability to automate Year 2000 compliance and database administrative tasks will help reduce cost of ownership, saving valuable time and money." Rich Telljohann, product manager for ISS added, "Database Scanner 2.0 introduces powerful security audit, analysis, and reporting for Sybase Adaptive Server databases, and critical business applications built upon it. An organization's most valuable business resources are frequently stored in databases, including financial and accounting systems, eCommerce and intranet applications, and ERP systems. Database Scanner enables customers to safeguard these critical assets and maximize the security of database servers with quick expert analysis and detailed best practice recommendations." Customizable Security Policy Development and Enforcement Database Scanner enables customers to set and enforce customized database security policies that act as a rule set for determining appropriate database activity. Users can create multiple security policies specific to different database servers within a networked environment. After the security policy has been established, Database Scanner performs a thorough audit, comparing the policy to actual user activity resulting in an important baseline from which to measure and control security risks and facilitate continuous security improvement. Comprehensive Vulnerability Detection Database Scanner quickly and easily scans databases across the enterprise to detect a wide range of database-specific security vulnerabilities, fully assessing all of the security risks associated with the authentication, authorization and system integrity settings of database systems. Key areas of Database Scanner vulnerability detection include: - Year 2000 Compliance - Analyzes database environments and reports potentially devastating Year 2000 compliance conflicts in data and stored procedures. - Passwords, logins and users - Performs automated password strength analysis, tracks past users who still have login capabilities (i.e. stale logins) and checks the referential integrity of user names. - Permission Control - Determines who has access to stored procedures and alerts when there is a possible threat of database users gaining unauthorized permissions on Windows NT files and resources. It also checks for the existence of potentially dangerous "Trojan Horses" - programs that may be installed unknowingly to gather sensitive data needed to gain network access. Corrective Actions and Reports Enable Fast Elimination of Security Holes Once a database security audit is complete, Database Scanner provides expert analysis of the security profile with a series of graphical reports. Database Scanner also provides easy-to-understand corrective actions for eliminating security risks. Pricing and Availability Database Scanner 2.0 is available now for download from the ISS Web site at www.iss.net. The product has a starting suggested price of $995 per database server. About Internet Security Systems (ISS) Internet Security Systems (ISS) is the pioneer and leading provider of adaptive network security delivering enterprise-wide information protection solutions. ISS' award-winning SAFEsuite family of products manages security risks and enhances end user confidence in intranet, extranet and electronic commerce environments. By combining proactive vulnerability detection with real-time intrusion detection and response, ISS' adaptive network security system creates a flexible cycle of continuous security improvement, including policy implementation and enforcement. This comprehensive approach to network security strengthens the security of existing systems and has dramatically improved the security posture for organizations worldwide, making ISS a critical, trusted security advisor for firms in the Global 2000, 9 of the ten largest U.S. commercial banks and over 35 governmental agencies. For more information, call ISS at 678-443-6000 or 800-776-2362.