PoliVec Applauds Emphasis on Policy as the Center of a Secure Enterprise as Outlined in Government's National Strategy to Secure Cyberspace.

Business/Technology Editors

MOUNTAIN VIEW, Calif.--(BUSINESS WIRE)--Nov. 19, 2002

Company Feedback Cites Automated Creation and Enforcement of

Consistent Security Policies Among the Positives of White House

Strategy

To mark the close of the first 60-day comment period for the National Strategy to Secure Cyberspace, PoliVec, Inc., the trusted leader in security policy automation, today announced its support of elements of the strategy that promote the importance of written security policy within companies. The President's Critical Infrastructure Protection Board (PCIPB) introduced the comment period on September 18, 2002, when it released a draft of the National Strategy to Secure Cyberspace. The Board invited the National Infrastructure Advisory Committee, leaders from the concerned sectors of industry, academia, and state and local governments to submit their comments and advice to the strategy. According to the PCIPB, President Bush will review and approve the strategy over the next several months.

PoliVec CEO Roberto Medrano said, "This strategy provides an excellent framework for outlining the priorities for large enterprises as they work to establish secure systems. Its emphasis on the need for enterprises to focus on putting policies, procedures and technologies in place to address such risks as insider threats and misconfigurations and to improve incident response matches up to the realities that we are seeing in the marketplace. PoliVec's customers rely on our policy automation solutions to prevent these risks and to enforce enterprise security through a holistic policy-based approach."

Security-conscious companies are developing strategies for their corporate networks that are based on a set of written security policy standards. PoliVec's solutions provide these corporations with the missing link--automation--so that policy standards are not just established, but are implemented, audited, continuously monitored and enforced in real time.

The security policy automation process, in part, addresses key concerns that the Administration highlighted in the draft of the National Strategy to Secure Cyberspace. PoliVec supports the following excerpts from the strategy that outline the PCIPB's recommendations for large enterprises:

-- "Create a regular process to assess, remediate (sic), and monitor the vulnerabilities of the network; consider developing automated processes for vulnerability reporting, patching, and detecting insider threats."

-- "Effectively mitigating the insider threat requires policies, practices and continued training. Three common policy areas which can reduce insider threat include: (1) access controls, (2) segregation of duties, and (3) effective policy enforcement."

-- "Manage configuration to know exactly what hardware, operating systems and software are in use, including specific versions and patches applied."

About PoliVec

PoliVec is the trusted leader in security policy automation. PoliVec's innovative software enables companies to define, detect, deploy and document a consistent security policy across the enterprise. More than 80 customers have discovered that PoliVec delivers immediate security ROI by saving time, reducing system resources and offering unparalleled assurance for both internal and external audits. The PoliVec suite -- PoliVec Builder, PoliVec Scanner, and PoliVec Enforcer -- proactively detects and eliminates configuration vulnerabilities before they can be exploited. PoliVec continues to receive industry validation and recently won the 2002 "Best New Security Technology" award from SC Magazine. Headquartered in Mountain View, Calif., visit PoliVec at www.polivec.com.