Securing Offshore Remote Access

Question:
How to secure data and protect intellectual property while allowing remote access to remote consultants / outsourcing partners / offshore captive operations?

Answer:
This is a long procedural and legal discussion. Restriction of access for remote administrators / consultants / offshore centers is not an actual “productivity” solution, so there is a clear need for sharing data in an intelligent and secure way.
Recently I have seen several discussions on policy based governance and operational controls but I was disappointed with the available technical options. Most of the articles I have seen so far were limited with phrases like “We do use firewalls”, ”We have SAS 70” , “We have strong authentication” or “We do have encryption” type of over the counter canned answers. The most joyful one was (this was on an overseas web site describing how secure the outsourcing operations were) : “We do use SecureFTP”
Well, basic technical controls are nice, like using scrubbed test data, segmenting servers,  using strong auth, physical data center security, or using full VPNs..But, what if the requirement is to have real controls?

The technical controls can be deployed at 2 layers:
1-    Controls at the Offshore Center: Regardless of the desktop security controls, endusers at remote data centers can access and steal critical data, at the end of the day, who will stop them if they can take a 5 megapixel shot of their screens with their cell phones. So it is a good idea to have a CCTV / camera based monitoring where access stations are (All remote access should be limited to secured facilities where it is possible – try to avoid roaming laptop based remote workers). I use the term access station because it makes no sense to have regular desktops at offshore operational centers.  Using terminal server type of solutions are great but citrix/terminal server type of emulations do not work great for developers. I like virtual desktop infrastructure (VDI) for developers since it gives them full independence in a controlled environment.  Base station should be thin clients or must be managed (e.g. group policies with limited user rights) even if they are using the base station only for terminal session.
If you do not have a captive center, and you do not have the full control on remote desktops or you cannot enforce thin client stations or managed workstations, securing the other endpoint (where terminal connection/citrix/VDI term is run) is very difficult. On these cases, make sure that you require VPN connection from individual endpoints so that you can control split tunneling, and you can apply /enforce pre-auth/during-auth posture checks very much like a NAC. The idea is to enforce endusers to install a security applet before they login to your network and run cleaning prior to auth. Create onetime secure virtual workspace that expire at the end of the session. You may also create remediation and quarantine options for non-managed remote access.
When you are securing the remote offshore centers never skip the “air” piece. Roque AP detection is a key feature. Your remote switch must detect any attached device to network esp if it is working as a switch. Also your policies must limit usage of cell phones and other wireless gadgets.
Of course endpoint security is still a key, like using full group policies, firewall/IPS, antimalware, antivirus, encryption, rights management etc, but it is much better to have it on a VDI system. It is also easier to control peripherals on a VDI.
Non-repudiation is another important point. Like the physical camera, a secure remote tamper proof logging facility is highly recommended.
2-    Controls at the server level: Consultants / remote system administrators/ offshore developers do need to access servers in development, test and sometimes production environment. It is a mandate to enforce individual user identities, with full access audit. Actually you can steal the PCI requirements.  There are systems that record every single move (literally on a video file  - ObserveIT) of a remote administrator. Or you can basically deploy privilege escalation management systems integrated with jump servers (e.g. SSH proxies, Power Broker) Need to know access is essential, but even after policy decisions, make sure that every activity is logged at different layers (network layer, OS layer, DB layer and Application layer) Remote admins should never access to log settings or the log repository (tamper proof logging is the key). This is the time to put SIEM solutions in use. Write correlation rules to alert you when suspicious activity is detected.
Segmentation is another key, but today’s high speed computing makes network level firewalling very difficult. (If you have 100 servers with only 1 Gbps NICs, you will a 100Gbps full duplex firewall ,  and as of today there is no IPS). I do expect switch vendors to offer port based filrewalling / IPS in the very near future but not today unless you have 7 figures to spend. Either way segment your servers at network level as much as possible, Even if you are using VMware, categorize servers physically according to their risk levels. There are also creative solutions like Apani Networks, Rohati Networks (now Cisco), or the NAC vendors for network based segmentation using user identities. Basically segmenting users with their user IDs instead of their source and destination addresses is better. You can even utilize secure de


Again, none of the technical controls eliminate the need for governance, policy based controls and the risk management frameworks.
Full data life-cycle management, data privacy, data security, audit program, security management program (like ISO 27001)  are all essential. But technical controls do really help you to reach your security objectives.

Let me know if you have a detailed question

Regards,
-    Yinal Ozkan

Security awareness - what worked for you

Question:

I am interested to know from you guys what methods you have used to prick the consciousness of your end users - from the standard policy delivery & enforcement tools (e.g. neupart, policy matter, netconsent, et al), through posters & startup screens, right through to "guerilla tactics" rather like Chris Nickerson & hisd guys who did the job on the car dealer.

I had thought of gearing ideas around end user pain points - e.g. post-it notes with a PIN on a dummy credit card, etc. Interested in what low-cost ways others have used.

Thanks in advance guys

Answer:

........,

I have gone through several iterations of awareness initiatives. Web based, class based, print media based, campaign based you name it…

Information Security Practitioners usually skip a very important part of awareness programs, these programs are not security projects where you deliver a technical solution; awareness programs depend on the training component…

Here is the most important thing I learned: Adult psychology is different, you cannot train adults as you train kids.. When you put kids a in a class they simply listen and they learn. Adults never do, they keep questioning: “ Why I am here? Is this good for me? What will I lose if I do not listen? What is in it for me? etc”  The questions above must be answered within security awareness initiative since they will keep occupying the short focus of the of the adult minds during training..

So the important structural shift of awareness program initiative is that this is not a project, this not about a portal with multiple choice questions with diagrams, this is not about an application that pops-up,  this is about training, and the adult training rules apply.

Years ago, I was in charge of security awareness training  of a large trading house.. Participation of all employees was mandatory. Everybody in the class (pre WebEx days) thought this was yet another training, and the eyes were focused on the clock.. I started the conversation with, “I am reading all your e-mail” Well, I got the attention. The whole class got mad . But we had established the training rationale, everybody wanted to how and why I was able to read their e-mail , they were questioning on who else can read their e-mail. Until that moment most of them thought the problems were someone else’s.

In order to share create the  personal interest, the best way is to demonstrate vulnerability in day to day applications with live demonstrations (not the checklists, and the pop-quizzes) that employees can associate themselves individually.  The demo should not be about the millions that a distant company lost (yes we all heard about TJ Max) or powerpointing defaced web sites to death to bore sales team away. There must be personal interest in security awareness program. Unfortunately not too many people care about the greater good of their employers or the security teams…A salesperson will be more interested so see his CRM database being stolen using his own small blackberry.  Or displaying chain of evidence for intellectual property for design engineers, more examples can be given but I think everybody who has managed to read until this paragraph gets the idea; unless there is personal interest there won’t be success.

That being said classical program components like continuous improvement, cyclic approach, audit, measurement/metrics etc will help. ISO programs or the programs like neupart can be used as a good base program management.

-Regards,

-          Yinal Ozkan

Using Certificates for Authentication ? Where to store them ?

Question: 

Has anyone deployed a VPN solution that leverages user certificates for authentication?

We are considering the possibility of leveraging digital certificates as an authentication factor for VPN. Has anyone implemented this or looked at solutions that do this? We are not comfortable with solely relying on a certificate and the security/integrity of the PC as an authentication mechanism. If you are currently using certificates, I would be interested in hearing how you are deploying this.

Answer:

.....,

The short answer is yes.  We did deploy several off-the-shelf certificate based authentication solutions for remote access VPN systems such as Cisco, Check Point, Juniper, Citrix, Nortel.. It is again very possible to deploy similar solutions over SSL VPN solutions (This time easier since browser is the client).   I worked with Entrust as the PKI integration provider.  When using certs, most of the questions/problems are generic PKI related questions (CRLs,  OCSP, identity management etc)

9 out of 10, enterprise shops store the certs on PC or mobile devices since they want to avoid using tokens/smart cards. Using a 3^rd party storage is ideal but to be honest smart cards share the fate of PKI for complexity so many solution sets avoid tokens/smart cards, unless the policies mandate certificates.

When smart cards are more expensive/complex (readers, personalization etc) enterprises use USB tokens to store certificates. (Several companies  provide tokens with certificate support, ActivIdentity, Aladdin, Authenex, Entrust, SafeNet (merged with Aladdin) , RSA (RSA has a hybrid token for OTP + certs)).

If you would like to use smart cards as the certificate container, or use the same certs for physical security simultaneously, you can simple take one of the ready to use HSPD-12 Personal Identity Verification (PIV) Card solutions (http://fips201ep.cio.gov/apl.php) so that you can avoid designing all components architecture yourself.

Of course do it yourself path is more fun, technically it is straightforward to integrate certs with any 802.1x based authentication server but as you know it usually gets more complex. We have deployed a complete system for enrollment, biometrics, cards, CMS etc, (took 3+ years)

cheers,

-     - yinal ozkan 

Best way to stop malware from spreading in a large secure network

Question :What's the best way to stop malware from spreading in a large secure network with no internet connectivity and a multi-platform environment?

Even though the secure environment has no internet access and is on a controlled environment, external USB devices have been added to the network and viruses have been introduced. I'm trying to think of the best ways to stop such external threats being added to a secure closed network. I've got a few ideas bouncing around my head as I believe Antivirus software should be deployed on the workstations in case additional methods of malware introduction are given other that USB. The USB ports could be disabled on all workstations and then the external devices could be scanned before adding to the network. But I'm sure there could be other ideas so can someone offer some suggestions?

Answer:There are multiple approaches, but “the” best way will depend on the mix of your devices in your multi-platform environment (if you still have NT4s and ancient slackware linux copies the solutions you are looking at will be different) and your network status. If there is no internet connectivity naturally you should focus more on entry points (intranets, USB, CD, Floppy, Bluetooth, IR, Wi-Fi)

If you want to classify approaches, your solutions can be at 3 levels, host based, network based and hybrid.

1- Host Based:

a. Use a comprehensive “endpoint security” solution that will have

i. Port Control (USB, CD, Floppy, Bluetooth, IR, Wi-Fi, Ethernet etc)

ii. Encryption (file, disk, mail), key/cert management

iii. Firewall

iv. IPS

v. Antivirus (http and SMTP)

vi. Antispam, Phishing, Malware control (http, SMTP, SMS)

vii. URL filtering

viii. Application control

ix. File integrity Monitoring

x. Remote device management (in a secure manner :)

xi. Biometrics/TPM/SSO/802.1x support

b. Lock down the environment. Do not allow end users to modify any system settings. (e.g. use group policies on windows environment, security blanket on Linux etc)

c. Use point solutions start with port control, anti malware, AV, IPS, firewall . Monitor system resource utilization you may kill endpoints by multiple clients

d. Get physical; super glue all USB ports, remove the CD Drives, break IR sensors, turn off the radios.

e. For old unsupported platforms, deploy file integrity monitoring on critical areas (e.g. tripwire)

f. Use a big brother monitoring tool like Raytheon Oakley’s SureView (check with legal first : )

2- Network Based:

a. Use IPS on the network. IPS will alert you on suspicious traffic you that you can take action faster. If the network traffic is encrypted, IPS will not be very helpful. You may consider decrypting traffic but the solution is a topic for another post

b. Use anomaly detection tools. I really like using these tools; they are my most favorite malware detection solutions. They can either sniff traffic over taps or get flow data. Good solutions are Q1 Labs, Mazu (now Riverbed Cascade).. But any netflow tool will help

c. Segment your network with firewalls

d. Do not allow all protocols (who needs IPX, NetBeui, AppleTalk, SNA anyway : )

e. Use ACLs on network devices. Only allow known ports, lock down network for SRC/DST APP based access rules

f. Monitor Airspace… Make sure that nothing flies out /comes in via wi-fi/Bluetooth et al. I can recommend several tools.

3- Hybrid

a. Use Network access control (NAC). You can have all the security in the world until the cable guy plugs-in his laptop to the Ethernet port in the cafeteria.

b. Use an agent-less scanning tool. Compare all hosts, applications vs your approved gold copies. Monitor all malware constantly from remote. My favorite is Promisec. But you can even use Microsoft SMS

c. Never forget the phones, the smartphones, VOIP phones are the new hosts for the virulent outbreaks/pandemic

If you have a specific question please let me know.

Regards,

- Yinal Ozkan

The "Cyber" Word

I got the following e-mail from one of my peers.
==================
From: Chris Camejo
Sent: Sunday, October 04, 2009 2:19 PM
To: ---------------------
Subject: Cyberwords
I saw this “Cybersecurity” article on CNN and the ridiculous overuse of cyberwords is good for a chuckle:
http://www.cnn.com/2009/POLITICS/10/02/dhs.cybersecurity.jobs/index.html
Apparently the government wants a “cyberczar” and more “cyberexperts” to work as “cyberanalysts” to protect “cybernetworks” from “cyberthreats” and engage in “cyberwarfare” so they can be a an effective “cyberorganization”. Yes, all of those words were really used in the article.
It scares me that there are people making decisions in government who write stuff like that.
-Chris
=====================
I could not agree more.

Every time I see an acronym or a government program that starts with “cyber” prefix I get irritated. I quickly associate the misapplication of the “cyber” prefix with ill-thought, wrong- footed, erroneous information security initiatives – cybersecurity, cyberczar, cybercop, cyberspace and the list goes on…Even my MS Word spell check doesn’t like them. This (using cyber prefix) simply takes the meaning of many serious topics that we are working on by diluting the significance, to the point of serious confusion to everyone except the small number of cyber experts : )

It is also very interesting that only state and federal agencies use “cyber”

The word cyber entered English language in 1991 as “of, relating to, or involving computers or computer networks” according to Merriam-Webster.

The reason I cannot associate cyber is that etymologically it is wrong. Cyber prefix is derived from cybernetics. Cybernetics as a concept in society has been around at least since Plato used it to refer to government. Maybe that is why the government today likes to use it. In modern times, the term became widespread because Norbert Wiener wrote a book called "Cybernetics" in 1948. The study is described as the science of communication and control theory that is concerned especially with the comparative study of automatic control systems (as the nervous system and brain and mechanical-electrical communication systems) Cybernetics is an established interdisciplinary science not a sci-fi flick or an internet buzz word (http://en.wikipedia.org/wiki/Cybernetics) ) The word comes from Greek “kybernetes” pilot, governor (from kybernan to steer, govern) + English –ics.

So what is the relationship between Internet and Cyber? I do not see a real one ..Maybe it is the cyborgs which is a combination of cybernetic + organism.

-yinal

Web Application Security Tools

I have been checking tools for a while for web application security engagements. Here is my list for web application scanners, test tools, proxies, source code analyzers, web application firewalls, XML SOA gateways (I will crosscheck methodologies in another post)


Remote Web App Test Tools and test proxies
1- SPI Dynamics WebInspect  - Now HP Webinspect - https://h10078.www1.hp.com/cda/hpms/display/main/hpms_content.jsp?zn=bto&cp=1-11-201-200^9570_4000_100__
2- Sanctum then Watchfire AppScan - Now IBM Rational AppScan -  http://www-01.ibm.com/software/awdtools/appscan/
3- Kavado Scando - Now Protegrity - http://www.protegrity.com/DefianceSecuritySuite
4- AppSecInc AppDetective Pro - http://www.appsecinc.com/products/appdetective/index.shtml
5- Cenzic Hailstorm - http://www.cenzic.com/products/software/overview/
6- NT Objectives NTOSpider http://www.ntobjectives.com/products/ntospider.php
7- Acunetix Web Vulnerability Scanner http://www.acunetix.com/vulnerability-scanner/
8- Burp Suite -proxy-  http://www.portswigger.net/
9- Sandsprite Web Sleuth - http://sandsprite.com/Sleuth/about.html
10- Positive Technologies MaxPatrol 7 - http://www.ptsecurity.com/mp_eval.asp
11- NGS Typhon III - http://www.ngssoftware.com/products/internet-security/ngs-typhon.php
12- Parasoft http://www.parasoft.com/jsp/solutions/soa_solution.jsp?itemId=319#web_iface_penetration
13- Hyperscan -Art of Defense - http://www.artofdefence.com/en/hyperscan/hyperscan.html
14- HP Assessment Management Platform software - https://h10078.www1.hp.com/cda/hpms/display/main/hpms_content.jsp?zn=bto&cp=1-11-201-200^9580_4000_100__
15- nCircle - http://www.ncircle.com/index.php?s=products_webapp360
16- Qualys - Web Application Scanning - http://www.qualys.com/solutions/web_application_scanning/
17- Foundstone - Now McAfee Vulnerability Manager - http://www.mcafee.com/us/enterprise/products/risk_and_vulnerablity_management/vulnerability_manager.html
18- Nessus - Tenable Security - http://www.tenablesecurity.com/nessus/
19- Syhunt SandCat http://www.syhunt.com/
20- Saint - No Web App Customization - http://www.saintcorporation.com/products/vulnerability_scan/saint/saint_scanner.html
21- MileSCAN Web Security Auditor (WSA) - Paros Proxy - http://www.milescan.com/hk/ , http://www.parosproxy.org/index.shtml
22- N-Stalker Web Application Security Scanner http://www.nstalker.com/products
23- Nikto - Open Source (GPL) web server scanner  http://www.cirt.net/nikto2
24- Canvas (formerly SpikeSecurity) - http://www.immunitysec.com/products-canvas.shtml
25- WebScarab -proxy-  http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project
26- Odysseus - proxy- http://www.bindshell.net/tools/odysseus
27- CoreImpact - http://www.coresecurity.com/content/core-impact-overview
28- Metasploit - http://www.metasploit.com/
29- Wikto - http://www.sensepost.com/research/wikto/
30- Proventia Scanner (formerly ISS) -http://www-935.ibm.com/services/us , http://www-935.ibm.com/services2
31- e-Eye Retina Web Scanner http://www.eeye.com/html/products/RetinaWebScanner/index.html
32- SQL Power Injector http://www.sqlpowerinjector.com/
33- Sensepost BiDiBLAH - Security Assessment Power Tools (not sure for Web App features)   http://www.sensepost.com/research/bidiblah/
34- The Security Auditor's Research Assistant (SARA) - http://www-arc.com/sara/
35- Founstone Tools - http://www.foundstone.com/us/resources/freetools.asp
36- Wapiti Web application vulnerability scanner / security auditor - http://wapiti.sourceforge.net/
37- Curl - httptools, not a scanner - http://curl.haxx.se/
38- Stanford SecuriBench - http://suif.stanford.edu/~livshits/securibench/
39- Fiddler Proxy - http://www.fiddler2.com/fiddler2/
40- Pantera - another spikeproxy- http://www.owasp.org/index.php/Pantera
41- Suru - proxy from sensepost - http://www.sensepost.com/research/suru/
42- Charles Proxy - http://www.charlesproxy.com/
43- Burp, Paros, and WebScarab for Mac OS X - http://www.corsaire.com/downloads/
44- RatPrxoy from Google http://code.google.com/p/ratproxy/
45- JS Proxy - for javascript - http://jscmd.rubyforge.org/
46- OWASP Phoenix Chapter - Another List of Tools : http://www.owasp.org/index.php/Phoenix/Tools



Source Code Analysis
1.Coverity Integrity Server / Prevent -http://www.coverity.com/products/coverity-prevent.html
2.Escher Technologies Eschertech  - http://eschertech.com/
3.Fortify Software Suite (analysis, workbench, metrics & trending console, customization module) http://www.fortify.com/products/fortify-360/vulnerability-detection.jsp
4.Gimple PC and Flexe-Lint C/C++  -http://www.gimpel.com/html/products.htm
5.Grammatech CodeSurfer C/C++ - http://www.grammatech.com/products/codesurfer/overview.html
6.Ounce Labs - Now IBM - http://www.ouncelabs.com/application_security/
7.Parasoft JTest  Parasoft Application Security- Java Static Code Analysis - http://www.parasoft.com/jsp/products/home.jsp?product=Jtest
8.Secure Software CodeAssure Workbench C/C++, Java (Now Fortify)
9.Veracode - http://www.veracode.com/solutions
10.Armorize Codesecure - http://www.armorize.com/?link_id=codesecure
11.Klocwork Insight/Solo http://www.klocwork.com/products/product-comparison-matrix/
12.Hypersource - Art of Defense - http://www.artofdefence.com/en/hypersource/hypersource.html
13. PHP Pixy - http://pixybox.seclab.tuwien.ac.at/pixy/
14. BFBTester: Brute Force Binary Tester - http://bfbtester.sourceforge.net/
15. CROSS (Codenomicon Robust Open Source Software)  -http://www.codenomicon.com/solutions/cross.shtml
16. Flawfinder - C/C++ source code - http://www.dwheeler.com/flawfinder/
17. Gendarme -.NET applications and libraries - http://www.mono-project.com/Gendarme
18. Stanford SecuriBench -open source - http://suif.stanford.edu/~livshits/securibench/
19. OWASP Phoenix Chapter - Another List of Tools : http://www.owasp.org/index.php/Phoenix/Tools




Web Application Firewalls:
I am excluding network firewalls with deep inspection features such as Cisco, Juniper, Check Point, Fortinet

F5- ASM -Application Security Manager - http://www.f5.com/products/big-ip/product-modules/application-security-manager.html
Breach Security - http://www.breach.com/products/
Imperva - SecureSphere -http://www.imperva.com/solutions/web-application-security.html
Cisco ACE Web Application Firewall http://www.cisco.com/en/US/products/ps9586/index.html
White Hat Sentinel (add-on for F5, Imperva, Breach) - http://www.whitehatsec.com/home/services/waf.html
Citrix NetScaler http://www.citrix.com/English/ps2/products/product.asp?contentID=25636
Protegrity WAF - http://www.protegrity.com/WebApplicationFirewall
Fortify Real Time Analyzer RTA - http://www.fortify.com/products/detect/
AQtronix for IIS  - http://www.aqtronix.com/?PageID=99
DenyAll rWeb - http://www.denyall.com/products/rweb_en.html
Applicure DotDefender - http://www.applicure.com/About_dotDefender
Armorlogic Profense - http://www.armorlogic.com/
Bee Ware i-Sentry http://www.bee-ware.net/en/product/i-sentry/
BinarySec (French) http://www.binarysec.com/cms/docs/products/products.html
BugSec WebSniper http://www.bugsec.com/index.php?q=WebSniper
e-Eye SecureIIS http://www.eeye.com/html/products/secureiis/index.html
webscurity web.AppSecure http://www.webscurity.com/products.htm
Phion Airlock http://www.phion.com/INT/products/websecurity/Pages/default.aspx
Radware AppWall http://www.radware.com/Products/ApplicationDelivery/AppWall/default.aspx
Hyperguard - Art of Defense : http://www.artofdefence.com/en/hyperguard/hyperguard.html
Barracuda Web Application Firewall - http://www.barracudanetworks.com/ns/products/web-site-firewall-overview.php

XML Firewalls
Radware AppXML http://www.radware.com/Products/ApplicationDelivery/AppXML/default.aspx
DataPower (now owned by IBM) - WebSphere DataPower SOA Appliances -http://www-01.ibm.com/software/integration/datapower/
Reactivity, Inc. (acquired by CISCO), The Cisco ACE XML Gateway - http://www.cisco.com/en/US/products/ps7314/index.html
Forum Sentry XML Gateway  - http://www.forumsys.com/products/index.php
Layer 7 Technologies' SecureSpan XML Firewall - http://www.layer7tech.com/main/solutions/firewalling.html
Vordel XML Gateway - http://www.vordel.com/products/vx_gateway/
Dajeil - http://www.dajeil.com/Products.asp
Sarvega (now owned by Intel) Intel SOA Expressway - http://www.intel.com/cd/software/products/asmo-na/eng/373233.htm
Bloombase Spitfire Security Server - http://www.bloombase.com/products/spitfire/index.html
Sonoa http://www.sonoasystems.com/product-matrix#anc-security
inferno - opensource - http://ixmlfirewall.sourceforge.net/
DAXFi - Dynamic XML Firewal - Opensource - http://sourceforge.net/projects/daxfi/

open for feedback,
- yinal ozkan

RSA Conference Notes (US 2009)

Better late than never...

During the RSA conference (April 2009) organizers had flip cameras for us (where they announced over twitter)
Instead of  typing/blogging my notes, I experienced the "vlogging" which was easy. Here are RSA edited notes from RSA Conference web site:

Part I
Part II
Part III

Sometimes it is positive to see and hear the author, sometimes it is not. But as far as I see we should better not hide behind anonymous posts. I think that we can communicate better with the new gadgets offered us literally at no cost.


cheers,
- yinal

IT Governance, Risk and Compliance (ITGRC) Tools August 2009

For 2011 list follow this link

Here are the updated links for the IT-GRC vendors, IT-GRC wanna be GRC vendors, and some IT based risk management tool/software providers.

There is still a thin line between IT, Financial and ERP GRC solution providers.

I have noticed that SAP has created its own GRC context where GRC means a lot of other things... SoD- Segregation of Duties, entitlements management, users access/authorization for applications/transactions, audit managment, role management etc.Basically a dull extention of IT audit controls. SAP's Virsa and SUN's Vaau acqusitions are good examples of this trend. That is not GRC -- that is mediocre IT controls audit. The term GRC is used without any consideration. This statement is also valid for the other usual suspects l(Oracle, PeopleSoft, Hyperion, JD Edwards,)

Here is a quick M&A update from last post:
Brabeion is acquired by Archer (Big News)
Controlpath is acquired by Trustwave.
Paisley is acquired by ThomsonReuters
Iconium is acquired by Logicalis
IBM dropped their own suite and working with Modulo
Favored GRC has a new name Highpoint GRC
Achiever is gone
I looked at ACL, Approva,Aveksa,Opentext,SecurityWeaver, Xpandion, Spatiq solutions,, I will be checking these vendors in the future, these solutins tend to manage ERP security only)..


IT-GRC solution Providers:

Agiliance
http://www.agiliance.com/
Archer ( acquired Brabeion)
http://www.archer-tech.com/solutions/index.html
Trustwave GRC
https://www.trustwave.com/GRC.php
Symantec (Control Compliance Suite)
http://eval.symantec.com/mktginfo/enterprise/fact_sheets/b-datasheet_control_compliance_suite_9.0-11_2008_14121573.en-us.pdf
Compliance Spectrum
http://www.compliancespectrum.com/
Modulo
http://www.modulo.com/home.jsp
NeIQ
http://www.netiq.com/solutions/scm/default.asp
eIQ Networks SecureVue
http://www.eiqnetworks.com/products/SecureVue/SecureVue_Technology.shtml
CA GRC
http://www.ca-grc.com/
Relational Security - RSAM
http://www.relsec.com/rsam_overview.htm
Logicalis grace (acquired Iconium Assets)
http://www.uk.logicalis.com/business_issues/governance_grace.asp
Lumension (acquired Security-Works)
http://www.lumension.com/landing.spring?contentId=154643
Oracle (formerly Logical Apps and Oracle GRC Manager)
http://www.oracle.com/solutions/corporate_governance/it-grc-management.html
Proteus
http://www.infogov.co.uk/proteus_enterprise/index.php
BPS
http://www.bpsinc.com/
Avedos
http://www.avedos.com/257-Home-EN.html
BWise
http://www.bwise.com/
Neupart
http://www.neupart.com/
Metric Stream
http://www.metricstream.com/
Nemea
http://www.nemea.us/
Highpoint
http://www.highpointgrc.com/
Paisley (now Thomson Reuters)
http://www.paisley.com/
OpenPages
http://www.openpages.com/Solutions/Technology_17.asp
Qumas
http://www.qumas.com/products/index.asp
IDS Scheer
http://www.ids-scheer.com/us/en/ARIS/ARIS_Solutions/Governance_Risk__Compliance_Management/139893.html Axentis
http://www.axentis.com/offerings/solutions/itgovernance
Methodware
http://www.methodware.com/it-security/
Protiviti
http://www.protiviti.com/grc-software/Pages/default.aspx
Cura Software
http://www.curasoftware.com/pages/content.asp?SectionId=7&SubSectionID=48
Mega
http://www.mega.com/index.asp/l/en/c/grc
ControlCase
http://controlcase.com/it-grc.htm
McAfee Risk and Compliance Manager (formerly McAfee Preventsys),
http://www.mcafee.com/us/local_content/white_papers/dashboard_reporting_it_grc.pdf
Greenlightcorp (SAP GRC)
http://www.greenlightcorp.net/sap_grc_cross_platform.html
Trintech -Financial GRC only
http://www.trintech.com/
SAI global
http://www.saiglobal.com/compliance/grc-software/
SAP
http://www.sap.com/solutions/sapbusinessobjects/large/governance-risk-compliance/index.epx
eFortresses
http://www.efortresses.com/Compliantz.htm
Simeio Solutions GRCAXS (IT GRC module)
http://www.simeiosolutions.com/
Compliance 360 ( eGRC )
http://www.compliance360.com/news.asp

There are also dedicated Risk Management Tools which will soon identify themselves (maybe they already do) for IT GRC marketspace
Callio
http://www.callio.com/
Casis
http://www.clearpriority.com/ (clearpriority)
Strategic Thought Active Risk Manager
http://www.strategicthought.com/riskmanagement.html
Cobra
http://www.riskworld.net/
Citicus
http://www.citicus.com/oursoftware.asp
Alion – Countermeasures (makers of Buddy System)
http://www.countermeasures.com/
Siemens – CRAMM
http://www.cramm.com/
Acuity Stream
http://www.acuityrm.com/
EAR/Pilar
http://www.ar-tools.com/en/index.html
GStool (mainly German)
https://www.bsi.bund.de/cln_136/EN/topics/ITGrundschutz/ITGrundschutzGSTOOL/itgrundschutzgstool_node.html Sigea GxSGSI (this site is in Spanish only)
http://www.gxsgsi.es/
RA2
http://www.aexis.de/index.php?site=static&staticID=4
RiskPAC
http://www.cpacsweb.com/riskpac.html
Risicare (French)
http://www.risicare.fr/
Riskwatch
http://www.riskwatch.com/
ISmart
http://www.biznet.com.tr/english/ismart_info.htm
Resolver
http://www.resolver.ca/
RMStudio
http://www.riskmanagementstudio.com/
RiskConnect
http://www.riskonnect.com/riskonnect_products.html
PTA Risk Assessment Tools and Technology
http://www.ptatechnologies.com/
Avedos Risk2Value
http://www.avedos.com/111-Short-Facts.html
Non-IT Risk Software
http://www.riskworld.com/SOFTWARE/sw5sw001.htm

I still need time to add URL links for the well known risk assessment methodologies. A little bit googling will take you to the right resources if you want to build your won system using a methodology or a framework.
Methodologies for Risk Assessment and Management listed below can be used at IT operations... Endless discussion for quantifying the risks... I like ISO 27000 series to lead, but each case is different.

ISO 14971 – Risk Management for Medical Technologies
NIST 800-30 Risk Management Guide for IT Systems - National Institute of Standards and Technology
OCTAVE (Carnegie Mellon)
The Institute of Risk management (IRM) The Risk Management Standard
ISO 13335-2 Information Security Risk Management, To be replaced by ISO/IEC IS 27005
BS 7799-3:2006 Information security management systems. Guidelines for information security risk management
BSI Grundschutz Handbuch
ENISA Regulation (2004)
PARA - Practical application of risk analysis
PTA - Practical Threat Analysis for Securing Computerized Systems
Austrian IT Security Handbook
Federal Financial Institutions Examination Council’s (FFIEC) IT handbook covers information security risk assessment
Threat and Risk Assessment Working Guide from The Government of Canada Security Policy
CRAMM - British Office of Government Commerce or The CCTA's (Central Computer and Telecommunications Agency) Risk Analysis and Management Method
Afhankelijkheids- en Kwetsbaarheidsanalyse (Dutch A&K)
EBIOS (French Government)
FRAP: Facilitated Risk Assessment Process
ISF –IRAM : Information Security Forum Ltd. Information Risk Analysis Methodologies . Also check FIRM (Fundamental Information Risk Management), SARA (Simple to Apply Risk Analysis) , SPRINT (Simplified Process for Risk Identification)
CLUSIF MEHARI - Club de la Sécurité de l'Information Français
Calpana CRISAM
Securitree from Ameneza
OSSTMM RAV (RAV stands for Risk Assessment Values)
SOMAP - Security Officers Management and Analysis Project
FAIR Factor Analysis of Information Risk
DRAM Delphic Risk Assessment Method
Buddy System
AS/NZS 4360 (2004) Risk Management. Australia/New Zealand standard for risk management

There are also Compliance Management/SIM/SIEM solutions which partially present GRC.
Here are a few links:

Tivoli Security Compliance Manager
http://www-01.ibm.com/software/tivoli/products/security-compliance-mgr/
Novell Compliance Management Platform
http://www.novell.com/products/compliancemanagementplatform/
Easy2comply (formerly Dynasec)
http://www.easy2comply.com/
AlertLogic
http://www.alertlogic.com/
NetForensics
http://www.netforensics.com/compliance/
Arcsight
http://www.arcsight.com/solutions/solutions-compliance/
RSA enVision
http://www.rsa.com/solutions/compliance/datasheets/9373_ISOENV_DS_0408-lowres.pdf
Intellitactics
http://www.intellitactics.com/int/solutions/compliance.asp

Actually all SIM SIEM vendors have a compliance management solution. For their list you can check the following post:
http://security.24kasim.org/2008/12/differentiation-of-log-management.html