Origina's layered approach to IBM software security provides greater protection than a security patch can offer.

IBM Software Security

Origina uses a layered approach to cybersecurity that melds cutting-edge technology with forward-thinking strategy to deliver comprehensive security and protection against security vulnerabilities and threats. With IBM, customers get a security patch, if they're lucky.

Origina's layered approach to software security delivers better protection than IBM.

Origina uses a layered approach that adopts elements of the world’s leading cybersecurity frameworks to help customers protect IBM software and products divested to HCL Technologies from emerging threats. In doing so, companies avoid falling victim to a single point of failure – relying on vendor-supplied security patches that may never arrive – and implement an extensive system of checks and balances that greatly limits exposure.

What’s In Origina’s Layered Approach to Security?

Origina’s layered approach to cybersecurity begins during onboarding with a service transition review. Each security incident is reviewed through a risk assessment to identify what the vulnerability is, if the customer is affected and how Origina can mitigate the threat.

1. Service Transition Review

Origina’s holistic approach to cybersecurity starts on the journey to becoming a customer. The service transition review identifies potential concerns and threats to business operation before onboarding and because of this, companies see a drastic reduction in exposure to service disruption and security vulnerabilities in the future. 

2. Product Hardening

Product hardening guides enable security teams to identify and treat security and compliance issues at the architectural level of the software. Implementing these controls can vastly strengthen a product’s security and will limit exposure to 85 percent of all known vulnerabilities.

3. Vulnerability Advisories

Staying informed of the latest security vulnerabilities that impact a digital estate is critical to securing it. In the same way, companies are notified of application risks by the vendor, Origina’s proactive vulnerability advisories deliver timely notifications of emerging threats and actionable guidance on how to mitigate them. 

4. Origina Independent Solutions

The service transition review, product hardening and vulnerability advisories form a strong foundation for a layered approach to cybersecurity. Origina’s Independent Solutions fill any gaps that may still exist. Every security threat Origina encounters in a customer’s digital estate is treated through a risk-based approach. After identifying and assessing the vulnerability, Origina resorts to a series of possible solutions to resolve it. These include entitled fixes, vulnerability shielding, workarounds and independent code

What Are The Origina Independent Solutions?

Entitled Fixes

Origina’s first port of call for mitigating security risks will be to check whether an existing entitlement is available. Before departing the IBM support service, Origina will ensure that customers capture all their entitled software versions and patches. These are perpetually licensed and may be used after the customer leaves IBM S&S. If the customer was entitled to, and downloaded, an existing IBM supplied fix, the assigned Global IBM® Expert will provide the necessary advice and guidance as to the correct application to address the vulnerability.

Vulnerability Shielding

Using the open-source ModSecurity Web Application Firewall (WAF) and the Core Rule Set (CRS), Origina can shield companies from known and unknown vulnerabilities. The WAF monitors incoming traffic and parses out potential threats by matching the traffic against known indicators of vulnerabilities. Once it identifies behavior associated with exploiting vulnerabilities, it immediately stops that traffic – even if the vulnerability isn’t yet published or if a security patch isn’t yet available from the vendor.

Workaround

In those circumstances where an entitlement to an existing patch is not available, the independent Global IBM® Experts will look to develop a workaround for the software weakness. The term workaround refers to a solution which does not employ independently developed code in order to treat the weakness. Workarounds can take many forms, such as reconfiguration of the software product, disabling features and making changes external to the product itself. Workarounds can be more timely and effective in treating the identified issue.

Independent Code

Where a workaround can’t resolve a security vulnerability, Origina will turn to independent code. These are proprietary, bespoke scripts that function the same as an IBM security patch would, without infringing on IBM’s intellectual property or modifying the software’s source code. Every independent code solution undergoes a tried and tested process to ensure the result successfully mitigates the cyberthreat.

Origina's Risk-Based Approach to Mitigating Threats

Whenever a security vulnerability is identified, Origina follows a four-step, risk-based approach to evaluating its threat to customers and finding the method of mitigating it.

Origina's risk-based approach to mitigating threats begins with a risk assessment to evaluate the severity of the security vulnerability and determine whether customers are affected, as well as how it would be remediated.

A review and assessment of the identified vulnerability is conducted to evaluate if the customer is exposed.

Origina will always review the customer's existing IBM software license entitlements to determine if a fix or patch is already available to mitigate the security vulnerability.

The software entitlement repository is reviewed to check if an existing patch is available and was it captured during the onboarding process.

Origina's workarounds can deliver greater security and mitigate a threat by changing configurations or making adjustments to applications external to the IBM product itself.

Where an existing patch is not available, our independent Global IBM® Experts look to create a workaround to mitigate exposure to the vulnerability.

As a last option, Origina's Global IBM® Experts can use independent code to deliver a security patch without touching the source code of the IBM software.

Where no workaround is possible, our independent Global IBM® Experts will look to develop a code-based fix to mitigate the issue.

Southern California Edison is a utilities company and is a third-party support customer of Origina for IBM software.
Toyota is an international automobile manufacturer and is a third-party support customer of Origina for IBM software.
Walgreens Boots Alliance is a retail pharmaceutical company and is a third-party support customer of Origina for IBM software.
T-Mobile is a telecommunications company and is a third-party support customer of Origina for IBM software.
Banque de France is a French bank and is a third-party support customer of Origina for IBM software.
Dow Jones is an American publishing company and is a third-party support customer of Origina for IBM software.
Raytheon is a defense contracting company and is a third-party support customer of Origina for IBM software.
Airbus is an aviation manufacturing company and is a third-party support customer of Origina for IBM software.
Capital One is a financial services company and is a third-party support customer of Origina for IBM software.
Capgemini is a technology consulting company and is a third-party support customer of Origina for IBM software.
Fujitsu is a technology services company and is a third-party support customer of Origina for IBM software.
MetLife is an insurance company and is a third-party support customer of Origina for IBM software.