My kids' Dad

Published again!

Finally back from a long vacation which was fantastic. I'll reflect on that in upcoming posts.

Network Magazine just published a second article I wrote called Take My Social Security Number--Please! The last article generated plenty of controversy including a topic on SlashDot. We'll see how this one fares, since I had encountered plenty of reaction to these ideas previously, often a knee jerk government or privacy concern fare, I expect plenty from this as well. What I didn't realize was how much mail I had to answer from the publisher on the last article.

I was also interviewed by Susan Schaibly of Network World Magazine in an article that spotlights network engineers who blog. Don't miss the link for other interviewed bloggers.

Welcome IT blogs!

Cisco gets some comeuppance. Among many of those who know and work with Cisco products it is widely recognized that Cisco doesn't write good software and doesn't have serious security products. Try to use CiscoWorks or PIX to manage an enterprise and you will know what I mean. But it is rare that you read in the trades such frank criticism. Jim Rapoza:

But this over-the-top product placement for Self-Defending Networks and many of the other pitches coming from Cisco only serve to remind me of how much of a novice Cisco really is in the world of high-level enterprise security.

Something that recently caught my attention is the abundance of blogs by many of the writers in the trades. Nicholas Carr has an opinion piece in eWeek that continues his discussion about IT being analogous to electrical utility where IT will outsource infrastructure and become a simple variable cost. The article mentions Nicholas Carr's most excellent blog which looks at IT from a business perspective.

Ephraim Schwartz's column also digs into the future of IT - If you demand routine be forewarned:

... work that is likely to stay in-house includes large-scale system-integration projects, highly iterative development processes, work that crosses multiple disciplines, work that requires a high degree of interaction with end-users or clients, and applications with complex procedures, such as those that require frequent manual intervention and data fixes.

Projects that require a high level of creativity, insight, innovation, and thinking outside of the box are also likely to stay onshore, as are jobs requiring process design and business analysis; technology and systems integration; and fusion of industry knowledge with a high level of IT skills.

Another blog that I noticed is Winn Schwartau's. In Network World he has joined the chorus of IT professionals that is singing the praises of Mac and OSX. The recent spate of testimonials is noticeable and generating a lot of emotion. IT professionals tend to be pretty logical and dispassionate except when it comes to certain areas like operating systems. I have had years of experience with Windows and Macintosh (and other OS's like OS2 and GeoWorks...) and understand the affinities but have long ago learned to view OS's as not worth my emotional attachment. (To many this is a heretical statement.) All of that being said I believe that Mac offers a platform that under the right conditions is more secure, more stable, easier on users and far less expensive for an enterprise.

Mark Gibbs also is a favorite writer of mine and offers a blog as well. In a recent column he too has recently come to discover the beauty of Macintosh but doesn't dwell under any misconceptions about its infallibility.

But Dave Kearns digs his heels in on Macintosh. Well... somebody has to keep out the infidel.

Beware the Trades of May

Get the Balance Right eWeek May 16, 2005

Smart companies are now multisourcing - contracting with multiple vendors to provide services so that they don't fall prey to vendors who get lax in staying lean and competitive. Single point vendors are prone to treat themselves as a monopoly as their services become difficult to replace. This leads me to consider why companies turn to outsourcing. Sometimes it simply just makes good economic sense We don't build our own corporate automobiles, why should we build other IT components from scratch? If you have just a few firewalls - it is simply too expensive to have your own trained staff monitor them 24 x 7. But there are other reasons - bad reasons to outsource such as poor upper management governance and leadership which results in poor overall management governance. When executives lose faith in their managers and staff they will turn to an outsourcer to provide credibility:

Replacing GM's own internal IT with that of an external provider merely cloaked the same management problems in a different garb.

Technical professionals have great anxiety about outsourcing - but these technical people are usually in the greatest demand and normally find a position waiting for them as a result of outsourcing either as a new employee at the service provider or in managing projects that require an understanding of the business needs. Management however is taking a large risk in shifting the skills requirements for managing large outsourced contracts managing external provider places far greater demands upon management from contract creation to compliance and measurements as well as additional and unexpected security risks.

The French Connection eWeek May 16, 2005

Even the outsourcers admit that you should be careful about your cost savings expectations:

Citing one CIO's experience, Unilog executive committee member Jean-Pierre Parra asserted that people tend to outsource what they don't know very well. However, Parra continued, it makes more sense to outsource what you do know well—that way, you can manage the relationship better. Parra also cautioned against seeking instant payback. "It's a myth that it's possible to cut costs immediately," he said. "It takes several years to realize real economies."

Failure Must be a Part of the Plan SC Magazine May 2005

It is hard for me to usually get passed Richard Clarke's highly politicized rhetoric but in this article I find myself agreeing with many of his statements (perhaps because he is no longer trying to influence an election?):

With most of the nation's critical infrastructure owned by private companies, part of the onus falls to companies' C-level executives to be more proactive about security. "The first thing that corporate boards and C-level officials have to accept is that they will be hacked, and that they are not trying to create the perfect system, because nobody has a perfect system," he says.

"Organizations have to architect their system to be failure-tolerant and that means compartmentalizing the system so it doesn't all go down... and they have to design it in a way that it's easy to bring back up," he says.

Relying too heavily on perimeter security and too little on additional host-based security will fall short, says Clarke. Organizations, both public and private, need to be much more proactive in protecting their networks from internal and external threats. "They spend a lot of money thinking that they can create a bullet-proof shield," he says. "So they have these very robust perimeters and nothing on the inside."

If he keeps talking this way I might have to buy one of his books...

No End in Sight ComputerWorld May 16, 2005

Frank Hayes talks about IT as a commodity and outsourcing comparing Nicholas Carr's analogy between IT and electrical generation 100 years ago. At one time individual companies generated their own electricity but then as the electric grid developed companies found it more reasonable to purchase electricity. While Hayes further analyzes this analogy - I can't help but consider that electrical micro generation is the next version of the electrical grid.

Trades - Opening, Removing and Wireless

CIO Magazine - February 15, 2005

How to Open the Kimono Safely

Hossein Eslambolchi, ATT CIO and CTO, discusses how ATT has opened their network to customers - very much an example of deperimeterization drive by business.

In addition to designing a data services layer and an application layer (which runs Web services), AT&T has a separate presentation and security layer. Eslambolchi and his team then further divided things into zones.

"You have to build a security infrastructure around the network, with clearly segregated security by application, by port, by customer, by service," says Eslambolchi. "You cannot take security lightly. It's not just a connection to the Internet—it's a connection to the AT&T network."

Although few ... are willing to discuss the specifics of how they address security, they all agree that it's a critical success factor when you're allowing outsiders access to internal systems—making a more open customer access system possible and profitable.

Nice Doing Business with You

This series on enterprise value awards focuses on the value of a self-service model for customers which increases customer loyalty and retention.

So whenever you can remove a human from the equation in a routine business process, you reduce the risk of error—and generally increase efficiency and reduce transaction costs to boot. "The trend is toward removing the bottleneck of human intervention from processes," says Esteban Kolsky, a Gartner research director who focuses on customer service and CRM.

Four of this year's Enterprise Value Award winners ... has given customers access to their back-end systems, whether through online portals or through direct links to customers' own systems. By making themselves easier to do business with, they've made customers happier—and gotten more of their business.

If eliminating the need for human involvement on one side of the equation is good for routine transactions, removing humans on both sides of the equation can yield even greater efficiencies. ... three of the Enterprise Value Award honorees are taking that extra step of allowing their customers' systems to link directly into theirs, yielding efficiencies for company and customer alike.

Expect business value to trump security - the smart businesses will always try to identify risk and then manage it. Barnett offers a very smart analogy between business and security:

Pol-mil refers to political-military, and it's a term of art to remind the economic world that security is the "everything else" they (the business types) tend to forget, just like the Pentagon tends to ignore the "everything else" beyond war.

This also can be applied to many security practitioners today, replace "the Pentagon" with "information security". No one wants to be a casualty in a war...

The other aspect we need to remember when 'eliminating human involvement' is that not only are we reducing errors and increasing speed we are also at risk of increasing risk - do we just pay whatever bill is sent our way? Or do we look at those bills to make sure they are right?

Ready, Aim, Fire!

Hardly politically correct, Michael Schrage gives us a dose of what many of us miss:

Nothing boosts morale or heightens concentration quite like the public firing of an individual who everyone knows is a persistent obstacle to discipline, collaboration, quality and ethics during an implementation. That these individuals have been able to flourish in your organization is a reproof to all your posturing about IT excellence and professionalism.

The culture was very polite and non-confrontational. Too polite. It frequently took weeks to get to the guts of a process design conflict. My professional opinion was that these delays were unhealthy and unproductive.

Even ditching 'star performers' can lead to overall improvements in productivity and employee morale. There are also cultures however that are doomed to extinction.

The Future of Wireless according to CIO and Business 2.0

New Way of Wireless

Cellular technologies are slowly increasing bandwidth from a painfully slow 30 kbps to an improved 300 kbps. But even that is dwarfed by new technologies and 'fixed based' systems.

Step out of the current network schemes, and you'll find even more options, such as Flash OFDM, a proprietary technology from Flarion Technologies that the company claims can offer real-world speeds of up to 1Mbps for users in motion and greater than 1Mbps for those not moving.

Based on the recently approved IEEE 802.16d standard, fixed WiMax has received a lot of attention lately as a wireless replacement for DSL, cable or T1 lines.

The technology provides connection speeds up to 10Mbps over five miles, says Jim Johnson, Intel's vice president of wireless networking, who expects to see technology trials this spring. "WiMax will stand out as a fixed wireless broadband solution."

And the IEEE 802.16e standard that supports mobile WiMax won't be finalized until 2006, so wireless carriers are also being cautious.

55% of large U.S. businesses will deploy a wireless wide-area data solution by mid-2006. (YANKEE GROUP)

The Road Map to Broadband Nation

For all of the moaning that our national high-speed infrastructure is being hopelessly damaged by the Bush administration, this reveals a more accurate picture:

Half of all U.S. households will have broadband access by next year, with the portion climbing to 75 percent by 2010. Not surprisingly, the quantity of data being pumped into homes is also increasing. Next-generation DSL and passive optical-networking technologies will usher in data rates in the range of 24 megabits per second -- nearly six times quicker than today's fastest cable modems. Thanks to new DSL chip designs, network speeds will climb to 100 Mbps by next year.

Some terms from this article are nicely defined:

3G (3rd generation cellular networks) Carrying information at up to 1 mbps - will be readily available by 2007
4G (4th generation cellular networks) Expect up to 40 mbps - enough to watch a DVD quality movie - still in development
BPL (Broadband over Power Lines) High speed information networks carried over our electrical grid - telcos and cable companies gotta be looking over their shoulder on this one
Cable broadband - 60% of broadband users have this - I get 4 mbps at home today
DSL (Digital Subscriber Line) Currently in the 300 kbps range - but newer versions promise up to 50 mbps over existing copper and extended distances.
Fiber Optic - Much faster ( 1 gbps) and much more expensive
Fixed Base Wireless - High speed coverage (10 - 100 mbps) over miles of area - but requires the receiving devices to stay in a fixed location. Think of this option like putting up a dish receiver for TV service. (WiMax)
Wi-Fi - Wireless Fidelity offer short range (hundred of meters) high speed wireless networking up to 100 mbps - what you get at StarBucks or the airport
UWB - Ultra Wide Band - Initially seen as a high speed 'system cable' replacement technology (replaces USB, BlueTooth and even that bulky monitor cable) but offers capabilities to reach very long distances at very high transmission rates (if the HAM radio operators don't have their way).

Expert Voices

In Lexus and the Olive Tree Thomas Friedman argued that economic interdependence equals prosperity and peace. In his new book he says the argument's over; globalization is here and it's good. But succeeding takes work, forethought, and resistance to "idiots" who say borders protect us.

CIO Insight has published a remarkable interview with Thomas Friedman who talks about outsourcing and his forthcoming book.

CIOs and IT management need to have a much better understanding about globalization and to get the message to stop shirking the duty to talk about it. His point about spreading stupidity about globalization is dead on as well as the ‘rule of law’ being a competitive advantage for us.

...a lot of things need to change. First of all, we need leaders who will dare to describe the world to us as it really is and make us smart, not make us stupid. ... Jobs are produced by thriving companies that are growing, and they may be produced all over the world, that's a good thing, but plenty will be produced here.

As an IT technologist I can’t agree more with Friedman. I have a choice to learn to become an interface with whomever we choose to get IT services from or to work for an IT services firm. The IT labor shortage taught us that each company can’t afford to be its own vertical IT supply chain, IT staff is now able to provide dozens of customers with the services it used to provide to only one.

The smartest things that I've seen companies do is trying to make their employees "versatilists," which is another word for untouchable. Versatilists are people who don't just know XML, they also know how to do distributed computing.

You take every employee, and you make this bargain with them: We cannot guarantee you a lifetime job, nobody can. But we can guarantee you that while you're here, we'll give you every opportunity to really become a versatilist. So if you stay here, you're more valuable to us because we can move you from here to here to here to here. And if, God forbid, we have to lay you off because we've found other ways to do this job cheaper or more efficiently, you'll be that much more marketable somewhere else.

Friedman also offers some wisdom about Sarbanes-Oxley:

Some people view Spitzer and Sarbanes-Oxley as hindrances to America's global competitiveness.

I think that's about as dumb as the day is long. Anyone who believes that is an idiot. The rule of law is one of our competitive advantages, and that's not to say that at times regulation can't go too far. But I'd rather err that way, and reel it back, than not have it at all.

Friedman does a great job explaining globalization conceptually, but I find that Thomas P.M. Barnett does a better job of describing its practical effects, however Friedman has an advantage now of knowledgeably addressing today's IT issues within a global context. Recently Barnett dismissed Friedman's forthcoming book but it is more likely from the stress of trying to birth his own new book. If Friedman's book is written along the lines of this interview it may offer plenty.

Trades March 21 2005

Compliance Measures Still Mounting Network World March 21, 2005
Regulatory requirements continue to squeeze IT budgets and staff
Sarbanes-Oxley regulations continue to yield benefits despite the complaints of cost. I am concerned that smaller companies and International businesses will suffer unintended consequences. Isn't it amazing that this stuff is just now being dealt with? Sure sounds like IT is not being managed well.

Many of the practices SOX has necessitated are good management practices, Olson says. "It is just we always gave them lower priority than our day-to-day stuff so implementation dragged," he says. "Now we have no alternative."

"Sarbanes-Oxley helped us get processes in place that probably should have been in place," ... the company could improve its change management processes and its security controls such as defining separation of duties and establishing consistent policies across system platforms.

... SOX security policies, such as incident response, need to be clearly stated to avoid any ad hoc firefighting when, say, a virus breaks out.

... his IT team spends about 60% of its time fixing problems, which take priority over long-term IT projects. Now with SOX compliance on their list of things to do as well, he says he can't "accurately predict how many resources we will have for IT projects," which means they could potentially miss scheduled deadlines.

Efforts this year will shift away from manual processes and toward automating compliance, he says. "Fixes are heavily manual today, but that can't go on indefinitely or it would pose a real hindrance to business."

"People are spending more in '05 than '04 because they realize they have to automate a lot of the stuff they did by brute force last year."

The Top 10 Ways to Fail a Security Audit InfoWorld March 21, 2005
You mean we have to take security seriously?

More Trades March 2005

CEO Blogs Baseline March 2005
More good info about CEO bloggers.
Includes this nice link.

Does Outsourcing Deliver the Goods? Baseline March 2005
Details statistics comparing companies that outsource vs. those that don't.
Bottom line: Flaws that cannot be cured by shifting work to others.

Shadowcrew: Web Mobs Baseline March 2005
Baseline case study on the online communities that traffic in stolen data.
Get the details and economics of the enemy as well as counteractions.

Making the Grade Information Security March 2005
Using security metrics to motivate business unit managers.
Lawrence Walsh presents an effective technique to make security matter with managers throughout a business.

"...started publishing department vulnerability scans and remediation times. Security, network and department managers raced to understand the numbers and what it would take to improve them. Security wasn't their concern; it was all about their careers."

Tearing Down the Firewalls Information Security March 2005
We need technologies that won't impede our Internet use.
Paul Simmonds sits on the Jericho Forum and describes how deperimeterization is happening and how we need to work with vendors to solve our problems.

Invasion Force Information Security March 2005
Describes the history and functioning of botnets.
David Dittrich offers an easy read on this threat that hides behind so many home computers and makes things like tracking down spam so difficult.

Guardians of the Crown Jewels Information Security March 2005
James Foster describes products to protect databases.

Crypto Hazard Information Security March 2005
Cryptography being turned against the good guys.
Walsh reveals the new cryptovirology threat and other money making malware.

Microsoft's Groove Move Information Week March 14, 2005
How Groove offers collaboration and threatens IT.
Groove offers secure P2P for business collaboration.

As demand grows for ad hoc collaboration among people who don't share the same employer--or network--PC users are setting up more electronic work spaces themselves, and they don't want to call in IT staff to do it.

The government uses Groove, but many IT managers associate it with the potential for copyright infringement--or worse. Nathaniel Palmer, an analyst with IT consulting firm Delphi Group, says there's still a stigma surrounding peer to peer. "There's a lot of concern about allowing any form of unqualified file sharing," he says.

According to Ozzie, Groove's national-security implementations quickly quash that argument.

Spoken like a true marketeer. The real problem is not how to protect the information during sessions but how to protect sensitive information while stored on the remote system. Does the remote system have a trojan or spyware? Is the remote system secure out of session? If the system is stolen is the information still strongly protected? Is the remote partner trusted? Have they signed needed agreements? Of course Ray Ozzie says: "It's up to users to use them within the bounds of the law".

J.D. Power Comes to IT Information Week March 14, 2005
IT vendors to be rated on customer satisfaction and audits.
Just as the auto industry benefited by exposing quality so will IT.

Instant Messaging Gets Riskier Information Week March 14, 2005
Expect more viruses and worms to attack IM and P2P.
70% of attacks are aimed at MSN instant messaging products.

Your Tax Dollars at Work Information Week March 14, 2005
Bob Evans gives great analysis.
He offers an example of how terrorists hate and attack globalizing infrastructure and institutions.

"Members of a terrorist group arrested over the weekend in Bangalore, India, appear to have been targeting the country's IT services industry," Paul McDougall wrote. Bangalore is at the heart of India's booming technology industry and is home to some of that country's major technology-services companies, as well as the Indian headquarters for such U.S. companies as Accenture and IBM. The arrests that foiled the terrorist attack reflect the safety and security of this country's IT infrastructure and networks for the past 3-1/2 years in spite of relentless threats and the attractiveness of those targets to terrorists. Hats off to all the public- and private-sector IT and law-enforcement professionals who've kept this vital infrastructure safe.

Following the trades

I have struggled for some time to organize references to trade articles that I continually come across. I am going to try to use this blogs to collect and organize those references. If things get too dry I may move them off to another related site. Let me know what you think!

Look Who's Blogging - Information Week March 7, 2005
How some IT executives are using blogs professionally and personally.
I believe blogs can become a powerful internal corporate tool to communicate ideas, solicit feedback and identify new opportunities and relationships.

Act promotes survival of the fittest Network World February 7, 2005
Some consider SOX a clarion call to effect comprehensive security programs.
I have posted on this issue here and on others' blogs. While I am reluctant to endorse regulations, this one seems to offer a hope to promote good governance and 'evolution of the corporate gene pool'.

Most Valued Skills ComputerWorld February 7, 2005
The skills that are most valued in IT managers
Too often people only focus on technology and miss the real needs.

So You Want To Be a CEO ComputerWorld February 7, 2005
Leadership is the linchpin quality of a successful CIO
Great article stressing leadership qualities and business focus.

The Tech-Business Link Pays Off Information Week November 1, 2004
Why J.P. Morgan Chase 'un-outsourced' IT from IBM.
We later also learned that costs got out of hand (Baselinemag.com). Austin Adams looks like one tough cookie - and probably a great guy to work for.

Superficial Security eWeek February 21, 2005
Investing more in the quality of security people than the mechanics.
The referenced book looks good. I also like the following quotes:

Marcus Ranum: ..."eventually, if enough data is going back and forth through your firewall, it is no longer a firewall, it's a router!"

Whatever the technologies, from IDS to PKI, organizations have deployed them to keep up with the data security Joneses, rather than from a correctly understood need.

Bottom line - know why you are doing what you are doing!

Arjen Lenstra interview Secure Enterprise March 2005
Discusses cryptography in a relevant way to businesses.
Don't miss the quick answer about quantum cryptography...

Shmooze or Lose Book Review CIO Magazine March 15, 2005
Success is all about relationships
A continuing thread of mine - relationships are undervalued in IT.

How to Save the Internet CIO Magazine March 15, 2005
Respected professor predicts the fall of the Internet in 2006
Sounds alarmist - but he makes a sound point. Example:

So far, the information security complex—vendors, researchers, developers, users, consultants, the government, you—have demonstrated remarkably little will to wage this war. Instead, we fight fires, pointing hoses at uncontrolled blazes, sometimes inventing new hoses, but never really dousing the flames and never seeking out the fire's source in order to extinguish it.

Article also includes others' perspectives.

(On PCs) "We're all sys admins," he says. And millions of end users holding sway over their security settings translates to millions of potential dumb configurations, boneheaded double-clicks and unintentional security lapses.

We also hear about how the insurance industry may get involved and the need to embed security teams within disciplines.

Soaring needs tackled eWeek January 31, 2005
Sonnenschein case study on managing IDS log events
Dealing with massive amounts of log data is difficult and expensive.

The Future of IT ComputerWorld March 7, 2005
A panel of IT visionaries look at the future
I always look forward to Thornton A. May comments and David Moschella offers a statement which rings true, "Too many IT organizations are currently drowning in low-value IT work."

The Dark Side ComputerWorld March 7, 2005
A bleaker look at the future
Includes irrelevance of IT and threats such as cyber terror.

Compliance: Thinking outside the Sarbox Network World February 7, 2005
The efforts to comply with Sarbanes
If you don't know mcuh about the magnitude of effort this article will help.

The selfish 'Net and the Big One Network World February 7, 2005
Mark Gibbs discusses the end of the Internet
But what caught my eye was this:

In fact, the Internet's commercial power is so profound that other countries whose governments discourage free speech (China, for example) cannot afford to ban Internet access. As the Internet in those countries grows and encompasses more aspects of everyday life, the effect will be a steady erosion of government control. This is arguably the most effective mechanism that America has for pushing democracy (or forcing it, depending on your political views) on non-democratic countries.

Gibbs must be reading Barnett - because he hits the nail on the head - it is all about connectivity and the freedom that flows with it.