I once was working on a project to install a robust wireless network for a company.  I asked the guy I was working with why they were doing it. This company had a general attitude of paranoia where security was concerned, so the drive to fast-track an expensive wireless network seemed out of place.  It turns out, this company’s president had been playing golf with the president of another company.  The president of the other company started bragging about his company’s new wireless network and how he could take his laptop anywhere in the building and get on the network.  Embarrassed, the president came back to work and immediately told his IT staff to install a WLAN so that he would never again suffer such indignation.  Halfway through the project, cooler heads pointed out to the president that since his company focused on critical infrastructure, the security risks of wireless were too great for them to bear.   

This new push for mobility has created a hierarchy within companies.  The important people get the coolest phones and PDAs.  I once discovered a disturbing trend during a policy review related to mobile devices:  when a new phone or PDA came out, a rash of dropped, damaged, and broken phones were turned into the person in charge of handing out mobile devices.  Many "accidentally" fell into the toilet.  Real money was being lost here, as employees jockeyed for status brought by the flashiest new phones.  Yes, this does really happen. I guess I shouldn’t have been shocked by this.  The mobile phone folks figured it out long ago…

If you have no clue what 802.1X is, read my recent technology primer first. If you’re already familiar with 1X, you’ve probably heard about some of the 802.1X additions- the 802.1AE (MACSec) and possibly 802.1af (the key agreement for MACSec)… but that’s just the tip of the iceberg, and what’s hiding underneath will knock your socks off!

We’re currently at the 802.1X-2004 edition, with the group working on the REV and hoping for an early-2009 release. When IEEE makes additions (such as AE and af) they’re just afterthoughts and changes tacked on to the end of the standard. But when they do a revision , as they are now, they’re opening up the whole can of worms and all parts of the standard are opened for evaluation and modification. Yee-haw!

So, what’s in this new revision and what can we expect from 802.1X-REV? That’s what I wanted to know, and I’m sure you’re curious too. I was lucky enough to catch a quick call with Paul Condon earlier this week and get some of the inside scoop. Paul is ProCurve Networking’s CTO, but more importantly for our purposes today, he’s the Vice -Chair of the IEEE 802.1 working group and is intimately involved in 1X and a variety of other networking, security and authentication standards.

1) Encryption & Key Exchange : The first goal in updating 802.1X was to add security with encryption, specifically on switch-to-switch links. Of course, with encryption comes the need for fast, secure key exchange, so we ended up with 802.1AE and 802.1af as answers to the first set of goals. The encryption will require hardware refreshes, and vendors are already gearing up for that. The benefits of encryption are pretty obvious, so I won’t bore you with that. There are some fun little gems hidden in the AE/af set though. Even without using the encryption piece, we’ll be able to use the key exchange as a means of quickly (in ~4-5 packets) authenticating (or re-authenticating) switches to one another after a reboot. It will be a critical piece for maintaining availability and integrity in the network. And w e can do this piece without a hardware upgrade, which is pretty nifty.

2) Same-Port Multiuser Support: Here’s where the 1X-REV sauce starts tasting really good. The new revision is leveraging some of its security updates to support multi-user modes on a single port. And no, not by using multi-tagged VLANs, this is way cooler than that. In theory, multiple PCs, phones or other connected devices can connect through a single port, which would essentially be running multiple instances of 802.1X, letting each communicate securely. It’ll be similar in practice to how wireless APs segregate and encrypt traffic between the AP and the endpoint. I’m sure at first we’ll see software-based endpoint encryption support and of course, move towards hardware encryption and see NICs with the capability baked in. That’s still down the road, but the road is getting shorter.

3) Network Advertisement/Selection : Now the 1X-REV sauce is the best you’ve ever had- you’re gonna want to put this stuff on everything ! :) The 3rd goal of the revision is to add support for network advertisements on the wired side- which would be a similar experience to selecting the wireless SSID from a list of ones available on your laptop. But, it’s happening on your wired switch. Wild, right? They’re going to leverage the EAPOL types here to communicate from client to network. Imagine the possibilities…

All these new functions and features give 802.1X numerous new use cases. I think you’ll see parts of these technologies leveraged in various parts of critical networks everywhere. Sponsor ballots come at the end of the year, and they’re hoping to see something solid and released in early 2009.

You can see why I’m excited. The 802.1X-REV may be the evil stepchild for a while, but it’s coming. When it does, it’s going to rock our little network worlds and flip our thinking about wired security and network segregation upside down.

Of course, you’ll be seeing more on this from me, so hang in there!

# # #

What are the telltale signs that your company is already Computing in the Cloud?

Is it when the CIO makes a big announcement at the monthly IT meeting?

Is it when the IT newsletter drops a reference to pilot testing of some ‘web based’ software?

Or, is it when the secretary whips out the boss’s Corporate Credit Card and signs up to a Cloud Service?

Here are 12 indicators that your company is *already* part of the Cloud:

1. Your internal helpdesk reports fewer password resets.
2. Finance contacts you to confirm all the DVD readers are disabled - they are puzzled by the number of recurring credit card charges for Amazon (are the secretaries spreading out their orders for “Lost” DVDs again?).
3. You are asked to authorise a network change ticket to send all outbound network traffic via the perimeter firewall, before being routed back to the internal server room (for performance reasons). 
4. You walk into the Data Center and it feels cooler than usual.
5. When the builders next door accidentally saw through the company Internet connection, people complain there must be a DoS attack going on as they can’t get to their files.
6. During physical inspections, you notice unexplained gaps in server cabinets.
7. Login failures go down, in fact login “attempts” in general go down but the company car park is full.
8. As you walk through the office, you notice all the “Security Awareness” posters have been replaced with pictures of Jeff Bezos (!)
9. You are asked to authorise a visit from the local environment group.  Fearing protesters, you are surprised to learn that your company has won a prize for reducing its Carbon Footprint
10. Your Intrusion Prevention System is preventing the call center from uploading contracts stored as GIF files.
11. You detect the presence of ‘malware’ in the form of unexplained ‘Machine Images’ on IT’s desktops.
12. You stop finding Windows passwords under keyboards, instead you find random hex digits next to the words ‘Access Key’ and ‘Secret Key’.  You sigh, but at least they are setting difficult to guess passwords now!

If you are charged with IT security in your company, you may want to start checking your web proxy logs for telltale signs that people are talking to the Cloud…or just talk to finance.

Some think the secret to being a road warrior is his durability, and for a large part that’s true.  But it’s not just a matter of surviving, but thriving through any situation that my come up comfortably.  The real key is always being prepared.  You never know what might happen.

Last night I was watching the news about the earthquake in Hawaii and thinking of a loved one who was out there for a conference.  I saw hospitals being evacuated, police breaking up fights over gas and food at convenience stores, bridges and roads that were un-drivable, no power, no water, no flights allowed in or out, etc. and I was worried.  It reminded me of several situations I experienced personally. 

Hurricane Ivan was by far the worst thing I’ve ever been through, and there have been many.

In September of 2004, I was working on a project in Montgomery, and had to be there the day before the storm arrived.  Things seemed normal enough at work, until everyone spent the second half of the day gossiping over whether or not they would have to come into work tomorrow.

I was in meetings all day and was oblivious to the news.  By time I left work, both lanes of I-85 were converted for northbound traffic as a mass exodus of people from Biloxi to Mobile to Panama City were heading north to get out of the storms way.  I had a perfectly good hotel room and opted to stay there instead of sitting on the freeway for what would have been a long, miserable drive back to Atlanta.  There wasn’t a bottle of water left on store shelves, so I decided I’d be okay and just head back home in the morning.

I never expected that the storm would be strong enough to do any damage as far inland as Montgomery…but it was.

I awoke the next morning to no power and no water, which was the perfect motivation I needed to get on the road and head home early.  I figured by leaving this early, the traffic on I-85 would be decent enough to make good time back to Atlanta.  I had a perfect view of I-85 from my room, and when I went to look, sure enough there wasn’t a single car on the freeway…there were however a number of trees, the marquee from the hotel, shopping carts, trash cans, and even a stray sock.

I was stuck.

I wasn’t worried at first.  I had endured several hurricanes before, once in a tent (Alberto, which dropped 24 inches of rain in a single night that cut off all the roads in and out of our base camp on the Flint River; I spent a week wet, living in a tent, and as a brand new lifeguard, performing live rescues for the first time).  

Things started to set in when I tried to find food.  The halls of the hotel were littered with refugees who even though they didn’t have a room, the hotel let them set up camp in the lobby, hallways, etc, each one of them with a giant cooler, luggage, and all acting as if they had done this a million times.

With no power, the vending machines were useless.  I got in my car to venture out, but a tree blocked off the single entrance to the hotel.  I decided to walk, but it was a ghost town.  With no power, nothing was open. 

Then my cell phone died. 

I spent 2 and a half days in Montgomery, without a lick of food and only a single warm bottle of water I traded a man for a pillow.

Most of Montgomery was without power for 4 days.  I was unlucky in that I had no supplies whatsoever, but lucky in that I was able to leave after waking up the third day to see that the roads had been cleared.  The refugees who had to spend weeks in shelters and hotels had it far worse.

Now I am always prepared.  It’s helped me through several other hurricanes (read Katrina), an ice storm, and a few other minor inconveniences.  When I’m on the road, I always make sure to adhere to a few simple rules:

• Never get below half a tank of gas, and always fill it to the top.
• Keep a case of water in the trunk of the car.  Most gas stations sell them now and it’s easy enough to grab one when you’re getting gas.  If I’m flying, I always keep 2 in my carry on and I make sure to stock my room immediately after I check in.
• Keep nuts and energy bars in my bag.  If you have to go without food for a couple of days or for 4 hours while your plane sits on the runway without a pilot (thanks Delta!), you’ll be happy to have a something to eat.
• Always keep a full charge on the cell phone and pack a car charger.
• Keep an emergency calling card in your wallet.  They are cheap enough these days and if something happens to you cell, you’ll find it terribly inconvenient not to be able to make any calls.
• Carry a MP3/FM Radio.  You can listen to MP3’s to take your mind of off things and be able to tune into local news advisories.

None of this does a single bit of good while you sit at home and worry about a loved one half way around the world, but hopefully it will allow your loved ones not to have to worry about you one day.