<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: corporations]]></title>
    <link>http://securityratty.com/tag/corporations</link>
    <description></description>
    <pubDate>Tue, 12 Aug 2008 08:05:30 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Stop Me if This Sounds Familiar]]></title>
      <link>http://securityratty.com/article/07468c09eca48cc8bfe532a83b3d394a</link>
      <guid>http://securityratty.com/article/07468c09eca48cc8bfe532a83b3d394a</guid>
      <description><![CDATA[My favorite book from last year was Charlie Munger's &quot;Poor Charlie's Almanack&quot; , there are so many fascinating parts in the book I can't go into them all here. Charlie Munger is Warren Buffett's...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.poorcharliesalmanack.com/index.html" style="float: left;"><img alt="Cover3rd" class="at-xid-6a00d83451c75869e2010535d3d4a3970c " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e2010535d3d4a3970c-120wi" style="margin: 0px 5px 5px 0px;" /></a>
 My favorite book from last year was Charlie Munger&#39;s <a href="http://www.poorcharliesalmanack.com/index.html">&quot;Poor Charlie&#39;s Almanack&quot;</a>, there are so many fascinating parts in the book I can&#39;t go into them all here. Charlie Munger is Warren Buffett&#39;s partner at Berkshire Hathaway, the book is a collection of a number of his speeches, and serves as a great backdrop for today&#39;s events, an &#0160;investing education, and a way to think through complex problems (&quot;invert! always invert!&quot;). It goes without saying that I think you should buy this book.&#0160;</p><br /><div>Chapter Three is a collection of Munger&#39;s unscripted remarks at Berkshire Hathaway and Wesco annual meetings. The below sections were transcribed by <a href="http://www.tilsonfunds.com/">Whitney Tilson</a>, &#0160;from annual meetings around the 2003-4 time period, and are pretty interesting given our current financial predicament.</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-weight: bold; ">Warnings About Financial Institutions and Derivatives</span></p><p><span style="font-weight: bold; ">Risks of Financial Institutions</span><br />The nature of a financial institution is that there are a lot of ways to go to hell in a bucket. You can push credit too far, do a dumb acquisition, leverage yourself excessively---its not just derivatives [that can bring about your downfall].</p><p>Maybe it&#39;s unique to us, but we&#39;re quite sensitive to financial risks. Financial institutions make us nervous when they&#39;re trying to do well.</p><p>We&#39;re exceptionally goosey of leveraged financial institutions. If they start talking about how good their risk management is, it makes us nervous.</p><p>We fret way earlier than other people. We&#39;ve left a lot of money on the table through early fretting. It&#39;s the way we are -- you&#39;ll just have to live with it.</p><p><span style="font-weight: bold; ">Derivatives</span><br />The system is almost insanely irresponsible. and what people think are fixes aren&#39;t realy fixes. It&#39;s so complicated I can&#39;t do it justice here - but you can&#39;t believe the trillions of dollars involved. You can&#39;t believe the complexity. You can&#39;t believe how difficult it is to do the accounting. You can&#39;t believe how big the incentives are to have wishful thinking about values and wishful thinking about ability to clear.</p><p>People don&#39;t think about the consequences of the consequences. People start by trying to hedge against interest rate changes, which is very difficult and complicated. Then, the hedges make the [reported profits] lumpy. So they use the new derivatives to smooth this. Well, now you&#39;ve morphed into lying. This turns into a Mad Hatter&#39;s Tea Party. This happens to vast, sophisticated corporations.</p><p>Somebody has to step in and say, &quot;We&#39;re not going to do it - it&#39;s just too hard.&quot;</p><p>I think a good litmus test of the mental and moral quality at any large institutions [with significant derivative exposure] would be to ask them, &quot;Do you really understand your derivatives book?&quot; Anyone who says yes is either crazy or lying.</p><p>It&#39;s easy to see [the dangers] when you talk about [what happened with] the energy derivatives - they went kerflooey. When [the companies] reached for the assets that were on their books, the money wasn&#39;t there. When it comes to financial assets, we haven&#39;t had any such denouement and the accountings hasn&#39;t changed so the denouement is ahead of us.</p><p>Derivatives are full of clauses that say if one party&#39;s credit gets downgraded then it has to put up collateral. It&#39;s like margin - you can go broke [just putting up more margin]. In an attempt to protect themselves, they&#39;ve introduced instability. Nobody seems to recognize what a disaster of a system they&#39;ve created. It&#39;s a demented system.&#0160;</p><p>In engineering people have a big margin of safety. But in the financial world, people don&#39;t give a damn about safety. They let it balloon and balloon and balloon. It&#39;s aided by false accounting. I&#39;m more pessimistic about this than Warren is.</p><p><span style="font-weight: bold; ">Accounting for Derivatives</span><br />I hate with a passion GAAP [Generally Accepted Accounting Principles] as applied to derivatives and swaps. JP Morgan sold out to this type of accounting to front-end revenues. I think it&#39;s a disgrace.</p><p>It&#39;s bonkers, and the accountants sold out. Everyone caved, adopted loose [accounting] standards, and created exotic derivatives linked to theoretical models. As a result, all kinds of earnings, blessed by accountants, are not really being earned. When you reach for the money, it melts away. It was never there.</p><p>It [accounting for derivatives] is just disgusting. It is a sewer, and if I&#39;m right, there will be hell to pay in due course. All of you will have to prepare to deal with a blowup of derivative books.</p><p><span style="font-weight: bold; ">Likelihood of a Derivatives Blowup</span><br />We tried to sell Gen Re&#39;s derivatives operations and couldn&#39;t, so we started liquidating it. We had to take big markdowns. I would confidently predict that most of the derivatives books of [this country&#39;s] major banks cannot be liquidated for anything like what they&#39;re carried on the books at. When the denouement will happen and how severe it will be, I don&#39;t know. But I fear the consequences could be fearsome. I think there are major problems, worse than in the energy field, and look at the destruction there.</p><p>I&#39;ll be amazed if we don&#39;t have some kind of significant [derivatives-related] blowup in the next five to ten years.</p><p>I think we&#39;re he only big corporation in America to be running off its derivative book.</p><p>It&#39;s a crazy idea for people who are already rich - &#0160;like Berkshire - to be in this business. It&#39;s a crazy business for big banks to be in.</p><p>Yo would be disgusted if you had a fair mind and spent a month really delving into a big derivative operation. You would think it was Lewis Carroll. You would think it was the Mad Hatter&#39;s Tea Party. And the false precision of these people is just unbelievable. They make the worst economics professors look like gods. Moreover, there is depravity augmenting the folly. Read the book F.I.A.S.C.O., by law professor and former derivative trader Frank Partnoy, an insider account of the depravity of derivative trading at one of the biggest and best-regarded Wall Street firms. This book will turn your stomach.</p></blockquote><br /><div>These are very blunt warnings from a legendary investor over many years, yet no one listened. It does explain why it is so hard for Infosec to make its case for building margins of safety into the system.</div><br /><br /><br />]]></content:encoded>
      <pubDate>Sun, 02 Nov 2008 19:30:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/derivatives book">derivatives book</category>
      <category domain="http://securityratty.com/tag/book">book</category>
      <category domain="http://securityratty.com/tag/derivatives">derivatives</category>
      <category domain="http://securityratty.com/tag/derivative books">derivative books</category>
      <category domain="http://securityratty.com/tag/books">books</category>
      <category domain="http://securityratty.com/tag/derivatives blowup">derivatives blowup</category>
      <category domain="http://securityratty.com/tag/derivatives operations">derivatives operations</category>
      <category domain="http://securityratty.com/tag/blowup">blowup</category>
      <category domain="http://securityratty.com/tag/favorite book">favorite book</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/stop-me-if-this-sounds-familiar.html">Stop Me if This Sounds Familiar</source>
    </item>
    <item>
      <title><![CDATA[Given the Current Economic Turmoil, What Should IT Managers Do?]]></title>
      <link>http://securityratty.com/article/c3cb795253913d9e8117ca429595355f</link>
      <guid>http://securityratty.com/article/c3cb795253913d9e8117ca429595355f</guid>
      <description><![CDATA[Gartner's Compliance &amp; Risk Management Research Community met recently and considered what IT managers should do given the economic turmoil spreading around the world

What started as a problem with...]]></description>
      <content:encoded><![CDATA[Gartner's Compliance & Risk Management Research Community met recently and considered what IT managers should do given the economic turmoil spreading around the world.<br />
<br />
What started as a problem with risky mortgages in hot real estate markets in the United States has spread to Wall Street with a devastating impact on the financial health and well being of a number of banks and an insurance company. Each day, the turmoil spreads, first to the equity and commodity markets where investors and speculators attempt to preserve what capital remains. Next, the central banks and governments rush in with an infusion of liquidity in an attempt to keep the money flowing through the world's financial market.<br />
<br />
The media commentary on the current financial crisis sounds the tone that all the laws of economics and free markets no longer apply. The reporters sound as if the next developments will be Mother Nature suspending the laws of physics and gravity. Against this backdrop, CIOs and IT managers wonder, "What do we do?"<br />
<br />
There is no denying that business as usual is not currently happening. To speculate or attempt to deal with the regulatory fallout that will follow this financial crisis is currently a waste of time. The central focus that CIOs must address now is what impact will this financial crisis have on IT in the next budget cycle. Also, how can IT help the enterprise demonstrate trustworthiness to key stakeholders, maintain critical functions that drive revenue and cash flow, and focus on the needs of the people who work for your organization.<br />
<br />
At the heart of the current financial crisis is a lack in confidence in the credit markets. Government officials report that interbank lending has ground to a halt, which prompted the U.S. Federal Reserve to step in on 7 October 2008 and offer direct short term lending to U.S. corporations. <br />
<br />
First, to combat this lack of confidence permeating the market, enterprises should take extraordinary means to increase their financial transparency and demonstrate that they have the ability to meet their obligations to creditors, customers, and the communities where they are located. Senior management must develop and exercise a voice in the public policy dialog immediately - and voluntarily. Do not wait for Congressional subpoenas, shareholder meetings, or ambush interviews by the media. Tell the world, honestly, about the state of your company and its plans for the near term and the long view.<br />
<br />
Second, everyone must develop a laser-like focus on the organization's value proposition, those intangible reasons that define why your enterprise exists. To leverage an old cliché, every oar must be in the water and pulling in the same direction. The goal is not just to make it to the finish line, but to survive. Ancillary or tertiary projects must be postponed for a later time; and tasks that improve customer service, remove friction from processes, and increase cash flow should be top priorities.  <br />
<br />
Finally, think about the people who work for you. No doubt they are scared by the uncertainty about the future. Management must be honest and open in keeping the rank and file apprised of the organization's situation. They should be encouraged to communicate that information in a timely fashion with friends and neighbors in the community. Management should be extremely sensitive to non-work related issues that may have an impact on employee morale and well being. The most obvious is related to housing, mortgage default and potential foreclosure. However, it can extend beyond the most obvious issues. The problem with short-term lending is also having an impact on some governmental agencies, and some school districts are cutting back to only four days of instruction, forcing many parents to scramble and find new daycare arrangements. ]]></content:encoded>
      <pubDate>Fri, 17 Oct 2008 07:38:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial crisis">financial crisis</category>
      <category domain="http://securityratty.com/tag/current financial crisis">current financial crisis</category>
      <category domain="http://securityratty.com/tag/increase cash flow">increase cash flow</category>
      <category domain="http://securityratty.com/tag/increase">increase</category>
      <category domain="http://securityratty.com/tag/central focus">central focus</category>
      <category domain="http://securityratty.com/tag/cash flow">cash flow</category>
      <category domain="http://securityratty.com/tag/focus">focus</category>
      <category domain="http://securityratty.com/tag/senior management">senior management</category>
      <category domain="http://securityratty.com/tag/obvious issues">obvious issues</category>
      <source url="http://blog.gartner.com/blog/security.php?x=0&amp;itemid=3968">Given the Current Economic Turmoil, What Should IT Managers Do?</source>
    </item>
    <item>
      <title><![CDATA[Uncommon Assurance With Common Criteria]]></title>
      <link>http://securityratty.com/article/6239b9efa09233bac59212ea9028a9a6</link>
      <guid>http://securityratty.com/article/6239b9efa09233bac59212ea9028a9a6</guid>
      <description><![CDATA[Corporations spend millions of dollars in getting their products Common Criteria-certified. It is a validation of being tested per an international security evaluation standard for meeting stated...]]></description>
      <content:encoded><![CDATA[<p>Corporations spend millions of dollars in getting their products Common Criteria-certified. It is a validation of being tested per an international security evaluation standard for meeting stated security claims.  Yet, the claims made by companies are not mandated to be at rigorous security levels by the Common Criteria standard &mdash; it merely advocates thorough testing. </p>]]></content:encoded>
      <pubDate>Tue, 14 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/common criteria standard">common criteria standard</category>
      <category domain="http://securityratty.com/tag/claims">claims</category>
      <category domain="http://securityratty.com/tag/security claims">security claims</category>
      <category domain="http://securityratty.com/tag/rigorous security levels">rigorous security levels</category>
      <category domain="http://securityratty.com/tag/products common">products common</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/validation">validation</category>
      <category domain="http://securityratty.com/tag/corporations">corporations</category>
      <category domain="http://securityratty.com/tag/millions">millions</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1367">Uncommon Assurance With Common Criteria</source>
    </item>
    <item>
      <title><![CDATA[FTC's red flag rules cast wide identity theft net]]></title>
      <link>http://securityratty.com/article/3b49bca7dcca20e147c21751033428b0</link>
      <guid>http://securityratty.com/article/3b49bca7dcca20e147c21751033428b0</guid>
      <description><![CDATA[Today's corporations face an almost endless list of rules and regulations with which they must comply: HIPAA , Sarbanes-Oxley and the recently updated Federal Rules of Civil Procedure (FRCP) are just...]]></description>
      <content:encoded><![CDATA[Today's corporations face an almost endless list of rules and regulations with which they must comply: HIPAA , Sarbanes-Oxley and the recently updated Federal Rules of Civil Procedure (FRCP) are just some of the laws that businesses are already under the gun to comply with them. Now on November 1, 2008, the Federal Trade Commission (FTC) Red Flag Rules , which were passed in 2003, will take effect, and while these rules have received scant]]></content:encoded>
      <pubDate>Tue, 14 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/rules">rules</category>
      <category domain="http://securityratty.com/tag/red flag rules">red flag rules</category>
      <category domain="http://securityratty.com/tag/federal rules">federal rules</category>
      <category domain="http://securityratty.com/tag/federal trade commission">federal trade commission</category>
      <category domain="http://securityratty.com/tag/civil procedure">civil procedure</category>
      <category domain="http://securityratty.com/tag/ftc">ftc</category>
      <category domain="http://securityratty.com/tag/comply">comply</category>
      <category domain="http://securityratty.com/tag/endless list">endless list</category>
      <category domain="http://securityratty.com/tag/hipaa">hipaa</category>
      <source url="http://www.networkworld.com/news/2008/101508-ftcs-red-flag-rules-cast.html?fsrc=rss-security">FTC's red flag rules cast wide identity theft net</source>
    </item>
    <item>
      <title><![CDATA[Corporate Greed and the Destabilization of Society]]></title>
      <link>http://securityratty.com/article/155810725ba943a1b35e1c2b39138f7a</link>
      <guid>http://securityratty.com/article/155810725ba943a1b35e1c2b39138f7a</guid>
      <description><![CDATA[In The Audacity of Capital Markets we briefly touched on the culture of arrogance and greed in financial services. It is interesting because if you look at the various software players that are...]]></description>
      <content:encoded><![CDATA[<p>In <a title="The Audacity of Capital Markets" rel="bookmark" href="../2008/09/19/the-audacity-of-capital-markets/">The Audacity of Capital Markets</a> we briefly touched on the culture of arrogance and greed in financial services.  It is interesting because if you look at the various software players that are focused on selling to financial services, you will easily see that they have bought into the same &#8220;feed the beast&#8221; culture that has contributed to the destabilization of the economy and, in turn, society.</p>
<p>For example, the &#8220;Average Joe Investor&#8221; does not care about &#8220;best order execution&#8221; or &#8220;smart order routing,&#8221; this is for &#8220;the big boys.&#8221;  As we all know, saving a few pennies or dollars per transaction to &#8220;Average Joe Investor&#8221; does nothing for them when their retirement nest egg is lost due to corporate greed and negligence.     The folks who &#8220;really care&#8221; about shaving a few milliseconds off market execution are the companies that are trading high volumes of exotic derivatives and baskets who have, for the most part, zero interest in the personal financial portfolio of &#8220;Jane in Iowa&#8221; or &#8220;Joe in Kansas.&#8221;</p>
<p>I am really amazed to see the dominance of greed in corporate America and the lack of corporate social responsibility.  Risk taking and &#8220;split second trading&#8221; does little for any small. individual investor and has proven to destabilize our society.    Who cares about saving a few pennies or dollars in market executive?</p>
<p>The answer: Only the greedy corporations, the same people responsible for the current destabilization, chao and near collaspe of our entire financial system.   Homes lost, unprecedented bankruptcies. and money market funds less than par value!   You no doubt have read that folks in the <a href="http://www.reservefunds.com/" target="_blank">Reserve Money Market funds</a> cannot even withdraw their &#8220;safe money.&#8221;  Investors in the Reserve Funds are being told that for every dollar they invested in a money market, they now only have 97 cents and cannot withdraw their capital as the Reserve waits for a government bailout.</p>
<p>What is to blame? Greed and profits over corporate social responsibility are to blame.</p>
<p>I read where some folks think the government needs to regulate market-related news, supposedly to stabilize trading based on news.   Regulating news has another name -  &#8220;censorship&#8221; - but who cares about the US Constitution when money and split second algo trading is involved?    I am amazed.   Folks in financial services just will say or do anything to make a buck, or keep from losing one, even at the expense of society and our basic constitutional freedoms.  News is not regulated in our democratic society, nor should it be to make algorithmic trading &#8220;better&#8221;.     What we need is less split second, computerized algo trading and more stablity.   Machine processing should not dicate nor mandate changes to our democratic principles.</p>
<p>Nor should our lives in a free society be censored or regulated because of the trading requirements for split second transactions that benefit large corporations.    The average investor does not need an unstable financial system trading exotic derivatives and baskets at the speed of light.  This requirement is driven by corporate greed that destabilizes the core economy and fabric of our society.</p>
<p>Of couse, many of the same folks would like for us to believe that technology is the answer.  This is a fallacy.</p>
<p>Corporate greed is destabilizing society.   What need to be regulated is not the news, but corporate risk taking and corporate goverance.  Individual investors do not need lightspeed transactions in an unstable world.   Citizens and families need a secure, stable economic infrastructure, something that has been lost in the culture of corporate greed, but hopefully not forever.</p>
]]></content:encoded>
      <pubDate>Tue, 23 Sep 2008 14:24:22 +0000</pubDate>
      <category domain="http://securityratty.com/tag/society">society</category>
      <category domain="http://securityratty.com/tag/greed">greed</category>
      <category domain="http://securityratty.com/tag/safe money">safe money</category>
      <category domain="http://securityratty.com/tag/money">money</category>
      <category domain="http://securityratty.com/tag/money market funds">money market funds</category>
      <category domain="http://securityratty.com/tag/democratic society">democratic society</category>
      <category domain="http://securityratty.com/tag/average joe investor">average joe investor</category>
      <category domain="http://securityratty.com/tag/free society">free society</category>
      <category domain="http://securityratty.com/tag/joe">joe</category>
      <source url="http://www.thecepblog.com/2008/09/23/corporate-greed-and-the-destabilization-of-society/">Corporate Greed and the Destabilization of Society</source>
    </item>
    <item>
      <title><![CDATA[Interop NY: IT Roundtable]]></title>
      <link>http://securityratty.com/article/4137ad5ff76308605c9861b27c7d0404</link>
      <guid>http://securityratty.com/article/4137ad5ff76308605c9861b27c7d0404</guid>
      <description><![CDATA[This session is a bit different than the usual sessions at Interop. It provides insights from three CIOs in three different industries
Moderator: Jim Metzler, Vice President, Ashton, Metzler &amp;...]]></description>
      <content:encoded><![CDATA[<p>This session is a bit different than the usual sessions at Interop. It provides insights from three CIOs in three different industries.</p>
<ul>
<li>Moderator: Jim Metzler, Vice President, Ashton, Metzler &amp; Associates</li>
<li>Rowan Snyder, CIO, KPMG</li>
<li>David Michael, CIO, United Business Media Group</li>
<li>Joanna Young, Chief Information Officer, Corporate Information Systems &amp; Enterprise Services, Liberty Mutual</li>
</ul>
<p><strong>Jim: Is the CIO a technical job anymore? For example, inside Liberty there are business projects with an IT component.</strong></p>
<p><strong>Joanna:</strong> We are organized to partner with internal business clients or vendors who provide objectives and business requirements. We strive to figure out the smallest amount of an IT investment we can make to get this to work.</p>
<p><strong>Rowan:</strong> We have both. Part of the dilemma is that the thing that sells the best is fear. I don&#8217;t want to use that to get business.</p>
<p><strong>Joanna:</strong> One good example is security from an application perspective. It&#8217;s hard to talk about security investments in business terms. We put it into terms like &#8220;this is what it will cost us if we DON&#8217;T do this.&#8221; For example, a solution for spam required us to do research into what it was costing us overall. Once we put it together, the business was all for it. You have to put your business hat on and think &#8220;how can I make this important for a businessperson?&#8221; If you can&#8217;t, you may need to ask yourself why you&#8217;re pushing services on them that they may not need.</p>
<p><strong>Jim: Can you give us insight into business-IT alignment? What about governance?</strong></p>
<p><strong>Rowan:</strong> Governance is the hardest part of IT. It&#8217;s not like the technology is easy. If it&#8217;s a business project with an IT component, I don&#8217;t usually get involved. It comes down to overall budget. The infrastructure we own and let people know exactly what it will cost to do it. We are a distributed IT firm, there are multiple groups. This is the most distributed and risk-prone organization I&#8217;ve worked in. It can be difficult for the business to exert control. It demonstrates risk, in security, compliance, methodologies, etc.</p>
<p><strong>Joanna:</strong> Governance has become a word that nobody wants to use. It suddenly implies that IT is the holder of all the money and they are the ones that get to decide. We stopped using that word and position IT as a strategic business partner.</p>
<p><strong>David:</strong> We have a highly decentralized IT set-up. We have about 600 globally and around 40 in the headquarters. We have 10 CIOs for each division, and within each division it is decentralized. We try to run each unit as autonomous. This is a close alignment with IT and business. However, then the problem of how do you have commonality between divisions and collaboration?</p>
<p><strong>Jim: How can you minimize risk in distributed environment using standards and procedures?</strong></p>
<p><strong>David:</strong> The reality is it can be impractical for an organization. You end up with a patchwork of platforms and technologies. We have to accept that we&#8217;ll have multiple solutions. We can attempt to push a standard, but overall have a much more relaxed approach to manage everything. There is a lot of equality between divisions in what they can choose to purchase.</p>
<p><strong>Joanna:</strong> Standards are easier to apply the further down the staff you are. The most important thing with any of this is to understand why you are making the decisions. If there is a process and pros and cons are identified, there is a clear record of why decisions were made.</p>
<p><strong>Audience Poll: Everyone raised their hand that MORE standards were needed</strong>.</p>
<p><strong>Audience Question: Are there inefficiencies in the data center in terms of energy and green IT? What are you doing about it?</strong></p>
<p><strong>Joanna:</strong> Everyone focuses on cars for carbon footprints. But, it&#8217;s really buildings&#8230;and then data centers. The data center has the same importance as any other efficiency. They need to be running as cheaply as possible. Corporations have a responsibility to make sure they are energy efficient.</p>
<p><strong>Rowan:</strong> We recently did a carbon footprint analysis, and found that half of carbon comes from electricity, with half of that from the data center.</p>
<p><strong>David:</strong> Every company does have a responsibility to look at its carbon emission globally. Consider international travel, flying, etc. As much as possible, we are not building data centers. We are using other people&#8217;s data centers in an effort to get out of the data center business.</p>
<p><strong>Audience Question: How do you balance the good from standards with agile development and possible roadblocks?</strong></p>
<p><strong>Joanna:</strong> Luckily agile development is under the CIO&#8217;s control. You can see the lifecycle and savings that occur. When I look, I check what the standards are that I&#8217;m measuring by.</p>
<p><strong>Jim: Does web 2.0 have any business meaning in your environment? If so, what are you doing about it?</strong></p>
<p><strong>Joanna:</strong> I&#8217;ve been in IT for 20 years. It&#8217;s another component to business IT investment, and has to be presented as such. As IT professionals we have a responsibility to identify what Web 2.0 is, and then translate to see if there is anything the company should be doing with it. Monitor it based on your current portfolio, and consider its impact.</p>
<p><strong>David:</strong> It&#8217;s pretty important to our business as a media company. I don&#8217;t think it means one thing, it&#8217;s a term people use to talk about the web and what&#8217;s going on online. From mobile, to ajax, cloud computing or mashups - you can draw multiple conclusions. More and more business is being done online. We have a lot of growth opportunities online.</p>
<p><strong>Rowan:</strong> Compliance, security, and privacy issues just explode with Web 2.0.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 15:45:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/terms">terms</category>
      <category domain="http://securityratty.com/tag/data center business">data center business</category>
      <category domain="http://securityratty.com/tag/data center">data center</category>
      <category domain="http://securityratty.com/tag/business terms">business terms</category>
      <category domain="http://securityratty.com/tag/business projects">business projects</category>
      <category domain="http://securityratty.com/tag/business-it alignment">business-it alignment</category>
      <category domain="http://securityratty.com/tag/internal business clients">internal business clients</category>
      <category domain="http://securityratty.com/tag/business hat">business hat</category>
      <source url="http://blog.sciencelogic.com/interop-ny-it-roundtable/09/2008">Interop NY: IT Roundtable</source>
    </item>
    <item>
      <title><![CDATA[Interop NY Keynotes: Cisco]]></title>
      <link>http://securityratty.com/article/c55a3293fe594f4363a5830f6da4d48c</link>
      <guid>http://securityratty.com/article/c55a3293fe594f4363a5830f6da4d48c</guid>
      <description><![CDATA[After some rousing introduction music, Marie Hatter , Vice President, Network Systems and Security Solutions Marketing / CMO of Cisco began her presentation on virtualization
Introduction...]]></description>
      <content:encoded><![CDATA[<p>After some rousing introduction music, <a href="http://blogs.cisco.com/authors/bio/83" target="_blank">Marie Hatter</a>, Vice President, Network Systems and Security Solutions Marketing / CMO of Cisco began her presentation on virtualization.</p>
<p><strong>Introduction</strong></p>
<p>Virtualization is a word used by consumers and also by IT. But, do we all mean the same thing?</p>
<p>A very cool video from Cisco provided answers to &#8220;what is virtualization&#8221; from an  engineering perspective, data center perspective, IT perspective and the user perspective (virtual world).</p>
<p>Virtualization is about breaking the bonds between applications and server hardware, nodes and networks, applications and operating systems.</p>
<p>Why is this interesting? Virtualization holds the promise to transform the way we work, live, learn and play.</p>
<p><strong>Why virtualize?</strong></p>
<p>The real estate boom over the last 30 years has driven people to the suburbs. People didn&#8217;t mind commuting for an hour with lower gas prices. Today, we have a weak economy and gas prices are high. Something has to change.</p>
<p>Many are opting to stay at home. Businesses are trying out telecommuting, some (like Cisco) are even offering telepresence. This helps by reducing carbon footprint. Corporations are breaking free from physical requirements. The global workforce is also having an impact on the network. These changes are having a huge impact on the network.</p>
<p>We are on the cusp of transitioning from virtualization to VIRTUALIZATION.</p>
<p><strong>&#8220;One to many&#8230;.many to one.&#8221;</strong></p>
<p>This is Cisco&#8217;s idea of virtualization.</p>
<p>Consider the different roles we play in life - one to many. Spouse, executive, friend, parent, gym rat. This would be &#8220;one to many&#8221;. This is exactly what virtualization does. It allows you to partition resources off that you can use on the fly.</p>
<p><strong>Where do I start?</strong></p>
<p>Virtualization starts with server and storage. But, it&#8217;s the network that touches everything - it spans the physical, the virtual, and the cloud. This provides the connectivity to all these resources. The network brings transparency to the picture. It allows you to better monitor performance and better implement security - great benefits!</p>
<p><strong>Why do I need this?</strong></p>
<p>At Cisco, we saw that we were only using 20% of our storage utilization. We wanted to virtualize our datacenters. When we did that, we were able to get 68% storage utilization. For each year that we were able to defer buildup, we saved $40 million.</p>
<p>From a business standpoint, virtualization helps you differentiate and work faster. Provisioning in minutes, improved productivity and competitive differentiation, using less power (environmental impact), and up the ante of business continuity. If VMWare fails? It&#8217;s OK. You can reprovision it on the fly.</p>
<p><strong>Is it for everyone?</strong></p>
<p>IT organizations tend to be siloed. You have the IT side and the Operations side. Each has responsibility. For virtualization to work, these walls have to come down. The concept of virtualization depends on shared resources.</p>
<p><strong><a href="http://en.wikipedia.org/wiki/Metcalfe%27s_law" target="_blank">Metcalfe&#8217;s Law of the Network</a> Effect</strong></p>
<p>Everytime you add a node to the network, you increase the value. This is what happens with virtualization. Every device you virtualize increases the power of each device. More control of environment and more efficiency.</p>
<p>This leads to&#8230;</p>
<p><strong>Cloud computing.</strong></p>
<p>Wow, show of hands from the audience when Marie asked &#8220;how many are using cloud computing?&#8221; and &#8220;how many are using your own clouds?&#8221; - not a lot of hands were raised. Interesting considering the coverage cloud computing has and the focus of it.</p>
<p>Cloud computing has three possibilities at Cisco:</p>
<ul>
<li>Flexible infrastructure (hosting)</li>
<li>Abstract services (APIs)</li>
<li>Application services (SaaS)</li>
</ul>
<p>Automation is going to be key, and will need to integrate virtualization-aware elements.</p>
<p>Can you imagine if you wanted interoperability in the cloud? People haven&#8217;t even begun thinking about it.</p>
<p><strong>Conclusion</strong></p>
<p>As you virtualize, your role will change. You will think more about strategy. But keep in mind these &#8220;minefields&#8221; of virtualization:</p>
<ul>
<li>Insufficient planning</li>
<li>Lack of standards</li>
<li>Weak security</li>
</ul>
<p>Security cannot be an afterthought. It has to be planned. We&#8217;ve seen new forms of malware, hypervisor attacks, and root kit infections.</p>
<p>As higher expectations from end users evolve, we&#8217;re becoming not server oriented, but SERVICE oriented.</p>
<p><strong>Tips:</strong></p>
<ul>
<li>Think holistically</li>
<li>Consider IT culture - equipment and people</li>
</ul>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 10:11:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/virtualization">virtualization</category>
      <category domain="http://securityratty.com/tag/virtualization starts">virtualization starts</category>
      <category domain="http://securityratty.com/tag/virtualization helps">virtualization helps</category>
      <category domain="http://securityratty.com/tag/helps">helps</category>
      <category domain="http://securityratty.com/tag/virtualization depends">virtualization depends</category>
      <category domain="http://securityratty.com/tag/virtualization holds">virtualization holds</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/network brings transparency">network brings transparency</category>
      <category domain="http://securityratty.com/tag/cisco">cisco</category>
      <source url="http://blog.sciencelogic.com/interop-ny-keynotes-cisco/09/2008">Interop NY Keynotes: Cisco</source>
    </item>
    <item>
      <title><![CDATA[Your Companies Biggest Security Hole - What is the BGP-style Vuln Lurking in Software Security?]]></title>
      <link>http://securityratty.com/article/95b08326dc660fff6cb1103621e8f2f3</link>
      <guid>http://securityratty.com/article/95b08326dc660fff6cb1103621e8f2f3</guid>
      <description><![CDATA[My vote is MQ Series and other enterprise messaging systems. Schneier's succinct summary of BGP

It's a man-in-the-middle attack. &quot;The Internet's Biggest Security Hole&quot; has been that interior relays...]]></description>
      <content:encoded><![CDATA[<p>My vote is MQ Series and other enterprise messaging systems. Schneier&#39;s succinct <a href="http://www.schneier.com/blog/archives/2008/08/border_gateway.html">summary</a> of BGP:</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">It&#39;s a man-in-the-middle attack. &quot;The Internet&#39;s Biggest Security Hole&quot; &#160;has been that interior relays have always been trusted even though they are not trustworthy.</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br />That could apply word for word to how MQ Series and other enterprise messaging systems are deployed. Let&#39;s say you are a bank and have been happily running your business on a mainframe for decades. Life is good, come in at 9 leave at 5, count the cash. Then some dotcommer comes along and tells you that you need to get online. What are you gonna do? Rewrite your whole system from scratch? Hard to make that case.</span></p><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">Nope what you&#39;ll do is build out a web farm to talk to the consumer, but then you will realize all of your business runs on the mainframe, and you need to connect to it. How exactly? Enter MQ Series and friends, they broker the communications to legacy backends for most major corporations, but there is one slight problem - they didn&#39;t even bother to support useful security protocols until very recently, and most of the time the security protocols are not even implemented.</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">Typical anti-patterns include:</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">* no authentication, no authorization (just open up a queue) - run your whole book of business transaction backbone on anonymous ftp</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">* authorization with no authentication (mq enforces authorization policy on unverifiable tokens) -&#160;run your whole book of business transaction backbone on anonymous ftp, but think that you have security</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">What is strange about the MQ Series, enterprise messaging vulns is that there is no need for them, there are no technical excuses to not add better tokens, message security, and encryption. People don&#39;t do it, because of poor tool support,</span><span style="font-family: Verdana; font-size: 12px; line-height: normal;">&#160;a </span><a href="http://1raindrop.typepad.com/1_raindrop/2008/08/mainframe-mindset.html">mainframe mindset</a><span style="font-family: Verdana; font-size: 12px; line-height: normal;">, silo projects, and a whole variety of reasons. But just because you choose to ignore a fact doesn&#39;t mean its not true. On the plus side, some of the open source ESBs are </span><a href="http://1raindrop.typepad.com/1_raindrop/2008/04/cxf-axis2-and-e.html">adding support for message security</a><span style="font-family: Verdana; font-size: 12px; line-height: normal;">, so you can improve security and save your company money at the same time, what&#39;s not to like?</span></div>]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 04:31:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security hole">security hole</category>
      <category domain="http://securityratty.com/tag/security protocols">security protocols</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/business runs">business runs</category>
      <category domain="http://securityratty.com/tag/business transaction backbone">business transaction backbone</category>
      <category domain="http://securityratty.com/tag/improve security">improve security</category>
      <category domain="http://securityratty.com/tag/message security">message security</category>
      <category domain="http://securityratty.com/tag/enforces authorization policy">enforces authorization policy</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/your-companies-biggest-security-hole---what-is-the-bgp-style-vuln-lurking-in-software-security.html">Your Companies Biggest Security Hole - What is the BGP-style Vuln Lurking in Software Security?</source>
    </item>
    <item>
      <title><![CDATA[Four quick tips for choosing an IM security product]]></title>
      <link>http://securityratty.com/article/644c4d858c0af28c530dae2d00363c43</link>
      <guid>http://securityratty.com/article/644c4d858c0af28c530dae2d00363c43</guid>
      <description><![CDATA[Instant messaging (IM) has become an increasingly useful business tool for modern corporations. Data from a Forrester Research survey suggests that 71% of businesses will invest in real-time messaging...]]></description>
      <content:encoded><![CDATA[Instant messaging (IM) has become an increasingly useful business tool for modern corporations. Data from a Forrester Research survey suggests that 71% of businesses will invest in real-time messaging this year.]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/modern corporations">modern corporations</category>
      <category domain="http://securityratty.com/tag/business tool">business tool</category>
      <category domain="http://securityratty.com/tag/real-time">real-time</category>
      <category domain="http://securityratty.com/tag/businesses">businesses</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/instant">instant</category>
      <category domain="http://securityratty.com/tag/increasingly">increasingly</category>
      <source url="http://www.networkworld.com/news/2008/082608-four-quick-tips-for-choosing.html?fsrc=rss-security">Four quick tips for choosing an IM security product</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Boingo Expands to Dulles, Reagan; HP Buys Colubris]]></title>
      <link>http://securityratty.com/article/bf4c344b29225f02ac5e0b333132500e</link>
      <guid>http://securityratty.com/article/bf4c344b29225f02ac5e0b333132500e</guid>
      <description><![CDATA[Boingo Wireless's airport wireless division brings service to Washington's two airports: Dulles and Reagan (National) offer Wi-Fi under the regular terms. These airports carry 24m and 18m passengers,...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://biz.yahoo.com/bw/080812/20080812005136.html?.v=1"><strong>Boingo Wireless's airport wireless division brings service to Washington's two airports:</strong></a> Dulles and Reagan (National) offer Wi-Fi under the regular terms. These airports carry 24m and 18m passengers, respectively, each year. It's $5/hr, $8/24 hours, and $22/month (no contract commitment) for US access, and $39/mo for worldwide access (no contract commitment). The company isn't the exclusive operator, but appears as one of three Wi-Fi network choices when you're in the airport.</p>

<p><a href="http://money.cnn.com/news/newsfeeds/articles/djf500/200808121051DOWJONESDJONLINE000381_FORTUNE5.htm"><strong>HP buys Colubris:</strong></a> Colubris was an early wireless LAN company, making sophisticated hardware for the enterprise, but I've seen its market and products shift across many markets over several years, including hotspot offerings. I'd lost track of them in recent years, although this story says that the firm refocused on service providers rather than corporations. HP will integrate Colubris into ProCurve, which will compete more effectively against Cisco. A few years ago, there were beaucoup WLAN switch operators, each with somewhat different approaches and offerings. Airespace was bought by Cisco, Trapeze more recently by Belden, and Aruba went public.</p>]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 08:05:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/buys colubris">buys colubris</category>
      <category domain="http://securityratty.com/tag/colubris">colubris</category>
      <category domain="http://securityratty.com/tag/contract commitment">contract commitment</category>
      <category domain="http://securityratty.com/tag/airports carry 24m">airports carry 24m</category>
      <category domain="http://securityratty.com/tag/airports">airports</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <category domain="http://securityratty.com/tag/wireless lan company">wireless lan company</category>
      <category domain="http://securityratty.com/tag/wi-fi network choices">wi-fi network choices</category>
      <category domain="http://securityratty.com/tag/hotspot offerings">hotspot offerings</category>
      <source url="http://wifinetnews.com/archives/008417.html">Wee-Fi: Boingo Expands to Dulles, Reagan; HP Buys Colubris</source>
    </item>
  </channel>
</rss>
