<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: delivery]]></title>
    <link>http://securityratty.com/tag/delivery</link>
    <description></description>
    <pubDate>Sat, 06 Sep 2008 07:25:02 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[MSP Snapshot Monitoring with EM7]]></title>
      <link>http://securityratty.com/article/5288692e82e0f23665e5086e43db9ed4</link>
      <guid>http://securityratty.com/article/5288692e82e0f23665e5086e43db9ed4</guid>
      <description><![CDATA[Between the fifth anniversary for ScienceLogic and the Inc 500 milestone, weve become very nostalgic about the beginnings of the company and EM7. For instance, did you know that EM7 was originally...]]></description>
      <content:encoded><![CDATA[<p>Between the <a href="http://blog.sciencelogic.com/sciencelogics-5-year-anniversary/08/2008" target="_blank">fifth anniversary for ScienceLogic</a> and the Inc 500 milestone, we’ve become very nostalgic about the beginnings of the company and EM7. For instance, did you know that EM7 was originally designed with managed service providers in mind? Not so surprising when 5 of the first 6 employees (including all 3 founders) came from hosting and MSP backgrounds and had first-hand experience with the daily trials and tribulations of MSP operations – and the tools that didn’t quite work for them.
<p><a href="http://blog.sciencelogic.com/wp-content/uploads/2008/10/john-at-interop-vegas.jpg"><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="184" alt="John at Interop Vegas" src="http://blog.sciencelogic.com/wp-content/uploads/2008/10/john-at-interop-vegas-thumb.jpg" width="244" align="left" border="0"></a>Here we talk to John Proctor, who started out as one of our first customers (and the first MSP customer). And he believed in it so much, he eventually became part of the ScienceLogic team. (Remember &#8220;I&#8217;m not only the President, I&#8217;m also a client&#8221; from <a href="http://www.hairclub.com/inthenews_article1.php" target="_blank">the Hair Club for Men</a>?)
<p>John shares his perspectives about the service provider world and why he took a chance on a little-known product called EM7.
<p><strong>ScienceLogic:</strong> What is your background? How many years have you worked as a service provider and for what types of companies?
<p><strong>John Proctor:</strong> I have been working with Service providers for over twelve years. I worked at a major regional service provider for six years and before that I designed and built national and international networks for ISP’s and Fortune 500 companies as a consultant for PriceWaterhouseCoopers and WorldComm.
<p><strong>ScienceLogic:</strong> You were one of the first customers of EM7 – why did you choose it and how did you get over the hurdles associated with using a start-up company’s product?
<p><strong>John Proctor:</strong> We were actually customer number five. Back in 2004 when we evaluated and purchased EM7 we could see that EM7 provided about 80% of what we were looking for in one integrated solution right out of the box. One of the things that sold us on EM7 was that the ScienceLogic founders had all previously worked for a service provider, so we knew they understood our business and our challenges. But in the end, it comes down to features. Once we compared EM7 functionality to the alternatives, it was clearly a “no brainer.”
<p><strong>ScienceLogic:</strong> What other alternatives were being considered?
<p><strong>John Proctor:</strong> Well, we had started with a few point solutions, but as our business and product offerings matured, this resulted in a growing number of point solutions. What started with 3 or 4 ended up as 14 separate tools. They all had strengths but what they didn’t have was integration and because of this they could not scale. And, if the tools could not scale, our business could not grow.
<p>So, naturally we started looking at framework solutions, but they are expensive to buy, expensive to implement, and expensive to maintain. At one point, we even considered some open source projects. There were several that showed promise, but we would still be stuck with tools that were not integrated. So then we considered hiring developers to cobble something together that would work for our business. The only problem with this alternative was that we felt it would take 6 to 8 months before we could have something viable to work with.
<p><strong>ScienceLogic:</strong> What products were you using before EM7? What were your goals?
<p><strong>John Proctor:</strong> Before we purchased EM7 we used 14 different point solutions to deliver our products and services to the marketplace. Tools like NetCool, Openview, Argent, Heat, What’s Up Gold as well as several other point solutions, vendor specific applications and manually updated spreadsheets. And, as I mentioned before, this does not scale. This also adds a great deal of complexity when you begin to consider business continuity and disaster recovery. All these tools were vital to the delivery of our products and services. Any service provider will tell you it is all about uptime. So if the product is uptime, the tools used to deliver it have to be available 24&#215;7x365.
<p>Our goals were simple: scale and redundancy. As it turns out, the solution was simple as well. EM7 provided a tool that could replace the functionality of almost half of the existing point solutions and the applications that could not be replaced were integrated with EM7 to provide our staff with a “single pane of glass” to see the status and performance of each area of the business from one application. We had visibility into everything from facility systems to applications using EM7.
<p>ScienceLogic also delivers an extensible configuration that addressed uptime and redundancy. We deployed collectors throughout our network that reported back to a central pair of redundant database servers and with this configuration we were able to perform backups and add capacity without taking the system down.
<p><strong>ScienceLogic:</strong> Why are service providers different from enterprises? How are their needs different?
<p><strong>John Proctor:</strong> First and foremost, service providers face the same challenges that only the largest enterprises ever face and they also have many unique challenges that only service providers experience.
<p>One challenge we faced was that we had multiple datacenters in different states. They were all interconnected with plenty of bandwidth between each site, but the tools were not designed to be used across the WAN. Our staff in our remote data center did not have the same access as our staff in the corporate office. Since EM7 is web-based, it immediately eliminated this problem.
<p>Another challenge is that service providers must manage systems across multiple domains. Back in the early version of a specific tool we were using before EM7, the only way you could implement it across multiple domains was to put the same username and password on every computer that you monitored. Beyond the security concerns, maintenance was a nightmare. Anytime we had to change the password, we would get locked out of dozens upon dozens of systems. When the password was changed on the monitoring server, it would attempt to login to the remote machines and fail. Repeated attempts would result in the account getting locked. I think that vendor eventually addressed this issue, but service providers seldom find tools that were designed for their unique situations.
<p><strong>ScienceLogic:</strong> How is EM7 geared to service providers?
<p><strong>John Proctor:</strong> Enterprise IT is a trusted part of the business; they are one of the team. Service providers are outsiders that must earn trust by showing the customer exactly what they are doing.
<p>EM7 provides a multi-tenant environment that allows service providers to manage systems across many different customers while at the same time providing the customer access to see the same information but only what’s relevant to them.
<p>EM7 was built by service providers and even includes a few features just for them. Two of my favorites are bandwidth billing and the emergency notification system. Take bandwidth billing, for instance. EM7 provides a way to collect bandwidth utilization, store subscription information, and calculate a bill from any one of about 10 different methodologies. And at the end of the billing period, EM7 sends the completed report out to whomever you chose via email.
<p>Another unique service provider feature is the emergency notification system. EM7 allows the provider to track what customers used their unique infrastructure components. If they have to perform maintenance on the infrastructure component or have a problem they can send an email to all of the impacted customers in a matter of minutes.
<p><strong>ScienceLogic:</strong> What trends do you see for service providers? What about big trends such as virtualization and cloud computing – how will they impact service providers?
<p><strong>John Proctor:</strong> Virtualization is really hot for service providers right now and for the same reasons as in the enterprise. Service providers run data centers and data centers must be powered and cooled. So, anytime they can use a virtual server instead of adding physical equipment it is a good thing. But then you add the complexity that multiple customers reside on the same host and you must track things like bandwidth utilizations by guest OS, and it all gets a little harder. Lucky for us this is not a problem for EM7.
<p>I still think it’s early days for cloud computing. Depending on who you talk to, much of what service providers (especially the big ones) have already been doing with SAAS offerings and hosted applications could be described as cloud computing already. In which case, service providers are ahead of the game. But whatever the “final” definition, cloud computing actually shares many similarities with virtualization – in that service providers (or enterprises) will need to be able to manage far more “devices” in real-time with “zero downtime” expectations by customers. What this really means is that you’re going to see much more automation in provisioning and IT monitoring tools to handle the scale and speed with which things can change in the data center given vm migration and the talked-about switching between “clouds” that can be used for high availability. </p>
]]></content:encoded>
      <pubDate>Wed, 08 Oct 2008 12:51:50 +0000</pubDate>
      <category domain="http://securityratty.com/tag/em7">em7</category>
      <category domain="http://securityratty.com/tag/service providers">service providers</category>
      <category domain="http://securityratty.com/tag/service providers experience">service providers experience</category>
      <category domain="http://securityratty.com/tag/service providers seldom">service providers seldom</category>
      <category domain="http://securityratty.com/tag/impact service providers">impact service providers</category>
      <category domain="http://securityratty.com/tag/em7 functionality">em7 functionality</category>
      <category domain="http://securityratty.com/tag/em7 sends">em7 sends</category>
      <category domain="http://securityratty.com/tag/service provider">service provider</category>
      <category domain="http://securityratty.com/tag/service provider world">service provider world</category>
      <source url="http://blog.sciencelogic.com/msp-snapshot-monitoring-with-em7/10/2008">MSP Snapshot Monitoring with EM7</source>
    </item>
    <item>
      <title><![CDATA[University sets up a campus warning network for free ]]></title>
      <link>http://securityratty.com/article/532f402f74efb59fafb0b176f8e8a342</link>
      <guid>http://securityratty.com/article/532f402f74efb59fafb0b176f8e8a342</guid>
      <description><![CDATA[Elon University needed to come up with a campus-wide emergency notification system that integrated with all the possible warning-delivery systems already installed on campus, and managed to pull it...]]></description>
      <content:encoded><![CDATA[Elon University needed to come up with a campus-wide emergency notification system that integrated with all the possible warning-delivery systems already installed on campus, and managed to pull it off for free.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=44788?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=44788?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Mon, 06 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/free">free</category>
      <category domain="http://securityratty.com/tag/campus">campus</category>
      <category domain="http://securityratty.com/tag/elon university">elon university</category>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <category domain="http://securityratty.com/tag/pull">pull</category>
      <source url="http://www.networkworld.com/news/2008/100708-campus-warning-network.html?fsrc=rss-security">University sets up a campus warning network for free </source>
    </item>
    <item>
      <title><![CDATA[MI6 Camera -- Including Secrets -- Sold on eBay]]></title>
      <link>http://securityratty.com/article/787b3bf3fc7e8ad2d3585c7a4f37ed35</link>
      <guid>http://securityratty.com/article/787b3bf3fc7e8ad2d3585c7a4f37ed35</guid>
      <description><![CDATA[I wish I'd known : A 28-year-old delivery man from the UK who bought a Nikon Coolpix camera for about $31 on eBay got more than he bargained for when the camera arrived with top secret information...]]></description>
      <content:encoded><![CDATA[<p>I <a href="http://www.techcrunch.com/2008/09/30/top-secret-mi6-camera-sold-to-the-highest-bidder-on-ebay/">wish</a> I'd <a href="http://gizmodo.com/5056749/mi6-camera-with-secret-images-bought-on-ebay-for-30">known</a>:</p>

<blockquote>A 28-year-old delivery man from the UK who bought a Nikon Coolpix camera for about $31 on eBay got more than he bargained for when the camera arrived with top secret information from the UK's MI6 organization.

<p>Allegedly sold by one of the clandestine organization's agents, the camera contained named al-Qaeda cells, names, images of suspected terrorists and weapons, fingerprint information, and log-in details for the Secret Service's computer network, containing a "Top Secret" marking.</blockquote></p>

<p>He turned the camera in to the police.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=T8c9M"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=T8c9M" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=CejeM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=CejeM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 09:59:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/camera">camera</category>
      <category domain="http://securityratty.com/tag/nikon coolpix camera">nikon coolpix camera</category>
      <category domain="http://securityratty.com/tag/top secret">top secret</category>
      <category domain="http://securityratty.com/tag/top secret information">top secret information</category>
      <category domain="http://securityratty.com/tag/named al-qaeda cells">named al-qaeda cells</category>
      <category domain="http://securityratty.com/tag/ebay">ebay</category>
      <category domain="http://securityratty.com/tag/clandestine organization">clandestine organization</category>
      <category domain="http://securityratty.com/tag/secret service">secret service</category>
      <category domain="http://securityratty.com/tag/fingerprint information">fingerprint information</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/mi6_camera_--_i.html">MI6 Camera -- Including Secrets -- Sold on eBay</source>
    </item>
    <item>
      <title><![CDATA[About the SDL Pro Network]]></title>
      <link>http://securityratty.com/article/dc28bc3dae82ee1f5322434291949577</link>
      <guid>http://securityratty.com/article/dc28bc3dae82ee1f5322434291949577</guid>
      <description><![CDATA[Hello all, Dave here
I expect that a number of you have seen the announcement and various press articles or Steve Lipner's Tuesday post about our launch of the SDL Threat Modeling Tool 3.0, the SDL...]]></description>
      <content:encoded><![CDATA[Hello all, Dave here... 
<P>I expect that a number of you have seen the <A href="http://www.microsoft.com/presspass/features/2008/sep08/09-16lipnersdl.mspx" mce_href="http://www.microsoft.com/presspass/features/2008/sep08/09-16lipnersdl.mspx">announcement</A> and various press articles or <A href="http://blogs.msdn.com/sdl/archive/2008/09/16/sdl-press-tour-announcements.aspx" mce_href="http://blogs.msdn.com/sdl/archive/2008/09/16/sdl-press-tour-announcements.aspx">Steve Lipner's Tuesday post</A> about our launch of the SDL Threat Modeling Tool 3.0, the SDL Optimization Model and the <A href="http://download.microsoft.com/download/0/E/9/0E9AC448-30B2-4451-9E23-46244AFABB7F/Microsoft%20SDL%20Pro%20Network%20_Fact%20Sheet.pdf" mce_href="http://download.microsoft.com/download/0/E/9/0E9AC448-30B2-4451-9E23-46244AFABB7F/Microsoft%20SDL%20Pro%20Network%20_Fact%20Sheet.pdf">SDL Pro Network</A>.&nbsp; Since I was intimately involved with the creation of the SDL Pro Network, I thought I'd write a few words about our objectives and chat a bit about the thinking behind our partner choices for the pilot phase.</P>
<P>So, what are we hoping to gain by creating a network of security consulting and training experts to work with customers who want to implement the SDL?&nbsp; Generally speaking, this question has a two-part answer:&nbsp; First, Microsoft is, and always will be a partner-driven company - we rely on the skills and capabilities of our partners to provide specialized services and broad geographic coverage for Microsoft products and services.&nbsp; Second, even though there are talented folks in the <A href="http://www.microsoft.com/services/microsoftservices/default.mspx" mce_href="http://www.microsoft.com/services/microsoftservices/default.mspx">Microsoft Services</A> organization, it's clear that we will need help from our partners to scale to meet the demand.&nbsp; I can't tell you how many times the folks on the SDL team have been approached by people - after an executive briefing, or a session at TechEd - asking for guidance in implementing SDL in their own organizations.&nbsp; When we look at the demand and pair it with the geographic diversity of our customer base, it's clear that a partner approach is the right answer.</P>
<P>Now a few words about the partners who will be participating in the pilot phase...</P>
<P>After the decision was made to work with partners on SDL delivery, we had two primary criteria that we had to address; partner quality, and manageability of the SDL Pro Network pilot. We have all seen instances where individuals or consulting organizations have represented themselves to the IT community as having security expertise when in reality the "experts for hire" were simply reading a page or two ahead of the customer in whatever security tome was "in vogue" at the time.&nbsp; </P>
<P>Based on those observations, it was clear that partner "quality" was a critical criterion. &nbsp;Fortunately for us, we didn't have to look far to satisfy our quality bar - many of the companies in the SDL Pro Network pilot have direct experience with executing portions of the SDL on <I>our</I> products, or have delivered services to Microsoft in a security context. Design reviews, code reviews, penetration testing, training&nbsp;and other tasks critical to SDL implementation were (and are) common fare for these folks.</P>
<P>Despite the customer demand for SDL that I alluded to above, starting with a small pilot was the right thing to do; a small group of trusted consultancies supports our imperative for quality and it allows us to pragmatically grow the SDL Pro Network as the market matures. &nbsp;As we continue to evolve and innovate with the SDL, we'll have a strong core of partners to help drive the software security message. </P>
<P>Will we grow the SDL Pro Network?&nbsp; The qualified answer is: "When the market demands it..." - there are a number of talented potential partners who meet the quality bar - and clearly, the need for security in software development will grow to demand additional talented specialists. However, it's our plan to begin with a small set of partners of known expertise, and then respond to growing demand as it materializes.</P>
<P>So there you have it - the nuanced beginning and bright future of the SDL Pro Network...&nbsp; I invite your comments, and encourage you to check in at the <A href="http://www.microsoft.com/sdl" mce_href="http://www.microsoft.com/sdl">SDL Portal</A> as we continue to build out the program</P><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8958114" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 23:12:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sdl">sdl</category>
      <category domain="http://securityratty.com/tag/sdl pro network">sdl pro network</category>
      <category domain="http://securityratty.com/tag/sdl implementation">sdl implementation</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/sdl delivery">sdl delivery</category>
      <category domain="http://securityratty.com/tag/sdl optimization model">sdl optimization model</category>
      <category domain="http://securityratty.com/tag/quality">quality</category>
      <category domain="http://securityratty.com/tag/partner quality">partner quality</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://blogs.msdn.com/sdl/archive/2008/09/18/about-the-sdl-pro-network.aspx">About the SDL Pro Network</source>
    </item>
    <item>
      <title><![CDATA[From the Executive Women's Forum on Information Security]]></title>
      <link>http://securityratty.com/article/f2976566aba2a7d7042931766a835f14</link>
      <guid>http://securityratty.com/article/f2976566aba2a7d7042931766a835f14</guid>
      <description><![CDATA[The theme of the 2008 Executive Women's Forum on Information Security, Risk Management &amp; Privacy is &quot;risk convergence is inevitable.&quot; The risks associated with information security, privacy, physical...]]></description>
      <content:encoded><![CDATA[The theme of the 2008 Executive Women's Forum on Information Security, Risk Management & Privacy is "risk convergence is inevitable." The risks associated with information security, privacy, physical security and so forth are converging such that an integrated management approach is required from within the firm. <br />
<br />
Interestingly enough, business continuity management was not a key risk area mentioned by all panelists of the session titled "Convergence: The Good, The Bad & The Ugly." There were two pieces of strategic program management advice from the panelists. The first point is that you have to partner with all of your lines of business and corporate support areas. Since risk is related to the delivery of the business, no one department can address all of the issues. And, you might find that there are good practices already in place within your firm, so that you are not reinventing the wheel - leverage the good stuff throughout the firm. The second point is to focus on the budget issue - how many risk-related activities are already in place in your organization that could be combined, and possibly duplicated, so that more work gets done with less money spent? Pooling of already limited budgets can go a long way toward developing a program that is more mature, delivers more benefit to the organization and eliminates a lot of duplicative work. <br />
<br />
But all of this convergence comes at a price - mainly in fear, uncertainty and doubt of the workforce. Some feel that they will lose authority (especially in siloed risk approaches); others might lose their jobs as a result of the convergence. This human aspect was mentioned as the key challenge of an integrated approach. Therefore, communicating not only up within the firm but down to the workforce is critical to achieving a well-run and integrated program. <br />
<br />
And finally, for those areas that just don't want to "play the game," use your internal audit department as the "stick" that can get them to act. When I was an IT risk manager, I always said that I was management's best friend - let me tell you the gaps in your risk program rather than having them come from the audit department, which then become part of the records of the firm.]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 15:29:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/risk approaches">risk approaches</category>
      <category domain="http://securityratty.com/tag/risk program">risk program</category>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/management">management</category>
      <category domain="http://securityratty.com/tag/management approach">management approach</category>
      <category domain="http://securityratty.com/tag/key risk">key risk</category>
      <category domain="http://securityratty.com/tag/audit department">audit department</category>
      <category domain="http://securityratty.com/tag/internal audit department">internal audit department</category>
      <source url="http://blog.gartner.com/blog/security.php?x=0&amp;itemid=3879">From the Executive Women's Forum on Information Security</source>
    </item>
    <item>
      <title><![CDATA[Can You Believe It? With the Financial Markets in Turmoil, the Hosting Industry Continues to Thrive!]]></title>
      <link>http://securityratty.com/article/b7bfb8c522ce436676068950e32e11a9</link>
      <guid>http://securityratty.com/article/b7bfb8c522ce436676068950e32e11a9</guid>
      <description><![CDATA[I am participating in the 4th annual Hosting Transformation Summit in sunny Las Vegas today and have just listened to some heartwarming news from Dan Golding the head of Tier1 Research . Dan kicked...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/datacenter-ani-optimized.gif" border="0" alt="Datacenter_ani_optimized" width="242" height="249" align="left" /> I am participating in the <a href="http://www.hostingtransformation.com/na/2008/" target="_blank">4th annual Hosting Transformation Summit</a> in sunny Las Vegas today and have just listened to some heartwarming news from <a href="http://www.hostingtransformation.com/na/2008/panelists.php" target="_blank">Dan Golding</a> the head of <a href="http://www.t1r.com/" target="_blank">Tier1 Research</a>. Dan kicked off the morning with his Keynote “Managed Hosting and Colocation in 2009 and beyond.” As you may know, ScienceLogic has maintained a large group of customers in the Managed Service Provider industry so we love to keep our ears to the pavement regarding industry trends. (<em><a href="http://www2.sea.siemens.com/NR/rdonlyres/4866BFD6-9181-41BD-90EA-D8380255E826/0/Datacenter_ani_optimized.gif" target="_blank">image from: Siemens</a>)</em></p>
<p>Dan described the Managed Hosting and colocation sector as “on fire” The sector is humming – incredible growth, outstanding execution, blowing away expectations. I must say, looking back 5 years ago after the tech bubble collapse, I can’t believe how strong the <a href="http://blog.wired.com/business/2008/09/why-the-tech-in.html" target="_blank">sector bounced back</a> from those very difficult times.</p>
<p>His presentation was focused on a future, and a longer view for the industry. The HTS conference is packed this year with the largest attendance of Datacenter owners, Managed hosting and colocation companies ever to attend this conference.</p>
<ul>
<li>Demand steady or increasing in all markets, driven largely by capex constraints and greater awareness and choices.</li>
<li>Supply is growing more slowly in the past 18 months as the credit crunch has hurt the ability of providers to expand ( it is very hard to get mortgages, loans only on new datacenter projects). Expansion build-out of existing shells is occurring, but very little on spec.</li>
<li>Demand Growth of 15% in 2008. (Steady and increasing in the out years) However after supply growth peaked at 7.5% in 2007 supply growth now has slowed to 5%</li>
<li>Dan believes that supply growth will pick back up again in 2011</li>
</ul>
<p>Conclusions – supply is tight, demand is high and growing…this very good news for the industry.</p>
<ul>
<li>Some other trends:
<ul>
<li>The <a href="http://royal.pingdom.com/?p=327" target="_blank">green initiatives</a> are more than just a <a href="http://www.greenm3.com/2008/09/cisco-and-ibm-s.html" target="_blank">trend as datacenter owners</a> who don’t figure out how to <a href="http://www.greenm3.com/2008/08/modeling-for-gr.html" target="_blank">maximize power efficiency</a> will be painted as villains.</li>
<li><a href="http://www.webpronews.com/topnews/2008/09/02/us-getting-dominated-in-internet-traffic" target="_blank">Internet traffic</a> and services consumption are linked as Internet traffic growth has been doubling every year (2005-2007)</li>
<li>Prediction: 2011 -2012 - <a href="http://mashable.com/2008/08/31/is-the-us-becoming-a-part-of-the-internet-backwater/" target="_blank">internet traffic</a> will get an exaflood – it is coming with a new breed of applications (set to boxes HD Video, games, etc.) that will drive new traffic patterns. <a href="http://www.nytimes.com/2008/08/30/business/30pipes.html?_r=1&amp;ref=technology&amp;oref=slogin" target="_blank">Growth driven by consumer broadband</a> + applications (HD video) applications, which in turn will drive demand for Managed Hosting / Colocation Services…</li>
</ul>
</li>
</ul>
<p>Managed Hosting Services Highlights</p>
<ul>
<li>Incredibly fast growth 30%+</li>
<li>$10 Billion worldwide revenue by end of 2008</li>
<li>We’ll keep growth pace until at least 2011</li>
<li>Good news, Dan believes that fears about slowdown in growth are wildly overblown.</li>
</ul>
<p>Why is managed hosting growing so fast?</p>
<ul>
<li>Demographic shifts – new breed of IT employees that <a href="http://www.crcexchange.com/outsource-your-it" target="_blank">embrace outsourcing</a></li>
<li>Growth in internet applications <a href="http://www.infoworld.com/article/08/07/30/Clear_strategy_key_for_SaaS_ecommerce_success_1.html?source=rss&amp;url=http://www.infoworld.com/article/08/07/30/Clear_strategy_key_for_SaaS_ecommerce_success_1.html" target="_blank">(SaaS)</a> The acceptance and growth of browser based applications has been enormous!</li>
<li>Ambiguity between web hosting and managed hosting has turned positive</li>
</ul>
<p>Dan’s Key success factors <a href="http://blog.adspotlive.com/managed-hosting-and-related-things-to-be-considered/" target="_blank">managed hosting and services</a></p>
<ul>
<li>High margin services – and not too many – it is so tempting in our day to day business when a customer comes along and wants to come and give us money for a unique on-off service… at this point the answer has to be no – or do it through a partner.</li>
<li>High level of support delivery is critical – don’t cut pay in support people or outsource support to save a nickel… what you are selling is support. Keep doing this well or you will head into a bad place… just as examples in retail like Home Depot and others who have struggled with customer service challenges – the whole business starts to slide into the toilet… High levels of support delivers a strong word of mouth buying cycle</li>
</ul>
<p>Final thoughts, the industry is healthy and will continue to thrive. Customers are looking for the one stop shop, one company that is a trusted advisor to the customer. As customers place more eggs in the Managed Service bucket, the industry will need to tighten-up those SLA’s. Today some parts of the industry have been getting away with loose SLA’s… as customers get more sophisticated and have more on the line, they will become more demanding and require robust multi-component SLAs and back-it –up.</p>
]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 11:00:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fast">fast</category>
      <category domain="http://securityratty.com/tag/demand steady">demand steady</category>
      <category domain="http://securityratty.com/tag/demand">demand</category>
      <category domain="http://securityratty.com/tag/incredibly fast growth">incredibly fast growth</category>
      <category domain="http://securityratty.com/tag/growth">growth</category>
      <category domain="http://securityratty.com/tag/drive demand">drive demand</category>
      <category domain="http://securityratty.com/tag/drive">drive</category>
      <category domain="http://securityratty.com/tag/internet traffic growth">internet traffic growth</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <source url="http://blog.sciencelogic.com/can-you-believe-it-with-the-financial-markets-in-turmoil-the-hosting-industry-continues-to-thrive/09/2008">Can You Believe It? With the Financial Markets in Turmoil, the Hosting Industry Continues to Thrive!</source>
    </item>
    <item>
      <title><![CDATA[Sorry, Qantas, No Unfettered Broadband]]></title>
      <link>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</link>
      <guid>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</guid>
      <description><![CDATA[Qantas backs off from earlier plans, changes provider for in-flight broadband: The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/plane.jpg" align="right" border="0" hspace="5" /><a href="http://www.smh.com.au/news/travel/qantas-limits-access-to-web/2008/09/17/1221330929870.html"><strong>Qantas backs off from earlier plans, changes provider for in-flight broadband:</strong></a> The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its in-flight broadband plans. Aeromobile was the provider when the service <a href="http://www.breakingtravelnews.com/article.php?story=2007081609481129&query=qantas"><strong>was tested in second quarter 2007</strong></a>, but OnAir is now described as the airline's partner. This was noted by colleague Fabio Zambelli, who emailed me the news, and <a href="http://www.setteb.it/content/view/4742"><strong>has his own account</strong></a> at 7BIT (in Italian).</p>

<p><a href="http://www.onair.aero/index.php?pid=123"><strong>OnAir</strong></a> has so far tested their calling/texting-only service on two aircraft--one operated by Air France, one by TAP Portugal--even though RyanAir announced plans that its planes would started being unwired with the service by late 2007. Still no word on that fleet progress.</p>

<p>Qantas will apparently launch cached Web browsing and limited Web email (probably through a proxy) along with instant messaging, with full Internet service coming "later in 2009." This is clearly due to a lack of satellite coverage that was just remediated a few weeks ago (see below). The first plane with limited service, a new A380, should be in flight 20-October-2008.</p>

<div style="float:right; margin:0px; padding-left: 10px; padding-bottom: 0px;"><p><img src="http://wifinetnews.com//images/2008/SorryQantas.jpg" alt="SorryQantas.jpg" border="0" width="100" height="152"></p><p style="font-size: 10px">I hate in-flight<br/>broadband</p></div>To Qantas' credit, note that each seat on the plane will have a laptop opower socket, a USB port, and a multimedia system that can show 100 movies and 500 TV show episodes, play the contents of 1,000 CDs and 20 radio stations, and offer 80 games. 

<p>The Morning Herald seems to overstate the importance and scope of a complaint filed by the union representing American Airlines' flight attendants. The detailed coverage in the U.S. had more to do with the potential for issues, and likely attendants lack of interest in policing yet another media on the plane. Filtering doesn't work, the attendants probably already know, and this may just be a negotiating point with the airline.</p>

<p>On why Qantas is waiting until late 2009? This requires unwinding how OnAir gets its signal.</p>

<p>Aeromobile and OnAir both rely on Inmarsat satellites for their service. Both companies had several years ago staked their futures on the fourth-generation network Inmarsat was to inaugurate with three satellites that would use beamforming to allow precise delivery of nearly 500 Kbps per receiver, with hundreds or thousands of regions being able to be targeted from a single satellite. Inmarsat's third-gen network--don't confuse this with 3G cellular ground-based networks--can deliver about 64 Kbps per channel.</p>

<p>Now, unfortunately, Inmarsat was three years late on launching its trans-Pacific bird. While the company <a href="http://www.inmarsat.com/About/Newsroom/Press/00021465.aspx?language=EN&textonly=False"><strong>claims 85 percent coverage of the earth</strong></a> and 98 percent coverage of population, there's a big gap over the Pacific that also prevents them from having good overlap between the U.S. and Japan/China/Korea, as well as the southern Pacific, covering Australia. Since the biggest market for long-haul flights would likely be Australia, Japan, and China, traveling trans-Pacific or trans-hemispheric routes, that gap is rather large.</p>

<p>Aeromobile opted to build out a service, deployed only by Emirates airline as far as I can tell, that uses the 3G service since it was available, and most necessary equipment is already installed on most over-water planes. OnAir was waiting for 4G, which has necessitated a long wait, but allowed them to launch in Europe with a seemingly next-generation service. Given that OnAir is controlled by an airline-owned integration firm, SITA, and by Airbus, they're not going anywhere.</p>

<p>Inmarsat finally <a href="http://spaceflightnow.com/proton/i4f3/"><strong>lofted its third satellite on Baikonur Cosmodrome in Kazakhstan</strong></a> on 19-August-2008, and the launch and separation was reported as successful. Previously, the company has needed up to a year to verify and deploy its 4G satellites. (You can <a href="http://forum.nasaspaceflight.com/index.php?topic=12380.105"><strong>read extremely close coverage of the launch</strong></a> at a Web site devoted to space enthusiasm.)</p>

<p>However, the dirty little secret about Inmarsat's BGAN is that it costs a fortune to heft bandwidth across it. Thus, in-flight broadband over BGAN, if it's ever available, is going to be changed on an extremely high per-MB rate. None of the providers want to say this. This is in contrast to Row 44 (and, once, Connexion by Boeing), which relies on leased Ku-band transponders where they can fix costs and they require high volumes to keep per-bit costs efffectively low.</p>

<p>OnAir's launch of calling on Air France's service involves paying a few euros per minute for calls, which might help you understand what data costs could ultimately run.</p>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 06:33:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/satellite coverage">satellite coverage</category>
      <category domain="http://securityratty.com/tag/coverage">coverage</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service involves">service involves</category>
      <category domain="http://securityratty.com/tag/internet service">internet service</category>
      <category domain="http://securityratty.com/tag/in-flight broadband plans">in-flight broadband plans</category>
      <category domain="http://securityratty.com/tag/plans">plans</category>
      <category domain="http://securityratty.com/tag/inmarsat satellites">inmarsat satellites</category>
      <category domain="http://securityratty.com/tag/inmarsat">inmarsat</category>
      <source url="http://wifinetnews.com/archives/008448.html">Sorry, Qantas, No Unfettered Broadband</source>
    </item>
    <item>
      <title><![CDATA[Interop NY Keynotes: IBM]]></title>
      <link>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</link>
      <guid>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</guid>
      <description><![CDATA[Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage
IBMs presentation was...]]></description>
      <content:encoded><![CDATA[<p>Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage.</p>
<p>IBM&#8217;s presentation was cleverly titled <strong>2mor0@Wrk</strong> - Tomororow work and Web 2.0.</p>
<p><strong>Overview</strong></p>
<p>Web 2.0 is delivering a whole different paradigm of communication. The slide is Lotus Symphony - NOT PPT. Over 2 million downloads.</p>
<p>There is an information overload that impacts individual productivity in the workplace. It has a profound effect on organizational productivity. A more complex organization entity provides more pressure and more inefficiencies in workplace. Up to 70% of time can be used looking for the WRONG information.</p>
<p>Collaboration mitigates information overload. It allows you to identify experts and opinions.</p>
<p>The collaboration agenda. Enterprises are at the onset of exploring these features. Web 2.0 is giving us the capacity to do more. Collaboration optimizes business outcomes - global, secure and dynamic.The most progressive companies are looking at UNIFIED COMMUNICATIONS. Making sure that directories and profiles are fully mobile.</p>
<p>Collaboration should be a contextual part of the workflow, going directly into applications.</p>
<p>IBM&#8217;s collaboration strategy is to deliver these services through online or offline services.</p>
<p><strong>Demonstration</strong></p>
<p>Executive IT architect Ron Sebastian provided a demonstration of IBM&#8217;s collaboration strategy. IBM&#8217;s Web 2.0 solutions span delivery platforms:</p>
<ul>
<li>Platform - web as&nbsp; platform</li>
<li>Application - development</li>
<li>People - social computing</li>
</ul>
<p><a href="http://www-01.ibm.com/software/lotus/products/connections/" target="_blank">Lotus Connections</a> - a family of social computing software that provides profile lookup and community capabilities. Think of Facebook, Yahoo Groups, and delicious combined in one portal.</p>
<p>Ron demonstrated these social services embedded into a healthcare provider application. Semantic tagging is available, contact information and commenting. Not only are we providing service to customers, you can integrate sync capability to directly call the person you want.</p>
<p>The biggest aspect of Lotus Connection? It&#8217;s all integrated.</p>
<p>A new service - <a href="https://www.bluehouse.lotus.com/" target="_blank">Project Bluehouse</a>. This is a SaaS delivery of these collaborated capabilities. The store and share can manage and share documents within and outside the company. Access control is no longer an issue.</p>
<p>Collaborative Web 2.0 services available as standalone products that also work in a mobile environment.</p>
<p><strong>Case Study: Natural Disaster Management Mashup</strong></p>
<p>Boeing came up with twenty different scenarios that they could handle through their systems. The problem was the one they didn&#8217;t count on. One example was Katrina - how to deliver supplies to the area: what airports were open? Where could they land? The problem was they could not find one list of public, private and military airports, nor what was open. The mashup took different feeds to allow the deacon maker to make a more rapid and intelligent decision based on information on where they could fly in the appropriate supplies. From open information sites like <a href="http://www.airnav.com/" target="_blank">AirNav.com</a> and personal contacts, users were able to mashup the information to make better decisions.</p>
<p><strong>Conclusion</strong></p>
<p><a href="http://www.eweek.com/c/a/Messaging-and-Collaboration/IBM-to-Unveil-Social-Software-Center-at-Interop/" target="_blank">IBM announced the IBM Center for Social Software</a>, proving their commitment to connect, collaborate, and innovate. Users and academics can work together to how these innovations can be applied to businesses and provide value to the market.</p>
<p>There has been <a href="http://teblog.typepad.com/david_tebbutt/2008/04/ibms-bluehouse.html" target="_blank">some question</a> of whether or not IBM can pull this off and move into the collaborative Web 2.0 market. Despite <a href="http://www.theappgap.com/ibm-bluehouse-organizes-online-meetings-and-the-before-and-after.html" target="_blank">some criticism</a>, it looks like IBM has really taken a step forward in advancing their products and services to meet market needs.</p>
<p>People drive better business outcomes. Connecting, collaboration, and innovation is key. Having the right tools and information to do that eases pressure that many organizations feel and brings Web 2.0 technologies to the heart of businesses.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 09:39:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/information sites">information sites</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/collaboration">collaboration</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/social">social</category>
      <category domain="http://securityratty.com/tag/ibms collaboration strategy">ibms collaboration strategy</category>
      <category domain="http://securityratty.com/tag/social services">social services</category>
      <category domain="http://securityratty.com/tag/collaborative web">collaborative web</category>
      <source url="http://blog.sciencelogic.com/interop-ny-keynotes-ibm/09/2008">Interop NY Keynotes: IBM</source>
    </item>
    <item>
      <title><![CDATA[Assets Good Until Reached For]]></title>
      <link>http://securityratty.com/article/b4259e9d1ccfa754480b062e7acb4e32</link>
      <guid>http://securityratty.com/article/b4259e9d1ccfa754480b062e7acb4e32</guid>
      <description><![CDATA[A few months back Minyanville wondered whether this subprime mess would end up as a cancer or a car crash. Guess we know the answer now. The question is - should we be at all surprised? Some smart...]]></description>
      <content:encoded><![CDATA[<p><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">A few months back </span></span><a href="http://www.minyanville.com/articles/football-bears-bulls-Credit-equities-fannie/index/a/18769"><span style="font-size: 12px; "><span style="font-family: Arial;">Minyanville</span></span></a><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> wondered whether this subprime mess would end up as a cancer or a car crash. Guess we know the answer now. The question is - should we be at all surprised?

Some smart folks have been warning for a long time. Warren Buffett famously called derivatives financial weapons of mass destruction.</span></span></p><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Charlie Munger, as he is wont to do, went a bit further (from 2004):</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">I think a good litmus test of the mental and moral quality at any large institution [with significant derivatives exposure] would be to ask them, &quot;Do you really understand your derivatives book?&quot; Anyone who says yes is either crazy or lying.</span></span></p></blockquote><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">They have many other statements in the same direction, based on their own experience from buying companies that used deriviatives where they were unable to to unwind the books and figure out who owed who. At the last Berkshire Hathaway annual meeting someone asked Charlie Munger what we could learn from past blow ups about the present crisis</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">It was a particularly foolish mess. We talked about an idiot in the credit delivery grocery business, Webvan. Internet based delivery service for groceries -- that was smarter than what happened in mortgage business. I wish we had those Webvan people back.</span></span></p></blockquote><div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
What can we learn from all this?
<br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Well Dan Geer launched a revolution with his </span></span><a href="http://catless.ncl.ac.uk/risks/20.06.html"><span style="font-size: 12px; "><span style="font-family: Arial;">famous speech</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> about risk management. He got the big picture part right on the security industry evolving into more risk management practices, however the examples we assumed that were right at the time, the financial industry are proving wrong. For one thing you can&#39;t manage a risk if you don&#39;t know the assets (back to Charlie Munger, emphasis added):</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 20px; "><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">It is crazy to allow things to get too big to fail, run with knavery. As an industry, there is a crazy culture of greed and overreaching and overconfidence trading algorithms. It is demented to allow derivative trading such that clearance risks are embedded in system. Assets are all “good until reached for” on balance sheets. We had $400m of that at general re, </span></span><span style="font-weight: bold; font-size: 12px; "><span style="font-family: Arial;">“good until reached for”</span></span><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">. In drug business you must prove it is good. It is a crazy culture, and to some extent an evil culture. Accounting people really failed us. Accounting standards ought to be dealt with like engineering standards.</span></span></span></p></blockquote><div><div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So, yes it is about risk management, but if you build too many abstractions on top of your assets through derivative accounting and such you may find you don&#39;t have any assets when you need them. Don&#39;t fall in love with your abstractions, </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2008/04/security-rules.html"><span style="font-size: 12px; "><span style="font-family: Arial;">manage your assets</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">There are some clear lessons for us in Information Security, err I mean Information Risk Management.</span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Margin of safety</span></span><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
Its our job to manage risk, but this doesn&#39;t mean that we have to build layers and layer of abstraction on top of it. It also means that we help to design, build, deploy, and operate systems with margins of safety. Understanding the failure modes and accounting for this in design. Developers (because they are supposed to) and architects (because they haven&#39;t been properly trained) focus on functional requirements, building features, but on security not so much. There are many ways to improve security in a system and they are all inadequate by themselves, but we can help find </span></span></span><a href="http://1raindrop.typepad.com/1_raindrop/2007/06/cost_effective_.html"><span style="font-size: 12px; "><span style="font-family: Arial;">cost effective improvements</span></span></a><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">. </span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Don&#39;t fall in love with abstractions</span></span><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">If you have a 100,000 dekstops or 100,000 servers it hard to manage. You will need to automate and to do that you need to abstract, but you should also realize that its a drawing on a whiteboard not reality. You need </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2005/12/the_road_to_ass.html"><span style="font-size: 12px; "><span style="font-family: Arial;">abstraction assurance</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">.&#160;</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><a href="https://financialcryptography.com/"><span style="font-size: 12px; "><span style="font-family: Arial;">Ian Grigg</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2008/09/if-a-tree-falls-in-someone-elses-silo.html#comments"><span style="font-size: 12px; "><span style="font-family: Arial;">commented</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> on an earlier post</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;">There are distinct parallels between phishing / retail payments, and the bigger investment mess. In both cases, banks would argue these are core business. In both cases, they have applied risk-based security models, and accepted some loss. In both cases, they have the ability to apply substantial experience to the monitoring, allocating and absorbing risks and losses.</span></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;">In both cases, they watched and did nothing as the risks started from low, and migrated upwards. Are we at the point where regulation has killed the ability of banks to apply their (arguable) one core skill, to whit, risk-based analysis? Are banks that far out of banking that they no longer have it?</span></span></p></blockquote><div><div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So you have to remember that top down and bottom up need to be combined.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; line-height: 14px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Design for failure</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Dan Geer has also told the story that he sat in a large bank&#39;s risk management training, and the trainer said &quot;you may wonder why this works so well. it works because there is zero ambiguity over who owns what risk.&quot; Dan&#39;s thought was - &quot;in my field we have nothing but ambiguity.&quot; Turns out the second part was right, we have nothing but ambiguity over who owns what risk; unfortunately the financial people have much more ambiguity than they thought! So we do have a lesson here after all, and it this - when the thing you thought was true isn&#39;t, the failure mode is very ugly. </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2006/01/design_for_fail.html"><span style="font-size: 12px; "><span style="font-family: Arial;">Design for failure - a</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">dd layers of protection. </span></span><span style="font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Keep it simple.</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">They have some smart engineers at Google to be sure, but even they had </span></span><a href="http://www.identityblog.com/?p=1011"><span style="font-size: 12px; "><span style="font-family: Arial;">incredibly basic errors in their SSO</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">. I have seen other obvious fails like people signing WS-Security messages, and the recipient checks for a signature but not if they trust the signer! There are so many ways to shoot yourself in the foot in a loosely coupled systems, and we have so many abstractions layered on top of each other, part of the mantra of protecting assets has to be keeping it simple.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So that is my list, to do all these things it requires that Infosec get in the game, understand the use cases, understand the business value (it should be abundantly clear that you can&#39;t simply rely on &quot;business people&quot; to be &quot;business experts&quot;), and that you not lose sight of the asset amidst all the abstraction. Finally, the systems we build security on are very primitive, a firewall and SSL are fine, a seatbelt was fine in 1935 and its still fine today, but there are lots of other safety controls in cars. ABS, airbags, traction control, they all protect the assets far better than in 1935, that&#39;s what we need to build.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Anyone can make bad assumptions (assume you know who owns what risk) and its easy to make bad abstractions (the firewall protects the information system), but when you combine bad assumptions with bad abstractions you&#39;ll get assets that are good until reached for sooner or later</span></span></div></div></div>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 05:41:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/information risk management">information risk management</category>
      <category domain="http://securityratty.com/tag/risk management practices">risk management practices</category>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/assets">assets</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/business people">business people</category>
      <category domain="http://securityratty.com/tag/security industry">security industry</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/assets-good-until-reached-for.html">Assets Good Until Reached For</source>
    </item>
    <item>
      <title><![CDATA[Cisco 7600 OSR Backbone Router]]></title>
      <link>http://securityratty.com/article/a447dc34e61d2770ab6d723a54abcb31</link>
      <guid>http://securityratty.com/article/a447dc34e61d2770ab6d723a54abcb31</guid>
      <description><![CDATA[For our confused CEO blogger over at StreamBase, who thinks an Internetbackbone router is the small $30 device he set up in his home office, here is a photo of a the Cisco 7600 OSR which of course...]]></description>
      <content:encoded><![CDATA[<p style="text-align: left;">For our confused CEO blogger over at StreamBase, who thinks an Internet backbone router is the small $30 device he set up in his home office, here is a photo of a the <a href="http://newsroom.cisco.com/dlls/prod_022001b.html" target="_blank">Cisco 7600 OSR</a> which of course runs <a href="http://www.cisco.com/en/US/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html" target="_blank">CISCO IOS</a>.</p>
<p style="text-align: center;"><img style="vertical-align: middle;" src="http://newsroom.cisco.com/ts_images/Cisco-7600-OSR-high.jpg" alt="Cisco 7600 OSR" height="600" /></p>
<p style="text-align: left;">The Cisco 7600 OSR consists of a 256 Gbps switching fabric and a 30 million packets per second (mpps) forwarding engine. Its breadth of IP services comes from Cisco IOS, which provides features such as security, enhanced QoS, and destination sensitive services. In addition, the Cisco 7600 OSR allows the migration of existing port adapters from Cisco 7500 series routers, via the Cisco FlexWAN module, giving service providers one the industry&#8217;s widest array of interface options in any single platform. This provides service providers great flexibility in deploying the Cisco 7600 OSR for a variety of applications, protects their investment in existing systems, and gives them a practical migration path to the New World Optical Internet.</p>
<h3>A Revolutionary Platform For Evolving Networks</h3>
<p>The Cisco 7600 OSR helps service providers break through service and bandwidth barriers today, while designing networks to scale for future growth. The Cisco 7600 OSR achieves this through &#8220;adaptive network processing,&#8221; or the ability to evolve the platform for new IP services without hardware upgrades. Unlike fixed, ASIC-based platforms, which are hardware encoded, the Cisco 7600 OSR relies on the highly flexible Parallel eXpress Forwarding (PXF) technology for scalable performance of services. PXF is a patented, Cisco-developed network processor capable of line-rate IP services delivery that can support new IP services through periodic software upgrades. Each OSM has two PXF processors capable of 12 mpps of IP services delivery per interface card.</p>
<p>&#8220;IP+Optical combines the dynamism of the Internet world with the foundation of the transport world, creating an infrastructure that can deliver the services that service providers need,&#8221; said Lele Nardin, vice president of the Internet Systems Business Unit at Cisco. &#8220;Cisco will continue to add innovative solutions on top of this solid foundation to make service providers better equipped to meet the constantly escalating and changing customer demands for new networking services.&#8221;</p>
<h3>Pricing and Availability</h3>
<p>The base Cisco 7600 OSR system is list priced at $73,000 and the entry level system, with interfaces, start at $100,000. The interfaces modules are priced between $27,000 to $180,000. The Cisco 7600 OSR is available now worldwide.</p>
]]></content:encoded>
      <pubDate>Sat, 06 Sep 2008 07:25:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cisco">cisco</category>
      <category domain="http://securityratty.com/tag/cisco flexwan module">cisco flexwan module</category>
      <category domain="http://securityratty.com/tag/osr">osr</category>
      <category domain="http://securityratty.com/tag/runs cisco ios">runs cisco ios</category>
      <category domain="http://securityratty.com/tag/base cisco">base cisco</category>
      <category domain="http://securityratty.com/tag/cisco ios">cisco ios</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/destination sensitive services">destination sensitive services</category>
      <category domain="http://securityratty.com/tag/osr system">osr system</category>
      <source url="http://www.thecepblog.com/2008/09/06/cisco-7600-osr-backbone-router/">Cisco 7600 OSR Backbone Router</source>
    </item>
  </channel>
</rss>
