Outside the Asylum

Category: career

  • Optimising Security

    Way back at university when i was studying Aeronautical Engineering, we covered one of the fundamental concepts in aircraft design; Safety.  It was summed up in an info-graphic which has stayed with me. In recent times, as I’ve moved over into IT security and up into solution architecture, I’ve been drawing on this educational background more and more. The analogous relationship between aircraft safety and IT security is safety = security.

    I’ve put together a series of diagrams to illustrate how this aircraft design concept applies to IT security.

    Firstly, the base concept; a cost vs security graph. The total cost to an organization being the union of two component cost categories. One, the cost of security measures implemented. Things like technology, people, processes, loss of agility, reduction in productivity. And secondly, the indirect costs due to all the security measures that have not been implemented. The lowest point in the total-cost curve is the optimum level of security that should be implemented.

    But of course, things are always changing. Technology improvements, smarter people and better processes all give you more security for your $. Also, security incidents start costing you more money(too many reasons to list here).  As a result, the total cost curve will shift up and to the right.

    and things are not always as well understood as you’d like.  The cost of security measures implemented is easy, but it’s not always certain how much security you’re actually getting.  The indirect costs are even less well understood, often almost not at all.  If you get the numbers wrong, and end up over the break even line, then you’re out of business or sacked.  The safer choice is err on the side of being too secure, trading off efficiency or cost effectiveness.

    The takeaway is; you need good data and to know your two types of costs as well as possible.  Qualitative data is nice for understanding the concepts, but completely useless in practice.

    If you aren’t moving towards finding your optimum security level, your competition most certainly is. That break-even line isn’t fixed either. It will start coming down.

    UPDATE: A common mistake i see is for organizations to underestimate their indirect costs (red line). They only factor in what they know, assuming zero contribution from the unknown indirect costs.  Look for statistical data from other organizations to make an informed guess.  Preferably including companies that have both survived and failed due to catastrophic events.  Make sure the companies are comparable; industry, size, market. Be wary of vendors as a source of this info though. They are motivated to shift your security spend as far to the right as possible. That said, vendor data can be useful for the extreme/worst case.

  • alternative cloud magic quadrant

    A Simon Wardley blog post

  • Do not covet your ideas

  • Cloud Security Alliance V3 Guidance and CCSK

    I’ll have to watch this closely. As soon as I hear about the V3 CCSK exam, i’ll need to jump right on it.

    udpate from Jim Reavis;

    I am sure many of you are wondering if the new version 3 of the guidance means we will have a new version of the CCSK test and what that means to existing CCSKs or those currently studying to be CCSKs. The CSA certification board that created the initial test will be providing definitive information about the plan soon, but I wanted to let you know about some things we know for sure, so you can plan appropriately.

    – We do not have an exact time frame for the new test, but likely will be the middle of next year.
    – Existing CCSKs will be able to take the V3 test when available at no charge.
    – Existing CCSK tokens will be valid for the V3 test.
    – It is possible that we may consider having a special V3 test for existing CCSKs that cover the difference.
    – You should still be studying V2.1 of the guidance to prepare for the existing test.

    If you have read both V2.1 and V3, you should be aware that key principles have not changed in the new guidance, but we have greater depth. From that perspective, we want to provide interested professionals assurance that you will not be penalized in any way for obtaining your CCSK now, and the effort will help you in gaining certification on an updated test. If you have questions or input, please respond to this post so we can make sure we update the website FAQ.

  • out of hiatus

    I’ve neglected this blog for quite a while now. Various events and machinations that affected my career used up all my headspace. Things are calming down and becoming more sensible. More headspace for interesting technical architectural topics. fun!

    I’ve started working on a product and service development program at eSecure. My interests and ambitions have found some nice synergies with eSecure’s business development goals.

    All through my career i’ve dabbled in IT Security. However i’ve never really considered myself a “security guy”. But after landing in a security role almost accidently, i’ve come to realise that it’s really my true calling.

    It comes down to the fundamental security triad; Confidentiality, Integrity and Availability. In the past in my telco jobs, it was predominantly about Availability, Integrity a close 2nd and not far behind, Confidentiality. Now i’m dealing with all three in roughly even amounts.

  • Certificate of Cloud Security Knowledge (CCSK)

    “The issues and opportunities of cloud computing gained considerable notice in 2008 within the information security community. It was at a security practitioners’ conference, the ISSA CISO Forum in Las Vegas, November 20, 2008, where the concept of the Cloud Security Alliance was born. Following a presentation of emerging trends by Jim Reavis that included a call for action for securing cloud computing, Reavis and Nils Puhlmann outlined the initial mission and strategy of the Cloud Security Alliance. A series of organizational meetings in early December 2008 that included Reavis, Puhlmann and industry leaders such as Dave Cullinane, Philippe Courtot, Alan Boehme, Izak Mutlu, Jay Chaudhry, Christofer Hoff, Paul Kurtz and Jean Pawluk formalized the founding of the Cloud Security Alliance.”

    That’s the introduction on the CSA website. Says it better than if I tried to paraphrase it.  I think I first heard about the CSA via posts on Chris Hoff’s blog which I follow.

    The first thing the CSA came out with was their “Security Guidance for Critical Areas of Focus in Cloud Computing” whitepaper. It takes a whole raft of well established IT security methodology and applies it to the emerging world of Cloud Computing. It’s very good reading, and excellent reference material.

    The next big release was the Certificate of Cloud Security Knowledge exam. It was announced at the end of July, and the exam made available on the 1st of September.  With timezones in Australia ahead of those in the USA, it was late afternoon Sydney when the exam went live. I had a free evening and thought, why not give the test a go. You get two tries for your exam fee.

    Well, I passed, which was nice. But the surprise came later when i got an email from the CSA Executive Director, Jim Reavis. It turned out that I was the first in the world to pass and also the fastest to complete the exam during its first day. That gave the ol’ ego a boost. But the voice of reason in the back of my head started to speak up, and bring me back to reality. There are a lot of good people out there. Better than me. There’s lots I still need to learn.

    But I think i’ll enjoy this for a bit 🙂

  • Two transitions, career and sport/fitness

    Almost two months ago, I started a new job. I left Verizon Business at the end of last year. It was a good two years there, i learned a lot. Verizon do a lot of things right, but they have their faults too, mostly due to their massive size. In short, Australia is not important to Verizon. On the other hand, Australia IS important to Telstra. My new role is the first proper Unified/Network/Utility Computing and Security solution architect in Telstra Enterprise and Govt. The Hosting product portfolio was not important until now, and thus was allowed to languish. With all the recent hype around Cloud Computing and the trend back to consolidation in the datacenter, the product set is being revamped. Interesting times ahead. Lots to be fixed, but there’s a lot of effort going into it. I’m along for the ride, to see where this takes me.

    The other big change is in my fitness and sport training. I’ve been with Vision Personal Training for a bit over a year now. Huge progress has been made, but in recent months it’s tapered off. I finally figured out the problem, I’ve outgrown them (plus they’ve changed to be more weight-loss oriented). I did a lot of research and spoke to friends that are triathletes. I settled on STG. I’ve got a qualified tri-coach now, and have started on a program with him. STG also provides a squad to train with, which is really good for motivation. Obsession with counting carbs, protein and fat is out. the “go hard or go home” mentality too. In with more logical and customized coaching. No more “don’t be lazy! just do it!”. Now it’s “ok, why are you tired/sore? what did you do/eat/etc?”

    I’ve got some big events coming up this year and next. Kinda exciting and scary at the same time. a month ago i wouldn’t have thought i could reach those goals. now, with the new training and coaching program, i reckon i’ll do it!

    note: not going to jinx myself by saying what I’m aiming for. I was planning to do the half marathon in May, the old personal trainer was pushing me hard. I was trying to keep to a training plan, but kept hitting injury obstacles. I wasn’t confident. The new coach; “forget that, you wont be ready”. Dude is hardcore, but fair, and logical, and experienced….

    I’m stoked. Life is good.

  • Cloud Computing

    I attended CloudCamp at Google HQ in Sydney last night. Interesting mix of attendees. Lots of discussion.

    “Cloud Computing”, is a hot buzzword at the moment. Probably used most often by people who have no idea what it means. Some people use it and have AN idea, but its different to the idea that other people have. Arguments result. People get tired of hearing the term.  There is good stuff behind the hype however.

    NIST have released a draft definition paper. If we can all agree on what to call things, then we can come out of the hype phase and start figuring out what is good when and for what (etc).

    Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models.

    Another way of describing “cloud” is “the stuff i don’t have to care about”. This has been used in various forms by a range of leading minds in the area. I didn’t make that up.  It’s a pretty good definition I think.  It’s common practice for network engineers draw clouds on their network diagrams to represent bits of network they don’t control, usually service provider networks.  Cloud Computing works the same way. “They give me computing resources of a particular type with a service description and an SLA and I don’t need to worry about the details”.  If you need a certain amount of security, get it in the contract. If you need a certain guaranteed performance, get that in the contract too.

    It’s early days. Cloud Computing offerings are still maturing. The types of offerings are still evolving.  In my opinion, there are some exciting changes starting to happen.

    IT departments in many or most enterprises are in an ongoing wrestle with their business masters. Both sides complain about the other, saying they don’t understand, they don’t deliver or don’t listen.  When IT departments don’t support their businesses, wholesale outsourcing usually results. However that’s had limited success and it’s like throwing the baby out with the bathwater.  You need healthy competition for an optimum result.  An internal IT department effectively has a monopoly, holding the business to ransom. Outsourcing the lot just moves that monopoly elsewhere.  We need to eliminate this monopoly situation.

    Network services have become a commodity because we now have standard networks. Everyone uses IP, ethernet, MPLS etc.  Switching from one carrier to another is a relatively painless process. Many companies use a mix, moving traffic and infrastructure onto one or the other over time. Competition is good!

    Cloud computing has the same potential. Running your company’s servers or apps on a service provider’s platform and being able to move from one service provider to another easilly is key. Hooray, true competition!

    Yes, this will most likely mean lots of job losses in IT departments all over the globe.  But this is a change that needs to happen.  If you work in IT, ask yourself, “how am I contributing to the profitability of my company?” If you can’t answer that, you better make some career changes so that you can.

    Company executives will start looking at IT departments as business enablers, not just a cost.

  • Confidence

    Whilst looking through the www.savagechickens.com cartoon archive, I saw this. Very apt. This is a great summary of my experience being technical in a sales department.

    chickenconfidence

  • Philosophical about virtualisation

    I stop and ponder things from time to time. Get philosophical about why we’re all charging like lemmings after buzzwords without stopping to wonder why or if we’re really going in the right direction. I’ve seen people end up in dead end careers because they were too near sighted. I dont want to end up like that.

    This article reminded me about a particular topic i ponder from time to time; Virtualisation.

    Google fires back at VMware

    I’ve known about VMware since it began yeeeeears ago. back then, i saw it as a developer tool, for people who needed to try various operating systems but having multiple hardware boxes wasnt practical.

    fast forward to the here and now, and virtualisation is all the rage, with VMware being top dog.  I’m from a telco core systems background, which is pretty much pure unix, of varying flavors.  vmware is almost exclusively used by SME, who are all windows shops.

    My opinion is that the dominating reason for vmware being such a huge success is the nature of windows and the apps that run on it.  windows server apps dont play nicely with each other, thus the resulting plethora of servers, each running one or two apps, all under utilised, with headroom for peak usage.

    In the unix world i’m used to, multiple apps all run happilly alongside each other.  the first big production systems i worked on were a pair of Sun enterprise 3000 servers. they ran mail, news, web, proxy, dns and some other minor apps. all on a single instance of Solaris. the apps were installed on external SAN disk and could be failed over between the two servers. this was in the late 90s.  ten years later, vmware is bringing to the windows world the efficiencies and high availability features that has been available for a long time in the unix world.  that said, even the unix world lagged behind the mainframe world.

    that got me thinking, why the move from mainframe to unix to wintel?  its about $.  when “open systems” aka UNIX started to beat the pants off mainframes, it was because of cost. the systems were good enough for what they were needed for and a lot less expensive. the fact that the technology wasnt as impressive didnt mater. the business case, weighing everything up tipped in favor of unix.   later, for the SME, the same thing happened between windows and unix. windows was “good enough” and required much less skill to work with. many companies couldnt afford the skilled sysadmins. their wages would cost the company more than the losses due to system crashes/outages.

    vmware helps companies run their windows environments in a much better way, without changing the way those companies’ apps work.  google helps companies by offering a whole new way of using software. new applications. gmail instead of Exchange/Outlook.  Google Apps instead of the MS Office Suite.

    as a result, system/hypervisor virtualisation is not needed by Google, they virtualise the apps.  the fight is between Google trying to convince companies to consume IT apps in a new way and VMware trying to convince companies their existing way is fine, but that vmware can make it run better.

    pass the popcorn 🙂 this should be fun to watch

    NOTE: VMware and Google are just examples. there are other players in each of their respective markets, they’re just the leaders in my opinion.