Technology for the Average Bear

BYOC

2012-02-13T20:01:00.002-06:00

The next big thing…

BYOC – Bring your own computer.

Working is hard work, and people want to be able to communicate to friends and family and strangers immediately these days, and everyone is connected to everything. Nobody wants to work during working hours.

That is where I am old school, I am sorry.

The problem is people have no clue as to what they are doing to themselves, so how do you expect them to be responsible to your business security issues? It is like giving everyone a crack pipe and saying, “Just do a little so you will work faster.”

That has never worked.

Not the crack pipe thing, the ‘Bring your own computer to work thing’.

The companies that have had significant breaches are also the same companies that have leveraged security against ease of use. “It is too hard to log into three different systems when I am on the road, why not open everything up and let me just use my phone to connect?”

How many times have IT guys heard that?

If you are an IT guy and you are in charge of a company asset such as data or network infrastructure, do not do this for the sake of your career. Let the company go down in flames without you. There are plenty of CFO’s and CIO’s and Executives that are perfectly willing to throw you under the bus when something goes wrong, and inevitably it will.

Send everyone a binding e-mail defining the person responsible for the stupid idea, and that you are against such moronic behavior. Ensure that it is made public, carbon copy and reply to ‘ALL’, and print out hard copies to display all over the facility. Let the CIO go down in flames, it will look good on your resume when you become the next CIO (That is the job after the one where the company spiraled down the toilet due to lawsuits for breach of security and malfeasance).

If you are a business owner, and you have stumbled across this discussion, remember this: “Can you dictate how much your employees actually produce in a given amount of time, or how often they get distracted?”

No. You can try, but No.

So what would be the bright idea behind letting people have even more distractions? Buy a firewall and watch how many people are checking their personal e-mail, and doing personal messaging on your existing equipment right now. You won’t be surprised you will be pissed.

Shut it down and I will almost guarantee productivity will go up 50%.

Here’s an idea.

• Lock down the company equipment to just do work related tasks.

• Create a break room network for people on break to log into their personal e-mail, blog sites and Facebook accounts, a designated place where wireless is allowed.

• Now you can see who is spending their time surfing or texting.

• If a security breach happens, and the network is set up properly, then only the devices in the break rooms will be vulnerable. Only personal information from the employees will leak out.

• Access to company data by employees and the less scrupulous can be strictly limited.

• There will be no need for people to have wireless devices roaming through your data infrastructure and bringing with them the plagues of the apocalypse for your business.

I know it seems like the dark ages, but business owners need to be aware of this and listen to their inner frightened child. Since they don’t always listen to responsible people, it falls to the computer tech, the IT guy to be the voice of reason.

God save us every one.

Maintaining User Rights

2011-01-14T10:01:00.000-06:00

Normal workdays include users passing through some kind of security checkpoint to be able to get at your data, if you don’t already have something in place you need to get one. Microsoft Servers come with Active Directory, and although Microsoft is trying their hardest to make it difficult and cumbersome to manage, it still is the best solution out there for managing user access to data.

Issues arise however over time as employees come and go and rights are assigned and data folders change or move. To keep track of this I suggest you keep a spreadsheet that tracks groups and users. We offer such a spreadsheet, but you must keep it encrypted or in a secure location as it does contain important data.

A subset of managing users is the user group. Always use groups instead of adding rights directly to users. Managing a group and then just adding and removing users prevents some of the major vulnerabilities such as one user with rights to the wrong folder.

Another reason to use groups is the audit. Instead of having to go through every user and determining what folders they have access to or purchasing a software application to do that, you can just list the groups and the users in the groups and verify them in there.

There are four types of Groups:

1. System Generated
2. Departmental
3. User
4. Application

What I do is name the groups in this format:
1. DPT – Accounting
2. GRP – Machine Shop
3. APP – Quickbooks

Using this format it is quite easy to find the groups when you are in a hurry. Need to add a user? When adding a user you can browse APP and you get all the application groups to choose from. Or DPT and get all the departments in the system.

Just a quick way that may be helpful...

A revolution is needed.

2011-01-09T14:12:00.004-06:00

This is where our technology is leading us, because there are two few men to lead the technology.

Men no longer have to be men, they can be Neanderthals. They can speak without fearing repercussions, they can act with impunity on the internet.

Look at the men out there, teaching their children that being an asshole is humorous. They drive loud, make sure everyone is watching them, they flaunt and tease and bully. Just like wild animals. This is what our current technology is reducing civilization to. If men can’t get noticed, they get louder, become even more obnoxious, and they are willing to give up all that is sacred to get it, to get that 5 minutes of fame.

My father taught me about integrity a long time ago. He had his weaknesses, but we all do, and what is more he overcame that, he overcame all his issues, to make me who I am. That is what a father does. A man does that, he does that for his children.

He overcomes his weaknesses.

Not with drugs, but with a strong sense of character.

A man stands up for the oppressed, he does not fight because he thinks he is oppressed. Men fight now for anything, they react with anger and violence without using their brain at all, and the result is more battered women and children, more shots fired and more irrational speak on the airwaves.

Real men are righteous.

Men understand love and life, and the fragility of children in their care. They understand that it is precious, and they are not so willing to throw it away.

A man stands up for something he believes in, but he does not fight for something he knows nothing about. Men know that a weapon does not make you a bigger man, it makes you a bigger threat. A man should never get to the point where he has to commit murder.

A man listens but he does not blindly follow. He can see the difference between someone who is speaking for themselves and someone who is doing right. A man does good. He knows the difference between right and wrong, and just being loud does not make you right.

A man has respect. Respect for his enemy, his boss, his coach, his rival. At sporting events a man buys a ticket not to demand a win but to see a game between extraordinary players. A man can accept the results of fair play. A man coaches a team to win through instruction, not blind obedience. Having men follow you into battle does not ensure a victory, a victory is ensured when the men follow you into battle because they have been taught how to win. A man handles a win with poise and grace, and handles a loss with dignity.

A man admits he was wrong, accepts responsibility and changes his life, he becomes better, a better man. A real man follows the laws of God, a Christian man follows the commandments of Christ too. A man does not just say he believes in Christ, he has to be able to show it in his actions; clothe the naked, feed the sick, love thy neighbor. Nowhere in his teachings did he say teach men to fish so they can go feed themselves.

A man knows that a patriot is one who understands democracy, that compromise is not failure, that no man is more ‘equal’ than any other. Tyranny is when one man will not accept any other views than his own.

The revolution has started alright. The time of the Neanderthal is over.

The internet in its current state cannot sustain itself under its own weight, there will be more blood. The right to express yourself should not be extended to the internet, because there are no real men on the internet.

A sounding alarm

2010-12-15T09:19:00.005-06:00

The founding fathers did not like to be monitored and detained by police everywhere they went. So they were driven to kill, to fight and kill for the right to be free. That is a pretty big step. That is a very strong principle to defend, to make a basic right, to make it the foundation of a government.

And yet we find ourselves in that same predicament again.

You drive at night past midnight and you can expect to be detained. You can expect a judge to have your blood drawn out of you against your will right there. How much more of an invasion could there be?

At a stop light there are police officers monitoring you from miles away on camera, while you pick your nose. When you want to fly on an airplane you are searched, your bags searched and they may forcibly take your water. When you are on the phone, your conversation is being recorded, because you were talking to grandma and mentioned a funny photobomb.

What do you think is going on electronically? Do you honestly think you can go to web sites without someone tracking you?

There is more known about you than 30 years of surveillance in and around your home, your job. The problem is, it is not just the good guys that have that data. It is available to everyone. You can be tagged right now so that disparate systems can link your movements together on the internet and track you, cookies are put on your machine so they know where you went, what page you looked at, even what item on that page was of interest to you.

Why are the paranoid people in the world OK with this?

Sure finding a bad guy is important, but how many good people are on this same list, waiting for a slip up, a missed mortgage payment, a traffic ticket, or just a jealous boyfriend to come back and destroy them. The only reason we keep this information is revenge. Not justice.

The people with all the information have all the power. Power tends to corrupt.

Men died to prevent what the government is now doing to every single person in America.

Patriot Act

HR 3167

EC. 204. CLARIFICATION OF INTELLIGENCE EXCEPTIONS FROM LIMITATIONS ON INTERCEPTION AND DISCLOSURE OF WIRE, ORAL, AND ELECTRONIC COMMUNICATIONS.

Section 2511(2)(f) of title 18, United States Code, is amended—

(1) by striking ‘‘this chapter or chapter 121’’ and inserting ‘this chapter or chapter 121 or 206 of this title’’; and
(2) by striking ‘‘wire and oral’’ and inserting ‘‘wire, oral, and electronic’’.

With this single change it will include every electronic transmission you make. Now that the government can track you, they are entering backdoors to every form of cryptography forcing companies to compromise their own security to allow government access.

The government now has absolute power.

Blunderbuss

2010-11-23T09:47:00.001-06:00

The Internet has millions of pieces of technical information, and even top secret information slipping though the backbone at any minute. Some of it is encrypted, some is not. The Top Secret encrypted electronic data may be at a level of risk that we did not foresee.

The recent suspicions of China re-routing internet traffic through their networks is really much more significant than one can imagine, primarily because any miscreant that wants to hack your data no longer has to get access to it by local means.

In other words you at one time had to put a grub of some kind on the network to start directing data to you, if you were a bad guy. Now you can just redirect network traffic through your portal, and then record everything that comes through for 10 months. Then re-assemble the data and analyze it, decrypting it at your leisure.

What does this mean for the average bear?

If a rogue state wanted to gain a secret clearance and read secret data, all they have to do is direct a copy to their network and record it. As data transmits between offices, sometimes whole documents are shared and whole documents become at risk.

Formulas, equations, sophisticated cryptography primers, all are sent back and forth between offices, often encrypted, but the problem exists as you can no longer expect your packets to be routed strait to your other office. They may go through China, and it is not a difficult task now to mirror the data off a single port on a switch somewhere, completely without detection.

It used to sound like a really lame idea, but with computers now, it is easier to reassemble billions of particles of data, then decrypt it without the risk of a trail leading right to your house.

Port 80 Love Fest.

2010-11-18T09:39:00.002-06:00

In an effort to subdue the tyrants, the hackers and miscreants that rule the internet right now, manufacturers of firewalls and filtering products are releasing their next generation products, or have been for the last six months. After seeing these new capabilities, the daunting task of grasping the incredible amount of change in a single year becomes obvious.

Not only hackers but software writers (the good guys), have come to a universal conclusion. They like port 80.

Everything on the internet is running on port 80 now. Well maybe not everything but just about EVERYTHING. So you can’t tell Facebook traffic from Farmville or a botnet from twitter traffic like you used to, they are not using the ports that used to be specific to them.

Sadly the black hat industry is just too big now, and the rest of the world is caught inside this war between the good guys and the bad guys that may never end. The world has to make their products work somehow, so they work on the only port available, port 80. All the other ports have been blocked by firewalls, and as you probably know already, it takes an act of congress for a company to get their network Nazis to open up any new ports on the firewall.

So to resolve the problem it is a port 80 love fest.

What does this mean for the average bear?

Your old firewall works less well every second, possibly even if you just purchased a new one recently. The technology has changed so much that hackers will have an upper hand for a solid year before the public can get prepared, and that is assuming that the public will attempt to get prepared.

This new generation of filtering will not be able to stop the new progression of attacks, but it will be able to see each one much easier. These new technologies will be able to adapt faster hopefully to deal with new issues and new tactics.

Hackers are delivering their new line of malware across port 80 with ease, and the only way to resolve this issue is to start identifying all the different applications running on the internet. Ha Ha you say that is crazy talk?

Nope, that is what must be done. Then you can start allowing and blocking specific applications and even restricting services to a specific account. For example, you don’t want Facebook open all over your network, so you only allow people access to the company Facebook account.

Sadly, no one can play Farmville anymore.

The technology has been out there for a select few, but it will have to become available for everyone if we are to stem the tide. But a sad indication is lurking in the shadows…

No one is yet going after the bad guys, and indication that we are somehow tolerating the crimes. We are just building new products to fight off their new attacks. Doesn’t this sound like an old Star Trek episode or something?

Rule no.5

2010-11-03T15:16:00.004-05:00

Ghost Fleet Status

When I was in the Marines we had a radio the size of a refrigerator and it was mounted on the back of a jeep. The power supply was just as big, and that was mounted underneath the radio. When you popped open the transmitter door, immediately your eyes fell onto this one giant tube the size of a basketball. For those of you who don’t remember President Ford and Billy Beer, a tube is what we now call a chip. This was before Steve Martin suggested everyone get small. They used to be made of glass, and they were pressurized, so they popped when you dropped them. Radios used to be full of them.

This jeep radio thing was awesome. You could take it to a parking lot like at the grocery store, set up the antennae and crank up the radio, wait a few seconds and hear yourself talk. The signal went around the world. It would also light up all the florescent lights in the store and in the parking lot when you keyed the mic.

One day, when prepping for a deployment through the air, I noticed the jeep was being prepared to be dropped out of an airplane. I told an officer that was with me, “Sir… I don’t think this is going to make it.”

“What do you mean?”

“This tube is going to shatter upon impact... It's too big to withstand an air drop isn’t it?”

“Awe hell no, we do it all the time.”

Hours later, the plane flew over, and out popped the jeep. It was huge, and you could see it from anywhere in America I think. The first thing I noticed was the tremendous speed. I thought that maybe over the years, since it had a governor on the engine, and it had to carry 800 pounds of radio, it had never gotten the opportunity to go very fast. Although every driver that had gotten behind that black plastic wheel, had their foot to the floor all day long, it was not very agile, and I felt that maybe this was more than just an air deployment for that jeep.

The jeep fell like a rock. It was balanced very well, the weight of the engine and the weight of the radio made it fall flat, but the parachute on the back pulled the rear higher, high enough so that it looked like it was screaming down the highway. Looking back now, maybe it was.

The parachute apparatus failed to deploy. It was like a long tail trembling in the wind behind the jeep, and seeing it my first thought was, they do this all the time? The jeep landed and created what we in the business call negative Earth. It was definitely a suicide. The officer that was with me turned and looked right at me, “I guess you were right about that tube.”

Those radios were decommissioned eventually. When we decommissioned an old radio, we pretty much made it as new as possible before retiring it into the Ghost Fleet. The Ghost fleet is awesome, because it is this magical place where time absolutely stands still. Old tanks planes and ships go to these places where they are used for parts or just to stand by in the event we need them.

In IT we have to do the same thing. We have to decommission our old equipment, and some of it gets recycled and some gets retired to the Ghost Fleet. Either way, there are rules that you have to follow.

Servers when decommissioned must go into the Ghost Fleet for at least 30 Days. That way if the new server is unstable we can go right back to the old one and keep on working.
What dictates the server Ghost Fleet status is also tapes. If you have a tape drive in that machine, and your company policy dictates you retain the tapes for three years, that means your server will be in Ghost Fleet status for three years.
It has to be working.

This is another reason I speak so much about BIA. If you are adhering to BIA policies that level A devices will not exceed 4 years in production, that means your server is not older than 4 years old. Which means it should still be in proper working condition when retired to the Ghost Fleet.

Otherwise, if not, if you fail to follow common business procedures, and you have done like some people do – run it into the ground, then you have to rebuild it, fix it or otherwise make it work. The point is you have to be able to get the data that you are by law required to produce, from whatever means you used to produce it before. If you ran that server into the ground and it died, you will be trying to fix a seven year old machine just to put it in a closet somewhere.

That is not money well spent.

Domain Documentation

2010-10-22T08:45:00.006-05:00

You company name is very important correct? So it should be with your domain name. It is what the world sees of your company. You must protect it. Here are some tips.

Document everything. It will be six years before you need this again, and everything will have changed by then, nothing will look familiar. Protect yourself.

Document what web site you registered it at, login credentials, contact information of the business you have registered your web site with. They get resold and their contact information changes, so you must be careful. In the event of something gone wrong, you may have to send legal documents etc to that company, but you will have to know how to contact them. Get that up front.

I also suggest you create a separate e-mail address for device correspondence and registration. For example we use mgiman@marloe.com. MGI is short for Marloe Group, Inc. This account can be forwarded to your IT guy or to you if you want to get all the spam associated with that.

There is a reason you want a generic company ID, because all the devices you register, the domain, a new server, a UPS, they all require you create an account at a website to register your product, and instead of having all your warranties registered to a technician who no longer works for you, you should have a company correspondence account.

Your web site data is important too. You own it and the data in it. Check your contracts if you have them, because you should have a copy of the web site, on CD or somewhere on your network. If you farm that out, you want the website data. You also want the passwords and accounts associated with that web site.

With E-Mail, there are encryption servers, spam servers, all have to be registered and accounts managed. Record all that information also. Or have your IT guys do it and keep it in a binder locked up somewhere. As a business owner you already know you don’t have to know everything, you just have to know where everything is.

Rule No 4 - Paranoia Big Destroya

2010-09-24T10:32:00.001-05:00

Firewalls Are Critical

I remember sitting at my work bench at 1st tank battalion, the windows open to the shop, technicians scattered all over the tank ramp, and during lunch it would get quiet, and you could step out of the front door to the shop and see the entire battalion, the hillside and some of southern California. I would be eating a hot baloney sandwich that had pretty much melted in my baggy, stuffed in my brown paper lunch box and left in my car during the heat of the summer. It may have been 90 degrees but there was always a cool breeze flowing from the Pacific.

Behind me on an old FM radio that had been dropped and crushed and broken several times, lying in a heap of parts and wires, cranked out that song loud enough so the tankers could hear it on the other side of the tank ramp. That was a requested song, on the Mighty MET, KMET southern California. Just hearing it brings back memories, a lot of ironic memories.

Harry and I were brown baggers and we would eat lunch together. One of the big secrets that we kept to ourselves was the radio that we had modified on the work bench. Not the radio that played hard rock all day, but our transmission station. We had to test the radios in the tanks, so a guy would climb in, and the tankers would take us out into the boonies where we would crank up the radios and request a radio check.

“Test One, Test One, this is Test Two over.”

“Roger Test Two, this is Test One over.”

“Test One, this is Test Two, request a radio check over.”

At that time we would crank up the FM Radio, wrap a rubber band around the microphone key and set it in front of the speakers, Pat Benatar, Led Zepplin and the Kinks would rain down on southern California. Me being the last of the junior technicians to work on the transmission station, I found that I could adjust the springs on the amplifier with a heavy metal screwdriver (They were heavy copper springs) and raise the transmission wattage by 80%. That was not to spec, that was way beyond spec.

I think I was broadcasting to New Jersey.

Harry and I were eating our lunch when we received the first radio check. Harry cranked up the FM and held the mic to the speakers for about twenty seconds. That was all that a technician really needed out in the field, but after he went back and sat down the request came again. Then it came again.

At this time we both realized at the same time that all the technicians were at lunch. A tanker must have found our secret, and wanted to hear some tunes out in the field. So, Harry wrapped the rubber band on the microphone and laid it in front of the speakers and came back to eat his lunch on a stool by the front door with me. We sat in the warm California sun and we could see everything from the top of that hill.

In fact it was right about then when I noticed the giant black mobile home with radar dishes and a forest of antennae come over the hill on its way to the battalion. I nudged Harry, “Check that out.”

Then we watched the radar on the top of the truck stop swinging back and forth and focus on me and Harry.

Expletive deleted.

Harry and I both ran to disconnect the radio but it was too late. Apparently Channel 2 San Diego had Video, but was re-transmitting the Mighty MET randomly throughout the day for audio.

We were caught by the man.

They took our radio, and our transmission station. Harry and I took the blame for the battalion. Those damn tankers.
Ever since then I have been somewhat paranoid over what I transmit over a radio, or send over the internet. Someone is always listening or watching you, some of them are good guys, but mostly they are bad guys. There are people that were never taught how to behave, how to have respect for others. Those people will rob you when you are not looking, take stuff that is not theirs and stalk you.

You can’t let that happen. Your laptop or PC is not isolated, once you plug in or sign on to a WiFi connection, you don’t know who is out there and what they are going to do to you. So here are two important tips:

1. You need a firewall. There is no question. Even at home. If someone tells you otherwise they are just ignorant. A router or cable modem that turns off ports is not a firewall. A firewall will examine packets and types of traffic and can determine a threat, which a modem or router cannot do.

2. You need Antivirus software. You need it on all your machines especially at home and you need it on your firewall.

There is no way around it. It is like buying locks for your house.

I don’t care where you get it from, who makes it (actually I do, you have to have a reputable firewall) or how inconvenient it is.

Ignore this at your own peril.

STOP POP UPS

2010-09-07T09:48:00.005-05:00

It happens all the time, when you go to a web site, a pop up asks if you want to sign up for a newsletter or something or you must register to see the postings.

Don’t click on anything. Be safe close your browser and start over. There is a way for hacks to make a connection to your computer once you click on that screen, even to click off the box. If you cannot find the ‘X’, - use ALT F4.

Hackers use pop ups to get you to hand over your secret information at the bank, or on common web sites, they are out there and they are not joking around. This is serious. If a legitimate organization wants you to sign in to get a newsletter or force you to register to read their public postings, then they will do so on a normal page.

Do not get in the habit of answering these pop ups, it is called social engineering and that is what they want you to start doing. You will fall for their scams much easier if you have been trained to do something and they can hijack the results.

Legitimate companies will not threaten your security, and if they aren’t legitimate you shouldn’t be there in the first place. Don’t worry; there are even Porn sites that will not threaten your security. Whatever it is you want to buy, you can find a legitimate web site to sell it, don’t get lured into the wrong places.

Rule 3 Business Impact Analysis

2010-09-02T08:14:00.000-05:00

In the Marines, there was a rating system for all the equipment needed to go to war with. When a piece of equipment was defective or downgraded enough so that it could not be used it was considered combat deadlined. I was at 1st tank battalion when I learned about this the first time, and I was indeed working on a tank. There was a damaged cable that ran under the turret so the tank would have to be disassembled in order to replace the cable. I told my gunny and he authorized it, and as usual I assumed I was done with the whole mess. I guess I figured they would throw the tank away and get another one.

Then I overheard my Gunny talking to my Lieutenant and he was the first person to say ‘Combat Deadlined.’ I think he said ‘Castro combat deadlined the tank on a Friday afternoon.’

Of course I was proud of myself until I had heard those words.

I figured they wouldn’t be done till Monday, so I was ready to go home, it was Miller time. Gunny stopped me with a few grown up words, and he explained that I was to sit next to the tank until it was done. There was no going to bed, or taking a break. I had opened a grand can of worms I did.

He left me standing there contemplating my fate. Although I had orders to get the tankers to take the turret off the tank so I could get in there, I was going to have to sit and watch them work all weekend. Suckage went up a notch, happy went down.

That night, that Friday night, I had Sergeants and Gunnery Sergeants waiting for me to tell them what to do. We located a part on the other side of the base and I had a driver go get it Friday night, and the tankers as well as the tank maintenance guys tore the tank apart all night long. They even took this giant crane tank and lifted the turret off so I could work in there. There were giant lights like at a football game, crews of maintenance guys, kitchen guys who brought us coffee and food.

I thought I was the Commandant. Sunday morning at about 3:00AM we were finished. I thought that was pretty cool on the whole.

Well, at my next duty station I learned a little more about the rating system, as I became Jr. Birdman for Combat Engineers. There were manuals on this rating system. I learned there was equipment that was not taken when we pack up and leave to go to war, there is equipment that will not leave my side, and there is equipment that is backup and standing by in case I need it. All these items were in various states of order and repair in a Maintenance shop like mine, so the first thing I did was compare what Manuel was saying with what my new shop looked like.

All the radios were dead or broken, we had one of twelve jeeps working and none of the mine detectors would pass a basic test. So I combat deadlined each one of them.

Unbeknownst to me, I combat deadlined the entire battalion.

Giant cracks appeared in the foundations of the Earth, the sun went dark and I think I saw a unicorn die. The Colonel called me into his office. A real Marine Colonel, I had seen one once, I think he controlled the lightning. As I walked through the crowd of Marines who quietly parted and removed their hats for me, I wondered if my family knew where I was.

Well, turns out, my Colonel was a cool guy. He told me the Pentagon was sending people from the IG’s office to meet me. Most guys would probably be excited, or proud. I had to change my underwear.

I was given authority to go anywhere on the base and exchange my equipment, radios, mine detectors, jeeps, with anyone else out there, it was awesome. For a Lance Corporal in a Staff Sergeant’s billet, I was king boss high banana but no one had any respect for me. That’s another story altogether.

I was just a Lance Corporal, but within 72 hours I had the battalion back up to 99% readiness.

In the IT world we have the same thing. It is called a Business Impact Analysis Rating, and we rate computers, people and processes.

What this means is that if this item, person or process is so important to your business that it could shut down the company for a few hours even, you must take extra-ordinary measures to protect it, to prevent that downtime. As a business owner you must determine in your mind what is important enough that you would want to spend the money protecting it.

You have to be able to estimate the cost and expense of a business interruption. In some cases it can be devastating, and a simple computer failure has caused businesses to close. (That data, he’s so funny.)

What we have learned from disasters and terror strikes is you can’t prevent the inevitable. So we don’t say ‘Disaster Prevention’ anymore. We say ‘Disaster Avoidance’. You can’t prevent a disaster, but you can minimize the effects, and avoid a complete disaster. It starts with the first five steps…

To take care of IT you must do five key things:

1 Document it – In the event of a disaster, theft, robbery or damage, you have paperwork to prove what it did either for insurance purposes or for procedural purposes. Businesses will insure their important people, they will spend money to protect themselves from losing money. In IT we must do the same thing. Document your devices, people and procedures.

2 Minimize the risk of loss or failure. Do this by protecting it, making it more resilient to threats and even replicating it. Be that a person, device or procedure. For devices, we put Uninterruptable Power Supplies on it, and we mirror the drives, backup the data.

3 Secure it. Protect it by locking it behind doors, putting it behind a firewall, password protecting it or even physically locking it down.

4 Prepare for the possibility of a failure or loss. We duplicate the training on multiple key personnel, we duplicate the processes on several machines or locations, or even have parts standing by in case of failure.

5 Obsolesce it. This is part of minimizing the risk of failure, by not allowing the device to get too old, or the people to leave without training a replacement.

This is the Rating system we use:

• A Critical Equipment, damage loss or failure will result in a business interruption. An example would be the primary network switch. If it fails, the entire company will be impacted.

• B Critical Equipment that would not directly cause a business interruption but will definitely affect production, such as the primary shipping computer. Without it people are running all over to do the job that was done on that one machine. Failure of this machine will not shut down the company but it will be tough to get all the shipments out that day.

• C Non Critical Equipment that will affect some aspects of production, but mostly will be easily replaced or repaired. A good example would be the receptionist’s computer.

• D Non Critical, collateral equipment that is used as extra or to help facilitate better performance and production. More than likely in the ‘who cares’ department, an example would the receptionist’s monitor.

Every business owner should examine his departments and personnel to establish the BIA rating for all possible events, from hurricanes to theft. Once the rating has been established, the next important piece would be to assign the obsolescence rules that apply to those devices.

• A For devices we do not want them to get older than 2 to 3 years. For procedures we must audit them every quarter. For people we have alternates trained weekly in some cases.

• B For devices we do not want them to get older than 3 to 4 years. For procedures we must audit them once a year, verify that they are still valid and update documentation. For people we have alternates who swap jobs periodically or share responsibilities.

• C For devices we do not want them to get older than 4 to 5 years. For procedures we consider them Ad Hoc, they are not necessarily important enough to write down or spend time training. For people we have an HR department or person who keeps these positions filled.

• D Collateral

Armed with this information, a business owner can predict the costs associated with maintaining the IT equipment. Servers should not be over three years old as the risk of failure goes up astronomically. This is not just hardware, but software obsolescence and application support. If a drive goes out on the server raid subsystem, does it have to have the exact replacement drive for it to function properly? In five years will you even be able to get that model? In five years will anyone remember how it was set up? You know you could lose all your data that way right?

Don’t risk it. When a business is interrupted it costs much more money than people realize. You’re paying people to stand around and watch you pay other people to fix what’s broken. All the while you lose money and customers because you can no longer provide the same level of service your customers are used to, they go somewhere else in a hurry. It is a domino effect that is just about money. Save the money by taking care of issues before they become issues.

That is why big businesses don’t talk about downtime. They talk about Uptime. Being up 99.999% of the time. They are down less than 5 minutes a year. Why? Prevention, they take care of their equipment before the risk of failure hits their books.

Rule 2 You have to spend money to make money.

2010-08-15T08:46:00.003-05:00

People spend money on IT. That is just the way it goes, and there is no way to avoid it. People also spend money money when they have to play catch up. What do I mean? If your technology goes bad on you or the industry changes and you have to make a course correction in what you do, then you need to be running at full capacity and there is little room for slowdowns or work stoppages.

The theory is this. Run the IT race at a marathon pace.

Spend gradually, and hopefully you will have something when you need it, but, just like a marathon, if you bonk early (Run out of juice), then when you really need technology you get the bad side of oops. There is nothing worse than starting out too fast and then doing the Bataan death march the last six miles.

What does this mean to the average bear?

That is a paradigm.

When you really need the newest technology, when times start to go bad on you, and they always ebb and flow, you need to rely on the tools you already have. You can’t afford to spend money during the lean times, and usually it is a year or two before things begin to change again, so you had better already have newer machines in place, newer operating systems, and newer applications. Failure at this point could cost you your business, and I have seen it happen (Including to me). If you hold on to your technology too long, you run into unnecessary expenses, business interruptions, downtime, production falters, employees bolt and the entire office begins to spin into the giant swirly of life. Pretty soon you’re on the curb with a sign, “Will work for Frappuccino.”

Once you realize that what people are selling you may sound great, but it has to be integrated into your IT department, your existing technologies and it has to coexist with people and their personalities, then you can start to look at the new technologies with a discerning eye.

A perfect example was not so long ago. There was Ethernet, Arcnet, and Token Ring and at the time everyone and everything was beginning this new thing called networking. I had a lab back then, and we tested networks. We created a facility where I could build an environment and test devices and one of the things we examined was this new form of Ethernet called 100Base VG. It was like normal Ethernet (It ran on the same type cables so the distances were similar), but it worked more like a token ring network.

I thought it was magnificent. We could not kill it. We ran at close to wire speed which was absolutely unheard of back then. I thought it would obviously be the right choice for everything. It was more expensive, but why would people choose normal Ethernet with all its known flaws (If you disconnect one device the network shuts down, if you send a big file everyone shuts down and pretty much has to wait, a change of impedance on one side of the building sends the symptoms to the other end of the cable on the other end of the building), certainly the best technology should win.

It didn’t. I convinced a few large companies to rip out their Arcnet and re-cable the entire infrastructure to go to 100Base VG and the manufacturer promptly went out of business, in one case before we had even completed the installation.

I know I will have to explain that to St. Peter…

Then with the dawning of a new day in technology the SQL (Structured Query Language) began to take root. It was imperative that we get in on the ground floor with this one. I was sent to training on the new language so we could harness it, sell it and train people on it. It was a great Idea. It worked just like the MIMMS machine in the Marine Corps. I was all excited on my way home. It could speed up networking by a tenfold.

The product was pulled from the market before I got off the plane. (Another useless plaque for my cubicle).

How do you know what is bleeding edge and what is ready for production? How do big companies do it?

First of all they have an IT department. They get a few copies of the new products, new hardware, and new applications and they create their own beta test. They let their techies spend hours upon hours testing and playing with their new toys until they feel comfortable with making the decision to upgrade everyone.

As a small business owner you will have to do the same thing. You have to.

How do you do it? (Everyone has a nephew that is really into gaming, you’ll be tempted to use him, it would even give him something to do for the summer… DON’T DO IT. You need real information from real time use).

Just purchasing a new computer to ‘play with’ goes against every fiber that is in you, and those fibers are what got you out of the poor house, so I understand. But this is how you minimize the risk. You begin to build a testing facility of your own.

I know what you’re thinking… Is that squirrel staring at me? Or maybe, how does the average bear afford to hire people and equipment just for play? That’s insane.

Every company has someone that is somewhat computer savvy. There is usually someone just like them on the opposite end of the spectrum (Try not to select the average bear for this experiment). Grab them and take them into a conference room. Buy a new system and new software and put it in the conference room with them. Then just observe through a one way mirror.

Actually it is more like this:

Make them do their jobs on it. Don’t replace their old machine, just put the new device in the conference room and have them report to it once a day for four hours, like a morning shift. Then, have them work as a team. Test it and see if they can use it. They will find all the flaws I can guarantee it, and let them voice their opinions (and you will get an earful), but keep in mind this is the future.

You can’t NOT do this.

This will do two things, number one; this process will ensure everything is compatible. If you need more RAM in the computer, this is the time to find out. If you buy the new accounting package will it print to your printer? Now is the time to find out. Number two; It will provide a way to do training and prepare the employees as well. Once the bugs have been worked out, start sending in other employees from that department to do their work in the conference room for a shift (Just half their work day).

At some point, when you see they are no longer flapping around on the floor and gnawing the furniture to pieces, then it will be easier to migrate a few into their departments. Now you have a standard cost for each workstation deployment and you can start budgeting them into your system, and when you do – make sure you STANDARDIZE. Find out what will work and duplicate that exact system to everyone in that department.

Plan on spending a solid month in testing, before rollout, and you also have a new machine you can do training on. You can now expect users to be at work right after the upgrade. They should not miss a beat, some will as they build a routine, but there will be less belly aching and more production.

As you are so fond of saying, “Me likes production.”

Rule 1 Businesses want to sell you stuff, they don’t care about your business.

2010-08-01T07:04:00.002-05:00

It’s not that they aren’t trying but a small business is nothing like a larger corporation, in scope or in technology, so why would you think that a billion dollar software company knows what you need? They know what they want you to need… They will tell you what they want you to need.

How I learned this…

I was a young cryptographic repair man who stumbled on a rules and guidelines book concerning the setup of a cryptography work center. It covered everything from the bench setup to how to cover and bar the windows. I was fixated and I set up my room exactly like the book.

In the Marines, when you set up things just like the book it means, number one, that you read, and number two that you follow directions. I got noticed by the Inspector General’s office in Washington. Pretty cool? Well not really they notice everything, and I had a previous run in with them, which I will explain later.

When they noticed me they snatched me out of First Tank Battalion and sent me to a new duty station to ‘fix it’. I thought it was a promotion. First important note about the military is there is no such thing as a promotion, just a higher level of responsibility that becomes solely your responsibility. I was sent to my first maintenance shop as a Lance Corporal. I was filling the billet of a Staff Non Commissioned Officer so you can imagine no one was interested in what I was doing, or should I say no one wanted to cooperate with what I was trying to do.

First thing I did was examine the platoon and facilities I was taking over and I was stunned. It was like a TV sitcom. The technicians had never worked on the equipment, piles of broken parts were hidden in wall lockers, and every day the toughest Marines in the platoon would crawl under the test bench and take a nap on a mattress supposed to be used for transporting equipment. No one had the courage to do anything about it.

One of the big new things in 1982 was the MIMMS system. The Marine Integrated Maintenance Management System. It was a computer.

Just so we are clear, a computer back in 1982 was neither user friendly nor was it easily serviceable. When something went bad on this truck like behemoth, it was a major problem.

The Marines already had a system, a manual paper system, but this giant machine was sold as a replacement for that process. It would remove the tedious task of daily organization of spreadsheets and allow the Maintenance Management Office to see how things were being done in the battalion. It tracked the parts and all the equipment needed to run a military outfit.

To me however, it just required three times the tedious input and ten times the tedious time to get the same results, but the important thing was the Marines had a computer.

Putting a million dollar machine in the hands of a Marine is shady business, but we had one. And I had the perfect antidote to technology. His name was Merryman. He was a virus before there were such things.

That’s Merryman, M.E.R.R.Y.M.A.N. spells Merryman. I can still hear him singing that song.

I wish my family had a song.

Merriman could walk by the computer and technicians leapt to their feet. Their faces were stern and puzzled as they watched their displays do fantastical things to the data before their eyes. Merriman would input pages and pages of data, which he was supposed to, and within minutes he would be running into my office to hide. Sure enough, as I expected, there were a crew of angry technicians rushing in right after him with pitchforks and torches.

That was back in the day when everything was manually programmed, there was no running to the Walmart to pick up a new Maintenance Software Package. So every time Merriman would do something inconceivable, there would be much programming to follow. Every time a circuit was blown apart, the ritual five day warranty period would have to be observed in which Merriman was sent to the rifle range or driving school.

It was an important moment in history, the Marines had a system that would track all their parts and serviceable gear in one giant computer. It was an important step to have a system that took twelve men to do previously now take only two men.

That was a fallacy. That did not include the twelve guys it took to maintain the beast when things went bad, or the extra 5 hours it took to double check all the data. If we took the original twelve guys that worked in the MMO’s office and put them in the room next to the MIMMS machine, gave them each a 5 million dollar raise, they would still not cost taxpayers as much as that damn machine cost.

On one hand, I remember the reports, we could see real information, and that was good. On the other hand, what actually constitutes a machine that is ‘ready for production?’

There were other ways to do things, there were better systems, but that was the one that the Marines had chosen, and that was what we were going to make work.

That is progress you see. The bugs would soon be worked out, and that giant beast that required its own air conditioning system would actually be able to prove it’s worth in roughly nine years.

That was 1982. Blast forward to 2010.

As a business owner you will need the newest version of Microsoft Office, and Windows 7 to run your business. It may not be ready for normal use, and your employees may not be able to use it but what is more important? Your productivity obviously so you need this stuff.

Windows 7 makes it much easier to play with images and pictures, and music. That’s exactly what most employees spend most of their time at work doing, right? Who cares if you can’t see the printers on the network now right? Who cares if it takes ten minutes to find the menu that shows you how to paginate a document, you now have fifty thousand different options you did not have in the old version.

That’s what they want you to believe.

The savvy business owner will notice right away that everywhere the new versions go, productivity drops down to virtually a standstill. All the icons are different. All the menus are different. All the normal processes, taskbars and desktops are different.

The average bear that actually does the work on the computers, whose entire day and entire career is built upon how fast they can do their job is now thrown into this whirling dervish that they have no control over.

Their bonuses and paychecks still use the same grading system, but what used to take them 5 minutes now takes hours. Nothing works right. It could be years before they can get back to the productivity that they once thrived at.

If a business owner wants to stem the tide he must send his employees to training prior to upgrades, at roughly $800 per person, just so they can continue their production. Aye there’s the rub.

Once the employees learn how to use the new versions of software, business owners must buy new products to limit what they just taught their employees they could do. Now they can play movies, transform images, chat and communicate with friends, family and lovers all day long, it’s integrated. It’s so flippin’ integrated now they have personal accounts loaded on company machines and they are communicating personal stuff 50% of the time.

Small businesses don’t need that. I don’t even think big businesses need that. Sure you talk to some vendors by IM, but who else are your employees talking to. The sad truth is you don’t know. You cannot control that.

This is what I say, this is my rule number 1 for small business...

Don’t spend the money. Vote with your feet. Don’t buy the new products until they can guarantee they won’t disturb your business. Who gives a crap about music and movies, you’re employees are at work! They should be working, and believe me, I can look at the traffic going through the firewall, I can look at what web sites they go to, so I don’t care what Microsoft says, new versions do not improve production.

And it is not that hard to do right by small business.

Microsoft can improve their products and keep the same icons and the same procedures for everything. They could, they just choose not to. So I say – if they chose to ignore what I need as a business, I choose not to buy the new products.

Look at the viruses. The current rate of virus infestations keeps growing because people are easily duped into going to these websites and chatting or reading about friends, heck even blogging. What the?... They should be working!

Don’t feel the pressure to upgrade because Microsoft pulls their old versions off the market. Let the big companies do the debugging and beta testing for Microsoft, and never by any version ending in a zero. Windows Vista was the millennium edition all over again. Windows 7 has been out for a while and they are still fixing vulnerabilities. When will they actually put a production version on the market, and where do they get their ideas about what employees are supposed to be doing all day?

Don’t tell me it is more productive. That is why there are great new products on the market like iFilter from Futuresoft.

Great new Video from Kaspersky

2010-07-30T10:52:00.000-05:00

Here is a great new video from Kaspersky, it has a lot of information about who is doing what on the internet. Learn how complicated these internet threats are becoming, and how vulnerable we really are.

http://threatpost.com/en_us/threatpost-now

An Introduction

2010-07-30T09:56:00.001-05:00

I have been managing electronic maintenance facilities since 1982. I was in the Marine Corps in 1982, managing a communications maintenance shop. I learned from military manuals on how to set up a facility and how to stack boxes, even how to organize my books on organizing my manuals.

Some of that stuff sticks with you.

Managing IT is pretty much just like that. It is a way for the anal retentive to find a place in the universe, and I found my calling here too.

IT for a business at any level or size is the organization created to maintain the systems and processes that make the endeavor function, be that a bank, a church, a police station or an Embassy. All of these organizations have fundamental properties in common, and I will address them in detail.

I am going to show you the rules according to Bob, and extrapolate them from the simple network at home to the humongus organization like a governmental entity. These rules apply to everyone.