CIA- The Fundamental Dimensions of IS Security

Let me begin with CIA.  For those readers who are not IS security professionals, “CIA” is not the Central Intelligence Agency.  Rather, CIA is the fundamental academic model of the full scope of IS security; Confidentiality, Integrity, Availability.

Confidentiality and Integrity project onto many of the best practices we use in applying good governance to data center operations.  Confidentiality is the motivation behind obscuring the purpose of our data center facilities to the outside observer.   If your data center has a neon sign with your company’s logo proudly displayed on the building or property then you’re not concerned with supporting confidentiality.  If you’ve applied for listing on datacentermaps.com then similarly you’re not worried about attracting attention of those who would like to cause disruption to your business.

Confidentiality, of course, also projects prominently onto a data center’s access control techniques, devices, policies and procedures.  There is certainly much that can be discussed about that, but that’s beyond the scope of this article.

The third leg of the IS security model is Availability.  Availability is a term that gets a lot of attention in the data center world, but the role of availability to IS security is often unrecognized.  The most obvious example of this is the common view of availability as “up-time.”  If the facility is down, access to data is not possible.   We invest exorbitantly to build facilities and systems that operate in a way that maximizes up-time.  We invest exorbitantly again to operate these facilities and systems, justified by our confidence in delivering up-time.  We build redundant paths for very high levels of power distribution, intense cooling, and robust plumbing paths.  The energy consumed by the magnitude and inefficiency (because of the included redundancy, at least) of these facilities has earned data centers the distinction of one of the highest industrial consumers of energy to the degree of driving new legislation about energy consumption and carbon emissions.

Tears for Tiers

One key conclusion of my presentation (I realize it’s taken me a while to get to the point here) focused on something I call “Tears for Tiers.”  The drive for high availability and maximization of uptime has driven a manic quest for Tier 3 and Tier 4 data center facilities (If you’re unfamiliar with what we’re talking about regarding tiers, you can find an explanation here).  The cost of building, buying, and operating data centers takes a big leap when moving up the tier ladder from Tier 2 to Tier 3 and especially to Tier 4.  ‘Big dollar multipliers for those higher levels.  It’s true that almost every business one can imagine absolutely needs something more than three nines availability these days.  However, when a business embarks on the path and the expense of owning and operating at Tier 3 or Tier 4 facility for the purpose of buying that third or fourth nine, there are still many, many single-event risks that are assumed.  Assuming these risks runs counter to the good governance that so much time was spent to build.

What I’m getting at here, is that if you have a single data center facility,… ‘regardless of what Tier you’ve achieved, the whole thing can be for naught as a result of common threats.  Fire, for example, is the big elephant in the room.  Even if the building doesn’t burn down, a minor smoke/fire event can mean total replacement of your IT kit is necessary.  An erroneous activation of the EPO is another, very common, catastrophic event that is exposed to common human error.

Data Centers are for Data

Data is a Business’ most valuable asset (or at least in the top two, depending on one’s point of view).  Data is product.  Data is money.  Data is raw material.  Data is business operations.  Data is compliance.  Data is any one or any combination of the above.  The reason we invest money in data centers is solely because of the value of data and data processing.  The amount of investment in the data center is a reflection of strategic decision-making around risk management and good governance and stewardship of the business.

Why are we doing this?  Well, we are seeing that perceptions about shopping for data centers with tier level as a requirement are changing.  We are seeing that, now that the community has had time to think about it, Business’ concept of data center tiers is evolving.  Without giving away the farm, we invite you to look at our poll in the sidebar of this blog and kindly register your opinion.

“I don’t really care, as long as their uptime is good”

…is for those who are focused on availability performance of the site, without necessarily correlating to a tier level designation.

“All Tier Level claims are lies”

…is for those who don’t believe tier level claims by data center operators, unless a certification can be produced.

“If they claim to be Tier III or Tier IV it must be true”

…is for those who take the data center operators at their word when it comes to assessing the quality of a data center.

There may be more choices that would amplify this study, but we’re keeping it simple for now.  We’d appreciate it if you can share your opinion by selecting one of the options in the Poll area of the sidebar.

Cost Contribution of Cabling

One component that often goes unchecked, even during deeper rounds of data center cost estimation is the cost of cabling.  Cabling costs can be (usually are) rather significant, especially with the escalating price of copper.  While through the 90’s, data center planners considered the cost of copper as data centers require vast amounts in support of “below white space” and “above white space” infrastructure, since 2005 the price of copper has been a dynamic variable that added a new complicating factor to data center implementation budget planning accuracy.

In the figure, we can see that the price of copper has now returned to double 2005 levels, after softening during the 2008 recession.

Cabling is overlooked during data center cost estimation, sometimes because of simple neglect, or confusion over how to price without a detailed parts list.  Rules of thumb or market rates are usually known for the other areas of cost estimation, but what about cables?

In this article, I will share with you a method that I use to include cabling costs of data center implementations even when there are very few “knowns” regarding the ultimate solution.

Dollars per RU Model

Many data center architects will base high level power dissipation estimates on the number of Rack Units (RU’s) occupied by the IT kit.  The recent BICSI-002 standard, in fact, recommends such an approach.  A similar approach can be taken for estimating cable costs.  Because equipment specifications may not be sufficiently detailed to know port count, interface type, and precise location in rack elevations, the total number of occupied RU’s can be used as a starting metric.

Because the cost of cabling will ultimately be impacted by port speed, media type, cable types, and lengths, we will use a range for estimation.  It is up to the engineer’s judgment, given their understanding of the IT environment at the time, to select where in the range to declare a cost term.  We suggest the range be from $250 per RU to $500 per RU.  The idea is to multiply the total number of occupied RU (the number of Rack Units that are consumed by the inventory of IT equipment) by a value from the range above, selected based on the estimator’s notion of complexity.  The resulting value is the indicative cost estimate for cable materials including cable management hardware.

We would be very interested to hear your perspectives and experience with using this model in your own work.  Please write back and share your experiences.

If you share an interest in the results of our research, or if you are a commercial colocation or data center services provider in India, please drop us a line.

BYO IT

While governance and security are even more important now than in times past, the characteristics of IT services have changed around us.  Take end user devices for example. The product life of a desktop or laptop system, several years ago, could be argued to be three years or more.  While the device can certainly function for that long and even longer, most users are “out-using” the device long before that now.  Device manufacturers are developing products that are well dialed-in to what users want… even if the users don’t know they want it.  The product cycles for these innovations are measured in months rather than years.  Furthermore, usability of the products themselves has significantly improved beyond what used to create routine help desk tickets.  The product marketplace has slanted heavily in the direction that users are disgruntled by someone suggesting they have to use some particular make and model of computing device.  Users are eagerly willing to switch to B.Y.O. IT

Offerings available through SaaS and PaaS cloud providers are very sophisticated and robust.  They are moving to the point of commoditizing IT services that not long ago were considered quite complex.  Some of the development work that consumed IT cycles in creating a new service has been already done and done well by these providers, bringing into question the cost justification of a new service creation project at the very least.

Changing Views of Shadow IT

So what does this mean to our traditional view of Shadow IT?  Well, if one is still reticent about letting go of the notion that Shadow IT is always bad, then it means the job of managing the proliferation of Shadow IT is becoming harder than ever.  If one is coming around to a model in which some Shadow IT may even be beneficial, then the focus of the work comes around to how to ensure governance and security.

Some may address this by trying to establish an approved list of BYO services.  In my opinion, this may be just as steep a treadmill as trying to eliminate Shadow IT.  Others have addressed this through what I call the “Walk a Mile in My Shoes” approach, through which the IT leader will try to make users appreciate what IT actually goes through to bring a service to the enterprise, in hopes that they will take with them an eye for good security and governance concerns.  To me, this is a roll of the dice, and given the typical success (or lack thereof) we usually have with communication plans in the IS security context, my hopes are not high for that one.

An argument can be made that Shadow IT, framed in the proper context, can even offer relief to IT services planning and delivery.  However, the aspects of governance and IS security are even more open ended in such a model, which requires a shift of attention to that area.

We’d greatly welcome your thoughts on Shadow IT in your organization, and in particular to hear about examples of how the changing marketplace has reinvigorated Shadow IT proliferation in your firm.

Quite often, I am called by a potential Client needing help with DR planning, and who is at the make/break point of a relationship with a DR planning tool vendor.  The conversation often goes something like this:

“Bob, we’ve had this vendor in here for the past 18 months, and they’ve been through the organization several times, helping us put words into this tool.  We need a real DR plan that we can show our auditors and after all this time, the vendor is blaming us for not being able to follow their process!”

…or,

“Bob, we’ve spent a ton of money on this tool that a vendor sold to us, and we’ve spent the last year populating it with data.  What we can’t figure out though, is where’s the darn DR Plan?”

I could go on, but I don’t want to come across as bashing the whole DR Planning Software niche.  There might be some good ones out there.  I just haven’t been impressed with what I’ve crossed paths with so far.  No, I can’t name them.  They’ve been that underwhelming.

Disaster Recovery planning is a complex craft.  It requires a strong background in security and risk management, an ability to comprehend the business and its value in all dimensions, an appreciation for business and technology governance, pragmatic “what if” thinking, and the ability to communicate effectively.  Looking at those ingredients for success, it’s difficult to comprehend how a bit of automation will accomplish that broader context of Disaster Recovery.

I would bet that the DR planning tool vendors are indeed advising their Customers that a few human brains need to be overlaid onto what their product brings to the table, but after the purchase I don’t think the consumers are seeing it this way.  It seems that at least some of the people buying DR planning tools are not DR planners.  As such, they are expecting more from the product than they should.   … and they’re coming away dissatisfied.

I’d love to hear your experience with these tools, and if you have a success story it would be most welcomed.

With that disclaimer, I was reading an article today in Gigaom about smartphone market share.  The graph is reprinted below.

There’s a lot to read between the lines in this and other similar reports over the past few months, one of which is what the impact of the Verizon iPhone will be.  So next year’s chart will be interesting to look at.

Oddly though, my motivation for banging out this quick post is the thought that occurs to me regarding Blackberry, in this regard.  In my personal opinion, I think that the Blackberries are going to quickly die off.  I think that their proliferation is being artificially buoyed by all the BES servers out there humming through their depreciation curves.  Maybe the RIM curve will be down there next to Microsoft next year.

I promise- no more smart phone posts for a while (I think).

HP does smart phones??

Apple already uses ARM chips in the iPad, and other circumstances are in line to make this transition a somewhat low-risk move for the product line.  Apple is said to also have been seeking fabrication capabilities for ARM chips.

At any rate, it seems that the x86 chips in Apple computers will be history in 2-3 years time.

This will undoubtedly result in lots of conversation around the office in the coming days.  We’d love to hear your thoughts.

This is a continuation of the trend we see with carriers purchasing hosting companies as a way to acquire cloud service product capabilities.  In the case of CenturyLink though, this acquisition of Savvis comes on the heels of the recent acquisition of Qwest Communications (a $20B deal).

Savvis had targeted a ten percent growth in revenue from its hosting business this year, prior to the announcement of this deal.  The publicly available plans say that current Savvis CEO, Jim Ousley will run the new hosting unit within CenturyLink.  Integration of Savvis may be complicated by the concurrent integration of Qwest.  This marks an aggressive step by CenturyLink to expand revenues, and continues the pattern of telecom companies merging with hosting companies to meet the market of rising cloud demand.

One of the topics that comes up in most of these conversations has to do with the number of applications ( “Apps” ) that are available for the phone.

A friend of mine, Adam Somer, brought my attention to an article in Business Insider that contained the following chart:

Smart Phone Apps, 2011

The point of this chart, and the text in the associated article, is that the number of apps available for the Android is quickly catching up to the number of apps available for the iPhone.  This is nice to know, I suppose.

What’s the Big Deal with the Number of Apps?

My reaction to this is, “Big whoop!”  If you believe the chart (which we have no real reason to question), we’re talking about 300,000 apps, essentially, for either device.  Three hundred thousand apps!  Would it really matter to me if one of the devices had ten more than the other?  How about 100… or 10,000… or even 50,000 more?  How many pinball or Shakespeare quote apps do I need to carry around?

In terms of quantity of apps available for the iPhone, the Droid, or the Blackberry, or whatever… we’re in pretty good shape, people.

The Better Question is, “What Kind of Apps?”

Instead of all these articles about the number of apps available for mobile phones I’d rather see some sort of categorization of applications.  That is, of the 300,000 apps available for the Droid, how many are business related?  How many are personal health related?  How many are financially related?… and so on.

Even better still, I’d like to see some sort of categorization about which apps are “good.”  What are they useful for and how do they facilitate one’s efficiency or overall satisfaction in some way.  I’ve not seen much of that.

Your comments would be greatly appreciated.  Maybe you know of a source for better information about mobile applications.