Some years ago, I came across the phrase “Suffering with delusions of adequacy”. It was used in a contemptuous way to describe the attitude of some people working on a major project – the people concerned hadn’t bothered to check their work as they knew that what they had done was totally perfect because they had done it. In fact their work was severely flawed and as a result, the project delayed whilst the problems were fixed.
It’s possible to see this attitude on many different user forums. Someone will pose a question, and another person will then post a response belittling the first person for their lack of skill. However, the individual leaping to criticise the other may not have taken all of the factors into consideration and as a result, the comments may be completely inappropriate.
I had a situation like this some years ago – a frantic sysadmin posted a comment on a forum about a problem with an ERP package that wouldn’t startup. One of the forum moderators responded with a confident assertion that the person had a virus and would have to completely re-install the OS and ERP package. I posted a comment that I had the same problem myself just 2 days before, and that it was solved by one of the run time elements being restarted – perhaps they should look at this first. When this was suggested, the moderator posted a major rant that newcomers should keep quiet!
In another incident several years before, I worked with a programmer on a large software package. I was running some tests using a manual script to check the functions of the software after a number of changes. I came across an unusual error which I reported to him – his response was that the software worked fine and it must be an error in the data that I was entering. I sent him copies of the data, screen shots of the process, yet he still refused to acknowledge there was a problem.
This went on for 3 weeks – eventually I spoke to another programmer who checked the code and found the error. It subsequently turned out the the first programmer hadn’t even bothered to run the checks – if he had, he would have seen the problem for himself as every other programmer did when I checked with them. This was extremely annoying as the wasted time could have been saved for more important issues and the faulty code had been issued to customers and had to be replaced.
Of course this is not specific to programmers (although they can be bad!) I’ve had discussions with networking technicians that refuse to accept that they could have made a mistake in setting up a routing table, and DB admins that can’t accept that their precious database is flawed. And don’t even get me started on consultants! As for the linux lovers and mac fanboys with their “my OS is better than yours”, they can be a real pain at times.
It seems that there are a lot of people in the IT world that suffer with delusions of adequacy. I’ve long felt that we need to try to improve the professionalism of the people that work in the industry, and this is one particular area that needs looking at. It seems to me that there are just far too many people that think they know the answer to every single problem, but need a large serving of humility. Whilst people act as if they are the fount of all knowledge when they clearly are not, it will be difficult to persuade others that people working in IT really are professionals.
Friday, 11 September 2009
Monday, 24 August 2009
(Un)Social Networking
People are social animals for the most part. We love to communicate with one another, share information about what we and people we know are up to – and it’s been suggested that this is why human beings developed the capacity for speech. In years gone by, people wrote letters to one another, or if urgent would send telegrams. Later, the telephone allowed actual real time conversations between people and that has lead to the growth of the more modern methods.
With the growth of the Internet, different methods of communicating have been developed and are used by people to enhance the way that they converse. And this has created a major problem; many workers want access to these new methods of communicating – instant messaging, blogs, wikis, social networking, video streaming and photo sharing sites. This increases the amount of data being transmitted and stored, which also increases the pressure on resources, and adds to the possibility of security issues.
Now many will maintain that these new methods provide significant benefits to the modern organisation – arguments are put forward such as “providing new revenue streams”, “improving marketing opportunities”, “ensuring real-time communications” – all the usual buzz words that you get from the people trying to persuade you that this is the way forward.
I like to think that I am quite open minded about most technologies, and I can see that there is a lot to be gained on a personal level from the use of these products. I can even see a number of practical applications within a business environment and have planned some projects to explore some of these. However, I do have a number of concerns relating to the security of these systems and how much time people will spend on them.
For example, being cynical I know that most data losses are caused by internal staff, not by outsiders hacking into the systems. Most companies are extremely protective of their data; but the social networking facilities can make it very easy for this to be copied and moved.
There is also the possibility that these systems could provide a route in for malware to be loaded. A user wants to install a new “Tool bar” application they see advertised on an IM message and click to install, not realising that what they are really doing is installed a keystroke logger.
Of course, there is also the concern that the staff may spend more of their working day actually chatting or posting items online rather than doing the job that they are supposed to be doing (I’m doing this in my lunch break!). And we have all heard the stories of embarassment of people posting comments in emails or on Facebook that are then sent around the world. These can cause an organisation to lose business and come to haunt a company for many years after the original event.
I think that there is a place in work for some of these tools – if we can teach people how to use them properly. But we have to make sure that they are being used appropriately and that we have a set policy so that all staff know where they stand, and we have to make sure that we can enforce these. I doubt that we can completely block their use, but I think it appropriate to try to set some ground rules so that we can at least try to make sure that they are not being used inappropriately.
What do you think?
With the growth of the Internet, different methods of communicating have been developed and are used by people to enhance the way that they converse. And this has created a major problem; many workers want access to these new methods of communicating – instant messaging, blogs, wikis, social networking, video streaming and photo sharing sites. This increases the amount of data being transmitted and stored, which also increases the pressure on resources, and adds to the possibility of security issues.
Now many will maintain that these new methods provide significant benefits to the modern organisation – arguments are put forward such as “providing new revenue streams”, “improving marketing opportunities”, “ensuring real-time communications” – all the usual buzz words that you get from the people trying to persuade you that this is the way forward.
I like to think that I am quite open minded about most technologies, and I can see that there is a lot to be gained on a personal level from the use of these products. I can even see a number of practical applications within a business environment and have planned some projects to explore some of these. However, I do have a number of concerns relating to the security of these systems and how much time people will spend on them.
For example, being cynical I know that most data losses are caused by internal staff, not by outsiders hacking into the systems. Most companies are extremely protective of their data; but the social networking facilities can make it very easy for this to be copied and moved.
There is also the possibility that these systems could provide a route in for malware to be loaded. A user wants to install a new “Tool bar” application they see advertised on an IM message and click to install, not realising that what they are really doing is installed a keystroke logger.
Of course, there is also the concern that the staff may spend more of their working day actually chatting or posting items online rather than doing the job that they are supposed to be doing (I’m doing this in my lunch break!). And we have all heard the stories of embarassment of people posting comments in emails or on Facebook that are then sent around the world. These can cause an organisation to lose business and come to haunt a company for many years after the original event.
I think that there is a place in work for some of these tools – if we can teach people how to use them properly. But we have to make sure that they are being used appropriately and that we have a set policy so that all staff know where they stand, and we have to make sure that we can enforce these. I doubt that we can completely block their use, but I think it appropriate to try to set some ground rules so that we can at least try to make sure that they are not being used inappropriately.
What do you think?
Tuesday, 11 August 2009
The battle of the Vs – VMWare vs Hyper V
Last week, I and one of the guys in the department had the chance to attend an event that demoed VMWare 4 and Windows Server 2008 R2 with Hyper-V. Many thanks to the people at Nexus in Exeter (http://www.nexusopensystems.co.uk/) that hosted the event, especially Gary that did the demos.
The presentations were quite straight forward. The first session was VMWare and we were shown the installation process starting right from the bare metal server. The actual installation process was Linux based and took about 20 minutes on releatively low spec machines. Once it was all up and running, we had the chance to see some virtual servers being created – literally just a matter of a few minutes work. We also discussed the switching process and the various options, and briefly saw how to create virtual switches.
There was a bit of a discussion about the merits of the VMWare product – how it allows you to “overload” by selecting options for the virtual servers such as levels of RAM that total up to more than the physical amount actually available. I would want to check this out for myself, but it certainly seemed to run OK.
We then discussed clustering and resiliance and the demo that followed showed a high definition media file being moved from one virtual server to another – the file ran constantly during the move and there was not even a slight pause during the process. Really impressive! Certainly, this would be of significant value in a situation where you are having to move production data when people are still working on it.
The demo actually ran over a bit as we were really interested in the product and had several questions to ask about various aspects – and Gary was only too pleased to show us the various bits in response. There is no question that it is an awesome product.
We then had the chance to see Hyper-V in action and for me it was the first chance I’ve had to look at this. We have Windows Server 2008, but not the R2 version which contains the hypervisor. The main difference between the two is that the VMWare hypervisor sits above the hardware and handles all of the driver requirements. Hyper V sits at the same level as the OS, just above the hardware, but each virtual server will handle it’s own drivers seperately. It also doesn’t allow overloading of resources – once you hit the limit, that’s it.
From what we saw, the Hyper V runs well – certainly it provided a smooth experience whilst we were watching it and the test moving the media file ran pretty much the same. There were a few diffences in the way that the virtual networking operates, but certainly it seems to run as we had expected. It definitely doesn’t have all the functionality of VMWare, but then there is a price difference – it’s a lot cheaper.
I’ve been looking at this now for a few months (in between other jobs) and I’m convinced that virtualisation is the way to go. It will certainly cut costs in terms of the electric bill, and it will also fit very nicely into our backup process / business continuity / disaster recovery planning. About half of our servers will reach 5 years old next year, so it seems a good time to start planning a move over to a virtualised system.
We have had a couple of visits to different vendor demos and they have been really useful. Although nothing has been decided, we are leaning towards the Dell Equalogic equipment – it seems to be everything that we could want and a bit more. The big issue of course is what software to run on the servers which is why we wanted to get to the event in Exeter. Howevever, I still not sure which one I think is the best option for us.
I’ve therefore planned that in the new year, say Jan / Feb 2010, we will get ourselves a spare server – there are plenty of cheap machines around at the moment. There is a trial version of VMWare available and of course, the Technet subscription allows us to install an evaluation copy of Server 2008 R2. Hopefully, this will gives us the chance to actually work with both products so that we can get a really good idea of which one we prefer – all we then have to do then is sell it to the powers that be!
The presentations were quite straight forward. The first session was VMWare and we were shown the installation process starting right from the bare metal server. The actual installation process was Linux based and took about 20 minutes on releatively low spec machines. Once it was all up and running, we had the chance to see some virtual servers being created – literally just a matter of a few minutes work. We also discussed the switching process and the various options, and briefly saw how to create virtual switches.
There was a bit of a discussion about the merits of the VMWare product – how it allows you to “overload” by selecting options for the virtual servers such as levels of RAM that total up to more than the physical amount actually available. I would want to check this out for myself, but it certainly seemed to run OK.
We then discussed clustering and resiliance and the demo that followed showed a high definition media file being moved from one virtual server to another – the file ran constantly during the move and there was not even a slight pause during the process. Really impressive! Certainly, this would be of significant value in a situation where you are having to move production data when people are still working on it.
The demo actually ran over a bit as we were really interested in the product and had several questions to ask about various aspects – and Gary was only too pleased to show us the various bits in response. There is no question that it is an awesome product.
We then had the chance to see Hyper-V in action and for me it was the first chance I’ve had to look at this. We have Windows Server 2008, but not the R2 version which contains the hypervisor. The main difference between the two is that the VMWare hypervisor sits above the hardware and handles all of the driver requirements. Hyper V sits at the same level as the OS, just above the hardware, but each virtual server will handle it’s own drivers seperately. It also doesn’t allow overloading of resources – once you hit the limit, that’s it.
From what we saw, the Hyper V runs well – certainly it provided a smooth experience whilst we were watching it and the test moving the media file ran pretty much the same. There were a few diffences in the way that the virtual networking operates, but certainly it seems to run as we had expected. It definitely doesn’t have all the functionality of VMWare, but then there is a price difference – it’s a lot cheaper.
I’ve been looking at this now for a few months (in between other jobs) and I’m convinced that virtualisation is the way to go. It will certainly cut costs in terms of the electric bill, and it will also fit very nicely into our backup process / business continuity / disaster recovery planning. About half of our servers will reach 5 years old next year, so it seems a good time to start planning a move over to a virtualised system.
We have had a couple of visits to different vendor demos and they have been really useful. Although nothing has been decided, we are leaning towards the Dell Equalogic equipment – it seems to be everything that we could want and a bit more. The big issue of course is what software to run on the servers which is why we wanted to get to the event in Exeter. Howevever, I still not sure which one I think is the best option for us.
I’ve therefore planned that in the new year, say Jan / Feb 2010, we will get ourselves a spare server – there are plenty of cheap machines around at the moment. There is a trial version of VMWare available and of course, the Technet subscription allows us to install an evaluation copy of Server 2008 R2. Hopefully, this will gives us the chance to actually work with both products so that we can get a really good idea of which one we prefer – all we then have to do then is sell it to the powers that be!
Wednesday, 5 August 2009
Terminal headaches
We have been trying to implement some new software for the CRM – the product has been used by one of our sites for some time, but not on the other sites. They had tried to use it before, but it’s not designed to be used across a WAN, so it had been set-up as multiple databases and when they started getting issues, they just stopped using the product.
The company concerned have issued a new version and our sales people have seen it and really like it. The vendor has produced a modified client GUI to run in a web browser – the idea is that those users on the remote sites would make use of that and so we could run a single database for all sites.
Well, that WAS the idea – the software runs OK locally, but when it was running through the browser, it was not as fast. Although it was usable, there was a definite speed issue, and we were worried that the users on the other site might not be convinced enough to use the product if the speed was poor.
It then occurred to me – the database was installed on the server and we also had a copy of the client software installed on the server so that we could test it was running as it was being set-up. I did a quick RDP to a server on the other site, the from there did another RDP back to the server on our site. The speed of operation was good – as far as I could tell, the speed was the same as if we were running it directly at this site.
So I set-up some shortcuts and emailed them to the users at the remote site, and then talked them through how to save and use the shortcut. They agreed that this worked well and they were really happy with the speed of operation. But then we hit a snag – only 2 users at a time. As we are talking about having some 20 remote users, then there is clearly a bit of a problem.
Now my predecessor had bought volume licences for a lot of software which included some terminal server licences, but unfortunately, none of the paperwork specified what was what. I found the paperwork ages ago and set-up a profile on eOpen to manage all of the various items. https://eopen.microsoft.com/EN/default.asp - this is a great resource and I suggest that you check it out if you don’t already use it. It allows you to see what the various bits of paper refer to and it gives you details on date of purchase, vendor, type of licence, quantity etc.
However, when I double checked, the Terminal Services licence server had been setup and the licences applied – so that wasn’t the problem. I then searched through the various bits and pieces and subesquently realised where it was all going wrong. The server that the software was installed on was set to use Remote Desktop as the licensing mode, not the correct Terminal Services mode. A quick couple of clicks and problem solved.
So now the staff at the remote site can all connect to the server and all use the CRM software. It seems to run just as quickly when half a dozen of them are using it – so they are all happy!
The company concerned have issued a new version and our sales people have seen it and really like it. The vendor has produced a modified client GUI to run in a web browser – the idea is that those users on the remote sites would make use of that and so we could run a single database for all sites.
Well, that WAS the idea – the software runs OK locally, but when it was running through the browser, it was not as fast. Although it was usable, there was a definite speed issue, and we were worried that the users on the other site might not be convinced enough to use the product if the speed was poor.
It then occurred to me – the database was installed on the server and we also had a copy of the client software installed on the server so that we could test it was running as it was being set-up. I did a quick RDP to a server on the other site, the from there did another RDP back to the server on our site. The speed of operation was good – as far as I could tell, the speed was the same as if we were running it directly at this site.
So I set-up some shortcuts and emailed them to the users at the remote site, and then talked them through how to save and use the shortcut. They agreed that this worked well and they were really happy with the speed of operation. But then we hit a snag – only 2 users at a time. As we are talking about having some 20 remote users, then there is clearly a bit of a problem.
Now my predecessor had bought volume licences for a lot of software which included some terminal server licences, but unfortunately, none of the paperwork specified what was what. I found the paperwork ages ago and set-up a profile on eOpen to manage all of the various items. https://eopen.microsoft.com/EN/default.asp - this is a great resource and I suggest that you check it out if you don’t already use it. It allows you to see what the various bits of paper refer to and it gives you details on date of purchase, vendor, type of licence, quantity etc.
However, when I double checked, the Terminal Services licence server had been setup and the licences applied – so that wasn’t the problem. I then searched through the various bits and pieces and subesquently realised where it was all going wrong. The server that the software was installed on was set to use Remote Desktop as the licensing mode, not the correct Terminal Services mode. A quick couple of clicks and problem solved.
So now the staff at the remote site can all connect to the server and all use the CRM software. It seems to run just as quickly when half a dozen of them are using it – so they are all happy!
Monday, 27 July 2009
Windows 7
Like a lot of people, we’ve been keeping an eye on the information coming out about the next version of Windows. We received a copy of the RC 1 candidate for Windows 7 on Monday (thanks Georgina) – we have a PC with a copy of Vista Business Ultimate that we use for testing purposes (a Dell Optiplex 210 with a dual core 1.8 GHz and 1 GB ram), so thought we would partition the disk and do a dual boot so that we could do a direct comparison.
The installation went quite well – some of the usual types of screens for the initial installation, but not as many as we would normally see for older OS. The actual process start to finish was a little over 40 minutes. We didn’t join the PC to the domain although we left it plugged in and it picked up on the required settings, so we were able to activate it straight away. We then joined it to the domain a couple of days later - no hassles at all.
I’ve also run another copy on a second machine – an HP dx2450 with a dual core 2.3 and 2 GB RAM. This one installed in just over 25 minutes. Again, it was a very straight forward installation, with only a few screens to configure and absolutely no issues at all.
Initial reaction to it was that it does look a lot like Vista – same screens, same gadget bar etc. However, within a few minutes, it was noticeable that it was faster that the equivalent Vista installation probably about 40 – 50% faster. The Start button, Taskbar items and other shortcuts all seem to work much quicker as well – no delays between clicking the button and the app starting to open, which was a bit of a major gripe with the Vista installation.
We added our AV product (Nod32 by Eset) – it worked straight away, without any issues at all. We then added our automatic patching tool (Shavlik) – as it’s an RC product, we didn’t expect it to work. However, it did actually pick up on the OS, although there were no patches for it at this stage. The second PC was left as a stand alone system and AVG free (8.5) was installed as the AV product. The PC was connected to the Internet to allow it to run the automated patching – again very quick, very straight forward.
At this stage, we are still testing different apps on the machines – our ERP software, some CAD software, and various applications which we use. Not one of them has had an issue with running – the UAC threw up its warnings, but I don’t consider that a problem as that is exactly what it should do.
We’ve left the test machines in an office for people to check out – so far only a few have taken the time to do this. However, of those that have used it, not one has said that they don’t like it. All comments have been very positive and it seems that a number of people are now very keen to get the product for themselves and we may well consider installing it early next year with our next hardware refresh. All in all, it seems that Windows 7 is just what the doctor ordered.
The installation went quite well – some of the usual types of screens for the initial installation, but not as many as we would normally see for older OS. The actual process start to finish was a little over 40 minutes. We didn’t join the PC to the domain although we left it plugged in and it picked up on the required settings, so we were able to activate it straight away. We then joined it to the domain a couple of days later - no hassles at all.
I’ve also run another copy on a second machine – an HP dx2450 with a dual core 2.3 and 2 GB RAM. This one installed in just over 25 minutes. Again, it was a very straight forward installation, with only a few screens to configure and absolutely no issues at all.
Initial reaction to it was that it does look a lot like Vista – same screens, same gadget bar etc. However, within a few minutes, it was noticeable that it was faster that the equivalent Vista installation probably about 40 – 50% faster. The Start button, Taskbar items and other shortcuts all seem to work much quicker as well – no delays between clicking the button and the app starting to open, which was a bit of a major gripe with the Vista installation.
We added our AV product (Nod32 by Eset) – it worked straight away, without any issues at all. We then added our automatic patching tool (Shavlik) – as it’s an RC product, we didn’t expect it to work. However, it did actually pick up on the OS, although there were no patches for it at this stage. The second PC was left as a stand alone system and AVG free (8.5) was installed as the AV product. The PC was connected to the Internet to allow it to run the automated patching – again very quick, very straight forward.
At this stage, we are still testing different apps on the machines – our ERP software, some CAD software, and various applications which we use. Not one of them has had an issue with running – the UAC threw up its warnings, but I don’t consider that a problem as that is exactly what it should do.
We’ve left the test machines in an office for people to check out – so far only a few have taken the time to do this. However, of those that have used it, not one has said that they don’t like it. All comments have been very positive and it seems that a number of people are now very keen to get the product for themselves and we may well consider installing it early next year with our next hardware refresh. All in all, it seems that Windows 7 is just what the doctor ordered.
Wednesday, 15 July 2009
Security 101
I don’t pretend to be a security guru, but over the last few years I have had some specialist training in this area. I’ve also read a number of books on various security topics and have developed a bit of an interest in the subject. As a result, I tend to look at things a bit differently now – and sometime what I see really gets me wound up.
This morning, I received a telephone call from someone that said he worked for the credit card fraud section of one of the main UK banks. Our company does have an account with them (we actually use several banks) and we get company credit cards through this particular bank. These are used for a number of things – minor expenses, making travel arrangements, increasingly to buy things on-line. It makes life easier, and the credit control staff in our accounts department can track the charges much more easily than though petty cash arrangements.
The person that phoned explained that he wanted to query a particular payment – not a problem. But then he said that he needed to go through some security checks to make sure that I am the right person to talk to. He asked for the card number, my date of birth, account password plus some other items – effectively everything that a crook would be able to use to pretend to be me. At that point I refused point blank – he has phoned me, and I have no way of knowing if he is in fact anything to do with the bank.
I tried to explain this to him – but clearly he was reading from a script and couldn’t deviate from the process. So I insisted that I wouldn’t discuss anything further and hung up. I then phoned their helpline (the number was on the back of the card) and was put into an automated system. Eventually, I got through a nice young lady who explained that she couldn’t put me through to that department; they only work via outgoing calls and will not accept an incoming calls “for security reasons”.
As it happens, she was able to check the required details and I was able to confirm that the transaction was OK. But I have to say that there is something fundamentally wrong with the way that this bank are working. I tried to get put through to someone to discuss this – they refused point blank. In fact it appears that the only way I can register my concerns is in writing – a letter is going to go off to them tonight and I’ll update this blog to let you know what they say.
To indicate why I’m so uptight about this, I should explain that a while ago a I bought a copy of the book “The art of deception” by Kevin Mitnick. I was a bit ambivalent about this to begin with, as I don’t think it is right to reward someone for bad behaviour; but I wanted to understand how he achieved the various expolits that he got away with. Although some of the descriptions of his activities are now out of date or only relate to things in the US, the majority of the principles are actually very relevant today.
In the book, he described how he managed to obtain information by talking to several people, using one piece of information obtained from one person to persuade someone else to reveal another and so on until he got just what he needed. In this way, he gained access to a lot of really sensitive information, and if he had wanted could have caused a lot of trouble. What is so disturbing is how easy he found it all.
In my case, I refused to pass over the information and then took steps to verify the person was who he said he was – but it appears that the bank don’t want to work that way and in fact try to prevent a fairly sensible set of precautions. Worse they are propagating a method of verification that is open to abuse, and it is likely that if the average person sees that the bank do it a specific way, they will assume it is OK and not question someone else that telephones them, potentially leaving them open for a security breach.
Social engineering is a fact not a theory – and that is why so many people still fall victim to scams and the quantity and quality of spam we get is testament to the amount of money that is involved, and the number of people that regularly fall prey to these crooks. The risks are well known and I would expect those people that are involved in areas of security to understand this. If they don’t follow good procedure, how are the rest of us going to enforce it at our level?
This morning, I received a telephone call from someone that said he worked for the credit card fraud section of one of the main UK banks. Our company does have an account with them (we actually use several banks) and we get company credit cards through this particular bank. These are used for a number of things – minor expenses, making travel arrangements, increasingly to buy things on-line. It makes life easier, and the credit control staff in our accounts department can track the charges much more easily than though petty cash arrangements.
The person that phoned explained that he wanted to query a particular payment – not a problem. But then he said that he needed to go through some security checks to make sure that I am the right person to talk to. He asked for the card number, my date of birth, account password plus some other items – effectively everything that a crook would be able to use to pretend to be me. At that point I refused point blank – he has phoned me, and I have no way of knowing if he is in fact anything to do with the bank.
I tried to explain this to him – but clearly he was reading from a script and couldn’t deviate from the process. So I insisted that I wouldn’t discuss anything further and hung up. I then phoned their helpline (the number was on the back of the card) and was put into an automated system. Eventually, I got through a nice young lady who explained that she couldn’t put me through to that department; they only work via outgoing calls and will not accept an incoming calls “for security reasons”.
As it happens, she was able to check the required details and I was able to confirm that the transaction was OK. But I have to say that there is something fundamentally wrong with the way that this bank are working. I tried to get put through to someone to discuss this – they refused point blank. In fact it appears that the only way I can register my concerns is in writing – a letter is going to go off to them tonight and I’ll update this blog to let you know what they say.
To indicate why I’m so uptight about this, I should explain that a while ago a I bought a copy of the book “The art of deception” by Kevin Mitnick. I was a bit ambivalent about this to begin with, as I don’t think it is right to reward someone for bad behaviour; but I wanted to understand how he achieved the various expolits that he got away with. Although some of the descriptions of his activities are now out of date or only relate to things in the US, the majority of the principles are actually very relevant today.
In the book, he described how he managed to obtain information by talking to several people, using one piece of information obtained from one person to persuade someone else to reveal another and so on until he got just what he needed. In this way, he gained access to a lot of really sensitive information, and if he had wanted could have caused a lot of trouble. What is so disturbing is how easy he found it all.
In my case, I refused to pass over the information and then took steps to verify the person was who he said he was – but it appears that the bank don’t want to work that way and in fact try to prevent a fairly sensible set of precautions. Worse they are propagating a method of verification that is open to abuse, and it is likely that if the average person sees that the bank do it a specific way, they will assume it is OK and not question someone else that telephones them, potentially leaving them open for a security breach.
Social engineering is a fact not a theory – and that is why so many people still fall victim to scams and the quantity and quality of spam we get is testament to the amount of money that is involved, and the number of people that regularly fall prey to these crooks. The risks are well known and I would expect those people that are involved in areas of security to understand this. If they don’t follow good procedure, how are the rest of us going to enforce it at our level?
Friday, 3 July 2009
Hot, hot, hot...
I booked to take a week off of work last week – no plans to go anywhere, but just wanted a bit of a break. It was a glorious week, with lots of sun, but not too hot, and I managed to catch up on some outstanding jobs at home, such as painting the windows. I also had the chance to sit around and just relax with a glass of wine or two….
So back to work on Monday this week. I thought that I would get an early start as there are a number of projects on the go and I wanted to get a few things out of the way. When I arrived, there was note on the door – the inventory clerk had had problems getting on the system, so had left a note for us to investigate.
When I checked the server room, everything was off and the room was absolutely boiling – we normally run at around 22-24 degrees C as we find that’s a nice temperature to work in, the servers are OK with that and it uses less power to cool the place down. I quickly checked and everything had shut down including the air conditioner which wouldn’t even re-start.
I looked at the UPS and that was showing power going in, but nothing coming out. I looked but couldn’t see a problem so grabbed a couple of power extension leads from our office and ran them around so that we could get a couple of systems running. Priority number 1 was the DHCP / DNS server so that we could get network services and that was the first one running. Next one was email – no problem there, it started up fairly quickly. But with the room so hot, I had to find a way to get some air movement. Even with all the windows and doors open, the room was still close to 40 degrees.
I pinched some fans from the HR office as a quickfix, and after about 20 minutes the maintenance manager came in. He did a quick check on the air con unit and discovered that the power breaker in the mains supply in the factory had tripped out – he reset this, but when the unit started up, it wasn’t cooling anything down. He contacted the service company who sent an engineer down later.
With the rest of my staff in, we started moving a couple of the servers – we have small backup room at the other end of the building so were able to put a couple of them down there as a temporary measure. By about 9:00 am we had most of the system running so that people could get on with the daily work.
When the engineer from the aircon company turned up, he identified that the compressor had failed and needed to be replaced. It took a couple of days to get this, only for him to then discover that anpother part had failed causing all the refridgerant gas to leak out. This is what caused the aircon to fail – and as a result everything over heated.
We checked the UPS settings as it is supposed to send an alert for various events, and it turned out that every event was ticked except the one for temperature. Doh! Basically the device had gone up to 60 degrees C and then just shut everything down. In addition, a switch on the device had tripped preventing any outgoing power.
So now we are almost back to what passes for normal – we have to make time to come in one Saturday to put everything back in place as it takes longer to build a rack up than it does to strip it down. But the aircon is cooling away nicely and hopefully, now we’ve ticked the box, it will warn us of any similar event in future.
So back to work on Monday this week. I thought that I would get an early start as there are a number of projects on the go and I wanted to get a few things out of the way. When I arrived, there was note on the door – the inventory clerk had had problems getting on the system, so had left a note for us to investigate.
When I checked the server room, everything was off and the room was absolutely boiling – we normally run at around 22-24 degrees C as we find that’s a nice temperature to work in, the servers are OK with that and it uses less power to cool the place down. I quickly checked and everything had shut down including the air conditioner which wouldn’t even re-start.
I looked at the UPS and that was showing power going in, but nothing coming out. I looked but couldn’t see a problem so grabbed a couple of power extension leads from our office and ran them around so that we could get a couple of systems running. Priority number 1 was the DHCP / DNS server so that we could get network services and that was the first one running. Next one was email – no problem there, it started up fairly quickly. But with the room so hot, I had to find a way to get some air movement. Even with all the windows and doors open, the room was still close to 40 degrees.
I pinched some fans from the HR office as a quickfix, and after about 20 minutes the maintenance manager came in. He did a quick check on the air con unit and discovered that the power breaker in the mains supply in the factory had tripped out – he reset this, but when the unit started up, it wasn’t cooling anything down. He contacted the service company who sent an engineer down later.
With the rest of my staff in, we started moving a couple of the servers – we have small backup room at the other end of the building so were able to put a couple of them down there as a temporary measure. By about 9:00 am we had most of the system running so that people could get on with the daily work.
When the engineer from the aircon company turned up, he identified that the compressor had failed and needed to be replaced. It took a couple of days to get this, only for him to then discover that anpother part had failed causing all the refridgerant gas to leak out. This is what caused the aircon to fail – and as a result everything over heated.
We checked the UPS settings as it is supposed to send an alert for various events, and it turned out that every event was ticked except the one for temperature. Doh! Basically the device had gone up to 60 degrees C and then just shut everything down. In addition, a switch on the device had tripped preventing any outgoing power.
So now we are almost back to what passes for normal – we have to make time to come in one Saturday to put everything back in place as it takes longer to build a rack up than it does to strip it down. But the aircon is cooling away nicely and hopefully, now we’ve ticked the box, it will warn us of any similar event in future.
Subscribe to:
Posts (Atom)
