Anonymous Hacks FBI Conference Call On Cyber Pirates

The group posted a 16-minute recording of a call in which U.S. and foreign law enforcement officials discussed two alleged teenage members. Officials are calling it a “low level cybercrime” but the call could have been about how to thwart a plot to blow up an airplane or even how to capture Bin Ladin.

Security pundits believe that an email to one of the call participants was intercepted by Anonymous and they simply dialed in. The FBI claims that one of the email recipients forwarded it to Anonymous. No matter how it happened, it’s easy to laugh and say that law enforcement is stupid, but the truth is that many organizations are being targeted by advanced persistent threats (APT), and your organization may be one of them.

And not only are your organization’s computers and networks being targeted, but if you are on someone’s hit list, your employees’  home networks and computers are probably being targeted as well.

I discussed some ways to help mitigate an APT against your company in this blog post  but wanted to reiterate how easy it is to use commercial off the shelf (COTS) encrypting USB devices from SPYRUS to protect confidential information. While this may start sounding like a commercial, I swear that it really isn’t and there are concrete actions below that you can use to protect your confidential information.

The SPYRUS Hydra Privacy Card® (Hydra PC™)

Hydra PC combines the features of a smart card (certificate storage and signing) with an encryption engine and a USB flash drive. But unlike other encrypting USB flash drives, Hydra PC can:

• be configured to work only on specific PCs so that it cannot be unlocked anywhere else
• encrypt files that can be stored anywhere, not just on the drive
• share encrypted files with specific individuals using public key infrastructure (PKI)

Now let’s look at this specific Anonymous hack again and see how it might have been prevented. The below steps are for the ultimate in protection. Confidential information can be encrypted and decrypted on your internet-connected PC if you are certain that it is not compromised.

1. Hydra PC devices are assigned to employees of the FBI and other law enforcement agencies.
2. Security administrators configure PCs that are authorized to be used with the Hydra PC device. The Hydra PC device cannot be unlocked on an unauthorized PC, preventing data leakage.
3. Authorized users insert their Hydra PC device into an authorized PC that is connected to the Internet and email their sharing certificates to all other parties. This is similar to the way that you would send email certificates or PGP keys to other users before you can receive encrypted information from them. Interception of a sharing certificate is useless, but it can be sent “back channel” if desired.
4. An FBI employee sets up conference call and creates a document with the conference call information on a PC that is not connected to the Internet.
5. The employee inserts their assigned Hydra PC device into the PC, authenticates to it, and encrypts and signs the Word document, incorporating the sharing certificates from only the authorized recipients of the document, and placing it on the Hydra PC flash drive.
6. The employee disconnects their Hydra PC device from the PC.
7. The employee connects their Hydra PC device to a computer that is connected to the Internet, authenticates to it, creates an email to all of the authorized recipients of the document, and attaches the encrypted document.
8. Recipients insert their Hydra PC device into an internet connected PC, authenticate to it, and copy the encrypted document from the email to it.
9. Recipients then move their Hydra PC device to a PC that is not connected to the Internet, and decrypt the document to gain access to the information.

This method may take a few extra steps than simply sending an email around, but if the information is truly confidential, then it’s worth the extra time. And unless you have a mole either creating the document or on the recipient list, the information is safe from disclosure because the file is never in a decrypted state on any PC that is connected to the Internet.

Additionally, a forwarded copy of the document is useless without a Hydra PC device that is on the authorized sharing list to decrypt it.

The use of Hydra PC encrypting devices is not limited to government or law enforcement – it is available to US residents directly from Amazon and as long as you aren’t’ in a restricted country, everyone else can buy directly from SPYRUS or a reseller.

The Magical 10,000 Foot Chime

After you have stowed your suitcase in the overhead bin and put your backpack under the seat in front of you, there isn’t much else to do until the door closes and you are told to turn off and stow your personal electronic devices (PED) for takeoff. Mid-flight, you get your laptop, tablet, and/or mp3 player out and do a bit of work until you are told again that all PEDs need to be powered down and stowed.

If you are a frequent flyer, you will note that there is a single chime before the purser (the lead flight attendant) announces that it is okay to power up your devices. That chime signifies that your aircraft has passed above (or below) 10,000 feet. What is magical about 10,000 feet? Because this is the loudest part of the flight, with the engines throttled up, flaps and gear hanging in the breeze and scared kids trying to drown out the noise with their screams and shouts, this is the time that you most want Metallica slamming into your eardrums but you’re not allowed to use your electronics.

Wash Hands Before Entering Cockpit

In 1981, after reviewing a series of accidents, the FAA determined that an aircraft below 10,000 feet is in a critical phase of flight and imposed the sterile cockpit rule. When the cockpit is sterile, no member of the aircrew, including flight attendants, are allowed to engage in any activity that could, “distract any flight crewmember from the performance of his or her duties or which could interfere in any way with the proper conduct of those duties.” Statistically speaking, an aircraft tends to be safest when it is cruising at altitude. Takeoffs and landings are very risky because of the number of variables involved and decisions to be made.

You may have noticed that when you are taking off and landing, there are many more aircraft in a smaller area than when you are cruising. In fact, there is a complicated set of handoffs between multiple ground and air controllers from the time that an aircraft leaves the gate until it reaches cruising altitude. Pilots need to change radio frequencies and direction in a rapid and accurate manner in a short period of time. One mistake and you could have a ground or mid-air collision.

So that explains why the crew has to have eyes forward and ears engaged, but what about us passengers? We aren’t doing anything that could impact the safety of the aircraft… are we? In fact, we could be, but not for the reasons that you might suspect. While the FCC banned the inflight use of 800 MHz cell phones because of potential interference with ground networks in 1991, there are more important reasons for not using PEDs during takeoff an landing.

Newton Was Right

The takeoff speed of the latest 747 is 160-180 miles per hour ( 257-290 km/h). What do you suppose would happen if the plane suddenly came to a halt, or twisted off of the runway? Just like the groceries in the back seat of your car come crashing into the back of the front seats, everything is thrown forward.

If the tray table in front of you was open, you would smash into it, posssibly bisecting your chest. That laptop or tablet you are holding would go flying forward, or if it was in the seat pocket in front of you, your knees might go into it, shattering the glass screen and embedding it into your flesh. And if you do need to quickly evacuate, it’s much easier if you don’t need to worry about where you’re going to stow your gear before you can get your butt out of the exit to safety.

Now Hear This!

What about wearing noise-cancelling headphones? In a sudden deceleration they also could become a projectile, hurling over the seat in front of you. Not to mention that if you have them on you wouldn’t be able to hear the brace or evacuation instructions endangering you and your fellow passengers. If your seat was reclined, it could some slamming forward, ejecting you or it could block the person behind you from getting out of their seat. And while were on the subject of flight safety, what’s with the instruction to keep our seatbelts buckled whenever we’re sitting down even if the seatbelt light isn’t illuminated?

In October 2008, Qantas flight 72 suffered an autopilot error causing the plane to drop for two seconds. In that very short period of time, almost all of the unrestrained occupants were thrown to the aircraft’s ceiling. At least 110 of the 303 passengers and nine of the 12 crew members were injured; 12 of the occupants were seriously injured and another 39 received hospital medical treatment. Even if I’m wearing my seatbelt, another passenger not wearing their seatbelt could be a threat to my personal safety if they go flying across the cabin.

So there you have it, written for adults. It’s not all about your personal electronic devices interfering with  the airplane’s electronics, rather it is all about trying to guarantee your safety by limiting loose projectiles and ensuring that the flight crew has your full attention in case something goes wrong.

Comments are always more than welcome and I hope that you’ll join the conversation.

What’s on the Horizon

Horizon on Mobile

At VMWorld and at Open Mobile Summit this year, VMware showed off a new product currently code-named Horizon. While some websites are calling Horizon a mobile platform that creates a “phone within a phone,” Horizon is much more than that. Think of whatever computing device you have in your hands as a window to your applications and data. Think of an unwalled version of iCloud. Think of a way to access applications built for a specific operating system from any other operating system.

In 2010, Michael Angelo and I talked about The Consumerization of IT at the RSA security conferences in San Francisco and London in our “Bring your own computer to work” session.

A year later, the trend of employees bringing their own devices into the office is not showing any signs of slowing down and no matter what VMware thinks Horizon is, I think it’s not only a solution to the problem of personal devices in the enterprise, but is a kicker for your business continuity plan.

Horizon is not one product, but is a combination of many disparate technologies developed or acquired by VMware. It includes elements of vSphere, desktop virtualization, a Type 2 hypervisor, and ThinApp (nee Thinstall).

Under the hood of a modern automobile, there are hundreds of parts and a handful of computers that no one person can understand. But press the accelerator and the car sprints down the highway.

Horizon is similar. There are dozens of point products hidden under a single management console. If VMware pulls this off, IT administrators will move from managing devices to managing users. Whether SAP, Oracle, Micosoft Office, custom Mac or PC applications, or a mobile app, Horizon will manage access to all of them in a device-agnostic manner.

No matter what device he or she is using, your employee will have a safe, secure, corporate sandbox that keeps their personal life separated from their business life, including apps and

Across All Devices

data. When an employee is terminated, the corporate sandbox and all of the information in it is deleted from all of their devices, whether Mac, PC, or mobile.

What does your company do to protect corporate assets when an employee with a personal device leaves the company? Do you have a way to wipe the device of only corporate data? What about your corporate address book, emails, and spreadsheets containing next year’s revenue projections? Are you beginning to see the need for Horizon?

I also said that Horizon would make a great business continuity product. Citrix and IBM introduced a virtualized business continuity product a few years back called Virtual Workplace Continuity, but axed it when they had a bad quarter.

If your employees access all of their apps and data in the cloud, it obviously doesn’t matter where they are physically. All they need is power and an Internet connection. That means you can move your employees to another building, fixed recovery center, mobile recovery center, or hotel and keep the business running. As a BC professional, this is one aspect of Horizon that I really want to see emphasized in addition to the security benefits.

So what do you think? Join the conversation by adding your comment below.

The World Lost a Visionary This Week

Steve Jobs was very much like Walt Disney in so many ways. Mercurial visionary and able to recognize the talents that he needed to get the job done. When Walt died he had left years and years of projects in the pipeline. Steve has done he same; he has projects in the pipeline and built an incredible team to take them forward. Like the Disney organization, people may feel lost for a while, but they will soon roll up their sleeves and get back to work.

My favorite Steve Jobs quote is, The people who are crazy enough to think they can change the world are the ones who do.”

Don’t Lose Your Data To Someone Else’s Disaster

In our last blog I said to watch for our guest blogger Randall Becker. As much as I would like to take credit for his writing, this is Randall’s entry. I hope you enjoy it as much as I did.

What is “The Cloud?”

Put simply, a computing cloud is a set of resources that run one or more applications without concern as to where the CPU cycles or data actually come from. Using a cloud rather than individual computers and disks enables “elasticity” of your computing assets.

Rather than allocating the maximum amount of CPU and storage resources that a business process might need at a peak,

Fig 1. Cloud Infrastructure

cloud infrastructure allows you to minimize resource costs by only buying the resources you need, when you need to use them, by sharing your computing assets (figure 1).

In most computing environments, not all applications need the maximum amount of resources at the same time. For example, company email on a major holiday will be at a minimum, while the ATM and credit card applications might be at maximum. CPU cycles can be “stolen” from the email application and given to the ATM and credit card applications. Similarly, end-of-month processing might need a lot of disk space and CPU cycles only while it is running, and otherwise is dormant.

There are private clouds and public clouds. A private cloud is a set of storage and computing resources that you own and manage, while the resources in a public cloud are owned and managed by someone else. Typically, you pay only for the resources that are actually in use over a specified period of time.

This blog is about public clouds and how your data can become lost in the fog—in a large variety of ways.

Service Levels

If you want to use a cloud service, you make a list and go shopping. Maybe you’re looking for computing capacity, a software application, or just storage. In any event, you’ll end up signing an agreement that looks a lot like a software license agreement, and unfortunately is about as useful. That is, it is full of caveats and disclaimers, and us often subject to change with little notice or negotiation.

Fig 2. Availability

“Reliability” service levels are rarely specified, and even if they are, “five nines” is still over five minutes of downtime a year and usually doesn’t include scheduled downtime for maintenance (figure 2).

What Are Some Service Level Risks?

Threats that can affect access to public cloud infrastructure include war, asteroids, earthquakes, tsunami, hurricanes, and children. Let’s take a closer look at each of these risks.

Unlike business, where war has economic impact only, war risk to cloud infrastructure is high. We’ll examine this in detail in the next post and you might be very surprised at what the risks are.

Asteroids are very much out of our control. Their risks can be assessed in terms of probabilities and severity, but not location. Fortunately for us, the big ones are not common and as far as we know, the dinosaurs were not using The Cloud when they were wiped out. While earthquakes, tsunami, and (to a lesser degree) hurricanes cannot be predicted with any accuracy, we are learning rather rapidly about their effects, the risk zones, and how to mitigate risk through the use of geographically dispersed data centers.

As for children, this risk is part of the overall category of “human error.” Somebody changes a setting on a computer and suddenly nobody in North America can access his or her data. If you have access to manage your infrastructure from home, do you lock your PC before leaving it even for a minute? How quickly could a family member take down your data center by accident? What about a cat walking across your keyboard – Do you know where that unexplained online salmon order came from? The Uptime Institute estimates that human error causes roughly 70 percent of the problems that plague data centers today.

Hacking can be included in the human error category as well if the intent was just to steal data and not take down the infrastructure.

Other risks might include:

• Internet backbone outages
• Denial of service attacks
• Cloud company goes out of business
• Service incompatibilities
• Economic conflict between countries

In our next blog, we’ll introduce the imaginary countries of Clientada and Servia and explore how access to your public cloud can be lost, through no fault of your own or from a failure of your cloud provider. This is a study of international intrigue at its finest, so stay tuned.

Cloud Country Map

CEO and founder of Nexbridge Inc., Randall Becker has been providing software solutions since 1983 across industries for organizations needing the next level of reliability where downtime is unacceptable. He has focused on the HP NonStop™ Server and UNIX platforms since that time and his involvement has included major infrastructure projects for financial, retail, and law enforcement sectors. An expert in Indestructible Computing and Software Development Lifecycle (SDLC) methodologies, Randall has been involved in all aspects of NonStop™ solutions development. More information is at http://www.nexbridge.com/

What Does “Data Loss” Mean To You?

The word “loss” only has one meaning with physical items, but can have multiple meanings when talking about digital assets. When you say, “I lost my iPhone,” I know that you don’t have it. Maybe you just misplaced it, or maybe it was stolen (did you leave it in a taxi?). Based on the last time that you saw your iPhone, you probably have a good idea whether or not it was actually stolen from you. If you knew you had it after you arrived home but cannot find it an hour later, the chances are high that it was not stolen (and as long as it’s not set to vibrate and it’s still charged, you can call it to help you find it).

On the other hand, if you left it on the table with your laptop at Starbucks while you picked up your double grande latte with low-fat milk and extra syrup, maybe someone did take it.

But what do you mean (and what do others think you mean) when you say, “I lost the names, postal addresses, and passwords of my customers.” Do you mean that the actual data became corrupted, or that it just isn’t on the disk anywhere? Maybe the data is there but the power went out and it’s lost to you for some period of time? Or did disaster strike, and destroy the equipment (or even the building)?

Perhaps you mean that it was stolen by a hacker or otherwise disclosed? Could it have been purposely deleted, perhaps maliciously, in violation of company policy or government regulations? If it was corrupted, destroyed, or simply disappeared, do you have a backup? How old is the backup and how much data could you be missing if the backup is too old?

In my last blog post, I asked you to write a short paragraph on what data loss means to you, and enter it into the comments. I got one answer that I was not expecting, but it makes a lot of sense. Randall Becker said, “Data loss also occurs when your information is stored somewhere on the [Inter]net (call it The Cloud), and your provider is no longer accessible.”

No matter what “data loss” means to you, planning ahead can help keep you covered. Let’s assume that the data just isn’t on the disk or has been corrupted. Planning ahead, you should have worked with your business units to determine their RTO and RPO. (Recovery Time Objective – how long can they do without the data, Recovery Point Objective – how “fresh” the data is when you get it back).

Separating RPO and RTO

Once armed with the business unit’s requirements, you select from many of the technologies being offered by vendors today. Here are just a few of your choices:

• Snapshots with an RTO of seconds and RPO of zero to seconds
• Synchronous data replication, with an RTO of seconds to minutes and RPO of zero
• Asynchronous data replication, with an RTO of seconds to minutes and RPO of seconds
• Disk-to-disk backup with an RTO and RPO of minutes to hours
• Tape Backup, with an RTO and RPO of hours to days

Is there a reason for both backup and replication? Absolutely. A replicate is not a backup! If a person or application goes rogue and corrupts or deletes your primary data, the corruption or deletion will be replicated as well. They only way to recover is to go to a pre-corruption or pre-deletion backup. If, on the other hand, you mean that your data was stolen, there are several steps that you could have taken, and many of these have been discussed in earlier articles.

Encrypting your data is one way to mitigate data disclosure, but it is not a panacea. Encryption alone cannot protect your data without many other controls such as access control lists (ACLs) and separation of duties. But, as Randall point out, what happens if your data is “lost” because it is stored in the Cloud and your cloud provider, or perhaps your local service provider, either has a temporary failure or goes out of business entirely. What did you do to mitigate this situation? I’ve asked Randall to write a guest blog on the topic of data loss in the Cloud so please watch for it.

Dereliction of Data Protection – By a Law Enforcement Union

If you are not from the San Francisco Bay Area, you may not know that hackers gained access to the website operated by The Bay Area Rapid Transit (BART) Police Officers’ Association, then stole and posted personal information on more than 100 officers. The officers’ home and email addresses were leaked along with passwords.

This is an extremely serious breach. With two officer-involved shootings in the last couple of years, there is a lot of controversy surrounding the organization, and activists and criminals now know where officers and their families live.

This is a breach that did not have to happen. I cannot think of any reason why extremely confidential information was on the web in the first place. What rationale could there be for anyone to be able to login to a public-facing website and look up the names and home addresses of law enforcement officers?

So let’s assume that the home addresses were not on the web server, and just the officers’ passwords were disclosed. For me to login to a website, the web server needs to validate my user name and password. I enter them into my browser, and they are sent from my computer to the server (I hope that the link is encrypted!) and the server validates them.

The server does not need to store my password, but can store a “hash” of it. When I first create my account, a one-way encryption algorithm takes my password, runs it through a mathematical transformation and then stores the result in the user database. Every time I login after that, the password that I enter into my browser is sent to the server where it is hashed and compared to the stored hash. If they match, I am granted access.

A good hash algorithm will prevent “working backwards” to discover the original password if the hash is known. The downside of hashing passwords is that if I forget my password, the system cannot email it to me, which is a breach unto itself! Instead, the site will need to implement a password reset mechanism whereby I will need to prove who I am in order to select a new password.

Do you know how your passwords are protected? You may want to check in with your IT department or the services provider that is hosting your website.

Data disclosure is just one type of data loss. Your homework is to write a short paragraph on what data loss means to you and enter it into the comments below. I will discuss data loss in general in my next article.

Be Alert– Our Country Needs More Lerts!

I don’t tend to write about politics, but a recent incident that falls into the area of protecting our nation’s infrastructure prompts me to do so. This story concerns how reporting something out of the ordinary to the proper authorities can help save lives.

Times being what they are, anyone who comes across something that is just not right should report it to the authorities because you never know if something nefarious is going on. Better to be safe than sorry and all that. Large purchases of fertilizer by someone who doesn’t know anything about farming is one example, or perhaps a Russian asking where you store your “nuclear wessels.”

Not Quite Right

Greg Ebert, an employee of Guns Galore LLC in Killeen, Texas, had a strange feeling about a man who came into the store to purchase six pounds of gunpowder, three boxes of shotgun shells, and a magazine for a semi-automatic pistol. The customer acted strangely and asked odd questions about what he was purchasing.

The incident was so out of the ordinary that Greg, a 17 year veteran of the Kileen police force, called it in. Authorities traced the customer, Pfc. Naser Abdo, to his hotel room and discovered explosives materials, a uniform with Fort Hood patches, ammunition, semi-automatic weapons, and a backpack containing a bomb. You remember Fort Hood, right? Maj. Nidal Malik Hasan was firing on soldiers there until Sgts. Kimberly Munley and Mark Todd Sr., Fort Hood civilian police officers, took him down.

After questioning, Abdo revealed that he planned an attack on Fort Hood. ABC News reported that Abdo planned to target a restaurant popular with Fort Hood soldiers. You can check out the rest of this story online if you so wish. Good thinking on the part of a store worker helped avert a tragedy.

Suspicious? Yeah, We Know

The reason that I am writing about this is because of a much different outcome when alert gun store employees in Arizona reported similarly strange behavior by smugglers apparently paying straw purchasers to buy guns for them. Instead of investigating and arresting the perpetrators, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) fired up an operation called, “Fast & Furious,” and ordered the gun dealers to continue selling to the suspected smugglers while ATF agents were ordered to stand down while the guns were smuggled into Mexico.

The idea was that once the weapons in Mexico were traced back to the straw purchasers, the entire arms smuggling network could be brought down. But what’s really strange about this whole operation is that many of the reports of violence against Mexican citizens contain evidence that machine guns and grenade launchers are being used — neither of which can be bought and owned legally by your average gun store customer. Rather, it’s believed that some of the Cartels’ high powered weapons and related accessories may have been stolen from U.S. military bases or acquired by the cartels through the huge supply of arms left over from the wars in Central America and Asia.

But back to our story. Border Agent Brian Terry was killed on December 14th, 2010 just north of the Mexican border in Arizona after he confronted a group of bandits believed to be preying on illegal immigrants. Two of the weapons found at the murder site were traced to Arizona gun stores that were ordered to continue selling guns to smugglers that were sold as part of the Fast & Furious operation.

Whistle Blower

Just a two weeks after Terry was murdered, a whistle-blowing agent made contact with the media. In January, the Mexican press begins reporting on the scandal. Over the next two months it becomes and remains front page news throughout the country, and US Sen. Charles Grassly offers his protection to the whistle-blowers. In February 2011, FOX news and the Washington Post break the story, and in March US Rep. Darrel Issa, chairman of the House Oversight and Government Reform Committee, started an investigation of the program, held public hearings over the summer of 2011, and called the operation “felony stupid.”

The story so far is that gun store employees in Ariona reported attempted gun buys that didn’t seem right but were told to make the sale so that the guns could be tracked in Mexico, even though it appears that most of cartel’s weapons are military-grade and come from Central America. Two of the guns were found at the Arizona murder scene of a border patrol agent and Congress is looking into the whole program to figure out what is really going on. In fact, CNN reported that of 2,020 guns involved in Fast and Furious, 363 have been recovered in the United States and 227 have been recovered in Mexico. That leaves 1,430 guns unaccounted for. Oops?

Store Owners Must Report Multiple Sales

The icing on the cake is a new ATF rule that will require gun dealers in the Mexican border states of Texas, California, Arizona and New Mexico to report all (not just suspect) sales of more than one semi-automatic rifle to the same person within a five-day period. This new rule ostensibly is because of all of the weapons showing up in Mexico, even though in the Fast & Furious case, dealers were ordered to sell the same kinds of guns now covered under this rule.

What especially upsets US gun owners is that while the ATF was telling gun store owners to continue selling to the smugglers, Obama administration officials, including President Obama and Secretary of State Hillary Clinton, were partly blaming US gun stores for the violence in Mexico. President Obama explicitly said so on a visit to Mexico on April 16, 2009.

Many U.S. gun owners think that the actual purpose of Fast & Furious was a political ploy to link US weapons to Mexican cartels in order to build support for stronger gun control on the US side of the border.

I’d love to hear your thoughts.

Workplace Recovery and the Secure Pocket Drive

True business continuity means keeping your business running. If your people cannot get back to work and be productive, all of the resources that you expended to protect your data centers and keep them running was a waste of money. As I wrote in an earlier post, companies can contract with SunGard, Rentsys, IBM, HP, or a handful of other companies to either use space in a fixed facility, or to have a trailer driven or airlifted to a convenient location. What I didn’t discuss in that earlier post is the preparation by your vendor and your company when your contract is first signed, and then after you have declared a disaster and need to move in to a workspace recovery unit.

Recovery Trailer Exterior

Like Chinese Food

You go into a Chinese restaurant and order from the menu. A few minutes later, your food shows up. Looks easy, right? What you don’t know is that well before the restaurant opened and all throughout the day, there is a substantial amount of prep work going on behind the scenes. Unlike a steak restaurant where you cut your meat and vegetables into bite-sized chunks at the table, hundreds of pounds of meat and vegetables need to be cleaned and chopped or diced in preparation for being tossed into the wok for cooking.

Similarly, there is a substantial amount of prep work that needs to be done before you can move into a workplace recovery center. After you sign your contract, you and your vendor will work together to develop the infrastructure your company needs to get your employees back to work. One of the first steps includes building and configuring the infrastructure to connect to your backup data center (which may be self-hosted or hosted by the same or a different recovery vendor). Unless your network or server configuration changes dramatically, maintenance is fairly easy.

Endpoint Preparation

One of the more involved aspects of workplace recovery is configuring your endpoints. In English, this means setting up the PCs that your workers will actually be using in the recovery center. The prep work involved in setting up your PCs is extensive and ongoing. The “gold master” (GM) configuration that you use for your desktops and laptops is a good starting point, but you might be using Dell PCs while your workforce continuity provider might supply Lenovo or HP computers. This means that in addition to testing your GM on your own computers, you also need to test it on the provider’s computers as well. And you can’t just stop there and burn a GM CD because Microsoft and Adobe are constantly releasing patches to fix bugs and close zero-day exploits. So whenever you patch your internal computers, you need to run the same tests on your provider’s computers and create a new GM.

Recovery Trailer Interior

Well I Declare!

When you declare a disaster, your vendor starts the provisioning process. Whether the workplace recovery center is fixed or mobile, this means setting up the required network connections within the vendor’s network so that the recovery center can connect with your data center. If you’ve signed up for mobile recovery services, one or more mobile recovery centers will be dispatched to your specified location. When they arrive, the trailers, generators, and satellite dishes will be deployed. After the mobile center is up and running, the IT experts begin the long process of setting up all of the endpoints.

Whether mobile or fixed, this process is the same. Each PC needs its internal hard drive erased to ensure that you company cannot gain access to any of the information that might have been on them from a previous deployment. If you want the drives erased to US department of defense standards, the number of wipes  may increase to 10, 20 or even 30. If the drives are large, this can take days. After the drives are erased and formatted, one or more gold master CDs are used to lay down the operating system configuration required to fit your environment. If the GM is old, the computers may need to be booted then patched to the latest software, which can take more hours to days depending on how many computers need to be provisioned, and how out of date the GM CD is.

Secure Pocket Drive For Organizations

Secure Pocket Drive from SPYRUS is a bootable “PC-on-a-stick” device. Windows Embedded Standard is bound to a bootable encrypting USB flash drive. Simply plug it into any computer and boot into a Windows XP or Windows 7 compatible version of Windows Embedded Standard. While Secure Pocket Drive is read only to the end users, system administrators can add it to a Windows domain, and push patches and settings to it through the use of Microsoft System Center Configuration Manager (SCCM).

Secure Pocket Drive from SPYRUS

Rather than having to image every computer in the recovery center, the IT staff plugs a Secure Pocket Drive into each computer and boots from it. Secure Pocket Drive can be stored at the company and brought to the revovery center when a disaster is declared or the vendor can keep them for you.

If the organization keeps them, either end users or the IT staff can boot and use them on a periodic basis. Since Secure Pocket Drive is perfect for road warriors and teleworkers, why not assign them to individuals and let them know that they will be responsible for returning them to the IT department or bringing them to the recovery center when a disaster is declared.

Secure Pocket Drive For BC Vendors

If you are a BC vendor, think about how quickly you can bring up a customer’s environment with Secure Pocket Drive. In fact, you could have one company in the center on Monday and another on Tuesday without needing to erase and reimage hard drives. No more worries about cross-contamination between customers if you forget to completely wipe a hard drive. Just keep a stock of Secure Pocket Drives for each client and don’t even put hard drives into the recovery center computers. When a disaster is declared, pull out the client’s stock of Secure Pocket Drives, pop one into each computer, and boot. What could be faster and easier than that?

HP and Oracle – Gloves Off, Teeth Bared

Over two years ago, I blogged on how the Oracle/Sun merger would change the computing landscape. While others were saying that Oracle only wanted Java, mySQL, and Sun’s customer list, I said, “Oracle will be working on very tight integration between the two companies and will begin to sell a juiced up Oracle Database Engine against Oracle running on any other platform.”

Not only did that come to pass, but Oracle is doing everything that it can to kill Oracle on HP Integrity servers, forcing enterprise customers to abandon HP and give all of their database infrastructure dollars to Larry & Co. Recently, HP accused Oracle of sabotaging its enterprise business by saying that HP’s Itanium servers has no future. It accuses Oracle of doubling the price of its software for Itanium servers, refusing to fix bugs, and generally making the life of 140,000 HP Oracle users miserable and uncertain. Well, color me surprised (not).

Going back to that original blog post, I said that HP had an incredible response to the Sun acquisition, namely the massively parallel HP Integrity NonStop Server running SQL/MX. But rather than investing in the NonStop server to take on and beat Oracle on Sun, HP continued winding it down, thus setting themselves up for the showdown now taking place.

My last sentence in that original post was. “I seriously would be considering how to use the HP NonStop server to protect HP from the Oracle-Sun onslaught against Oracle on HP-UX. And don’t think that it won’t be coming, because Larry doesn’t like to lose.”

I hate to say that I told you so, but NonStop was HP’s only answer. I hope it’s not too late to turn the ship around.