Winn Writes & Wrants

The whole political maelstrom in Washington is entirely too binary for my taste.
Should we have a cyber czar or not?

First of all, this is an old age discussion. Many of us lobbied for national cyber leadership nearly two decades ago, but Congress and the White House said, “it’ll never be an issue.”

Wrong on count one.

Two. This binary thing, from Ms. Hathaway to Obama’s House to the NSA or DHS… this is the modern equivalent of eminent domain, the 19th century national political dynamo that resulted in Native American genocide. This is a political land grab for control… and that is not what we need now.

What we need is Leadership. We need the kind of leadership… not control… that will find realistic, real-politik, global sensibilities and balance them  against our national (Western?) interests. Not to mention, some 3 million geeks (good hackers, please…) will need to be mollified and included in the process.

I sat with some Fed-types at InfowarCon a couple weeks ago and told them they had to get over the fact that the very people they need to work on national cyber security are the least likely they are to hire… under current policies.

For example: What government security clearance goon is going to approve a metal-detecting, pot-smoking, un-educated (formal) smelly character with Asperger’s Syndrome to develop technology to bring the Dubai Tower elevators to a grinding halt… and be assured he won’t attack the Sears Tower in response to a billing error?

Those are the folks we need, and only a major re-think of what we mean by leadership is going to allow us to approach national security in the asymmetrical way we must… if we ever expect to successfully defend our cyber-borders.

Recent studies show that the SMB (Small Medium Business) sector is getting nailed by botnets and hostile code with greater severity than Big Business. They don’t have the budgets, IT staff or security experts on staff and so, well, they get nailed.

In fact, a friend of mine runs a fairly large construction company in British Columbia, Canada. He is the epitome of the SMB market. He called me with ‘Troubles’.

His network was at a standstill. His e-mail was down… and he was freaking out. His IT guy, a friend of mine who is not a security person, wanted me involved.

The answer was comparatively simple, inexpensive and workable.
1.    Keep your internal data and applications server(s).
2.    Keep your existing end-point applications.
3.    Use the usual mess of A/V, spyware detectors and so on at the proper places in the internal network.
4.    Get rid of your own mail server. Outsource it for like – what - $10 month? Let them be responsible. If you want your QoS to be higher, pay $100 month. Just admin the user accounts and use a decent client at the end points.
5.    Get rid of your Sharepoint server, your internal collaberation servers ad nauseum. Write down a set of specifications and features you want. Search for the SaaS Cloud Based product that meets the majority of your needs. (Nothing is perfect.) Outsource it – SaaS – and let them have the headaches.

Dave took my advice. He saved $15,000 on new hardware. He saved dozens of hours of techy time. He lowered his admin time that our friend was handling (to his relief, too). He set up a Cloud based collaborative environment for his back office intranet for $149 month.

He’s happy. And much more secure than ever before.

Boy the media likes being wrong. It’s H1N1 not swine, pork, pig or ham flu. The FUD frenzy caused Egyptians to kill off enough pork to infect all of Afghanistan’s poppy fields for a year. But never mind…

They think the swine… oops… H1N1 might come back in a few months or next season with a potential vengeance, mutated, resistant and the FUD also says that more than a billion people could be caught up in the pandemic.

If this was a computer virus/worm like the Conficker or other hostile code that we know about in advance, we’d start reverse engineering the code and tell folks to behave themselves more than ever.

But H1N1 presents another security issue. Let’s hypothesize that this is all real and that masses of people are going to get sick-sicker-sickest.

How do you, the corporate exec, security guy, or whatever plan for 15-30% of your staff being out with the flu? Some companies use temporal dispersion to avoid having all execs and mission critical folks sitting in one physical location every day.

But will the same rules apply with a pandemic?

I don’t begin to have an answer other than this: every company that has global presence with volumes of on-line people integral to their business continuity had better get a game plan started.

I’ve always called it Graceful Degradation. Technically this means, “how can I conduct business with certain key portions of my infrastructure broken.”

When it comes to H1N1, Graceful Degradation needs to apply to the human Domain of the Integrated Security Triad.

Think about. Or better yet… assign it to HR and make them come up with a plan!