IT Best Practices and Compliance Reporting Information

What Will Be Trends In 2007?

A new year is almost upon us. What does the future hold for IT and the organizations they serve? A recent article on echannelline.com highlighted eight potentially significant IT issues or trends, according to Jeff Wacker, corporate futurist at EDS. I've shared some of my thoughts in italics. Feel free to post your comments as well.

(1) Short battery life on mobile computing devices is a major impediment to people working in 12 hour shift jobs.

Important emergency services, like police departments and hospitals rely on mobile computing at a growing rate. It is an understatement to think of the negative repercussions that could be caused by an untimely dead battery for the professionals in either of these occupations.

(2) IT applications will increasingly be about 'context as well as content,' he stated. An early adopter is Google with its ability to track people's searches and base its advertising on the choices that are made.

The world wide web is a big place. No one has time to spend digging into sites to find the information they need or the product they want. We must use the technology at our disposal to guide customers to exactly what they want. Of course, all of that information has to be secured, as it will contain privileged, personal information.

(3) 'Monolithic' applications like ERP that prescribe one way to accomplish things are going to be replaced by more SOA based 'granular' apps. The later will allow users to use a portion of a solution that fits their needs.

Integration among vendor offerings will continue to grow, so users can leverage the strengths of multiple products to deliver their organization the greatest value.

(4) "Companies will have to take action on the sophistication and depth of the security violations that will be coming out in 2007," stated Wacker. The current focus on perimeter security is not sufficient to ward off external intruders invading a system and manipulating existing internal applications.

Gaining control over infrastructure security is paramount. More and more reports confirm the large majority of security breaches are internal and are tied to misconfigured systems. Automated reporting through dashboards and security-specific reporting is key.

(5) More and more small and mid-sized companies will rely on third parties to manage elements of their IT infrastructure requirements.

Outsourcing is great, but requires vigilance. Compliance laws will hold both parties accountable for the security of systems and information.

(6) Simulation technologies that were originally developed in engineering will be used as a backup for decision-making. Human beings face a psychological limitation in terms of how much data they can fully assimilate, stated Wacker.

"The complexity of business these days exceeds the ability of human beings to make the kind of decisions that they need to make on a routine basis. We are starting to use IT, not to process data, but to process information into decisions."

Automation will soon be used to assess changes in the IT infrastructure before it is ever rolled out to production. Even change approval committees are fallible. Only automation can analyze the thousands upon thousands of interrelated configurations in today's compliex infrastructures.

(7) Legacy applications are too expensive to maintain. "You cannot maintain those systems in a high growth environment," stated Wacker. He estimated that 85 per cent of corporate IT's budget involves maintenance. "What are we seeing is movement to a high degree of application modernization and applications rationalization. That is being able to understand and harvest the business rules, of what is actually happening in those old legacy things. But put them in a way that is highly changeable, highly flexible and highly efficient. That is not what we have right now."

(8) Mass marketers like Wal-Mart are suffering because they cannot offer what people individually want, stated Wacker. More successful are companies like Amazon, Google and E Bay that provide personalized services, he continued. The futurist offers the example of Amazon which automatically knows his book preferences when he goes online.

"We are starting to see personalized information systems in places like financial, travel and hospitality."

As I mentioned above, the more personalized the communication customers demand, the greater the importance of controlling the systems containing the data. It will be the marketplace, not government regulations, that demands the continued investment in automated controls over systems and data.

Those are the thoughts of one industry futurist and some of my responses. What are yours? What other trends do you see coming on the horizon?

Ten Things IT Doesn't Want You To Get This Holiday

A lot of gifts are being opened today, as part of a holiday celebration. Many of those gifts will be tied to technology and may even make their way into the office. But, some of these gifts are better left at home. Eweek has posted a list of ten. Check it out!

Regardless of whether you celebrate Christmas, Hannukah, Kwanzaa or simply celebrate time with family and friends, I want to thank you for making time to visit this blog and look forward to sharing more insights on IT Best Practices and Compliance Reporting in the year to come.

Change Management Presentation

In early November, I had the privilege to speak before a group of IT Professionals at the IT Infrastructure Management Association 2006 Conference in Las Vegas, Nevada.

Using some pretty cool editing software, I am pleased to offer you the opportunity to view an on-demand web version of that presentation, entitled Automating Change Management for Security, Compliance, Stablity and Sanity !

After you've had the chance to view the presentation, please feel free to post any questions or comments you might have.

Googling for Greater Security

The latest issue of CSO magazine just crossed my desk. This edition is full of lists - security and non-security-related. Did you know that Italian workers average 43 vacation days a year? That's more than three times the average vacation time in the US. Can you say arrivederci? Seriously, there are some really interesting lists the editors have included. Lists for your first hundred days on the job as CSO, takeaways from earning an MBA, and four things to steal from Six Sigma.

The one that caught my eye the most was submitted by Nish Bhalia, founder of Security Compass.

Bhalia offers four search strings you can use to help identify potential security gaps you can discover using Google. Just substitute your URL for yourcompany.com in each of the strings below.

1. inurl:yourcompany.com -www
What you're looking for: registered domains
This search lets you look for any domains other than your main website which may be publicly available. Perhaps you have a staging server that is searchable that you hadn't intended. This server may not have the protection around it that the main web server has in place.

2. "http://*.*@www.yourcompany.com"
What you're looking for: passwords
The protocol for a user name and password is "username:password'. Using the string "*.*" allows you to look for any data that fits this format that has been posted either inadvertently on your own website or maliciously elsewhere on the Web. Be warned, this search does reveal a number of false positives.

3. intitle:"Apache Tomcat" "error report" site:yourcompany.com
What you're looking for: technologies used
Your company may be inadvertently exposing your company's technologies for hackers to exploit. For example, a misconfigured Apache Web server commonly produces a page with "Apache Tomcat" in the title and "error report" in the text. Once a hacker knows your company is running an Apache Web server, they can run targeted searches. For instance, Apache also produces error messages that begin with "access denied for user" and "using password" which may reveal user names and passwords. Perform similar searches for any Web server or application server in your environment using phrases from some of the common error messages they generate.

4. intitle:Remote.Desktop.Web.Connection site:yourcompany.com
What you're looking for: log-in portals
Remote Desktop is one type of software used by IT admins to gain remote access to computers. Hackers can use these portals to gain back door access to try user names and passwords. If you're using other remote technologies, alter the search string accordingly.

I didn't discover any unexpected problems when i used these search strings on our domain. I was excited to discover how useful (and fast) Google was for providing this type of security information. Try it on your domain and let me know if you discover any surprises.

Do you have any tips on how to improve the security of your enterprise using a commonly-used resource like Google? I'd love to share your idea here.

What do YOU think a CMDB is?

Configuration Management Databases or CMDBs are a hot topic of conversation in IT today. Whether you're looking to implement best practice standards like those found in ITIL, or need to find an enterprise solution for meeting compliance obligations, establishing a CMDB is becoming as much of a "must" for how data is managed as grabbing a PS3 is this holiday season for some families. And, just as disappointed as some kids will be to not see one December 25th, there's a similar expectation that a CMDB will magically appear under the corporate tree this year.

This past week, Dennis Drogseth, Vice President of Enterprise Management Associates, shared some timely reminders of what a CMDB is, not what we'd like it to be.

CMDB's are:

• Still in their infancy. Don't try to define them prematurely.
• A foundation and enabler that will continue to grow in importance
• A system that brings politics, culture, organization, technology and products together
• Not something you can buy, although you can purchase software that may be strategically useful in creating a CMDB system.
• Systems that demand a phased approach which requires executive buy-in.

If you are looking to successfully establish a CMDB system, it's important to reject the typical "microwave" solution we seem to favor - especially in America. By its nature, a successful CMDB will take cooperation among diverse groups within your organization. To successfully capture the appropriate information, you will need to plan carefully and involve multiple vendors. Make up your mind now that establishing a CMDB system is a process, not an one-time event.

So, where do you begin this CMDB journey? Drogseth spells it out clearly when he says, "I believe the single most defining thing in creating a CMDB system is identifying trusted sources of information, or sources of record...it's the one [step] aboe all that brings you immediate, intrinsic value."

Establish your objectives for the CMDB, then determine your trusted sources of the information that will meet your objectives. You can't pull up to a drive-thru and order a super-sized CMDB with a side order of compliance or expect to see a guy in a big red suit drop by with your gift-wrapped CMDB.While it's not glamorous or quick, a carefully followed plan will ultimately yield the benefits you're looking for when considering establishing a CMDB system.

Assess Before Making Major Investments

In my conversations with corporate business and IT executives, it is clear that organizations that have bought some software solution with the hope that somehow the software would be a panacea for their problems have been less than satisfied. More and more, I am seeing organizations today realizing the value of a formal cross-departmental assessment of the organization's needs and the development of a formal plan before making an investment in a "product." The findings highlighted in an article in CFO.com reinforce the value of including an assessment as part of any software or hardware investment.

"It is as much the implementation of technology — the delivery of the right solution tailored to a business problem and aligned with business strategy — as the core technology itself that delivers real value to companies."

The key points the article draws out, based on a survey by CFO Research Services, include:

• IT is vital, but poor implementation kills value
• Risk & performance vary through the IT Delivery Process
• Delegating work while retaining risk
• IT needs help with business-risk analysis & governance
• Risk analysis is too narrowly focused

A formal assessment can address all of these points. The starting point is communication. Getting key leaders from your entire organization in the same room is invaluable to ensure success for any implementation. It's easy to get tunnel vision to only what your department needs. Hearing the concerns of others can not only help you get what you need, but make sure it'll work for what other departments are trying to solve. Not only will you avoid investing in something that might be in conflict with what another department needs to do, you might even get the funds for a broader implementation with the additional buy-in.

Finally, by working together to establish a plan for implementation, expectations are clearly understood by everyone involved - including vendors and consultants. Risks have been identified and addressed prior to beginning a project, rather than being discovered midway through implementation.

If you are considering a major IT investment for 2007, make sure you include a formal planning assessment before you make your final decision. It could be the difference between a strategic technological improvement for your organization and an expensive software purchase destined for shelfware.

Is The Focus On Compliance Actually Hurting Data Security?

Compliance has had a stranglehold on the minds of corporate and IT executives over the last several years. But, is all the money spent on compliance actually making information more secure? An AMR Research report stating that "compliance spending in 2006 will reach $27.3 billion and spending will climb even higher in 2007, with companies devoting $28 billion to compliance initiatives," But, according to senior analyst Kark Khalid with Forrester Research, security spending is actually decreasing as firms redirect monies from security to meet compliance obligations.

According to Khark, "to be both compliant and secure, organizations need to shift their thinking from responding to tactical IT security issues like firewalls, intrusion detection systems, viruses and worms, system hardening, and encryption to addressing information risk and more strategic business concerns, such as protecting intellectual property, ensuring regulatory compliance, preventing insider abuse, and safeguarding customer privacy."

A recent story on Informationweek.com indicates a change in how security dollars are spent will have a positive effect on both security and compliance. "Organizations are better served spending their security dollars on hardware and software such as configuration and change management applications, antivirus, user-access control systems, and reporting tools, which facilitate more frequent audits, rather than spending the money to hire more contractors and outside services. Organizations with the fewest compliance problems are spending 9% more to automate audit functions and 11% less on contractors and outside services", according to the author.

This is a good wake-up call reminding us that the real purpose behind compliance is security, not just satisfying the auditor. We'll see if the lawmakers get this message if they reconsider Sarbanes-Oxley in the next session!

Ready Or Not...Another New Rule for Electronic Documents

They're coming fast and furious. The latest federal compliance rule went into effect last Friday, December 1st.

The new rules are related to electronic discovery of documents in civil cases. The rules specify requirements for submitting electronic documents - likely to include e-mail and possibly even instant messaging logs, depending on future case law - as evidence in civil litigation.

According to an article in Computer World, the rules require companies involved in civil litigation to meet within 30 days to decide how to handle electronic data - including what must be shared and in what media format.

Failure to preserve electronic information could prove incredibly costly. In May 2005, Morgan Stanley was fined $1.5 billion when a judge ruled they'd failed to preserve electronic information adequately. Yes, that really was billion, not million!

This new rule just adds to the growing nightmare for IT departments. Now, you're being asked to store everyone's communications for an undetermined amount of time or face huge fines, while knowing full well that these communications are going to be loaded with personal information that you're required to protect by some other regulatory compliance.

In our litigious-happy society, you're going to want to pay attention to this one.