• 23Jan
    Author: ned Categories: Green IT, Infrastructure Comments: 3

    As part of Applied Trust’s commitment to conservation in IT, we’re now running our machine room at a significantly higher temperature.  Like many folks, we used to cool our data center to a chilly 60 degrees Farenheight (the purple line is ambient temperature): 

    One key strategy for reducing cooling load (and thus saving money and the environment) is to crank up the temperature of your machine room - cooling alone uses a third of all the power consumed by the data center!  Back in the days of giant monolithic servers, it really was important to keep the temperature below 70 – with today’s modern hardware, that thinking is history like the Ice Age. Here’s what our server room temperatures look like now: 

    Read more »

  • 22Jan
    Author: ben Categories: IT Management, Security Comments: 0

    I have a love/hate relationship with standards and regulations. On the one hand, they pay my bills, and I like having my bills paid. Without them, infosec would be mostly ignored, especially in large enterprises, and that’s not good for anyone. Our personal data would constantly be at risk without oversight or hope for improvement.

    On the flip side, despite the existence nine meaty, enforceable regulations that I plan to blog about in this series, we still have large scale compromises on a regular basis. Compliance costs billions of dollars to organizations of all shapes and sizes, and to what end? A single large-scale breach that affects tens or hundreds of millions of individuals, such as the recent Heartland breach, can undo most of that effort. Furthermore, many of the regulations are impractical, vague, or not enforced.

    In the end, however, I agree with Bruce Schneier who says that “more important than the specific list of countermeasures is a process of continual security improvement.” I’ll support any effort that protects my privacy and yours.

    So, without further adieu, I present a list of ten regulations that those of us in information security have come to know and love.

    Read more »

  • 15Jan
    Author: ben Categories: Security Comments: 0

    I love elegant solutions to complex real world problems. Secure communication over IM is really easy to get wrong, but Off-the-Record has gotten it right. OTR provides encryption, authentication, deniability (you can’t prove it was me!), and perfect forward secrecy wrapped up in an elegant protocol using standard, strong cryptographic algorithms (AES, Diffie-Hellman, SHA-1).

    Practically speaking, I’m a fan because it’s so simple to implement. Adium, my favorite Mac IM client, bundles OTR functionality so it “just works.” There are Trillian and Pidgin plugins for those wielding Windows or Linux so it’s a simple process to start communicating securely with just about anyone.

    Now there’s no excuse – grab OTR and stop putting those IM’d passwords at risk!

    [Slashdot] [Digg] [Reddit] [del.icio.us] [Technorati] [StumbleUpon]
  • 08Jan
    Author: admin Categories: IT Management, Infrastructure, Ramblings Comments: 0

    I used to play a lot of poker.  I mean a lot.   And one day something just ’switched’ in my brain and I began to start constantly profiling people.  Now it’s second nature.  Sometimes it’s more of a curse than a gift but it’s interesting to see how poker playing styles can be translated to describe peoples’ personalities in IT.  I think a lot of people fall mostly into one of these categories (the category headings are actively used by poker players to characterize their opponents) but many people can be considered a combination of two or more.  For example, someone could be characterized as tight-aggressive with loose-passive tendencies.  In poker there’s only a couple dominant styles of play but in the IT world I’ve seen all sorts of personalities work.

    I didn’t write any of these with anyone in particular in mind but think that most IT workers can be categorized as one of the following:

    NIT: Someone who is overly risk adverse (read: this is NOT necessarily portrayed as a bad thing). The Nit is unwilling to do things that make him/her uncomfortable or have the slightest amount of danger or uncertainty associated with them. Nits will be frugal on purchases, eat plain cream cheese, fold all of their clothes perfectly, never gamble, order their steak well-done, and choose the safest 401(k) plan.  The NIT is content with the way things are and is OK with TAGs and LAGs fighting to take the majority the glory.  The NIT fairs well against all playing types but it is much harder for the NIT to be recognized as a leader.

    Weak-tight (WKT): The weak-tight individual worries about everything. Sometimes this individual is so worried about doing something wrong that it hampers their ability to make any progress. Even worse than a LP, the weak-tight individual will not express their opinion unless they are 100% certain it is the correct, because they are too worried about how others will perceive it. The weak-tight style is unfavorable and often gets dominated by TAG and LAG styles.

    Loose-passive (LP): When asked, the loose-passive individual is not afraid to voice his opinion and is active in giving suggestions but as soon as opposing aggression is shown towards his ideas he will usually back off and just go with the flow. Even if the LP individual is confident in an idea, he will not assert himself as it is not worth the possibility of upsetting others. The LP is usually a good team player and almost everyone likes him, unfortunately he can often be pushed around by LAGs and TAGs. The loose-passive player occasionally fairs well against the LAG who often makes a fool of himself in front of others.

    Tight-aggressive (TAG): An attitude or demeanor that is arguably optimum and one you should shoot for. The TAG chooses his battles wisely and knows when to apply selective aggression. He is well versed in knowledge in many different areas but does not find it necessary to flaunt it. Often times you may wonder about a TAG’s value until a crisis occurs and the TAG saves the day. The TAG’s worse enemy is the LAG who often steals the spot light from under him. While a TAG may want to research something before suggesting it, a LAG will be the first to shotgun ideas, this is frustrating to a TAG who wants to play it safe.

    Loose-aggressive (LAG): An attitude or demeanor that is intended to portray one’s self as vocal, confident and assertive. Many argue this style is borderline reckless, unnecessarily risky and has been known to put LAG’s into hard spots at times. The LAG is always willing to gamble and often finds himself in situations over his head. The LAG’s worse enemy is a TAG who knows that it is inevitable that the LAG will mess up one day, and whenever this day may come, the TAG will be the first one to point out his oversights.

    In my opinion, life is one big poker game, and conflicting styles and attitudes are what keep it interesting.  What category do you fall into?

    [Slashdot] [Digg] [Reddit] [del.icio.us] [Technorati] [StumbleUpon]
  • 06Jan
    Author: ben Categories: Infrastructure Comments: 2

    I often work in hybrid environments with lots of Linux/UNIX servers to do heavy lifting and a large Windows domain for workstations, directory services, and Exchange. Interoperability between the environments is important, and there is the occasional need for a web application or script that can change a user’s AD password. Here’s a breakdown of a rough script that does just that.

    The script takes the following approach:

    • Accept inputs from the command line (this is a rough script – no fancy usage flags or getopt argument parsing).
    • Bind to the directory.
    • Search for the user, confirm only one account matching the constraints exists, and pull the DN attribute.
    • Create a double quoted unicode version of the passwords (Active Directory requires this for the account’s current and new passwords).
    • Delete, then Add the unicodePwd attribute from the account. This is must be done in a single LDAP modify operation.

    In the form of the script below, a user can change their own AD password, but a privileged account (such as a domain admin) cannot. Users change their own password with a delete, followed by an add. Admins change passwords with an LDAP replace. Uncomment the appropriate line in the script to adjust the functionality. Read on for the full script.

    Read more »

  • 04Jan
    Author: ned Categories: Green IT, Infrastructure Comments: 0

    While most people are making New Year resolutions like “exercise more” or “eat healthier food,” us IT wonks are busy making our own!  Here are ten New Year resolutions that every IT department should consider:

    Read more »

    Tags:
  • 04Jan
    Author: ned Categories: IT Management, Infrastructure Comments: 0

    As part of releasing the DNS issue of The Barking Seal, we’re excited to launch our free DNS Alerts service! Simply enter your domain and email, and we’ll automatically check your domain for configuration problems a few times a day. Optionally, we’ll also notify you when your NS or A records change.

    Please sign up to give it a try – we’d love to get your feedback in the comments below…

    Note that we’ll send you an “unsubscribe” link with every alert, and we promise to never use your email for anything other than DNS Alerts and service-related updates.

    [Slashdot] [Digg] [Reddit] [del.icio.us] [Technorati] [StumbleUpon]
  • 03Jan
    Author: trent Categories: Infrastructure, Ramblings Comments: 5

    It’s that time again — the blogosphere is chock full of predictions for 2009 on a variety of topics, including the IT Infrastructure space.  What’s on a bunch of these lists (like Security to the Core, and TaoSecurity)?  IPv6!  Quick, run and hide in the cellar!  IPv6 is right around the corner!!!

    IPv6 in 2009?  Of all the things that might happen in the coming year, I’m fairly certain that’s not one of them.  This isn’t my first rodeo; I’ve been talking to folks publicly about IPv6 deployment scenarios at least since 1997.

    It’s true that folks are carefully tracking IPv4 allocation exhaustion.   However, when that counter runs down to zero, it’s very unlikely that suddenly IT folks in the US are going to dedicate their lives to moving to IPv6 post haste (or really, at any significant rate whatsoever).  As of October 2008, less than 0.3% of world-wide Internet clients are using IPv6.  With this abysmal adoption rate, there are lots of options at the IPv4 allocation exhaustion point that are going to be much more attractive and cost effective compared with turning the whole community on its head and moving to IPv6.  Especially in a “down economy”, organizations are not going to have the discretionary capital to purchase the necessary infrastructure equipment to make this painful  transition, not to mention the folks to learn about/implement/operate said gear.  (Additionally, for the moment, I’m ignoring the many technical and security hurdles that would also come with such a change).

    So, what happens when the clock runs out?

    Read more »

    Tags: , , ,