Category Archives: Security

Cloud Economics and the Telegraph

Computer world has an interesting review of a British company’s outsource strategy for IT. It has the provocative title of How the Cloud Changed World’s Oldest Newspaper.

It shifts IT from keeping the lights on to delivering customer-facing value. Wright presented a chart showing the changing makeup of IT headcount and how cloud computing supports delivering business value. Over a four year period (2008-2011), IT headcount shifts from 90% “Run the business skills”/10% “Change the business skills” to 20% “Run the business skills”/80% “Change the business skills.”

This sounds good but it’s hard to tell from the review whether there was a proper accounting of cost. Moving the IT headcount to just 20% run the business means the skills are not removed, they are elsewhere (outsourced). Thus it would more accurate to include the outsourced staff in a total cost of IT estimate, rather than say it’s a straight drop from 90% to 20%.

More to the point, the review is weak on security data and analysis.

[H]e feels that security has improved, in that the cloud providers implement a far higher set of security practices than the Telegraph had in place or could afford to implement.

He “feels” security?

I am not so quick to believe that high security practices are less expensive at a cloud or service provider than in-house. Perhaps it is true for the Telegraph but then where are the 90% to 20% numbers like those given for staff load? Suddenly data is missing when it comes to measuring security.

That is because validation alone becomes significantly more expensive when it has to be done in a cloud. An argument can certainly be made that a giant company will have the resources to spend on doing things the right way, as opposed to a small company focused on another business. The problem with this argument is that companies like BP, Ford, Enron, Worldcom…show that you can not simply assume that things will be done right. Show us the numbers.

Photo by Harriet Ottenheimer

Spies in the Cloud

The big spy news in America must have put a spell on some people. At least that is how I would like to account for the comment on The Register story

Maybe these findings were written by an American, for Americans have little to fear. It’s the rest us the world that stands to lose.

The comment centers around the idea that a UK company that hosts in the cloud may have their data end up in the US and that will expose it to the risk of spying.

World+kitten knows damn well that the EU->US bank account data suck has sod all to do with terrorism, and rather more to do with keeping an eye on the competition. It is also public knowledge that various British agencies were involved in snooping on Airbus, with the info gleaned being passed right on to Boeing. The American government is using tactics from spying to bullying to downright theft to prop up its ailing businesses.

Boeing is American. The British spied on Airbus for an American company? I don’t follow the logic but then again this is just a short comment on a story called “The cloud’s impact on security?”. I also don’t follow why the title of the story has a question mark. It could have been “The cloud’s impact on security.”

Anyway, while there is likely to be an international component to the risk of cloud it really is not at all different for companies like Airbus or Boeing. They already have data moving between nations and handled by third-parties and are well aware of the dangers of competition and spies. Take for example that Airbus has a page called “A truly global network” where they boast about their global reach for production and support facilities.

I Love You Phillip Morris

A movie that tells the true story about an American con man has not yet been released in America. No, not Abignale. This is a different spin artist.

Like Abignale this man starts out losing his parents. Instead of running away, however, he is adopted. The search for his real parents leads him to master the use of law enforcement databases. Things go downhill quickly as his life becomes a game of breaking identity and trust systems.

At one point after being arrested he managed to assume the role of his own judge and orders his own bond reduced. Another time in jail he signed up for art classes and then slowly acquired green ink to dye his clothes to look like medical staff, at which point he simply walks away without detection.

The plot is definitely good security material

I Love You Phillip Morris is a 2009 comedy-drama film based on the real life events of con artist, impostor, and multiple prison escapee Steven Jay Russell played by Jim Carrey. While incarcerated, Russell falls in love with his cell mate, Phillip Morris (Ewan McGregor). After Morris is released from prison, Russell escapes from prison four times in order to be reunited with Morris. The film was adapted from I Love You Phillip Morris: A True Story of Life, Love, and Prison Breaks by Steve McVicker.

Wikipedia says a release in America may happen this October. It has a great cast and good reviews from Europe and Taiwain. Watch it if you can.

Signal Bars are Meaningless

The iPhone 4 signal issue is thoroughly dissected by fscked.co.uk

The tl;dr version of this is: the signal strength bars are almost meaningless and should not be relied on.

Incidentally, this also explains what’s going on when you have a strong signal, attempt to make a call, and can’t connect. The bars only indicate how well your phone can listen to the cell tower. They don’t tell you anything about how well the tower can receive your phone, but that’s a pretty important part of making a call. Similarly, the phone doesn’t know anything about what’s going on in the cell provider’s network past the tower; if you’re on a really busy cell it might not have any spare outgoing circuits to direct your call to, so even if the radio is working fine, you might still not be able to get through. If you’re on AT&T it’s probably all of the above at the same time of course.

In conclusion, version 4 of the iPhone continues to have serious data integrity and availability issues.

Taking my Objective Scientist Dude hat off now, I’d say that iPhone 4 is a fantastic device but a lousy phone.

Updated to add: I had no idea Apple would made this announcement today:

Upon investigation, we were stunned to find that the formula we use to calculate how many bars of signal strength to display is totally wrong.

[…]

Apple is promising a patch fix “within a few weeks”. Users may also choose to get a full refund within 30 days of purchase, the firm has said.