Category Archives: Security

History, Security

Today in History: The Battle of Antietam

1 Comment

Early in the morning on this day in 1862 soldiers of the Union stopped the Confederate offensive march north at the creek of Antietam in the fields of Maryland.

Soon we began to hear a most ominous sound which we had never before heard, except in the far distance at South Mountain, namely, the rattle of musketry. It had none of the deafening bluster of the cannonading so terrifying to new troops, but to those who had once experienced its effects, it was infinitely more to be dreaded. These volleys of musketry we were approaching sounded in the distance like the rapid pouring of shot upon a tinpan, or the tearing of heavy canvas, with slight pauses interspersed with single shots, or desultory shooting.

Nearly 100,000 men were ready to fight throughout the day. As the sun set only 77,000 were standing and 4,000 lay dead — the most casualties in one day in American history.

The majority of the Union effort was amassed at the center of the battlefield while smaller groups attacked first on the left, then center, and then the right. Their plan was to push in from a flank and only then drive forward with a numerical advantage. The initial attacks were mostly unsuccessful in making ground, however, and so the Union’s largest division never was fully engaged. The Union General was conservative and slow to react, despite having acquired a paper copy of the Confederate battle plans.

The Confederates then abandoned their offensive and retreated at night. This is believed to have been enough of an end to their march north that President Lincoln was able to issue the Emancipation Proclamation a few days later. Two months later, the Union General in charge at the Battle of Antietam was removed for failing to pursue the Confederates and win more decisively.

Update: Some interesting details in this video on how the battle set the stage for the President to renounce slavery

Energy, History, Sailing, Security

Do we know how to make software?

Leave a comment

Jeremiah asked and I did my best to answer without getting wrapped around the axle because he bragged to me about buying a big American car during the fuel price rise.

Here is my response:

Well, maybe you knew I couldn’t resist commenting on your automobile engine analogy. I’m still laughing from the time last year you told me ‘when gas prices went up, prices on Suburbans went way down, so I bought one to drive my five miles to work’. Clearly we still don’t see eye-to-eye on managing risk.

You say “the United States ruled the automotive industry; an industry we created from a machine we invented”. For brevity sake I’ll concede the industry was largely built by the US (not created) but I can’t let you assert that the machine was invented in the US. The engines of steam, electric, internal combustion, diesel; all were invented outside the US in the 1800s. I mean by comparison the US at that time was stuck in a rut over whether slavery was a viable engine to power its industrial production!

Yeah, ok, I know Ford gets lots of credit for ramping up his assembly line and blowing a whistle at his workers, but even that was an application of British automation developed and built 100 years earlier to support the quality and speed necessary for their military during the Napoleonic wars. Imagine watching a steam engine-driven system in 1808 that produced over 100 thousand blocks (pulleys) for the Navy. The Block Mills of Portsmouth proved that with an assembly line and machines just 10 men were made able to work as quickly as 100.

More to the point you say “The trend is that we (in the U.S.) invent something new, create an industry around it.” That seems to skip right past the fact that most industries in the US were started by European immigrants based on European ideas in place for many years before the US copied them. From Budweiser to Champagne, Cheddar Cheese to Chandeliers, what the US has really done well is bring down the price of goods and make them more accessible. In fact, that was an obsessive element to the Nixon administration that success would be determined entirely by the availability of goods. A steak on every table. And it’s true our shelves were stocked our pantries full while others in the world were still paying more for fewer goods, but somewhere in that heady explosion of prosperity out of the 1900s the US lost its sight of quality as a measure of success in “efficiency”.

You bought that Suburban, you said, because you perceived value, right? Did you feel like you were buying innovation? Quality? Maybe a trip to a car show to look at the latest models (all outside the US now) will change your perspective:

http://www.nytimes.com/2011/09/11/automobiles/as-frankfurt-show-opens-industrys-balance-shifts.html

“If it seems as though German manufacturers are on the leading edge of new, gas-free urban transportation solutions, it is due in no small part to the European Union’s strict pollution controls. ‘Today, all the innovation in the auto industry is coming from the German manufacturers…A little from Japan. None from the U.S.’”

NONE from the US. Our amazing ideas of “efficiency” apparently were not so.

I mean a four-door all-wheel-drive station wagon made by Volvo is expected to be available next year that delivers better horsepower than a Ferrari 308 and a Camaro Z28, yet will also provide 100 mpg. That should have been an American made vehicle. No reason that it could not have been built and sold here. We have the weather, the open roads, the crap to haul around. Oh, no reason except people were for some reason still buying Suburbans. You know I could go on about this forever and someday I MAY convert you to a highly resilient low-risk source of energy for transportation, even if I have to do it on the mat…but I’ll try to get back to the point of your post.

I think your definition of software may be too narrow. You say “software must be built by highly skilled people, whose skills are not trained up quickly or easily.” But isn’t that the very opposite of what is causing so many problems in code? Code is being written by many more people less trained and using toolkits. It is based on a massive rise in the amount of shared/borrowed/stolen code available. I see this most in recent cases of malware mutations — so many more people developing (or at least modifying) more code more rapidly than ever. The mobile app stores are another example. Anyone with a cheap personal computer and a few online tutorials now is in place to build and release software to hundreds of millions of users. Compare that to the training, samples and platforms of twenty years ago. Software is just flying off the wires now and it’s going to get even faster as more remote areas are connected.

You say “those who profit by the billions from creating software, like Microsoft, Oracle, and Adobe seem unable to ship multi-million line software projects on a deadline”. You’re looking at the wrong sources of innovation. That’s like criticizing the British Navy for deploying ships late (a critique as old as the British Navy — special note to the Falklands War deployment, which led to the development of ITIL). While the Navy isn’t going away and will continue to find ways to automate production, they are solving massively complex problems. The future of software build efficiency is less about the big guys just like ship building an ocean-going vessel for the masses is at a much smaller scale today. The lessons learned from the big expensive mistakes are applied faster, better and at smaller scales of automation.

So, I’d be one to argue yes, we know how not only to make software but hundreds of millions of people know how to save time by learning from the innovation of others — sharing knowledge and tools to reduce build times. I’d be happy to go more into the myths of commodity and innovation. I also would like to clarify trends and real numbers but I’ll leave those for another day (e.g. Today’s fastest growing telecom company? Skype is barely over 500 mil while India mobile is soon expected to have 1.2 billion subscribers). Alas, it’s time now to go make some more fuel for my engine.

Update: My comment has not yet been approved, so I’m glad I made a copy here just in case. I also have to point out there is some sweet irony; a post about efficiency and automation is taking a long time to approve a comment. Maybe it’s a manual process. :)

Security

Extending OVF for security

Leave a comment

Envelope information on a virtual machine has come up a lot lately, not least of all after my presentation this week on Cloud Forensics Trends at the HTCIA International Conference.

The cool thing about a virtual system powered down or hibernated, dormant, etc. is that it has an envelope of metadata that forms an audit trail separate from the system. Take the OVF standard, for example. If the envelope were to include information about the status of the enclosed virtual system, such as the last time it was booted, the hypervisor it was running on, its device list, the current software/patch level…then it would provide more security information and control than a physical system which is “dark” when powered down.

This insight into off-line systems becomes really important in environments that have zones of online systems, such as multiple time zones. A company that spans America and Australia that must assess its systems at opposite times of day can read the envelope of offline systems to know their overall status. It also means systems can be easily identified and moved to a different zone for maintenance or containment before they are powered on again. Complex asset management systems can become simple queries of a virtual system envelope.

OVF is expected to evolve. It may eventually incorporate things like service levels and external configuration dependencies (e.g. network performance, state and security settings) that cloud providers crave for automation but, based on recent meetings with NIST and DMTF, it also is possible that it will evolve controls for virtual systems to be better than what we have used for physical systems.

OVF Envelope:
OVF Envelope

Security

TSA Creator Laments Creation

Leave a comment

A government official who says the TSA was his fault now says he regrets the monster he helped create.

…a decade after the TSA was created following the September 11 attacks, the author of the legislation that established the massive agency grades its performance at “D-“

[…]

“It mushroomed into an army,” Mica said. “It’s gone from a couple-billion-dollar enterprise to close to $9 billion.” As for keeping the American public safe, Mica says, “They’ve failed to actually detect any threat in 10 years.”

[…]

The fledgling agency was quickly engulfed in its first scandal in 2002 as it rushed to hire 30,000 screeners, and the $104 million awarded to the company to contract workers quickly escalated to more than $740 million.

Federal investigators tracked those cost overruns to recruiting sessions held at swank hotels and resorts in St. Croix, the Virgin Islands, Florida and the Wyndham Peaks Resort and Golden Door Spa in Telluride, Colo.

His solution? Reduce government oversight by giving large portions away to be run by private companies.

Asked whether the agency should be privatized, Mica answered with a qualified yes.

“They need to get out of the screening business and back into security. Most of the screening they do should be abandoned,” Mica said. “I just don’t have a lot of faith at this point,” Mica said.

Allowing airports to privatize screening was a key element of Mica’s legislation and a report released by the committee in June determined that privatizing those efforts would result in a 40% savings for taxpayers.

A committee figured that out? Is it anything like the committee that thought the TSA was a good idea? As far as I can tell the magic Mica savings report was based on simply comparing the number of government supervised private screeners working at SFO to the number of government employed LAX screeners. Fewer screeners work at SFO so labor costs are lower, so they must be more efficient, right?

A 2006 report comes to mind that showed the SFO screeners failed to report security breaches to the TSA. There’s also the 2010 knife incident that the TSA tried to hide. And who can forget the missing laptop at SFO? Even though the laptop was found, confidence in the security screeners at SFO was lost.

Extrapolating screening management from SFO to the rest of the country does not seem to make a lot of sense either from a security or a financial standpoint. Sure, it reduces the number of jobs, but is that the real goal? And if all he wants is to reduce jobs, and screening is unnecessary, then why stop at most? Why not dismantle the whole program instead of saying government will be better off to try and take on management of fraud and waste among private contractors?