Intel Communities : Blog List - IT@Intel

Who should start the ‘data security revolution’?

webadmin@intel.com — Wed, 25 Nov 2009 19:02:18 GMT

After posting the video and opinion paper It is Time for a Data Security Revolution! a reader posed a simple yet deep question. GroogFish, in the YouTube video comments asked ...who is supposed to start this "revolution"? As my response is a bit lengthy for the comments section of YouTube, I am posting here.

I believe everyone has a role to play and a responsibility to support steps for securing data. It is, after all, OUR information. To succeed, a data security revolution must be a community effort resulting in the development of an entire ecosystem, with standards, communication, and an open architecture.

Consumer demands bring attention to the problem and ultimately will drive features. Regulatory bodies, dare I submit, can enact requirements which mandate changes to technology capabilities. Hardware and firmware vendors are important in order to support new architectures. Data management and processing organizations must be on-board to insure interfaces and storage formats of data are compatible. Operating system and application writers are key players to utilize and enforce such controls at the host system and repository levels. They develop the products which engage the user.

The information security communities are the expert advocates. They must analyze the situation, stimulate conversations, guide changes, and engage in value assessment discussions to become the sharpened spearhead which leads the charge forward. Traditional and social news media should also contribute to overall education and public awareness. They must go beyond just reporting the breaches, failures, and losses. We are at risk of becoming numb at all the stories, without a meaningful reference point or perspectives of significance which show how the situation can change. The public must be better informed to the root problem, the industry opportunities, and the dark truth of where apathy will lead.

I would like to see a consortium formed with major players and international standards bodies to establish a framework for development. Government, privacy, commercial, academia, technology, and security representatives should be represented at the very least. Critical mass with the aforementioned groups must be established before enough traction motivates a commitment on behalf of lead players to allocate initial resources. Alternatively, assertive academic bodies could work together and take a first step by developing recommended standards, architectures, and proof-of-concept systems.

Although some pieces to the puzzle are out there, we don’t even know what the picture is supposed to look like and no guarantees the available parts will or should be brought together. Boldly, I believe we must enforce a tabula rasa to nurture a fresh start, otherwise risk poisoning from our natural presumptions of what we believe we know. It may not be the most popular sentiment, but adopting refined solutions and attempting to bolt them together is a mistake. Instead, we take the learned and proven principles of those solutions and integrate them at a strategic level to eventually lead us to workable end solutions.

Opinion paper: It is Time for a Data Security Revolution!

Is Cloud computing really cheap ?

webadmin@intel.com — Wed, 25 Nov 2009 09:34:49 GMT

Cloud computing buzz is on the raise. Cost reduction is one of the perceived benefits of this capability. But is it really that cheap?

Yes, it's a great solution for small companies with Web-based operations, which don't have to plan for peak demand now - see "Animoto's Facebook scale-up" as an example.

We've looked into applicability of such Infrastructure-as-a-Service solution for Intel Silicon design environment, and I may blog in the future on some of the findings from this study.

At Intel, we utilize internal distributed grid of over 60,000 compute servers to run various jobs at over 80% utilization. The idea was to consider an external IaaS capacity as an extension to accommodate possible peak demands.

We've built a proof-of-concept environment using one of the major IaaS clouds. The applications we are interested in are mostly single-threaded, and are CPU bounded. We found that per-core performance of the external cloud instances is significantly lower compared to our internal compute servers. As a result, we'd need 3x-4x more instances in the cloud as opposed to the internal deployment to achieve the same throughput. The TCO for such use (calculated based on July'2009 pricing) would be significantly higher in the cloud, this is one of the reasons for us stepping back at this point in time.

I'll talk more about this study on the Cloud Computing Summit in Israel next week.

Cloud vendors - bring the performance up and the cost down, and we may come back!

Are you already leveraging external cloud capabilities to complement your computing infrastructure? What is your experience?

Till the next post,

Gregory Touretsky

IT Can’t Lead Corporate Sustainability Efforts but Sure Can Help

webadmin@intel.com — Wed, 18 Nov 2009 19:47:44 GMT

I’ve been hearing about green IT for a while now and personally thought it was a lot more hype than true business value creation. I was surprised coming over to the IT side to see a good deal of focus being applied to Sustainability. A couple months ago, I asked a peer of mine working on Intel IT sustainability a simple, yet challenging question.

“Why should an IT manager or CIO bombarded with a 1,000 other things to think/worry about, care about sustainability? How will it help them advance their careers or bring more IT value to the business.”

The answers I got from her plus a recent listing from Gartner of “IT for Green” as Number 4 on a Top 10 Strategic Technologies for 2010, helped shape my thinking and the title for this blog.

Keep the Business Running/Legal. As an ongoing activity, IT must always look at industry and regulatory trends to proactively plan for an ever-changing compliance landscape. Many European Union countries and the US Environmental Protection Agency are creating regulations that affect the application of information technology.
Green IT initiatives can impact ROI and Profitability. In addition to the benefits of electricity savings, the proper application of technology (like proactive server refresh, facility re-use) can affect land use, avoidance of new construction, boost asset utilization … all of which assist in improving corporate sustainability.
Green IT initiatives can also reduce operational costs. I recently learned about the broad video conferencing capabilities that Intel IT has enabled to help employees collaborate across time zones and countries. This capability has encouraged less travel for routine purposes avoiding unnecessary travel expense for employees delivering a dramatic multi-million dollar savings impact this current year.

The three reasons listed above are prudent IT operational activities and doing them represent best IT practices that have a solid impact on creating business value. Not doing them could actually have detrimental impacts to an IT career. Intel IT’s recent data center strategy identified that not only is proactive server refresh the biggest driver of financial value but also in the reduction of IT’s CO2 footprint. Another area where our business strategy benefited IT Sustainability was in our transition from a desktop driven PC fleet to a mobile PC fleet that boosted employee productivity while employing more energy efficient solutions.

However, IT sustainability also help serve as an example for corporate responsibility building brand, influence product purchase with an increased focus on energy efficiency and influence the improvement of business processes with a mind toward efficiency and elimination of redundancy and waste.

Gartner's Top 10 list reinforces these sentiments where they identify that "IT can enable many green initiatives. The use of IT, particularly among the white collar staff, can greatly enhance an enterprise’s green credentials. Common green initiatives include the use of e-documents, reducing travel and teleworking. IT can also provide the analytic tools that others in the enterprise may use to reduce energy consumption in the transportation of goods or other carbon management activities.”

So while IT Sustainability may not be your most important IT or CIO priority, investing with an eye toward this topic is wise and is likely aligned with many other priorities you and your peers are already doing.

For us inside Intel IT, it is now clearer to me why Intel IT maintains an IT Sustainability Program that supports Intel’s Corporate Sustainability initiative.

Intel IT’s proof of concept efforts in data center cooling innovation earned us recognition as one of the 2009 Green 15 by Infoworld.com. Together with Intel’s business leaders, our operational and investment efforts have helped Intel achieve a top 5 ranking as a green company by Newsweek.

Learn more about Intel IT’s lessons learned and best practices here.

Chris (twitter)

Taking Back the Security Initiative

webadmin@intel.com — Fri, 13 Nov 2009 19:21:37 GMT

Threat agents maintain the initiative and we respond to restore balance. The bad guys innovate, find exposures, and use technology which they can leverage to achieve their objectives. They take the first step, set the tempo, and lead this wicked dance. The security industry normally operates in a responsive manner, closing the door behind successful attacks to prevent further loss and scrambling to prepare for the next issue. But every once in a while, the security community comes up with a predictive and proactive idea which has sweeping effects against attackers and their future likely methods, and we show true leadership in innovation.

These golden nuggets can change the initiative and give an advantage to the defenders. Sadly, it is rare. In most instances it is difficult to justify expenditures for capabilities which may or may not interdict future potential attacks. Our industry cannot confidently measure and substantiate such innovation to determine which will leapfrog us ahead of the bad guys and those which fail miserably. Without clear value, those holding the purse strings are not very motivated to blindly invest. It reverts back to the age old security problem of measuring attacks which are avoided.

How will we ever change our industry to support security taking back the initiative? First we must devise a good way of measuring innovation. We have much better metrics for how good the bad guys succeed, and are blind on how to measure the value of security ideas. This must change in order to facilitate the financial support necessary for investment. The value is there, we must adjust our focus to see the opportunity. Otherwise, the enemy will maintain the advantage as we continue to follow behind the attackers, cleaning up messes, and forever responding to their ingenuity.

Intel Initiative Aims For More IT Enabled Innovation

webadmin@intel.com — Tue, 10 Nov 2009 20:21:33 GMT

For the past couple months, I have been working to understand Intel IT's innovation model ... specifically, how do we create business value with IT investment. I have come across many approaches, opinions, projects, programs and more.

One of the key answers and best practices that I have found sits within a small team of Intel IT employees that is led by Martin Curley, Director of IT and co-founder of the Innovation Value Institute (IVI).

The IVI and Martin's role and goal in developing the IVI was written up in an article online at InnovationManagement.se, titled "intel Initiative Aims for More IT Enabled Innovation"

This article does a nice job summarizing one of the core IT governance tools we use internally inside Intel IT to drive innovation for the purpose of creating business value. Originally formed through a strong link between NUI Maynooth and Intel, the consortium’s more than 30 members are among the world’s leading companies such as Chevron, Google, SAP, BP, Ernst & Young, and BCG. While Intel IT has been using this model (the IT Capability Maturity Framework) ourselves for a few years we are not alone. I'm told that over 200 companies utilize the resources and framework developed by the IVI in helping create more value through IT investment.

Learn more about the Innovation Value Institute

What tools does your IT organization use to create business value?

Chris

Assessing Business Value with Net Present WHAT?

webadmin@intel.com — Mon, 09 Nov 2009 23:03:50 GMT

Net Present Value. Since coming to IT, I have spent much time focused on the topic of business value. This topic has dominated customer presentations and events, CIO forums, internal discussions several blog posts and even a few twitter discussions that I've been having. Whether an IT organization is attempting to justify investment to support a new project or communicating the benefit of an existing one, being able to communicate, demonstrate and deliver the value of those projects is critical.

What I have learned is that there are many different ways to communicate the savings or value created by a project. Matt Beckert, Intel IT finance, and I have spent several hours discussing this topic. Let me provide the cliff notes (simplified version) and why Intel IT is moving to a standard methodology focused on Net Present Value.

Many times you will hear individuals talk about how much they saved by doing something. Example, yesterday I saved 10% by using a coupon buying a coffee at Starbucks. I saved $0.35 on my $3.50 latte. So while I avoided spending $0.35, did I create value for myself – not really.

Value is often a collection of costs that include what I had to spend (my capital outlay), cost avoidance (what I didn’t have to spend), operational cost savings (how my daily costs are affected), additional revenue generated (what I earned), productivity gained (greater output for equal or less input) and several other variables. Intel IT looks at a variety of business value metrics for our project portfolio.

In the terms of IT projects, the business must invest in something to achieve a goal. The collective measure of money spent vs. benefit received is a Net benefit. If I buy 100 t-shirts to sell for a charity and each t shirt costs me $5 and then I sell those t-shirts for $15 each, then the net benefit to my charity of that project is $1,000 (100 x $15 minus 100 x $5).

Expanding on my example further. What if I did not sell those shirts immediately but I held on to them for five years. In this case, my net benefit would still be $1,000 from the project but because of inflation, the value of that earnings is worth less to me than if I sold them immediately. If inflation was 10% per year, then the $1,500 that I earned from sales would [when discounted back with inflation $1,500 / ((1+inflation rate) ^(# years))] would only be worth about $931 in today’s dollars today. So taking into account the time-value of money, now this t-shirt project was only worth $431 to me in today’s currency or Present Value.

(Readers Aid. If you anything like me, this topic makes my head spin, Matt helped me build a cheat sheet table that shows the time value of money depending on how long it is held and the annual inflation rate or discount rate applied over that period of time. See the table at the end of this blog.)

It is possible that I could have earned more than $431 by doing another project or by maybe investing my original capital of $500 in the financial market and getting a better ROI (often called the “hurdle rate” for financial planning). With many IT projects affecting a many types of cash flows over different time horizons, it is critically important from a financial perspective to compare apples to apples when looking at projects.

This is why a Net Present Value is so important – it allows business leaders to compare the net value (return on capital) in present value (accounting for time value of money) across many projects, thus prioritizing the most important ones with an eye on the bottom line.

I have to admit, while communicating savings in terms of NPV is a lot more confusing and often less interesting (the numbers are lower than gross undiscounted multiple year savings numbers), it does enable a more level playing field and better articulates the actual impact projects are having on an organization. For example, in the recent data center paper published by Intel IT, our gross benefit is estimated at $1B, while our NPV is estimated at up to $650 Million - depending on when we make the investments and how quickly we realize the benefits. Either way you look at it, you can draw one common conclusion: our eight year Data Center IT strategy is creating a lot of business value for Intel.

Read Matt’s perspective on our Data Center Strategy.

Chris, follow me on twitter

NPV Table. The net present value of receiving $1,500 cash five (5) years from today assuming a 10% annual rate of inflation is $931.

Data Center Execution and Unit Costing

webadmin@intel.com — Mon, 02 Nov 2009 16:10:55 GMT

I was recently involved in a project where Intel IT SMEs from disciplines including Server, Storage, Data Center, Network, and Finance reviewed and updated our Data Center Strategy (Intel IT Data Center Solutions: Strategies to Improve Efficiency) for Intel IT. The primary focus of the paper was to provide an update on value realized, shifts in strategy, and key execution lessons learned.

Our execution highlighted the need for finance to participate as an active partner in the influence planning and internal communications. At some point, especially in economically challenging environments, cross organization investment decisions boil down to a tradeoff between limited resources and a number of good projects. Being able to clearly articulate the value added by a "portfolio of projects" (like the Data Center Strategy) and how you will track progress doesn’t mean that the project(s) will be funded – but it does increase the likelihood that you will be in the game at the end. For us, having this coordinated communication strategy for technology solutions,cost efficiency, and operational efficiency was a key consideration for successful execution.

We currently estimate that the cumulative projected financial impact over eight years will be ~$500-650M NPV - this range has changed in upper and lower limits based on updates to forecasts. Over the first three years, Intel IT has realized ~31% of the projected benefits through execution to the Data Center strategy. The primary value driver has been the impact of our server strategies (multi-core refresh and virtualization) that enable demand growth within the existing data center footprint and affordability targets. Moving into 2010, we are evaluating new forecasting and value metrics to enhance customer reporting of data center activities. This approach will incorporate our activity driver methodology into comprehensive unit costing and forecasting framework, creating a holistic cost forecasting process to improve future decision making.

One area currently under review is establishing the right unit of measure for a data center infrastructure housing different compute environments. Is this something you or your business partners are exploring or looking to explore?

Sustainability – This & That

msbreton@intel.com — Thu, 29 Oct 2009 20:26:40 GMT

Energy Use in the Office PoC (phase 2)

It’s been a while since I’ve talked about Energy Use in the Office. The small PoC we did early this summer had some pretty interesting results but due to the size of the PoC and time constraints, it’s was unclear as to how the data we obtained would scale up. So, building on the results from the first phase, we are planning a second phase of this PoC on a much larger scale: We are involving about 1,000 users, and the second phase will not be subject to the limiting time constraints that characterized the first phase. During this second phase, we will focus on user awareness and enforced energy profile settings. We are also building a real-time energy-awareness user interface that PoC participants will be able to access with web browsers, as well as view on large screens in the building’s lobby and cafeteria. I’ll keep you up to date as the project progresses.

Making IT Real!

By the way, the second video in the “Making IT Real!” series has been released. If you haven’t already seen it, you can see it here and in case you missed the first video, you can see it here.

-Mike Breton

IT Technology Evangelist

How to Value Digital Assets

webadmin@intel.com — Thu, 22 Oct 2009 19:05:38 GMT

Russell C Thomas delivers a great post on How to Value Digital Assets. It covers many basics and more importantly gives a good direction to take while spotlighting common pitfalls in the valuation journey.

“This tutorial article presents one method aimed at helping line-of-business managers (”business owners” of digital assets) make economically rational decisions. It’s somewhat simplistic, but it does take some time and effort. Yet it should be feasable for most organizations if you really care about getting good answers. Warning: No simple spreadsheet formulas will do the job. Resist the temptation to put together magic valuation formulas based on traffic, unique visits, etc.”

Definitely a good read for anyone wondering where to start the valuation process. I especially like the Three Principles section. He makes a logical separation between assets which provide direct revenue (Class 1) and those which are in a support function (Class 2).

As follow-on, I believe some other aspects may be covered under the Class 2 section including liability avoidance, direct efficiency gain, life safety, and regulatory compliance. In certain cases we must apply a different method to determine the value, outside what has been explained. As management may be willing to replace or upgrade, but typically such investments must have a positive ROI, therefore they provide much more value than the replacement/repair costs.

Years ago I had a stimulating conversation with the late (and some would say infamous) Dr. Bill Hancock. Bill had trudged through the information security swamps for decades and had a unique insight to valuations of vulnerable systems, particularly single-points-of-critical-failure. He recanted his experience evaluating an airline’s security and discovery of a minor system which was largely ignored, a weights and balances server. Apparently when planes take off, the distribution of weight must be calculated to insure they don’t become giant ‘lawn darts’ (Bill’s colorful description) at the end of the airfield. A data integrity compromise of this system could cause catastrophic consequences, leading to the end of the business. Who would fly on an airline which had several take-off crashes in a single day? It would be the critical factor to likely cause the airline to no longer exist as a viable business. Although this was a support system, the integral value was far beyond the cost of the equipment, software, and support.

Secondly, the blog is written with the assumption the assets are already in place. Thus, in a perfect world, a proper ROI/justification has already been made to assist the decision to acquire and land these assets. But what if a decision to purchase or not, is the objective? The Class 2 method then becomes circular. The value is the expenditure management is willing to invest? How do they know?

Overall it is a great blog. I think it would be helpful if the author could give an example for a medium sized enterprise, with particular focus on Class 2 areas (specifically security or safety assets). Hopefully he is willing to post such details.

Are billion year passwords weak?

webadmin@intel.com — Tue, 20 Oct 2009 22:45:20 GMT

No. Just the people who use them.

Passwords of reasonable strength (8 characters or more consisting of upper/lower case and special keys) coupled with timely expiration, are secure. Passphrases with comparable measures are equally secure. The systems and users are currently the weakest links in the security chain.

The interfaces and tools which we input the passwords may be vulnerable. This includes but is not limited to key-loggers, sniffers, input redirections, etc. But it is the user, where the most significant weakness exists. They can be duped into divulging their passwords (phone, web, chat, email, etc.) and in many cases make them available in other ways (sticky note under the keyboard).

A recent Newsweek article covered the topic of building a better password:

"...a short but hard-to-remember string like "J4fS<2" can be broken by what is called a brute-force attack (in which a computer attempts "a," then "ab," then "abc," and so on) in 219 years, while a long but easy-to-remember phrase like "du-bi-du-bi-dub" will stand for 531,855,448,467 years. (Two hundred nineteen years is actually very good, but the lesson remains: simpler can be stronger.) The idea of passphrases isn't new. But no one has ever told you about it, because over the years, complexity-mandating a mix of letters, numbers, and punctuation that AT&T researcher William Cheswick derides as "eye-of-newt, witches'-brew password fascism"-somehow became the sole determinant of password strength."

The difference between passwords which can be cracked in two-hundred versus a billion years is immaterial if users are forced to change passwords every few months. The bad guys just don’t have the time to crack the password before it is changed or the data is sufficiently aged to not be of value.

To undermine cracking attempts, we force users to use 'strong' passwords so that dictionary attacks are fruitless and threat agents must resort to a laborious brute force attack, trying massive numbers of combinations in order to be successful. All passwords can be cracked via brute force, but it takes time. It becomes an exercise in how many attempts can be made over a given period. The faster the process the more combinations can be tried and therefore the shorter the time to discover the one which works. The length and possible characters determines the number of combinations.

Undermining the strength of a password is not the biggest concern. It is far more likely for a password to be sniffed on the network, captured on a system, or duped from a user, rather than be cracked.

The most significant vulnerability is with the user and systems where passwords are entered and stored. There is no practical benefit to further abuse users with new diabolical password schemes. We should pay less attention to stronger and better password formats and instead invest in better behavioral controls, user education, and the strengthening of system and interfaces.