The loud crash from upstairs brought me out of my restful state with a surge of adrenalin. As this wonder-drug coursed through my veins I immediately became aware of everything. The Tick-tock of the clock, the dog breathing in the corner and floorboard creaks from upstairs. I kept telling myself that the storm outside must have caused something to shift -- something simple and not so scary. Starting up the stairs, eyes darting, the beat of my heart drowned out my adrenalin edge. Near the top of the landing there was a flash of lighting, a large boom, and the lights went out as I saw a figure lunge at me, knocking me down to the landing below.

Nightmares can manifest themselves in many forms. I'll leave the ending up to you, however, I am currently living a nightmare with regards to my personal data at home.

About ten months ago I took the plunge into the terabyte (TB) arena and bought an external drive. This enabled me to pull information from many sources in order to supply a consolidated view of different media (movies, pictures and music) to the family. As I was going through this evolution I started removing data from internal drives, and making neat and organized structures on the external drive. It was fast and friendly and up until a few weeks ago, it was also reliable.

That's when the nightmare began.

One day I turned on my home system and noticed that the external drive would no longer connect (it actually connected and disconnected about five times a minute). This was the one time I had turned off the computer and forgot to turn off the external drive, so I figured it had just gotten hot and was in some self-protection mode with a thermal overload. No such luck.

The enclosure (device containing he hard-drives) had failed.

I contained my anxiety because it was obvious it was the enclosure and not the drives (through some hardware diagnostics). So I figured I would simply mount the drives and extract the data that was not backed-up on DVD (about 8 months of video and photos).

Again, no luck. The problem was caused by the type of enclosure I had purchased.

There are multiple types of drive configurations on the market, and if you are not aware of what type your enclosure uses, you could find yourself in the same boat I'm in. The specific one I had was configured (from the factory) as a RAID-0. For the unaware, RAID (redundant array of inexpensive disks, http://en.wikipedia.org/wiki/Redundant_array_of_independent_disks) has different settings (or levels), which are configured based on the level of security and speed you want for your data.

The vendor had configured this as a RAID-0 to maximize the space available and maximize speed. The benefits of a RAID-0 come at a price. This array configuration (with two drives) basically splits the data in half and writes each half, simultaneously, to each drive. Half the time to write, half the time to read, makes it very fast. The basic problem is that only half the data exists on each drive meaning no drive is of use without the other. And when there is corruption of a logical disk or you want to switch to a new enclosure, you are stopped by the fact that most hardware RAID controllers use proprietary disk layouts.

I know they are proprietary since I've tried reading these drives with three different RAID-0 arrays (which is also why I know the drives work fine, through diagnostics).

My next step is to try and perform a soft-RAID setup internally to my computer.

This involves creating an image of each drive and using software to try and detect the different parameters of the RAID setup, in order to emulate the hardware configuration. If this works I should be able to pull my data off of the drives.

What do I do with the data?

Well, I have sufficient internal storage to keep it while I catch up on 8-months worth of DVD back-ups. Long-term I am looking to a RAID-5 setup in hopes of solving my data storage, security and hardware failure worries.

Bottom line.

Be aware how your external (or internal) setup is configured. If you see RAID-0 or JBOD, then you have zero protection and must have a way to perform back-ups. Yes, I could try to have some external data recovery company perform the data restoration, however, I would rather do it myself and save the cash for a back-up system.

How do you ensure you don't lose anything of value?

Have you encountered a similar issue?

Recently, security expert Bruce Schneier expounded security ROI figures were meaningless! Is it true? Well, yes and no.

The brutal truth.

Well respected information security expert Bruce Schneier recently provided a stark opinion regarding the value of ROI's.

Follow this link to see the story:

http://www.zdnetasia.com/news/security/0,39044215,62037905,00.htm

In brief, Bruce stated security because numbers can be manipulated to justify anything.

He explained that the amount spent on a product can change significantly by simply playing with the equation.
"If the chance of you being attacked is one in a million and I change it to one in two million... I have halved the amount of money you should spend.
"I can make an ROI model say whatever I want. I could justify or not justify anything based on these very, very rare and very, very damaging events," he said.

Tell me it is not true!

I believe Bruce is both right and is delivering a message which is a little incomplete. His general message is accurate and shocking enough to garner the right level of attention. Most of the information security ROI's I have read were speculative, could not be validated, were impossible to reproduce, and had great latitude to provide results which benefit the desires of the author. Nowadays audiences are being provided ‘information' under the auspices of ‘fact', when in reality they are more of an opinion. Such valuation assessments are based on qualitative data versus quantitative metrics.

I blogged about the The Problem of Measuring Information Security back in August 2007

Awareness must be raised. I applaud Bruce in helping to make this happen. His message, as brutal as it sounds, is bringing to light a shadowy area in our industry. I think the follow-up message for audiences is to scrutinize and apply common sense to any ROI they come across. Understand the methodology and if it makes sense in their context. Lifting the curtain can quickly reveal a puppet master pulling the strings to artificially show value.

Like Bruce, I too have a jaded perspective. I have seen some WILD ROI's. Much of what I have read from security vendors is pure folly. However, just because most are fiction, it does not mean all methodologies are without merit.

Intel published a Whitepaper - Measuring the Return on IT Security Investments which is applicable to some situations. This method, far from being a silver-bullet, is a good start and has proven its truthfulness.

For any method, the accuracy should be scrutinized. Can it be validated, repeated? Was the method exclusively developed solely for self serving purposes from someone trying to sell something shiny? Does it make sense? These are the questions I ask myself.

On the bright side, many bright sharp people are working very hard to make the industry better and develop more rigid processes to insure both accuracy and confidence.

In the end, there is much work to be done in the information security valuation space. In the meanwhile, savvy consumers should be aware of the challenges and dive deeper into prospective ROI's and determine if they are ‘meaningless'.

The early morning dew glistens as the light of dawn wakens the cactus blossoms of the Arizona desert. Of course, at this time of the year, it never gets cool enough for dew to build or blossoms to go to sleep. During the late summer there are winds that blow through the sands, kicking up dust, and filling the maddening clouds with thick rain. These winds blow hard. These winds cause the desert to change.

There are other winds that have been blowing through the business world enabling a convergence of technology and usage patterns. What was once firmly outside the firewall, and considered only for those on the fringe, is now being embraced and pulled inside.

Social Media (corporately named Professional Media) can be used to enhance your work force like no other tool/technology/use ever has. In the past, when you were looking for an expert, trying to solve a problem, or interested in posting a solution, you did so within the confines of your close personal network. Today, as many of the common social media tools embraced by the business world, that personal network is expanding to involve the whole company. In my case that number approaches 100,000 people.

My specific opportunity involves the forming of a company-based, professional society of software developers.

Why is this important or even needed? Let's say you are starting a new project to create a web-based sales system. While going through the design process you decide upon a certain software platform, specific languages and messaging mechanisms. After the design is approved you then need to setup your development and testing environments as well as any compilation/deployment mechanisms necessary to manage your processes. For just about every project, this has been a large chunk of time and effort because each individual group had become their own pocket of excellence.

What is a pocket of excellence? This would be the team, or individual, who does their job really well, because the processes (and tools) they have in place correspond to the needs and expectations of their immediate team. It is the single person doing it the same way because that way works and meets the customer’s needs.

A pocket of excellence is a personal (or private) network based solution to their local problem (software development).

My goal is to start a society of loosely coupled software developers willing to share their thoughts and ideas in order to allow those private networks to become global in scale. In sharing their data from their pocket of excellence, they begin to gain a wider insight regarding their approach. They may get input to improve it or in turn may see something which makes sense and simplifies their own solution. It should resolve itself into a library of processes and a network of people, in order to help make their jobs better.

Some of the focus areas that I have targeted in our society are:

• Education

• Standards

• Technologies

• Tools/Utilities

• Design

• Testing

• Deployment

• Supportability

I will follow up with some expansion of this and further explanations of how social (professional) media can help to enable this on a company scale. I would love to hear about any efforts in your company, or feedback on what we are attempting to do.

Can an organizations greatest security asset also be its most serious threat? Yes it can.

The Greatest Asset

I manage information security for Intel’s mergers and acquisitions. Recently, I was evaluating an acquired company and delivering information security training to our newest employees on their collective hire date. As I was presenting the fundamentals of how to keep the company, their work, and our industry safe from cyber threats, an important security maxim was exemplified.

In interacting with the audience, I understood how they were accustomed to conduct business, the scope of information they handle on a daily basis, and their views on the value of security. I began to emphasize how the employee base was the greatest asset to information security and the combined force of a well informed, properly trained, and security savvy workforce dwarfs the efforts of the dedicated security staff. My recruitment speech sunk in and their faces glowed with pride. I saw a bit of excitement from the audience, that of empowerment and newfound responsibility. I was setting them up. Although absolutely true, a few slides later in my presentation I unveiled the stark reality.

The Greatest Threat

I asked to my newly recruited security champions what the greatest threat to the company was. Amid different answers, I revealed that THEY were the greatest threat. Not just them, but the entire workforce. The glow in their faces dimmed a bit. How can this be? How can our employees be both the greatest asset and the worst enemy in the cyber warfare trenches? They were shocked. They were dumbfounded. They were intrigued. I gave a dramatic pause. It is not often people are captivated by the boring and bothersome topic of information security. I savored the moment.

The real battlefield is in hearts and minds of employees. These new employees, more than any, represent the greatest challenge. They are accustomed to their previous ways, inundated with new-hire information, and are not familiar with the security expectations of their new corporate parent. Security policy is a distant concern on their first day. Every subsequent day, the separated cluster of workers will not benefit from the social reinforcement of good security practices as they are distanced from the collective body of experienced employees who exhibit secure behaviors.

We discussed how apathy, laziness, and circumventing policy for a quick gain, can cause significant weaknesses in security. Every employee has a responsibility to be secure and reinforce those fundamentals with their peers. A single employee through malice or carelessness can cause more damage than a legion of hackers. They must decide, through their actions, if they are the security marshals or the villains of the story. The battle is with the mindset of the employees. The finest security policy is worthless in the hands of an apathetic workforce.

In the end, the discussion was a success. It was not just training; it was an interactive dialogue talking to what is important and how every employee, now including them, work as a team to be Intel’s greatest security asset.

So, who do you market to?

In the world of effective software inventory management there are audits. Those audits are done comparing the software to physical installations or against budget. There are audits performed when a HFE (Human Factors Engineer) analyzes your usability or those done to ensure that you have sufficient disaster recovery elements in place.

This happens every day against dozens of software applications and I have to ask the question -- where do you record this data? Does everyone have individual approaches and simply has a spreadsheet containing the data? Is it recorded anywhere?

I have to wonder where the value is in gathering data that has no reuse or exposure to the owners of the software solutions.

So I've been bouncing around an enhancement to allow certain groups to register (and report) on audits. Internally some people hate it and some love it.

What do you do?

Do you have yet another application for capturing software audits?

Do you do them at all?

Let me know.

Previous topics include Application inventory, what do you capture?, Application inventory starts with a definition, Application inventory as a cost savings initiative, Application Inventory, the start of data sustainability? and How do you measure data quality in your Application Inventory?.