I was recently involved in a project where Intel IT SMEs from disciplines including Server, Storage, Data Center, Network, and Finance reviewed and updated our Data Center Strategy (Intel IT Data Center Solutions: Strategies to Improve Efficiency) for Intel IT.  The primary focus of the paper was to provide an update on value realized, shifts in strategy, and key execution lessons learned.

Our execution highlighted the need for finance to participate as an active partner in the influence planning and internal communications.  At some point, especially in economically challenging environments, cross organization investment decisions boil down to a tradeoff between limited resources and a number of good projects. Being able to clearly articulate the value added by a "portfolio of projects" (like the Data Center Strategy) and how you will track progress doesn’t mean that the project(s) will be funded – but it does increase the likelihood that you will be in the game at the end.  For us, having this coordinated communication strategy for technology solutions,cost efficiency, and operational efficiency was a key consideration for successful execution. 

We currently estimate that the cumulative projected financial impact over eight years will be ~$500-650M NPV - this range has changed in upper and lower limits based on updates to forecasts.  Over the first three years, Intel IT has realized ~31% of the projected benefits through execution to the Data Center strategy.  The primary value driver has been the impact of our server strategies (multi-core refresh and virtualization) that enable demand growth within the existing data center footprint and affordability targets.  Moving into 2010, we are evaluating new forecasting and value metrics to enhance customer reporting of data center activities.  This approach will incorporate our activity driver methodology into comprehensive unit costing and forecasting framework, creating a holistic cost forecasting process to improve future decision making.

One area currently under review is establishing the right unit of measure for a data center infrastructure housing different compute environments.  Is this something you or your business partners are exploring or looking to explore?

Reading from news (http://news.cnet.com/8301-13577_3-10368956-36.html) today, a survey has shown that 54% workplaces block social networks completely. I'm glad to be in a company which is the 10% which allow social-network use at work so I can stay connected with my external partners and industry peers. It seems the debate on whether social media is a effective business tool or a productivity drain is still going on.

In Intel, we are embracing social media as a mean to transform collaboration in Intel. We see the opportunity out weights the potential risk. We are deploying a social media platform for our employees. You can find out more about our social media strategy from our recent white paper (Developing an Enterprise Social Computing Strategy) and the blogs from Laurie Buczek (Why Intel is investing in Social Computingand Intel's Enterprise Social Computing Strategy Revealed).

Personally, I think social media is going to repeat the history of email and instant messaging (IM) at work. Few years ago, there were skeptics about IM at work. Our CIO at that time, John Johnson, took the risk and deployed IM in Intel. Today, it's a productivity tool that I cannot live without. This morning I was troubleshooting a problem with a colleague waiting to broad a plane 16 hours away thru IM. I frequently talk to my colleagues around the world. They could be anywhere in office, at home, or on the road, when I need to connect with them. Whenever they pop up online, I can get hold of them. Without IM, life will be much more difficult and less productive.

I have been participating in a IT pilot program testing out Windows 7 in our environment. We have a Windows 7 group setup in our social media platform where we share BKM and help each other. I got workarounds from the forum for issues I ran into with the beta version of the operating system. I also contribute my findings and solutions back to the group. Together we are creating a rich knowledge base for the Windows 7 program team. The pilot users around the world were helping each other and saving each one of us a lot of time learning about the new OS, troubleshooting and finding workarounds. This is an excellent success story for social media at work. (Find out our Windows 7 experience here: The Value of PC Refresh with Microsoft Windows 7*)

What is your view of social media at work? Is your company putting up a strategy to adopt the technology?

I hate fixing the roof.  In fact, I have been postponing a roof repair over my garage for about 2 years now.  I recently read an article by Peter Kretzmen titled “IT, The CIO, and the Business Need for Roof Projects” and realized that while I can put off my roof repair, IT may not be able to postpone routine upgrades. 

For businesses, technology refresh is a standard business process (ie a roof fix).  The question for IT often boils down to WHEN I should upgrade, not IF. Why? … because hardware technology ages, maintenance costs rise, and software solutions can become unresponsive or obsolete as business needs change, user needs evolve and new technology and software become available. In this economy, cost is king and reducing IT costs has clearly become a critical imperative.

My colleagues in Intel IT recently conducted two separate and independent studies on how frequent we should refresh our PC fleet and data center servers.

PC Fleet Management:  John Mahvi and Avi Zarfaty from Intel IT recently wrote a paper titled “Using TCO to Determine PC Upgrade Cycles”.  The conclusion of this analysis showed that a 3.5 year refresh rate was optimal for total cost management in our IT environment.  Despite the fact that delaying PC refresh this year was initially seen as a cash conservation approach, the analysis showed that not refreshing older PCs increased the business’s overall costs.  As a beneficiary of PC refresh (I got a new laptop a month ago ), I can also personally attest that my productivity has gone up.

Data Center Efficiency:  Matt Beckert and Diane Boyington of Intel IT recently published a paper titled “Realizing Data Center Savings with an Accelerated Server Refresh Strategy”.  This paper discusses Intel IT’s movement to a proactive 4-year server refresh cadence in 2007 and illustrates both the long term savings (up to $250M over eight years) and immediate benefit to the corporate bottom line ($45M saved in 2008). After plans to refresh our servers was slowed earlier this year to preserve capital funds, a re-assessment was done that showed that Intel IT could save $19M by refreshing now vrs waiting until 2010.

Just like you shouldn’t sleep in a house with a leaking roof … it is prudent to not let old hardware create a hole in your IT budget. In today’s economic environment, Intel IT can’t afford a leaky roof and so we are moving forward with proactive business client PC and Server refresh, proven approaches to reduce TCO and boost business value.

Chris Peters, Intel IT

twitter @chris_p_intel

For the last 18 months, Intel has invested a significant effort to develop a full strategy & implementation roadmap for social computing within the enterprise.  I am pleased to announce the release of a white paper Developing an Enterprise Social Computing Strategy that I did jointly with Malcolm Harkins, Chief of Information Security. The paper details our approach towards embracing the use of collaborative technologies while addressing the mitigation of legal, HR and governance issues.  Here are some key areas you will find detailed in the paper:

• The business focus for social computing (also refer to: Why Intel is investing in Social Computing
• Collaborative approach IT, HR and Information Security
• Intel's integrated architecture
• Intel's approach to determine early use cases, business value and vendor/solution evaluations
• Results of a security risk assessment
• Phased implementation plan
• Initial results after 3-1/2 months into deployment & adoption

There are a lot of key takeaways within this paper.  The biggest one that I hope you will walk away with is:  Enterprise 2.0 is a challenging effort.  Yes, there are risks.  But Intel hasn't discovered any new risks introduced with 2.0 technologies that doesn't already exist with 1.0.  We believe the opportunities outweigh the risks. In fact, we are convinced that inaction carries much greater risks: that the enterprise will not realize the benefits that social computing can deliver, and that employees will increasingly turn to external, unsecured tools for communication.  IT has a leadership opportunity to get ahead of and deliver emerging platforms, at a fraction of the cost of "standard" collaborative infrastructure, to enable their business to stay one step ahead of the competition. 

I hope you enjoy the paper.  I welcome your perspectives and learning about that strategy that is yielding success for you.

I was recently trading thoughts with Anton Chuvakin, a respected security metrics professional, in a philosophical discussion of perfection and quality of security.  Admittedly, I was on auto-pilot (operating without the benefit of coffee) rattling away with my ‘Optimal Security’ rhetoric, when Anton posed two thought provoking questions: CAN one "mandate optimal security"?  How do you "mandate flexible"?

I was stopped in my tracks.  This got me thinking.  After fetching a tall cup of coffee to start my brain juices flowing in earnest, I reached back into the pages of history to come up with the following perspective and examples:

I believe, to a certain extent, we can mandate flexibility and optimization.  Surely we can act in ways which deny both.  So why can’t we act in a manner which intrinsically promotes them?

I think back to lessons of WWII and the Maginot line.  The French chose to create a fortification which was static by design and lacked mobility or a capability to adapt to changing enemy tactics.  They invested heavily into this control, which became the backbone of their country's eastern defense.  It was an appalling failure.  Alternatively, the German blitzkrieg, and the stratagems of both Rommel and Patton prevailed.  Flexibility through mobility was far more effective than an elaborate static defense.

I would argue that flexibility can be mandated through proper planning and design.  We have examples in the history of information security.  In the early years of Anti-Virus (AV) products, they were non-memory resident applications which were prescribed to be run once a week.  Updates were a rarity if at all.  That rigid design quickly lost effectiveness, with the rise in velocity of new malware.  AV vendors were forced to adapt.  The overall design has changed to one which is flexible, can be updated to meet emerging malware, and continuously runs in the background to provide persistent security.

Rigid security postures lack the ability to remain effective over time and are likely derived by an equally rigid infrastructure which will struggle to adapt to new threats and changes within the organization.  Create security to be flexible and you enable the service to keep up with the continual changes.

In general, design a system to be flexible and its longevity for effectiveness is extended.  Plan how systems can continuously adjust itself to align to what is 'optimal' and you increase the sustaining efficiency.

We must be strategic in our planning and design of security, lest we suffer the fate of France's Maginot line.

Check out Anton’s Blog for other thought provoking viewpoints; just be sure to have your coffee at the ready.

More on “Optimal security”:

Strategy for Sustaining Optimal Security

Information Security Defense In Depth Whitepaper is Now Available

Fortune Cookie Security Advice - June 2008

Defense In Depth Strategy Optimizes Security

The Four Dirty Questions of Measuring Information Security

What are your thoughts?  Rigid or Fluid?  Have you implemented optimal and flexible?

Optimal security must not only be attained, but also sustained over time.  A good security strategy must be forward thinking to understand how intervention and continual maintenance will be needed, then implement those capabilities as part of a complete service deployment.

'Optimal Security' is the right balance of security spending and losses prevented where business acceptable losses are achieved.  It changes often and likely maintains different targets for the dissimilar parts of the entity.

Organizations are likely to mandate security expectations which typically manifests in a set of configurations, specifications, and operating standards.  The risk is these security controls may be relatively static and entrenched.

Establishing a baseline security is a good practice, but in order to remain effective it must adapt to changes in the environment by remaining dynamic to keep in lock-step with rapidly changing threats, vulnerabilities, and resulting exposures.  It must be a fluid posture, able to rapidly change based upon different internal priorities and external changes.  Sustaining business structure must be designed to continually predict areas needing modification and support design and deployment of those changes.  Rigid security postures lack the ability to remain effective over time and are likely derived by an equally rigid infrastructure which will struggle to adapt to new threats and changes within the organization.  Design security to be flexible and you enable the service to keep up with the continual changes in the information branch of security.

I recently spoke with an organization who had established a security posture which relied heavily on a hardened OS and application build for their systems.  At the time, they deployed a platform which took into consideration all the best configurations for hardening.  They were so confident they had satisfied security requirements they considered the problem solved.  They integrated the security design into their normal platform refresh cycle of system replacement every few years.  They never comprehended the fact they would need to continually update the build to compensate for changes in threats, new vulnerabilities and malware, and evolving business usage models.

The platform’s security, which initially was strong, began to quickly erode.  With no internal mechanism to identify when changes needed to be made, nor the testing and distribution capability, they soon found themselves in a situation where they were responding to individual incidents and changing systems one at a time based upon particular end-user needs.  This created inconsistencies in the builds which was more difficult to support.  Without proper forethought, the security team turned themselves into a firefighting organization, losing the initiative in the war of security.

This is one simple technical example.  The same holds true for the expanse of automated solutions and behavioral security controls as well.  Highly effective and efficient security strategies are forward thinking and understand how intervention and continual maintenance will be needed, then implement those capabilities as part of a complete service deployment.  Overall, the concept of ‘optimal security’ is one of fluid adaptations of controls to meet an ever changing target for risk acceptance.

Is the value of patch management decreasing?  Some experts say, due to a rise in privately held vulnerabilities, the value of patch management is eroding.  Others feel patching is losing the race and becoming too little and too late with the rapid development of attackers.  I too have chimed in on the topic and stated patching all vulnerabilities is not economical, as most are never widely exploited.  But does this mean we should be looking at alternate paths, away from patch management?  I stand firm in support of the end-node update concept, but take a slightly different view of the scope and value.

I see ‘patch management’ as the strategic capability of managing end nodes.  I consider the delivery of ‘patches’ as a broad term which includes OS, application, and hardware BIOS upgrades which can benefit the security posture of the device.  This includes and is akin to the widely accepted delivery of security product updates for anti-virus, anti-spyware, firewalls, etc.  Some of which are updated daily.

Attacks are constantly changing.  They normally take advantage of poor coding practices, use design functionality in unintended ways, or exploit avenues to misguided end-user judgment.  The ability to update systems is crucial to maintain security equilibrium.  It is a support function for systems to adapt to new threats.  This capability has a multitude of benefits, both strategic and tactical.  Being able to reach out to systems allows for a better understanding of the number, type, and usage of systems in the environment.  An effective system can paint a picture of systems at risk.  It is a sweeping means to close identified vulnerabilities in deployed code, which can reduce the exposure surface.  It can be used to respond to compromises and drive clean-up activities.  Such services can raise the general security level of a community and may drive to a more homogenous security stance, which strongly lends towards efficiency.

Mapping ‘patch management’ against a defense-in-depth model shows it allows for Prevention of exposure to known vulnerabilities where patches exist.  It can provide Detection capabilities to improve alerting of attempted as well as successful attacks.  Once systems are compromised, this Response function aids in the restoration of services back to a norm state.  The combination of indicators generated in these areas may assist in efficiency improvements and be used to comprehend future trends, therefore providing a potential Prediction opportunity

Overall, actively managing end-node security via ‘patch management’ is very important.  I doubt any serious security professional is advocating turning off all patch or remote system security updates.  The value may vary over time and across different systems, but we have a lot of control in how this capability evolves and the value it returns.  We are empowered to maximize the return on investment.

The question still remains, from a measures and metrics perspective, how best can we show and quantify the benefits, efficiency, and value.  The industry as a whole has yet been able to adequately or consistently tackle this challenge.  That discussion is fodder for another blog.

Everyone wants information security to be easy.  Wouldn’t it be nice if it were simple enough to fit snugly inside a fortune cookie?  Well, although I don’t try to promote such foolish nonsense, I do on occasion pass on readily digestible nuggets to reinforce security principles and get people thinking how security applies to their environment.

Common Sense
I think the key to fortune cookie advice is ‘common sense’ in the context of security.  It must be simple, succinct, and make sense to everyone, while conveying important security aspects.

Fortune Cookie advice for March:

The most successful civilizations rose to power, not by ignoring security, rather they ensured greatness through strategy and achievement.

For this month’s advice, you are a victim of eye-candy.  I created this slide for a recent presentation, to capture the audience’s attention and rouse some brain juices flowing.

The general message does hold true.  Security strategy is the long term endeavor to protect an organization’s future.  If the war is fought thinking exclusively about one battle at a time, you will lose the tide of initiative and ultimately spend most of resources responding to your opponent’s attacks.  If however, we keep in mind the end goals and manage to a state of optimal security, we can progress towards an advantageous and sustainable level of security.

We don’t have to win every fight, lock every door, and close every exposure.  Instead, we are in a position to selectively choose our victories to maximize our capabilities.  Our victory is finding the right balance of risk and costs.  Thinking strategically, in concert with tactical actions, will drive clarity for the desired end-state of security.

In practical terms:

• Have a plan and communicate it
• Understand the business need for security
• Prioritize security initiatives based upon their value
• Develop an overall defense-in-depth capability, with interlocking services
• Characterize the most severe threats and identify the most likely and impactful exposures
• Know what you are protecting
• Be cognizant of when you need more, have enough, or too much security

My moment of enlightenment is over.  It is time to get back to the grind of the security firefights.  But my strategy is never far from my mind.  It defines the boundaries and guides my tactical decisions.