Working in or with the IT industry? This is the thread to discuss it!

Branching off from a slightly off topic discussion in the housing market thread. I know there are a few people here working in the IT industry...


I don't believe it's the same. I've studied and worked in the network engineering field and if there's one basic lesson with IT security it is that physical security comes above everything else. All the other points are irrelevant if you don't have physical security.

Laptops left in taxis are a risk. If people are not taking work laptops home then this risk doesn't exist.

Viruses can penetrate defences. If corporate networks are secured properly by competent IT staff the likelihood of this happening is much much lower than if staff are taking laptops home and connecting them to their own private networks.

VPNs can be hacked. If you don't have staff working remotely (ie. from home) then this risk is reduced.

Anyone storing sensitive corporate data on USB keys is probably breaching security guidelines anyway so I don't see how this point is relevant.

So, I still think a corporate network without people connecting from elsewhere and without people moving data outside of the network at all is inherently more secure than any type of 'cloud' computing system (or whatever fancy sales term you want to use to define it).


Are you serious? Do you have any idea how much IP can be worth? I think not... I can invest 8K worth of my time into a product which I can sell to 10 clients and then I've made 80K. If I sell it to 50 clients I can make 400K. I find it impossible to believe that any organisation would consider losing IP to competitors as a "little risk".

Being a pretty security conscious person if I saw well founded reports of a major security breach within an organisation who I entrusted valuable data with (financial or medical or whatever else) then I would be looking for an alternative. The hassle is next to nothing compared to the real hassle involved in trying to claim some kind of compensation if you are directly affected. Maybe for you it's too much hassle. That'd be a personal decision.


Virtualisation is definitely a big step forward and one I think is excellent. This website is hosted on a virtual private server. The issues relating to security are nothing to do with being "conservative". Seriously Rob, I am looking at this topic from an IT security perspective. You sound like you're trying to sell something. What's your job title?


I just said it wasn't directly related to the discussion in the other thread, not that it was unimportant.

Interesting article about: Computers and the environment...

haha You really want this thread to take off!

Will comment when I have a bit more time!

Sure, why not? I bet there's at least half a dozen regulars working closely in this industry, and probably over a dozen overall in related areas - even if it's just at the help desk level.

If anything the help desk crew will be the ones with the funniest stuff to add to the thread anyway. For example about PEBKAC issues!

i work as an analyst/programmer at a private company

mainly java and oracle stuff

As you have stated, you're looking at security purely from an engineering standpoint. As far as your concerned, if you stop all these blasted people from doing this silly thing called 'working', your network would be 100% secure, error free and up 100% of the time. It is engineering nirvana.

Unfortunately, the real world does not work like that. Take your tech hat off for a moment and think about the average end user. Think about their experience. Corporate data IS stored on USB keys. Laptops ARE taking around the world and ARE regularly lost and stolen.

You seem to have completely missed my point about operational costs - you want people to work smarter, not harder. Locking down networks to the point where people can't work effectively is counter-productive.

Here is an example:

A hacker wanted to access a corporate network to gather corporate IP to sell to competitive companies.

How did he do it? Did he come up with sophisticated cyberattacks to access the network, through firewalls and unified threat management devices?

No.

He walked into the main foyer of the building, and dropped a CD on the floor. The CD was titled 'Corporate Salaries'.

He had access to the network within 20 minutes.

Why?

Someone picked up the CD, put it in their drive, and tried to access the data. What person in a company doesn't want to know what the person in the next booth is making?

The CD launched some malicious programs, unbeknowest to the user and corporate IT staff, and the hacker got what he wanted.

Another example:

Two men walk into a corporate headquarters dressed as removalists. They walk up to the counter, explain they are here to help with the removals on the 2nd floor. The receptionist asked them to sign in, and buzzed them through the security doors.

They proceeded to walk out with 4 servers containging all of that companies IP.

The receptionist did not ask to see ID, she did not check to see if the removalists were expected on the 2nd floor, and no one stopped 2 men dressed in overalls wheeling massive servers out of the building.

You can spend all the money on the world on engineering tight security defenses on your network. At the end of the day, human beings are the ones responsible for the security of the company's IP.

I believe security is important mate, I am with you on that one. I was merely providing a perspective on what I am seeing, not what people are doing

Fair enough. I know problems like what you described occur. But they're not risks that technical people like me can fight - they're social engineering problems that need to be addressed by others. Any places that have competent management and real security measures in place wouldn't have the types of things happening that you have described. The last few times I've been in larger corporate environments or data centres I've had to sign in and be guided by their staff to move around.

One data centre I visited had a policy that for each guest entering a server room there had to be one staff member with them! This was a place with a bomb proof section of the building storing equipment for financial institutions though and had a V12 backup diesel generator in the basement though so it made sense that they had a very tight security policy in place.

So basically you're completely right that security is not just a technical thing. In fact these days it probably takes more technical training than anything else to ensure real security.

I like it when we agree. I might start calling you Erika

Security isn't really my area of expertise. I just help people understand that IT can help business work better, and show them technologies they can use to help their businesses grow.

So to answer your question, yes I am in sales. Was I that blatant?

Imagine having a business where you don't need an IT infrastructure, you just need an internet connection and a terminal with a mouse and keyboard and screen.

We're almost there. And it's bloody exciting.

I move boxes.

Mmmmm boxes.

And I feel you're increasingly adequate at it too...

Don't call me Erika please. I could pick that you were in sales, yes.


What do you think that your internet connection and the laptop you described that you can take anywhere are going to connect to? You might not need an office to put your staff in with carpets you need to clean, but you sure as hell still need servers for them to connect to.

If anything I think we'll need more of the real IT infrastructure! Not only will the same central locations for storage systems and processing power be required, but network infrastructure will need huge capacity increases so that people can increasingly work at home with the same network performance as what they'd get if they were cabled in to a corporate network!

Did you actually read the first two paragraphs of that Economist article? It basically affirms my above point. The corollary of more computing in the sky is more and bigger data centres on earth. I read that as: people working in a cloud environment still need data centres to revolve around. Almost like clouds revolve around the earth. It's great that IT firms are increasingly marketing the fact that they are becoming more energy conscious though.

I have never disputed, nor refuted, this. I am unsure what you're arguing about...?

*confused in Adelaide*

Earlier you brought up how so many changes were driven by attempts to reduce running costs (you mentioned cleaning carpets, things like that). You called this the 'cloud' thing, just like what that article touches on. I am just saying that it might cut costs for some areas but it'll increase costs in others.

Ah, ok.

The 'cloud' is still many years away. As I have mentioned, businesses are only just now realising the potential of rationalisation and consolidation through virtualisation.

There are still 70%+ of the world's servers to shrink yet. As that process happens, cap ex and op ex will be reduced.

Once 'cloud' computing takes off, you will see many shared resources. As opposed to companies having their own dedicated infrastrucutre, they will share data centres, compute resources and security with other companies, in order to save further costs.

So I don't believe the data centre will disappear completely, quite the opposite. I think I am trying to articulate that the data centre will become a totally different beast, and I do not believe that Information Technology will be this disparate, hard-to-manage, resource-hungry animal for much longer.

Buy stock in VMWare. When they start virtualising mobile phones, you will be glad you did.

I wont jump in this debate, because I think you are both in agreeance with the importance of security. Now, as touched briefly in this topic, there is the subject of cloud computing and there is also the option as Software As A Service - where apps etc are all becoming web based to be accessed wherever and to store company data centrally.

Has anyone seen/ played with this? http://www.modsecurity.org/

firewall for web based apps - sounds very interesting - whilst this isnt the first web application firewall I have come across - I am pretty sure this is the first one available as open source.

Also, for those who provide hosting - there are some replacements for Horde and Squirrel mail -

Roundcube - http://www.roundcube.net/
AtMail - http://atmail.org/

If anyone knows how to get these installed as default mail client on CPanel - can someone help a brother out!?

Oli, did you see EDS and HP are trying merge to take on IBM's services business.

Even with the two companies merging, they still have less head count than IBM in Australia!

Yes I read about that. I don't know about HP but I think I'd much rather be working for IBM than EDS...

My mate works for them in Malaysia, he told me about the HP takeover. EDS are making some major inroad's into Asia at the moment, integrating some key markets, I'm sure they aren't too worried about the Australia focus...yet...should be an interesting battle. For my mate's sake I hope it doesn't get too ugly! On the flipside if it gets better for them he's gonna have even more headaches (workload) to deal with when the Aussie companies get poached!

My host offers AtMail for free alongside the Cpanel install (if you've opted for that). I don't use either... Might give them a try on the next VPS I use.

Why does having AtMail as the default for Cpanel matter? Can't you just install AtMail separately? Probably takes 10 minutes tops.

Would be pretty hard to hack the VPN at my work. We have this keyring things that have batteries in them and they display a different 8 digit number every 30 seconds. The VPN server needs to have the correct number entered ( as well as the username and password ) to connect.

I'm sure it would be "hard". My point is that every system can have flaws in it and no matter what is done security systems don't always work.

Funny thing is my bank (Bendigo Bank) offered to sell me one of those. I told them if they thought it was needed to make my online banking more secure they should be giving them away... The response was just a funny look.

RSA token?

I've been working in IT as sys admin and support for a while now, and the best analogy of security I've heard is a triangle, where each point represents either Security, User-Friendliness, and Cost effectiveness.

Move closer to security, the solution can get less cost effective and less user friendly.
Move closer to user-friendliness, and the security can be lessened, and the cost can go up.
Move closer to cost-effectiveness, and you can get a system full of holes that is dodgy and unstable.

So yeah. A three-fold Catch 22.

The other issue with security is, it doesn't matter how tight your system is, if your users don't give a stuff about protecting their password, or locking their computer when walking away, or putting their password on a post-it note attached to the screen, then it'll be a lot of wasted dollars and effort.


Fully.

That analogy is pretty spot on I think jimarko.

That said it really depends on what the IT systems are doing. For simple services like web and email hosting you can get pretty close to the centre of that triangle. It's just in corporate environments where customised applications or where systems are doing more complex things it applies completely.

Is anyone using virtualization extensively in their networks? Eg. With VMware ESX or Xen or Virtuozzo? I've been playing with VMware Server on a server here at home, running two instances of Windows XP. It works pretty damn well considering I only have 2GB of RAM and the CPU doesn't even have the special VT features that all new ones do... Also using VMWare Fusion on my Mac.

We have two IBM nodes running 18 virtualised servers on an IBM SAN here at work.

It rocks my jocks.

I think you mean servers They might be using a SAN for storage, but you can't run anything "on a SAN" since it's just a way to connect storage systems to servers...

Are they using ESX and running everything on top of that or some other virtualization platform?

I've got two VPS's now and it's pretty cool what feature the providers can offer. I can get a migration from a VPS to a Dedicated Server with no downtime, or changes in disk allocation, memory allocation, etc with no downtime.

The virtualised files reside on the SAN. They do not reside on the physical nodes.

The nodes provide the computation, the SAN provides the storage.

ESX only. It's the best virtusalistion platform on the market. I wouldn't waste my time, or money, on anything else.

Oli, check out Platespin - only replicating 32-bit servers (virtual and physical) at the moment, but will be a killer DR solution once they can replicate 64-bit architecture.

I would not jump to that conclusion about ESX. It depends on what it's being used for. If the others were a 'waste of time and money' then nobody would be using them, but plenty of people are.

That Platespin system looks good. I bet there are a few companies in the US who had systems in a data centre where there was an explosion and massive outage recently had something like that.

AFAIK, ESX is still the only software with VMotion functionality.

Novell have admitted to me their Xen product is 'rough around the edges'.

Microsoft have not even released a 1st generation hyper-visor yet. And when they do, in a few months, it will still need to be attached to a WIN2K8 O/S to function. Which kind of defeats the purpose of a dedicated hyper-visor in the first place.

I see the direct competitor to ESX being Citrix's Xensource product, but that is still not as mature as ESX. Citrix have a pretty cool VDI product though.

At the moment, all things being equal, VMWare have the best product. Ask the top 497 companies of the Fortune 500. They all use VMWare

You're talking about corporate environments.

If you look at the webhosting market the biggest player is Virtuozzo.

Your argument would look silly if you said 497 of 500 Fortune 500 companies use Microsoft products so Microsoft products are always the best and anything else is a waste of time, wouldn't it? Anyway, no need to nitpick. At the end of the day like I said, it depends what it's being used for.

Interesting product.

Does it automatically move workloads off of failing systems to available systems like ESX? I can't be arsed reading the whitepaper right now.

It can run on clusters and has HA features to move both servers and containers (their term for virtual machines) around without downtime, so to answer your question: yes.

For example, right now this site is hosted on a CentOS Virtuozzo VPS container, on a system with 8 CPUs (2x X5355 quad core 2.6Ghz Xeons) and 16GB of RAM (not all allocated to me unfortunately ). I've already enquired about this and my whole VPS can be migrated to a dedicated box with no downtime. The only change I'd have to make would be an IP addressing change. That's a network issue though not a virtualization one. I am actually considering doing this in the next few months...

Anyway Virtuozzo is really designed for a different area of the market compared to VMWare stuff, I wouldn't even consider them to be direct competitors in the market. VMware stuff is great if you have a real mix of OS's to run in a corporate environment, and they all need to do completely different things. Virtuozzo on the other hand is great for hosting solutions who need one platform only (RHEL or CentOS servers for example). From what I understand this specialisation (or you might call it a restriction) allows Virtuozzo to get very good performance, compared to some other products.

You didn't answer my question surrounding automation though.

Your explanation above leads me to believe you have to move the virtual servers manually off the node onto another available node, in order to take a node offline.

VMWare will move the virtual servers automatically in the event of catastrophic loss of systems. No manual intervention required.

Thus, management overhead is reduced, therefore reducing operational expenditure, which in turn saves the organisation money.

Anyway, as you said, sounds like they are similar in theory, but perform differently when in application based on different requirement parameters.

What other geeky things have you been looking at lately?

It can be done automatically.

Either way, you should apply for a job in sales at VMWare. 


Outsourcing or automating more of my management tasks with my own hosting systems, to reduce overhead, reduce my operational expenditure (in terms of time) and save me money.

That might sound like a joke, but it's not. At first I got into hosting business because I had 1 customer with some special requirements, which most hosts could not meet. Then I was in a fortunate position to be working for a company whose provider for hosting went bankrupt and who was completely unavailable to fix and rescue things. I wasn't prepared for the growth and didn't have time to set up some things the best way and now that is hurting (as in it's frustrating, not financially hurting).

Don't think VMWare haven't asked Oliver

Re: operational savings, you're circumstance sounds unique. I was looking at it from the corporate point of view, where (as you mentioned), IT managers have multiple, disparate O/S and applications, so to have their availability managed automatically takes some of the pain away.

Of course, server sprawl is server sprawl, regardless of whether it is physical or virtual. It's just that the management tools and automation capabilities for high availability are better with virtualised servers.

As you're not directly in control of the physical systems you manage, your circumstance is a little different.

Interesting to get your perspective though, helps me learn to overcome objections so I can sell the product better

Ok, changing tack back onto my favourite subject - SaaS and Cloud Computing

Google Apps have recently merged with Salesforce.com, and now Amazon.com has built a platform to deliver cloud computing.

http://www.salesforce.com/googleapps/

http://www.amazon.com/AWS-home-page-Money/b/ref=sc_iw_l_0?ie=UTF8&node=3435361&no=3435361&me=A36L942TSJ2AJA

My question is: Do you forsee that in the future, you will not own any IT infrastructure, or software licenses?

Instead, your desktop experience will be delivered to your terminal as a service, which you pay a monthly fee for. You can access an 'office-type' suite of products (Google Apps, Lotus Symphony, OpenOffice etc), along with your finance/HR/CRM/ERP/payroll application, delivered to you over the internet.

I am not just talking about this type of cloud computing in a corporate environment either. Even at home, everything can be done online now, meaning all you need is a connection to the internet.

Is the money in going to be hosting these services, or is the money going to be in designing the software that is going to be delivered as a service?

Absolutely, this is one area I specialize in. We provide enterprise-level solutions to SMB customers for a monthly fee. A lot of our customers are 'corporate refugees' who have worked for bigger businesses and miss having such technologies at their fingertips.

We virtualize everything through ESX on IBM servers with IBM SANs. ESX = the shit.

We have many customers who can't see the point of having a server, so we host everything for them - terminal server, Exchange, BES, Maximizer, Websense, etc etc. It is a very manageable solution and the client does not need to worry about maintenance, licensing, etc. Generally all they need at their end is an internet connection and an RDP client.

I believe that in the next 10 years cloud computing will shine and virtualization farms popping up everywhere.

Because of the nature of what I do, I can't see that I'll ever "not own any IT infrastructure", but I hope my business (like the one mylo is apparently working for, but on a different scale) is providing some of these services you're going on about. More $ for me.


Both. They have to complement one another anyway it's not as if one can exist without the other. How they'll balance is another question... That said if I look at the last 6 months of my own work I can tell you that I've made a hell of a lot more money designing "online software" than I have hosting anything.

Who do you work for bro?

I'm technically employed by Comprus, but Hostus is under the same roof and I am sub-contracted by them

Comprus = IT support
Hostus = hosting

I thought you might!

I deal with Rob Librandi on a pretty much daily basis

just have a couple of quick questions....
Chain emails., does the mere existence of them annoy I.T. professionals more than the content of the chain email.

Passwords, the programs that generate them for you, how safe are they ?.... is it better to just make up your own random-pattern password thats 40 characters long and has things like {, +, $, *, ), %, and ; in it ?

and how is proxy server spamming prevention coming along ?, I heard that's a real pet-hate of the I.T Industry, well a year or so ago, cause people learn fast.

They don't specifically bother me, because I don't get any. When people believe them though... That bothers me.


They're safer than anything you could think up against brute force attacks. That said, I suspect more systems are compromised by poor security in other areas, post it notes on monitors, social engineering, and other hole rather than bruce force attacks.


Single compromised machines are a bigger problem in my opinion (as an email server administrator).

ESX in a C7000 on a CX3 to an SL8500 here 

Truth. Back in the good ol' days most of the interesting logins this guy I know found were either a result of dumpster diving or social engineering.

 

http://vmware.com/company/news/releases/esxi_pricing.html

Go play with it for free now!

hey IT headz, probably the wrong thread sorry. I'm after a decent monitoring tool for xp that will give me detailed info on cpu usage and also ethernet usage. There's heaps out there, does anyone have any recommendations?

cheers

Isn't task manager decent enough or are you looking for something with longer term logging/graphing?

I've been playing with VMWare Server beta 2 a lot in the last week. Very impressed by this software - except that the web based console system only works in IE.