Encypt Everything!

Encryption is the encoding of information in such a way that it is useless to use. It renders plain text impossible to read. This is a very good thing if:

• You have sensitive information you don't want anyone to see. Some examples might be contracts, design drawings, new product information, or bookmarks of web sites that your wife would not approve of.


• Really believe that someone might be able to see this sensitive information.


• It is even remotely possible any one who could see your sensitive information would care enough to look at it.

In all seriousness, there is a lot of information floating around that is not for public consumption. Let's be honest, most of us have a list of passwords around. Those who say they don't either use only one password for everything (dangerous!) or are lying. One of the things I find highly amusing is when companies have extravagant document control processes in place and don't bother to encrypt said documents when they sit on someone's hard drive. So much for watching your assets...

Encryption is an interesting way to secure information. It does nothing to keep the bad folks from getting to your data. Instead, it makes the data unviewable and unuseable. It is no longer worth the hacker's time or energy to try and get at something important. Why go through the effort when you can't read the file? Even if the hacker is lame enough to take something, they can't see it or use it so it doesn't matter. In fact, while some idiot hacker is spending time looking at data that they can't use, your network security wizards are tracking the fool down and reporting him to the FBI. Ha ha ha! You can tell, I don't have a lot of respect for hackers but that's another subject.

It is imperative that mobile devices use encryption. It's just too easy for someone to lose a flash drive or CD. If you are transporting confidential information, encryption is a must. This is especially true for backup tapes. If I have to read one more report of backup tapes being lost and data not encrypted, I'll scream. How many times do we have to get hit in the head before we decide to wear a helmet? Many times apparently.

Every time another company reports losing unencrypted backup tapes it makes us all look like idiots. Earth to IT. Come in please. Encryption is a cheap (or free) feature and a checkbox in the software. If your backups are too slow for encryption then they are too slow period and you need to rethink your backup strategy. It's criminal not to use encryption.

The same is true for desktop files. There are lots of good solutions for encrypting files, either individually or through an encrypted drive. Encrypted drives are the easiest. The software creates a file, makes it look like a disk drive and - voila - encrypts anything sent to it. It is so easy that even your average end-user can figure out how to use it. Of course, you usually need to remember a password. Oooohhhh my gawd! How hard is that?

Many of the solutions are pretty inexpensive too. One software package that I like is TrueCrypt. It works great and it's free open source software. That's right friends - Free! It even comes in Windows and Linux flavors. You mount a file, partition, or entire device (like a flash drive hint-hint) and everything is encrypted. Safe. As in "no worries".

So, there are no more excuses left. Either encrypt or be made the fool. And let's be honest, who wants to have to say to the CEO "Um, sir. About those backup tapes..."

Imposed Standards Are The Most Enduring

I hate to admit it but the best standards are the ones rammed down our throats. Technology is chocked full of standards that have been imposed by a company or cabal that have been proven to have staying power. The telephone system, the cell phone system, cable TV (and now Internet access), and WINTEL are just a few of the many examples of imposed standards that we benefit from on a regular basis. In the storage world, many of the Fibre Channel switching standards in current use were imposed by a few companies, though eventually adopted by the T11 committees. Even Mozilla applications and the LAMP stack are controlled by a relatively small group of people, despite the term Open Source. A very small group of people decide on what is to be released and what is not. That's a cabal and that's good.

Constrast that to current situation with SMI, the Storage Management Interface, under development at SNIA for years. It is designed by a committee and as such subject to committee dynamics. So far, the output of the committee has not been widely adopted and is far from complete. Bits and pieces of the model are in use but there is no standard implementation - the original point was to have a standard interface to storage devices - and SMI is barely on the radar when it comes to buying decisions. SMI should have been, by now anyway, a standard feature that every IT manager assumes is in a product and without which no product could be purchased. Heck, it should already be implemetned in freeware and open source software. Too bad that's not the case, since this could be a very useful feature set.

It almost seems counterintuative that a standard that is imposed (is that really a standard then?) by a small group could be better or more quickly adopted then one created from an entire committee of the best minds from many organizations. There are three reasons why it is true.

First, the single-minded vision of a small group is much faster than the pluralistic mindset of a committee. Even if there is debate over direction or approach in the small group, there is usually a single arbitrator (such as an executive) to whom the group can turn to make a decision. That's rarely the case in industry or standards groups. While consensus would seem to make it more likely that a standard would be eventually adopted, trying to acheive consensus all the time slows a project down. Simply waiting for all committee members to go back to their own companies and come back with decisions can be time consuming. In many cases, consensus is nearly impossible because of the competing agendas of member companies. This is the bane of all industry groups - finding common ground in a competative environment. Having endured the old "what's good for the industry is good for your company" speech, I can say with authority that that's usually not the case. This is especially true when you are from a small and innovative company. Where's the incentive to share your best ideas until you have them out in a product?

Which brings us to reason number two - incentive. We live in a capitalistic world that values profit. Sharing your best ideas with a committee rarely results in solid return on investment. That is, unless you have products already that encapsulate those ideas. In that case, you not only control the market through superior products but the technology the market is based on. By opening up and standardizing your technology you remove obstacles to sales (fear of incompatibility and fear of lock-in) and generate side products that enhance the experience of your products. Meanwhile, you keep the good stuff for yourself. Sweet!

Finally, the standards are exposed to and shaped by market forces more quickly. Standards committees can become insular. They spend time contemplating their collective navels and arguing (yes arguing!) about tiny little issues that have no bearing on the market. I can still remember sitting in a standards committee meeting where the group argued for nearly an hour about the state of a single bit. When it was pointed out that the bit had no bearing on products or features that the IT managers cared about in the least, the group hesitated and then continued to argue. I left and had a drink with a potential customer, a much better use of company time. This tendency to lose market focus makes committee generated standards quite abstract and often useless in real world terms.

There are also imposed standards that fail. That's good. Very good. The market can shape products and standards quickly, discarding those that are not feasible or interesting and keeping the ones with real value. Committees cannot do that. The companies that send peopel to these standards groups have money and time invested in their ideas and won't let go of them until their customers make them. Standards committees thus become the zombie world for bad ideas that will not die a natural death.

So, when people whine that Microsoft is shoving a new standard down their throats, or that Apple has gone over to the Intel dark side, or even that we should "wait just a little longer for the committe to finish its work", remember that the imposed standard is usually the better one. Waiting fro the committee is like waiting for Godot. We all know by now that Godot never comes.

Treet! Almost as much fun as Spam.

The inspiration for this column came from, of all places, this blog. I occasionally will look through the comments left on this blog, the paucity of which convinces me that I'm only writing this for myself. A few weeks ago, there was a comment posted to the column on ILM. "Hooray!"I said to myself "Someone actually reads my drivel!" Alas, it was someone leaving the blog equivilant of spam.

We all know spam, right? That unwanted junk that shows up in our e-mail boxes full of fabulous offers to make us rich - if we will only help a Nigerian Prince transfer millions to our bank accounts - and to assist us in pleasing our spouse (nudge nudge, wink wink). Some spam is almost worth reading, if for no other reason then the comedy. Most, however, clog up our e-mail like hair and soap in a drain.

So, just as I figured that the bottom feeder purveyors of electronic mucous can't dip any lower, along comes something new - spam in my blog comments. Only, it's not very inventive spam, not particularly enticing, and not even entertaining. It is near-spam. Hence the title's analogy, for we all know that Treet is another company's version of Spam but not real Spam. I'm sure that the vermin infecting my blog think they are being clever by trying to make it look like a real post but they are not fooling anyone. It's like a rat masquerading as a squirral and wondering why everyone is staring at its long naked tail.

What I don't get is what they hope to accomplish. With real spam, you play a numbers game. Spam is so cheap to send out that if only a tiny fraction of the most gullible respond, you've done your job. Granted, your job is about as popular as a Roman tax collector in 5 B.C. but hey! we all have to eat. With treet, you have to hope that I'm (just me) particularly stupid or silly. How many people will actually read the comments in a blog, let alone the comments in a blog about technology from a relatively obscure analyst? Not the millions you need to make spam worthwhile. It seems like a proposition with a low return on investment.

Of course, if enticed by the treet, it pays to consider that it is unlikely that people who are spewing it out are not reaching much of an audience and most probably wasting their time. This is much the same way you need to consider what is in real Treet (or Spam) before deciding to eat it. You can't pop open a can of Treet, have lunch, and then complain that you don't like ham. If the method of marketing is this lame, it says something about what any business proposition (or other type of proposition) would be worth. Less than a can of Treet I would think.

So, while not nearly as low or dispicable as black hat hackers, virus makers, con artists, and ancient Roman tax collectors, these treet people are pretty close to the bottom rung of the social ladder. Worse, they are not even good con artists and scammers. I've seen better out of street people in Buffalo, NY.

To end, I would ask that the people who feel the need to dirty up my blog comment space with this trash, stay away. And while you're at it, how about leaving everyone else alone too. Go bother the folks at MSNBC or CNET. At least someone is reading those blogs.

Note: I have nothing against real Treet or Spam or any of the other fine product from Hormel or Armour. I don't eat either but who am I to say what someone finds delightful for lunch. Having eaten cold Spam out of a C-ration can, I can tell you that there were times I was really glad there was Spam. But not spam (small s). In no way do I mean to imply the companies that make these fine products, or the people that eat them are bottom dwelling, blood sucking lampreys. I reserve that for the spam (small s) and treet (small t) folks. Thanks!