Wednesday, 22 October 2014

11 ways to re-energize your IT career

Mid-career blues, begone. Here are 11 actionable items tech pros can tackle to keep moving on up in IT.

Stuck in the middle -- and blue?
Eric Reed knows a thing or two about mid-career pitfalls. He's seen some mid-level IT managers get too enamored with technology for its own sake, rather than viewing it as a way to advance business goals. Other would-be leaders didn't know how to communicate or collaborate with non-IT colleagues and were sidelined as techies rather than ID'd as future business leaders.

Reed is grateful he was able to overcome those challenges in his own career and sustain his momentum -- he's now CTO at GE Capital. With that goal in mind, Computerworld asked Reed and other seasoned IT pros for advice on how to keep your tech career from getting bogged down. Read on for their tips.

Develop a road map
It's smart to know not just where you want to land but how best to get there. Piera Palazzolo, senior vice president at Dale Carnegie Training, which specializes in business-oriented improvement, recommends starting with self-reflection. Map out the exact positions you'd like to hold and the ultimate title you'd like to achieve. "Then set a course for yourself and find out what you need to learn," Palazzolo says. Talk to your supervisor and other higher-ups in the company to determine how they can help you and whether your company's plans for you mesh with your own.

Gain new perspective
Managers often pay lip service to the concept of "walking the shop floor," but James Stanger, senior director of product development at CompTIA, an IT trade association, suggests going beyond the typical pat-on-the-back mentality. Instead, get to know how your direct reports, your colleagues and your customers view the world.

"In middle management, due to the demands of the job and just trying to get it done, people get these blinders on, and they don't think about how others think," Stanger says. Try asking: What do you think about this problem? What's your perspective? Can you explain your need here?

"Take those blinders off and you'll find yourself much more nimble in your thinking," Stanger says, which in turn will make you a better problem-solver -- a valued leadership quality.

Find leadership opportunities
To continue honing your leadership skills, look for opportunities that will get you noticed -- especially ones outside of your department. "Volunteer for a cross-functional task force that exposes you to senior leaders. Get out of your silo, and get more people in your organization to know who you are," says Carly Goldsmith, a career coach specializing in guiding mid-career professionals. She suggests seeking out projects and committees that will help you grow your skills.

One of her clients took Goldsmith's advice, joining a project that required her to have more interactions and strategic conversations with senior leaders. The move paid off: She was offered a promotion shortly after the project wrapped up

Be a perfectionist
Sure, no one's perfect, but if you're gunning for more responsibilities, you have to make sure you're doing your current job as close to perfect as possible.

Sean Andersen, director of interactive services at Six Flags Entertainment Corp., works with IT managers across the company's 18 theme parks. He says he notices the ones who "keep their house in order" -- consistently fulfilling all of their assigned duties, including routine and mundane tasks that often get overlooked. Andersen taps those individuals for special projects because they're most likely to be able to handle additional responsibilities.

Case in point: When the company launched a pilot program with the new Chromebox two years ago, he went to the manager who had everything else already under control.

Learn constantly, and share what you discover
To protect yourself from becoming technically obsolete as you move up in management and away from the tech trenches, you need to be constantly building and refreshing a well-rounded set of skills. "The idea is to be constantly learning," CompTIA's Stanger says. Take more classes, get another certification, earn an advanced degree, he says.

If you're like most workers, your current job requirements already fill your work week, which means you'll have to dig hard to find more hours for learning something new. Andersen, the Six Flags executive, says he carves out time -- usually late at night -- to read up on and test out new technologies. And he says he likewise has doled out plum assignments to direct reports who show similar initiative.

Compensate for your blind spots
Reed, the CTO at GE Capital, admits that in the past he often didn't think about the impact his decisions had on other people. "I'd sign onto an objective and put together a plan, but I was not thinking about the ramifications on the team," he says. He didn't realize the problem until someone on his team called him out on it.

Reed says his headlong decision-making style didn't kill his career, but it had done some damage with his business partners. Now that he's became aware of his blind spot, he works to keep it front of mind as he makes commitments that affect his team.

Bernadette Rasmussen, divisional senior vice president of information management and CTO of Health Care Service Corp. (HCSC), agrees with Reed's approach. "Listen to your team members, listen to your peers and listen to your business leaders," she advises.

Know how your business makes money…
It's not enough to have generic business acumen. That's required for most technologists these days.

To gain a leadership position, you have to know how your organization operates and, more importantly, how it makes money. "Some people get into middle management and they don't understand that. They don't understand that we're not here to implement neat technology. We're here to help the business make money," Reed says.

He recommends spending more time meeting with business colleagues to develop that insight and then using it to make smarter decisions within IT. Understanding which technologies have the biggest impact on the company's bottom line will help you prioritize projects and deliver the big bang that draws attention, Reed says.

… then use that knowledge to drive business results
As an IT middle manager, you most certainly need to know technology and must consistently deliver on your technology projects. As an aspiring C-level leader, your priority should be making sure those projects deliver a tangible benefit to the company. In other words, show your ROI.

"You must change your perspective from mastering technology to helping your organization drive results," says HCSC's Rasmussen. "Help connect the dots, drive change with perspective beyond your own and add your unique value," she advises.

Be the expert that people seek out
You need to be more than an expert to attain a corner office -- you need to be the expert.

Theresa Caragol learned that lesson during her upward climb. "You have to be the best and have the deepest expertise so someone says, 'If I want to understand this, I have to go talk to this person.' And if you're the expert in more than one technology, that's even better," she says.

Caragol, now global vice president for channels and partners at Extreme Networks Inc., positioned herself as an expert in software-defined networking at a previous employer. Her mentors helped line up opportunities for her to speak on the topic, which brought her to the attention of those in positions to promote her. She worked her way up to vice president of global channel, alliances and partners at Ciena Corp., her previous employer, a role that in turn served as a stepping stone to her current position.

Manage up and manage down
If you really want to shine, make sure your team does. And make your manager look good, too. After all, in almost all cases your boss will be the one to recommend you for top assignments and promotions. Have regular face-to-face conversations where you can talk about company objectives, professional goals and, yes, even your personal interests, says Dale Carnegie Training's Palazzolo.

Put the same effort into building relationships with your team, because you're only as good as the output you get from them. Vidhya Ranganathan, senior vice president of products and engineering at cloud-services firm Accellion Inc., takes a commonsense approach to building relationships. She regularly has lunch with her team and chats over coffee. "It's not to give them [formal] guidance, but to just listen and let them know I'm available," she says.

Avoid missteps
To make your rise through the ranks as painless as possible:
Don't wait for your manager to offer you opportunities. There's a reason why Microsoft CEO Satya Nadella recently found himself embroiled a firestorm of criticism when he urged women seeking a raise to "have faith in the system" rather than asking for what they want -- it's bad advice for all employees. "Too often, middle managers take a passive approach to their career advancement" -- including raises and promotions, career-coach Goldsmith says. "Go out and find the opportunities yourself.
Don't linger in a job you dislike or that's not well suited for you. "Motivation plummets, mistakes are made, stress increases. And whether you're conscious of it or not, you start to be seen as a poor performer," Goldsmith explains.
Don't get trapped in the weeds. According to Goldsmith, middle managers often do more hands-on work than they should. You need to move out of the tech trenches and lead your team, not code with them.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Monday, 13 October 2014

Startup proposes fiber-based Glass Core as a bold rethink of data center networking

Software Defined Networking (SDN) challenges long held conventions, and newcomer Fiber Mountain wants to use the SDN momentum to leap frog forward and redefine the fundamental approach to data center switching while we're at it. The promise: 1.5x to 2x the capacity for half the price.

How? By swapping out traditional top of rack and other data center switches with optical cross connects that are all software controlled. The resultant “Glass Core,” as the company calls it, provides “software-controlled fiber optic connectivity emulating the benefits of direct-attached connectivity from any port … to any other server, storage, switch, or router port across the entire data center, regardless of location and with near-zero latency.”

The privately funded company, headed by Founder and CEO M. H. Raza, whose career in networking includes stints at ADC Telecommunications, 3Com, Fujitsu BCS and General DataComm, announced its new approach at Interop in New York earlier this week. It’s a bold rethinking of basic data center infrastructure that you don’t see too often.

“Their value proposition changes some of the rules of the game,” says Rohit Mehra, vice resident of network infrastructure at IDC. “If they can get into some key accounts, they have a shot at gaining some mind share.”

Raza says the classic approach of networking data center servers always results in “punting everything up to the core” – from top of rack switches to end of row devices and then up to the core and back down to the destination. The layers add expense and latency, which Fiber Mountain wants to address with a family of products designed to avoid as much packet processing as possible by establishing what amounts to point-to-point fiber links between data center ports.

“I like to call it direct attached,” Raza says. “We create what we call Programmable Light Paths between a point in the network and any other point, so it is almost like a physical layer connection. I say almost because we do have an optical packet exchange in the middle that can switch light from one port to another.”

That central device is the company’s AllPath 4000-Series Optical Exchange, with 14 24-fiber MPO connectors, supporting up to 160x160 10G ports. A 10G port requires a fiber pair, and multiple 10G ports can be ganged together to support 40G or 100G requirements.

The 4000 Exchange is connected via fiber to any of the company’s top-of-rack devices, which are available in different configurations, and all of these devices run Fiber Mountain’s Alpine Orchestration System (AOS) software.

That allows the company’s homegrown AOS SDN controller, which supports OpenFlow APIs (but is otherwise proprietary), to control all of the components as one system. Delivered as a 1U appliance, the controller “knows where all the ports are, what they are connected to, and makes it possible to connect virtually any port to any other port,” Raza says. The controller “allows centralized configuration, control and topology discovery for the entire data center network,” the company reports, and allows for “administrator-definable Programmable Light Paths” between
How do the numbers work out? Raza uses a typical data center row of 10 racks of servers as the basis for comparison. The traditional approach;

Each rack typically has two top-of-rack switches for redundancy, each of which costs about $50,000 (so $100,000/rack, or $1 million per row of 10 racks).
Each row typically has two end-of-row switches that cost about $75,000 each (another $150,000)
Cabling is usually 5%-10% of the cost (10% of $1.15 million adds $115,000)
Total: $1.265 million

With the Fiber Mountain approach:
Each top-of-rack switch has capacity enough to support two racks, so a fully redundant system for a row of 10 racks is 10 switches, each of which cost $30,000. ($300,000).
The 4000 series core device set up at the end of an isle costs roughly $30,000 (and you need two, so $60,000).
Cabling is more expensive because of the fiber used, and while it wouldn’t probably be more than double the expense, for this exercise Raza says to use $300,000.

Total $660,000. About half, and that doesn’t include savings that would be realized by reducing demands on the legacy data center core now that you aren’t “punting everything up” there all the time.

What’s more, Raza says, “besides lower up front costs, we also promise great Opex savings because everything is under software control.”

No one, of course, rips out depreciated infrastructure to swap in untested gear, so how does the company stand a chance at gaining a foothold?

Incremental incursion.
Try us in one row, Raza says. Put in our top-of-rack switches and connect all the server fibers to that and the existing top-of-rack switch fibers to that, and connect our switches to one of our cores at the end of the isle. “Then, if you can get somewhere on fiber only, you can achieve that, or, if you need the legacy switch, you can shift traffic over to that,” he says.

Down the road, connect the end of isle Glass Core directly to other end of row switches, bypassing the legacy core altogether. The goal, Raza says, is to direct connect racks and start to take legacy switching out.

While he is impressed by what he sees, IDC’s Mehra says “the new paradigm comes with risks. What if it doesn’t scale? What if it doesn’t do what they promise? The question is, can they execute in the short term. I would give them six to 12 months to really prove themselves.”

Raza says he has four large New York-based companies considering the technology now, and expects his first deployment to be later this month (October 2014).


Friday, 3 October 2014

9 cool Java 9 proposals developers will love

Modularity, JSON, smart compilation -- Java's future offers compelling features to look forward to

Cool Java 9 proposals developers will love
Java 8 arrived earlier this year to much fanfare, including high marks for lambda expressions and JavaScript on the JVM via Nashorn. But not everything about Java 8 was a love fest, and core developers at Oracle are already chalking up plans for the next version to improve Java.

Expected in early 2016, Java Development Kit 9, based on the Java Standard Edition 9 specification, is expected to include performance tweaks, new capabilities, and, most notably, modularity. While some proposed features could miss the final cut or be postponed to a later release, there's already a lot to like about Java's proposed future. Here is a preview of some of the most intriguing proposals for JDK 9 so far.

Modular source code
The most highly anticipated change to Java 9 will be modularity. Inspired by Project Jigsaw, which was deferred from Java 8 until Java 9, the effort to modularize Java's source code will be accompanied by a build system enhanced for this capability.

"Project Jigsaw aims to design and implement a standard module system for the Java SE Platform and to apply that system to the platform itself and to the JDK," according to JDK Enhancement Proposal (JEP) documentation. "Its primary goals are to make implementations of the platform more easily scalable down to small devices, improve the security and maintainability, enable improved application performance and provide developers with better tools for programming."

Multiple JEPs are planned as part of the modularization process.

Lightweight JSON API
Java 9 is expected to include a lightweight JSON API to facilitate the inclusion of JSON documents and data streams in Java programming.

"JSON has become the lingua franca for Web services and it is time for Java SE to adopt functionality for interacting with and utilizing JSON documents and data streams," a JEP document says. "This proposal is designed [to] provide the most commonly needed functionality and take advantage of Java 8/9 language and library features."

The JSON effort aims to enable Java developers to parse and generate JSON data. A generator style API for JSON data stream output and JSON literals is also a goal.

Process API updates
Java 9 is also expected to improve the API for controlling and managing operating system processes.

"The limitations of the current API often force developers to resort to native code," according to the process API JEP. Java SE presently offers limited support for native OS processes, allowing Java developers to simply set up an environment and start a process. Changes will require new unit and functional tests, according to the JEP.

OS differences mark the main risk facing this API, in particular Windows. "The design of this API needs to accommodate possible deployment on smaller devices with different operating system models. It should also take into account environments where multiple Java virtual machines are running in the same operating system process," the JEP states.

Segmented code cache
Java 9 aims to divide code cache into segments to improve performance and facilitate extensions.

"Instead of having a single code heap, the code cache is segmented into distinct code heaps, each of which contains compiled code of a particular type. Such a design enables us to separate code with different properties," the JEP states.

Top-level types of compiled code include JVM internal code, profiled and nonprofiled code, which would be separated. The organization and maintenance of compiled code has a big impact on performance, according to the JEP. Better control of the JVM memory footprint is a goal of this initiative, as is improved execution time for some compilation-intensive benchmarks.

Smart Java compilation, Phase 2
Java 9 proposes to improve the sjavac compiler tool, so it can be used by default in the JDK build. The tool is also expected to be generalized for use in other large projects.

"Due to various issues relating to stability and portability, sjavac is not used by default in the JDK build scripts," the JEP document states. "The first goal of this JEP is to resolve these issues. This involves making sure the tool produces reliable results on all software/hardware configurations at all times."

Currently, core developers have improved sjavac's build speed and allowed for incremental builds. "The quality of the code and stability of the tool as a whole, however, is not satisfactory and it is certainly not ready for public release."

Improve contended locking
Core Java developers aim to boost the performance of contended Java object monitors in the next iteration of Java, as measured by benchmarks and tests, including CallTimerGrid, among others.

"Improving contended locking will significantly benefit real-world applications, in addition to industry benchmarks such as Volano and DaCapo," JEP documentation states.

Performance improvements will be explored in a number of areas pertaining to contended Java monitors, such as field reordering and cache line alignment, as well as fast Java monitor enter and exit operations.

HTTP 2
Under development by the IETF, HTTP 2 aims to improve Web page loading times and API capabilities and is based on Google's SPDY networking protocol. "The focus of the protocol is on performance; specifically, end-user perceived latency, network and server resource usage," according to HTTP 2 documentation on GitHub. "One major goal is to allow the use of a single connection from browsers to a website."

Core Java developers are keeping an eye on HTTP 2 developments. "[This proposal is] basically looking at HTTP 2 and what is needed to support that," says Georges Saab, vice president of the Java platform group at Oracle and head of the Java Standard Edition group.

Cloud-optimized JVM
Core Java developers hope to enable users to better leverage existing cloud infrastructures with Java 9 by cloud-optimizing the JVM.

This proposal is all about helping with deployments of Java in the cloud, Oracle's Saab says.

Oracle already has been working on better enablement of cloud computing in Java EE (Enterprise Edition) 7. Plans call for building on that with Java EE 8, due in two years.


Ahead-of-time compilation
One common knock against Java is its relatively slower startup times. Java 9 proposes to fix this, by enabling ahead-of-time compilation to improve startup, among other benefits.

"The primary reason for adding ahead-of-time compilation to Java is improved startup time, but it may also bring other benefits such as smaller install footprint for self-contained Java applications that are bundled with a JRE [Java Runtime Environment]," says Henrik Stahl, vice president of java product management at Oracle.



Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Thursday, 25 September 2014

Why Amazon is rebooting 10% of its cloud servers

Amazon says a patch is needed to fix Xen hypervisor issue

Amazon Web Services issued a blog post on Thursday providing some more details of why the company needs to reboot up to 10% of its cloud servers in the coming days, and it doesn’t have anything to do with the so-called Shellshock vulnerability.

Amazon says that about Elastic Compute Cloud (EC2) servers from across the globe will be impacted by what it calls a “timely security and operational update” related to its open source Xen hypervisor. The blog post explains:

“As we explained in emails to the small percentage of our customers who are affected and on our forums, the instances that need the update require a system restart of the underlying hardware and will be unavailable for a few minutes while the patches are being applied and the host is being rebooted.”

The full blog post can be read here.
It appears to be just a coincidence that an update to the open source Xen Hypervisor is happening at the same time that security experts have identified a major vulnerability in Linux code known as the Bash Bug, which some are dubbing Shellshock. AWS officials say the two events are unrelated.

Amazon likely deals with many vulnerabilities each day and week, but Jesse Proudman, founder and CTO of cloud provider Blue Box says this Xen bug is different because it effects the hypervisor that creates virtual machines. The only way to appropriately patch the system is to reboot it.

AWS goes on:
“While most software updates are applied without a reboot, certain limited types of updates require a restart. Instances requiring a reboot will be staggered so that no two regions or availability zones are impacted at the same time and they will restart with all saved data and all automated configuration intact. Most customers should experience no significant issues with the reboots. We understand that for a small subset of customers the reboot will be more inconvenient; we wouldn’t inconvenience our customers if it wasn’t important and time-critical to apply this update.”

Amazon says that the updates must be done before October 1, when details of the Xen flaw are made public as part of the Xen update XSA-108 release. Expect at that time AWS and the Xen community will have more details as to the specific security flaw that is being patched.

Proudman suspects the issue is likely related to flaw CVE-2014-7155 In the Xen code, which was first announced on Wednesday. It was found that the bug can be exploited by a hacker to escalate its privileges, allowing the hacker to potentially glean access to other virtual machines. In contrast, an issue like Shellshock is something that can be patched in the Linux code and does not require a reboot of the machine.

Proudman says the CVE 7155 has been in the Xen code since the 3.2 release, which was in 2008. Still, he says that customers should not be too worried about the situation since Amazon will be updating all of its impacted machines before more details about the security vulnerability are publicly released on October 1. Proudman says AWS is absolutely doing the right thing by updating its systems and rebooting customer machines, even if that may cause some stress in the coming days.

The big takeaway for customers is that a subset of AWS instances will be rebooted at some point in the next five days. Cloud consultancy RightScale expects the reboots to begin at 10 PM ET on Thursday and run through Sept. 30 at 7:59 PM ET. Customers don’t necessarily have to do anything, but they should be prepared for their EC2 instances to go down for a few minutes if they’ve been notified by AWS. RightScale advises AWS users to test their system for a reboot. “It’s going to test the operational prowess of a lot of systems,” Proudman says.



Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com



'Bigger than Heartbleed' Shellshock flaw leaves OS X, Linux, more open to attack

Well, this isn't good. Akamai security researcher Stephane Chazelas has discovered a devastating flaw in the Unix Bash shell, leaving Linux machines, OS X machines, routers, older IoT devices, and more vulnerable to attack. "Shellshock," as it's been dubbed, allows attackers to run code on your machine after exploiting the flaw, but the true danger here lies in just how old Shell Shock is—this vulnerability has apparently been lurking in the Bash shell for years.

Why this matters: A large swath of the web-connected devices, web servers, and web-powered services run on Linux distributions equipped with the Bash shell, and Mac OS X Mavericks is also affected. The fact that Shellshock's roots are so deep likely means that the vulnerability will still be found in unpatched systems for the foreseeable future—though the odds of it directly impacting you appear somewhat slim if you use standard security precautions.
MORE ON NETWORK WORLD: Free security tools you should try

Heartbleed redux


The news comes as the security community is just shaking off the effects of Heartbleed, a critical vulnerability in the widely used OpenSSL security protocol. "Today's bash bug is as big a deal as Heartbleed," says Errata Security's Robert Graham, a respected researcher.

Hold your horses, Robert. Before we dive into dire warnings, let's focus on the positive side of this story. Numerous Linux variants have already pushed out patches that plug Shellshock, including Red Hat, Fedora, CentOS, Ubuntu, and Debian, and big Internet services like Akamai are already on the case.

But Graham says Shellshock's danger will nevertheless linger for years, partly because "an enormous percentage of software interacts with the shell in some fashion"—essentially making it impossible to know exactly how much software is vulnerable—and partly because of the vulnerability's age.

"Unlike Heartbleed, which only affected a specific version of OpenSSL, this bash bug has been around for a long, long time. That means there are lots of old devices on the network vulnerable to this bug. The number of systems needing to be patched, but which won't be, is much larger than Heartbleed."

Now consider that more than two months after Heartbleed was disclosed, hundreds of thousands of systems remained vulnerable to the exploit.
Maybe not Heartbleed redux?

But don't panic! (Or at least not yet.) While Heartbleed had the potential to be widely exploited, Jen Ellis of security firm Rapid7 says the Shellshock bug's outlook isn't quite as grim, even if it is rampant.

"The vulnerability looks pretty awful at first glance, but most systems with Bash installed will NOT be remotely exploitable as a result of this issue," Ellis writes. "In order to exploit this flaw, an attacker would need the ability to send a malicious environment variable to a program interacting with the network and this program would have to be implemented in Bash, or spawn a sub-command using Bash."

As a result, Ellis and Rapid7 urge keeping a level head about the bug.
"We’re not keen to jump on the 'Heartbleed 2.0' bandwagon. The conclusion we reached is that some factors are worse, but the overall picture is less dire… there are a number of factors that need to be in play for a target to be susceptible to attack. Every affected application may be exploitable through a slightly different vector or have different requirements to reach the vulnerable code. This may significantly limit how widespread attacks will be in the wild. Heartbleed was much easier to conclusively test and the impact way more widespread."

While older Internet-connected devices (like, say, security cameras) seem to be likely victims of Shellshock, respected security researchers Michal Zalewski and Paul McMillan note that many embedded devices don't actually use the Bash shell at all.

Beyond Linux-based systems, Graham and Ars Technica report that Mac OS X Mavericks contains a vulnerable version of Bash.

To test if your version of Bash is vulnerable to this issue, Red Hat says to run this command:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If the system responds with the following, then you're running a vulnerable version of Bash and you should apply any available updates immediately:

vulnerable
this is a test

"The patch used to fix this issue ensures that no code is allowed after the end of a Bash function," Red Hat reports. So rather than spitting out "Vulnerable," a protected version of Bash will spit out the following when you run the aforementioned command:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test

What does this mean?

When it boils down to brass tacks, most major websites and modern gadgets you own likely won't be affected by this Bash vulnerability, and Apple will no doubt patch the OS X implementation quickly. (Here's a highly technical DIY fix for now.)

It's impossible to know just how far this flaw reaches, and it's likely to linger on in neglected websites, older routers, and some legacy Internet of Things devices—many of which are impossible to patch—providing an opening for determined hackers to sneak into those systems.

So what should you do? Here's some actionable advice from security researcher Troy Hunt's tremendous in-depth primer on Shellshock:

"In short, the advice to consumers is this: watch for security updates, particularly on OS X. Also keep an eye on any advice you may get from your ISP or other providers of devices you have that run embedded software. Do be cautious of emails requesting information or instructing you to run software – events like this are often followed by phishing attacks that capitalize on consumers’ fears."

PCWorld's guide to protecting your PC against devious security traps can help you I.D. bad actors, while Ian Paul has three tips for spotting malicious emails over at his Hassle-Free PC column.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com



Monday, 1 September 2014

Happy Labor Day -- Will a bot take your help desk job?

Automation technology is getting better as help desk requests continue to rise

Competing forces are affecting people who work on help or service desks. One is improving automation tools, which advocates say can replace level 1 and 2 support staff. At the same time, the number of help desk tickets is rising each year, which puts more demand on the service desk.

These cross-currents in the industry make it hard to predict the fate of some IT jobs. A Pew survey, released in August, of nearly 1,900 experts found a clear split on what the future may bring: 52% said tech advances will not displace more jobs than they create by 2025, but 48% said they will.

Either way, a push toward automaton is certain. In the help desk industry, the goal is to keep as many calls for help at either Level 0, which is self-help, or Level 1, as possible. It's called "shift-left" in the industry.

"It costs way more to have a Level 3 or Level 2 person to resolve an issue, and it also takes a lot more time,' said Roy Atkinson, an analyst at HDI, formerly known as the Help Desk Institute. To keep costs down, help desks are increasingly turning to automation and improvements in technologies such as national language processing, he said.

A Level 1 worker will take an initial call, suggest a couple of fixes, and then -- lacking the skill or authority to do much more -- escalate the issue. The Level 2 worker can do field repair work and may have specific application knowledge. A Level 3 escalation might involve working directly with application developers, while Level 4 means taking the problem outside to a vendor.

Among the companies developing automation tools is New York-based IPsoft, a 15-year old firm with more than 2,000 employees. It develops software robotic technology and couples it with management services.

A majority of IT infrastructure will eventually be "managed by expert systems, not by human beings," said Frank Lansink, the firm's CEO for the European Union. IPsoft says its technology can now eliminate 60% of infrastructure labor tasks.

IPsoft's autonomic tools might discover, for instance, a network switch that isn't functioning, or a wireless access point that is down. The system creates tickets and then deploys an expert system, a software robot with the programming to make the repair. If it can't be done, a human intervenes.

Many service desk jobs have been moved offshored over the last decade, displacing workers. That trend is ongoing. One of the ideas underlying IPsoft's business models is a belief that offshore, as well as onshore, labor costs can be further reduced through automation.

Offshore firms are clearly interested. IPsoft's platform was adopted last year by Infosys and, more recently, by Accenture.

One IT manager using IPsoft's automation technology and services to support his firm's infrastructure -- including its network, servers and laptops -- is Marcel Chiriac, the CIO of Rompetrol Group, a Romania-based oil industry firm with 7,000 employees serving Europe and Asia.

"Without the automation, we would have to pay a lot more" for IT support, said Chiriac.

The cost savings arise from automatic repairs and routine maintenance that might otherwise be neglected, said Chiriac.

If he weren't using autonomic tools, Chiriac said he would have to hire more people for a similar level of service. But he can't easily estimate the impact on staff because of the firm's IT history. (Rompetrol Group outsourced its 140 IT staff, ended that relationship, then rebuilt an internal IT staff with about two dozen fewer workers; it also uses outsourcing as a supplement.)

Nonetheless, Chiriac doesn't believe that infrastructure automation will necessarily eliminate IT jobs, though it may shift them to other IT areas. "In IT, we're not going to run out of work for the next two generations," said Chiriac.

The work that help or service desks are asked to take on is increasing. Two-thirds of 1,200 organizations surveyed by HDI reported that the number of tickets, either to fix something broken or to outfit a new hire or change permissions, for instance, os increasing annually by more than 60%.

The top five reasons for this increase, according to HDI's survey, is an increase in the number of customers at surveyed firms, a rising number of applications, changes in infrastructure, increases in the scope of services, and the need to support different types of equipment and more devices. That latter could reflect BYOD use.

At the same time, support is being transformed in new ways. Service desks may, for instance, now act as a liaison for all service providers, including cloud and mobile carriers, said Atkinson.

"I think a lot of people have been predicting the death of support for a number of years, and it hasn't happened," said Atkinson.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Wednesday, 20 August 2014

Healthcare organizations still too lax on security

Data breach at Community Health is symptom of broader problem, security experts say

The data breach at Community Health Systems that exposed the names, Social Security numbers and other personal details on more than 4.5 million people is a symptom of the chronic lack of attention to patient data security and privacy within the healthcare industry.

For more than 10 years, the Health Information Portability and Accountability Act (HIPAA) has required all entities handling healthcare data to implement controls for protecting the data, yet many organizations pay little more than glancing attention to the rules because of the relatively lax enforcement of the standards.

The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services has begun cracking down recently on hospitals and other healthcare entities that have suffered security and privacy breaches. The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 introduced some significant penalties for noncompliance with data security requirements.

Yet, many health organizations don't see data security as a major concern until a breach. So far this year, healthcare entities have reported to the HHS at least 150 incidents involving compromises of personal data.

"The industry has a long culture of not recognizing the incredible value of healthcare information," to those who want to misuse it, said Deborah Peel, a physician and founder of the advocacy group Patient Privacy Rights.

Apart from a lack of real enforcement of any of the privacy and security provisions in HIPAA, the industry has also suffered from the lack of an auditing requirement for security, Peel said.

HIPAA doesn't require even large healthcare organizations to submit to a third-party audit of their data security controls. "Only if you have a breach or someone reports you are you likely to come to the attention of HHS," Peel said.

Companies in other industries, such has financial services, have to go to great lengths to externally validate their systems and provide audit reports on request, she said. "There is no such requirement in healthcare," even though the information handled by the industry is highly sensitive and far more valuable in the underground market than financial data.

"There is a lot of catching up to do. A lot of public trust is going to be lost," before real change happens in the industry, Peel said.

Things will probably have to get worse before it starts getting better, said Phil Lieberman, president of Lieberman Software, a security vendors.

"It will take a Target type of episode where a healthcare provider and their C-suite face demise due to the damage they have caused to their entire population of patients to get some providers to wake up," and invest in real security, Lieberman said.

The unfortunate reality is that most healthcare providers have little concern for having IT security, he noted. "There is no incentive for them to invest, nor is there any material consequence for their failure to protect their infrastructure. HIPAA has had little to no effect in protecting patient data."

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com