Never be responsible for something that's only valued when absent

I wish I could follow this advice. I heard it from one of Google's CIOs. He said he never wanted to be a CIO because you end up being responsible for things that are only valued when they are unavailable.

Like email. Or worse, voice communications. There is a 100% expectation of dial tone. So people don't care about you meeting your 99.99% SLA. No, you are at risk of getting fired over the .01%

When in IT Operations, I used to whine that nobody notices when the train runs on time. It is only that one, cold, rainy morning that it was 20 minutes late that is remembered. Of course in the US, this is a bad example. The trains running on time would actually be notable. But you get the idea.

I sometimes envy actuaries. They make great money and can't be proven wrong until they are long retired. In IT, you can be proven wrong instantly and publicly.

Read More

"Best Practice" so often isn't

I was at a conference a year or so ago and watched a brilliant presentation by a Verizon scientist. His presentation was on virus patching. and he was making the point that our relentless multi-day patching is at best a waste of money and at worst it is making our systems less secure and less reliable.

At conferences, I feel as if it was worth attending for one bit of wisdom to carry forward. In this case, it was his words that I noted:

Doing the same thing, only better, is almost always a waste of money.

His presentation used car safety as an example. He showed how safety was vastly improved by a seat belt. A standard vinyl seat belt is strong enough to lift the car it is in. He said for $1000 you could put in a titanium seatbelt that would be strong enough to lift the building we were in. This titanium seatbelt would improve your chances of survival by 2%. He plotted a graph, showing the improvements from nothing, to kite string, to rope, to vinyl seatbelts and finally titanium seatbelts.

It was a masterful speech, so I was thinking sure, I'd spend $1000 to improve my chances of living. He then drew something along the lines of the graph above and marked that zone of "best practice" and spoke the line that I wrote down: "doing the same thing better is almost always a waste of money." Because he then drew a different line that showed how an air bag (duh!) costs only $100 but increases survival chances by something like 30%.

So, he was doing something different, not just the same thing better.

I remembered this as I am now having that loathsome term "best practice" thrown at me left and right. The latest example is password policy. I am told that best practice involves complex passwords that require:

• upper case letters
• lower case letters
• numbers
• special characters

Curiously, there is a limit of 6 to 12 characters. Six is too small a lower range, and 12 is also too small for an upper range. I pointed out that according to this "best practice" passwords such as Pass!1 followed by Pass!2 would be perfectly acceptable. That's the wrong argument, though. It just gets the auditors to add more rules (no password that contains contiguous letter similarities with the previous 100 password).

Human nature is such that nobody is going to pick a password like $fHY^*L MkL~ü. People will game any system that you make too hard for them.

I point out to internal auditors that certainly one "best practice" concerns itself more with password length than character set. "bestpracticesooftenisnot" would be an obscenely good password. It's 24 character length makes it, with current technology, uncrackable for more than a century. It is also something a user can remember, and so they are less likely to write it down. And on an iPhone or other small device, it avoids the giant pain (and inevitable mistakes) associated with special characters.

So my suggestion is a minimum password length of 15.  Also,  issue some guidelines to help people pick better rather than worse passwords. Perhaps show them diceware. I find that fascinating - even given a known list of only 7,776 words. a password of 5 words constructed with diceware, all lower case, is resistant to years of brute force attack. That would be another lovely thing to get past the "best practice" crowd - if a strong password is safe for years, why does policy force you to change it every 30 days?

The wisdom regarding best practice applies to much more than passwords, of course. So whenever you find someone talking about best practice, pause for a moment. What is really being discussed is an incremental investment. So the decision doesn't have to be obedience to such an obvious term as best practice (who would be against doing things the best way?). You have to rise above that and ask if the incremental investment will yield a reasonable incremental benefit. And then you need to look at all of the things you are considering, and pick the ones with the best cost/benefit. In this way, you may find your current practices may not be the theoretical "best", but they are good enough. This might result in you inventing the next airbag instead of titanium seat belts.

Read More

SysAdmin; OnPrem versus the Cloud

It used to be I hated the letters e and i. Everything in the 90s was eSomething or iSomething. Heck, one of the companies I worked for started with a lowercase i.

Now I hate the word Cloud. Everything is branded that way, whether it deserves it or not.

But while I hate the term and its marketing overuse, I am completely bought into the concept and the value proposition. Take my recent experiences with SharePoint, both an on premise version and the hosted version from MS 365:

Getting Ready
On premise: I have to find a physical server or make a new virtual server. I have to size it appropriately and then load Windows Server. I'm not really up on the latest versions of Windows Server, so this is 2008R2. Of course, before then, I had to buy Windows Server. Oh, and now I realize that I have to do the hardware and software thing all over again for SQL Server. While you can run both on the same hardware, it's not "best practice." I also have to worry about disk space on my SAN. SharePoint, if it's successful, can gobble up a lot of space. So now I have a Windows Server and a SQL Server, I need to buy and install SharePoint server. Same with SQL Server. It's not particularly onerous, but it's definitely a couple of days of work. So, lots of time and money later, I have the basic infrastructure to run SharePoint. But I still have to make sure I am monitoring the servers, backing them up, applying patches and anti-virus updates. So much work, and I haven't published the first page in my first site. Also, if I want this to work outside my LAN, I need to setup firewall rules.

Office 365: OK, I'm very lucky to work at a non-profit where Microsoft gives us Office 365 for free. SharePoint 365 is included. From a setup basis, I am done! And I have some ridiculous disk allocation - something like 1 TB if I want it.

The winner: Office 365 (even at commercial rates)

Deploying
On premise: Being fairly experienced with SharePoint, this is familiar ground for me. I map out sites and subsites. I create a navigation structure. I am tied to our internal Active Directory, so user setup is straight-forward. And being on my own server, I can add in 3rd party webparts easily, or even write my own. I can review logs and dive directly into the SQL Database.

Office 365: In this environment, I am using SharePoint 2013. It's nearly identical. I have my AD federated with MS, so user setup is easy. A downside I discovered: 3rd party webparts are more limited - only what you can get from the MS SharePoint store. And a real bummer: logging is almost non-existent. I can't see what pages are being accessed the most, or which users are contributing the most. MS really needs to fix that.

A major bonus with 2013, especially in the O365 offering, is Office Web Apps and OneDrive (nee Skydrive). With these apps, users can edit (heavily, although not as complete as the full Windows applications), view, share, version control and even group edit all documents, spreadsheets and presentations, all within a browser window. All of my users have 25GB of personal space, and I have a few hundred GB devoted to shared documents.

The winner: A toss-up, but the OneDrive integration with Web Apps has me giving the nod to Office 365

On-going support:
This is where the hosted variety really shines. I don't need to worry about the underlying infrastructure at all. It's being patched, virus protected, backed up and updated. It's load balanced across Microsoft's elastic cloud.

Of course, sometimes the all-included model can cause problems. MS recently released a patch (in some non-traditional way) that caused all O365 applications to say "something went wrong" or "we're sorry, but try again later." Late last year, the migration from SP 2010 to SP 2013 was not friendly. But they fixed these things pretty quickly, and you always run a risk of down-time with on-premise services, especially if you are a jack of all trades (master of none).

The winner: Office 365

Summary
I work for an organization with a small IT shop and a small budget. We don't have the resources to dedicate to server management, database management, SharePoint administration. Our Exchange server, SharePoint, and Office Apps with OneDrive all benefit from being hosted. We can quickly use these tools instead of spending all of our time and money preparing them for use. Sure, some of the use may be more limited than would be the case "On Prem", but if you don't have the resources to make all that other goodness work, it's not worth it.

I will be curious to see how my opinion may change with Lync. At the moment, we are making limited use of Lync in O365. But when we upgrade phone and video systems, we may find that this integration is too valuable to give up. Of course, by then Microsoft may have done a better job with this integration. And also, perhaps the VOIP phone system of our future will be cloud-based itself.

For things unique to your business or those that confer a competitive advantage, by all means run them in-house with in-house expertise. But for everything else, it's a better decision to forego a little control and a few features by going into the cloud. It frankly blows my mind that anybody runs in-house Exchange servers anymore. Servers, electricity, data centers, disaster recovery, software licenses, software upgrades, the cost of Exchange Administrators, disk space, etc. The cost is staggering, and all for email.

Read More