The one thing we know for sure about IT is that the technology is constantly changing. Staying current with that technology, and acquiring the skills to support it, is a career necessity. Whether you simply need to learn the latest techniques or you want to completely retool, if your employer or client does not fund the training, it could be very expensive for you. Fortunately, there are some low/no-cost alternatives to conventional training programs that might even be more effective and be a better fit for your learning style.
#1: Public libraryAs obvious as this resource is, I am always surprised at how many people never think of it. Though some of the material may not be the latest, you might be surprised, especially if you have access to a fairly large metropolitan library. Do not forget about videos and DVDs either, especially for training on less technical, common applications, such as QuickBooks or Microsoft Access. If you are looking for business or methodology training, you may also want to look for audio books. You may not be able to find detailed information on the Rational Unified Process (RUP), but Six Sigma and other initiatives in which your company or client may be involved may well be there. Audio books also enable you to convert idle drive time, or exercise time, into a value-add for you and your client.
If you are stuck in a small town with limited resources, consider approaching a larger library system to become a guest patron. Many times this is available to the public for a fee, but your local library may also have a reciprocal agreement with them, in which case access to the other library system may be free. Also, if you do teaching at a school of any type, you may be granted access to a library system if you can show proof of your status as a teacher.
University libraries are another rich store of material from which you can learn new skills. But unless you are a student at the school, it may be less than straightforward to check out materials. If the university is state-funded, you might be permitted to check out material if you are a resident of the state. If the university you approach does not permit you to check out material, you can always make a routine of camping out there for a couple of hours each week and learning on the premises.
#2: Company library/resourcesMany companies have their own libraries and training that are available for the asking. Training is usually a part of human resources, so you might start there if the company doesn’t have a formal training department. If you are an independent consultant, does your client have a library you could tap into? It has been my experience that clients are generally quite willing to open up their training to outside consultants, especially if the training makes the consultants more effective in working with them.
If there is a cost associated with the training, however, reimbursement can be complicated, as clients usually lack a process for accepting that type of payment. Very large companies have particularly difficult time accepting money for training, but do not give up. Your client’s department may still be willing to carry your training if they see a material benefit.
#3: Vendor trainingIt is to a vendor’s advantage to have you use their product, and use it effectively. To that end, many vendors offer training for little or no cost. This training is made available in a variety of formats, including:
Training sessions at conferences and trade fairs
White papers
Online tutorials
Online/on-demand videos
Special training events
You will not find a five-day intensive training session available for free, but you can still learn quite a bit from these free vendor resources. The more prepared you go into a vendor’s event, including being armed with questions, the more you will gain from the experience.
#4: PodcastsPodcasts are becoming increasingly popular among the typical channel of technical media and vendors. They include product information or interviews with experts in a particular field and tend to cover fairly narrow topics, such as the software quality topics offered by StickyMinds. There are also a number of resources from more public sources, such as iPod and YouTube. These may come from a number of academic sources, or they may be the product of someone who simply has a passion for the subject.
#5: Webinars/webcasts and virtual trade showsOne of the greatest developments for people who actually have to work for a living, webinars and virtual trade shows offer a no-travel way to accomplish in an hour what used to take an entire day. Virtual trade shows are not as well attended by vendors as live trade shows, but as vendors figure out how to use the new venue, I expect more will start to join in. Advantages, besides the obvious lack of travel and enormous time savings, include having a fairly narrow topic focus and relatively easy access to representatives. There are also some pretty awesome networking opportunities, as well.
Webinars usually consist of an industry expert providing general information, followed by product information from the sponsoring vendor. The product typically has some tie to the overall topic, and many times, the product information portion of the webinar may be as informative as the general topic portion. If the sponsor has a broader interest in the industry, such as an association or a publisher, the entire webinar may be information-oriented, with no product application.
Various webcasts can be found at TechRepublic, as well as at other publishers.
#6: Associations and user groupsNational organizations typically have a number of resources that you, as a member, can participate in. These may include online libraries, peer forums, and training courses. There may be a cost associated with some of this training, and access to some of the resources may require a paid, or premium (read: more expensive), membership. But when you consider that a membership to the Association of Computing Machinery, for example, can give you access to more than 1,100 books online, in addition to their journals and proceedings, it might well be worth the annual membership fee.
User groups, or other local groups that share your interest in a particular topic, offer a great forum to learn and share information for little or no cost. Special interest groups (SIGs) within the user group offer further topic specialization and can be a tremendous way to learn or be mentored. Check with vendors that interest you, as they may maintain a list of user groups in your area that relate to your product. Microsoft, for example, has a site with user group information, as do other major manufacturers. Consider, also, simple word of mouth and the “community calendar” section of your local paper to find out about upcoming meetings of groups that may interest you.
#7: VolunteeringThe best way to learn is by doing. However, most companies are not willing to pay you while you learn. If you have all of the books and tutorials, but just need to get your hands dirty, why not volunteer to do a project for someone for free? Churches and nonprofits might need some work done that you can help with. A new Web site, a donor tracking system, or automation of monthly billing are all things that might benefit them and can give you the hands-on experience you need to approach a prospective employer or client. This is an especially good approach if you are trying to retool yourself with some new technology, or least a technology that is new to you.
This same approach can be applied in an incremental fashion with existing work you may be doing. Can you work a little beyond your current job description? If you are working within an old development methodology, for example, but want to try what you have learned about RUP, redo a portion of your work in the style of the new methodology, such as use cases. There is nothing like trying a skill on a real project to give you a real sense of the process, and sometimes a real sense of how much you still need to learn. Who knows — besides getting some great experience, you might even start to convert your team to the new process (but don’t get your hopes up).
#8: The InternetWho has not Googled to learn more on a topic or to clear up an office dispute on the origins of some phrase or song lyric? This same resource is a great learning tool. A simple topic search can produce content from college courses, vendor training, and government information sites. Don’t be surprised if some of this content offers better explanations than some text books.
Online publishers are another great source for information to enhance your skills. Consider dropping a topic that interests you into the search field at a site such as DevX, and you may be surprised how much detail you will find.
#9: Continuing educationContinuing education programs, also called adult education or community outreach, offer nondegree classes that are generally conducted in the evening for a modest fee. Besides the stereotypic class on how to weave a basket, many programs also offer database, networking, and a number of other technology classes. Many of these programs are run through high schools and colleges, so if you are not aware of any programs in your area, start by checking with your local high school, career center, or university for contact information.
#10: Community collegeState-run community colleges generally offer a number of affordable classes you can take without seeking a degree. Many of these colleges offer technology and programming classes. Because you have probably not taken the prerequisites for the class, you may need the permission of the instructor, but that should not be a problem if you are already a professional in the field. These programs are usually far less expensive than your typical week-long vendor training and are usually scheduled during the evening to minimize the impact on your workday. There may also be for-profit community colleges in your area. But since they may lack public subsidies, be prepared to pay substantially more for their course offerings.
One less hurdleLimited time, family demands, and travel may still keep you from dedicating to learning a new skill, but if you’re creative, cost doesn’t have to be an obstacle. In fact, the nature of some of these suggested training alternatives lend themselves nicely to working around the time and travel constraints that are so often a barrier. Take advantage of as many of these training approaches as you can, and you will have one less hurdle to moving your career forward.
Tuesday, October 7, 2008
10+ tips for combating Computer Vision Syndrome
If you spend two or more hours a day in front of a computer, you might suffer from Computer Vision Syndrome (CVS). Symptoms include headache, inability to focus, burning or tired eyes, double or blurred vision, and neck and shoulder pain.
Computer screens are the culprit. Our eyes don’t process screen characters as well as they do traditional print. Printed materials have well-defined edges and screen characters don’t. Our eyes work hard to remain focused on screen characters and to temporarily relieve stress, our eyes drift and then strain to refocus. The constant muscle flexing causes fatigue. Keep in mind that computer screens aren’t the only screens that matter — most of your electronic toys, such as cell phones and PDAs, also cause eyestrain.
Fortunately, there are a number of simple (and mostly free) things you can do to alleviate CVS. Don’t wait until you’re suffering. Make these adjustments now.
#1: Use proper lightingMost office settings use bright, often harsh lighting. The more light the better, right? Unfortunately, that’s not true, but the solution to harsh bright lights is simple. Knowing that the bright lights are hurting you is often the bigger problem.
If you have a window, use blinds or curtains to limit the amount of sunlight beaming in. Use lower intensity bulbs and tubes inside. If you have both, turn off the indoor lights and open your blinds or curtains until you’re comfortable.
If you’re used to working in bright light, you might feel a bit out of sorts at first. Give yourself some time to adjust to the softer lighting. If you can’t control the lighting, consider wearing tinted glasses.
#2: Reduce environmental glareGlare is reflected light that bounces off surfaces such as walls and computer screens. Often, you don’t even realize you’re compensating for it, so finding glare might take a bit of effort. There are a few things that you can do to reduce the glare:
Paint bright walls a darker color and use paint with a matte finish.
Install an anti-glare screen and/or a glare hood on your monitor.
If you wear glasses, consider applying an anti-reflective coating to the lenses.
Glare screens help only part of the problem. They cut down on glare from the computer screen. Unfortunately, they won’t help your eyes focus better.
#3: Use proper computer settingsOne of the simplest ways to reduce eyestrain is to adjust your monitor’s brightness and contrast settings. There’s no right or wrong setting. Just experiment until you’re comfortable.
If the background gives off a lot of light, reduce the brightness. In addition, keep the contrast between the background and characters high. Generally speaking, your settings are probably too bright, but a setting that’s too dark is just as tiring.
#4: Maximize comfort by adjusting text size and colorAdjusting the on-screen text’s size and color can provide relief. First, try enlarging the text. You’re probably using the smallest size you can to view more text on the screen, but that compounds the problem. Instead, enlarge the text to two to three times the smallest size you can read. Almost all software and most browsers will let you adjust text size. When possible, use black text on a white background. And avoid busy backgrounds. Sometimes, you have no control, but do so when you can.
#5: Take a break!
The AOA also suggests you follow their 20/20 rule when regular breaks just aren’t possible. Every 20 minutes or so, look away from the screen and focus on something in the distance for about 20 seconds.
(Breaks can be a touchy subject in the workplace, so discuss your needs with a supervisor. Don’t get yourself into trouble.)
#6: Clean your screenThe easiest tip of all is to clean your screen frequently. Dust, fingerprints, and other smears are distracting and make reading more difficult. Often, you don’t even see the dust; you just look right past it. Make it a habit to wipe off your screen frequently. Every morning isn’t too often and is easy to work into your routine.
#7: Position copy correctlyGlancing back and forth between a printed copy and your computer screen causes eyestrain. To ease discomfort, place the printed copy as close to your monitor as possible. In addition, use a copy stand if possible to keep the copy upright.
This is the one time you might want more light. A small desk lamp will suit your needs, but position it carefully so that it sheds light on the printed page but doesn’t shine into your face or reflect off your monitor. Remember to use soft light.
#8: Position yourself correctlyKeep your distance from the monitor; most people sit too close. Position your computer monitor about 20 to 24 inches from your eyes. Your screen’s center should be about 10 to 15 degrees below your eyes. This arrangement provides the best support.
If you can’t change the distance between you and the monitor, adjust the text accordingly. For instance, if you’re sitting farther away than you should, increase the text size. It’s not the best solution, but it’s better than straining to see something that’s too far away.
#9: Get computer glassesIf you just can’t get relief, you might need special glasses you can wear just for working at the computer. You can’t pick these at your favorite discount store. You’ll need a prescription from an eye doctor.
Don’t depend on prescription reading glasses to negate CVS either. Reading glasses help with distances of 16 to 21 inches. In contrast, computer glasses work for distances of 18 to 28 inches. It’s unlikely that the same pair of glasses will accommodate reading printed material and working at your computer.
#10: Seek alternative helpIf all else fails, try something a little different, like yoga. In an Indian study of 291 people, half practiced yoga daily for an hour, five days a week, and noticed an improvement after 60 days. The other half, those not practicing yoga, saw no improvement. If your eyestrain doesn’t disappear, at least you’ll have fun and feel better in general.
Computer screens are the culprit. Our eyes don’t process screen characters as well as they do traditional print. Printed materials have well-defined edges and screen characters don’t. Our eyes work hard to remain focused on screen characters and to temporarily relieve stress, our eyes drift and then strain to refocus. The constant muscle flexing causes fatigue. Keep in mind that computer screens aren’t the only screens that matter — most of your electronic toys, such as cell phones and PDAs, also cause eyestrain.
Fortunately, there are a number of simple (and mostly free) things you can do to alleviate CVS. Don’t wait until you’re suffering. Make these adjustments now.
#1: Use proper lightingMost office settings use bright, often harsh lighting. The more light the better, right? Unfortunately, that’s not true, but the solution to harsh bright lights is simple. Knowing that the bright lights are hurting you is often the bigger problem.
If you have a window, use blinds or curtains to limit the amount of sunlight beaming in. Use lower intensity bulbs and tubes inside. If you have both, turn off the indoor lights and open your blinds or curtains until you’re comfortable.
If you’re used to working in bright light, you might feel a bit out of sorts at first. Give yourself some time to adjust to the softer lighting. If you can’t control the lighting, consider wearing tinted glasses.
#2: Reduce environmental glareGlare is reflected light that bounces off surfaces such as walls and computer screens. Often, you don’t even realize you’re compensating for it, so finding glare might take a bit of effort. There are a few things that you can do to reduce the glare:
Paint bright walls a darker color and use paint with a matte finish.
Install an anti-glare screen and/or a glare hood on your monitor.
If you wear glasses, consider applying an anti-reflective coating to the lenses.
Glare screens help only part of the problem. They cut down on glare from the computer screen. Unfortunately, they won’t help your eyes focus better.
#3: Use proper computer settingsOne of the simplest ways to reduce eyestrain is to adjust your monitor’s brightness and contrast settings. There’s no right or wrong setting. Just experiment until you’re comfortable.
If the background gives off a lot of light, reduce the brightness. In addition, keep the contrast between the background and characters high. Generally speaking, your settings are probably too bright, but a setting that’s too dark is just as tiring.
#4: Maximize comfort by adjusting text size and colorAdjusting the on-screen text’s size and color can provide relief. First, try enlarging the text. You’re probably using the smallest size you can to view more text on the screen, but that compounds the problem. Instead, enlarge the text to two to three times the smallest size you can read. Almost all software and most browsers will let you adjust text size. When possible, use black text on a white background. And avoid busy backgrounds. Sometimes, you have no control, but do so when you can.
#5: Take a break!
The AOA also suggests you follow their 20/20 rule when regular breaks just aren’t possible. Every 20 minutes or so, look away from the screen and focus on something in the distance for about 20 seconds.
(Breaks can be a touchy subject in the workplace, so discuss your needs with a supervisor. Don’t get yourself into trouble.)
#6: Clean your screenThe easiest tip of all is to clean your screen frequently. Dust, fingerprints, and other smears are distracting and make reading more difficult. Often, you don’t even see the dust; you just look right past it. Make it a habit to wipe off your screen frequently. Every morning isn’t too often and is easy to work into your routine.
#7: Position copy correctlyGlancing back and forth between a printed copy and your computer screen causes eyestrain. To ease discomfort, place the printed copy as close to your monitor as possible. In addition, use a copy stand if possible to keep the copy upright.
This is the one time you might want more light. A small desk lamp will suit your needs, but position it carefully so that it sheds light on the printed page but doesn’t shine into your face or reflect off your monitor. Remember to use soft light.
#8: Position yourself correctlyKeep your distance from the monitor; most people sit too close. Position your computer monitor about 20 to 24 inches from your eyes. Your screen’s center should be about 10 to 15 degrees below your eyes. This arrangement provides the best support.
If you can’t change the distance between you and the monitor, adjust the text accordingly. For instance, if you’re sitting farther away than you should, increase the text size. It’s not the best solution, but it’s better than straining to see something that’s too far away.
#9: Get computer glassesIf you just can’t get relief, you might need special glasses you can wear just for working at the computer. You can’t pick these at your favorite discount store. You’ll need a prescription from an eye doctor.
Don’t depend on prescription reading glasses to negate CVS either. Reading glasses help with distances of 16 to 21 inches. In contrast, computer glasses work for distances of 18 to 28 inches. It’s unlikely that the same pair of glasses will accommodate reading printed material and working at your computer.
#10: Seek alternative helpIf all else fails, try something a little different, like yoga. In an Indian study of 291 people, half practiced yoga daily for an hour, five days a week, and noticed an improvement after 60 days. The other half, those not practicing yoga, saw no improvement. If your eyestrain doesn’t disappear, at least you’ll have fun and feel better in general.
10 ways to survive office politics
Office politics will never go away. It’s a fact of company life. However, destructive office politics can demoralize an organization, hamper productivity, and increase turnover. Here are some tips, applicable for both staff and management, on dealing with office politics.
#1: Live at peace with othersThe easiest way to avoid problems with politics is to get along with people. I’m not saying you need to hug everyone and sing songs, and I’m not saying you have to be a pushover for everyone. You can be pleasant and professional, while at the same time being assertive when necessary. If you have a concern, focus only on the issue, not on the person. If you have to refuse a request, explain why and try to come up with alternative solutions.
Living at peace with others also means being careful about choosing sides during office power struggles. Aligning yourself with one faction or the other will prevent you from working effectively with people from the “other” side, thereby hampering your productivity and thus your performance. It’s even worse if “your” faction loses out. Instead, try to focus on your tasks, dealing with people in either faction on the basis of the tasks alone, and avoid talk on the political issue that separates the groups.
#2: Don’t talk out of school
Does your organization have issues? Have people told you things in confidence? Then keep those matters to yourself. Talking to outsiders about issues within your organization makes all of you look bad to that outsider. Furthermore, your boss or your boss’s boss will not appreciate that behavior. People will find out that you spoke about what they told you, and they’ll lose confidence in you and respect for you.
#3: Be helpfulWe all have responsibilities and objectives, and those things should receive priority. Nonetheless, if it doesn’t take too much time, being helpful to others can reap benefits for you. Does someone need a ride in the direction you live? Did your co-worker leave headlights on in the parking lot? Is someone having trouble building an Excel macro? If you can help that person, especially if you can do so without taking too much of your time, you benefit yourself as well as the other person. By doing these things, you’re building political capital and loyalty. In doing so, you reduce the chances that you will be the victim of political intrigue.
#4: Stay away from gossip
Nothing destroys the dynamics of an office more than gossip. Stay away from it, because nothing good comes from it. Just be sure you avoid the “holier than thou” attitude of lecturing your co-workers on the evils of gossip. You’ll make them lose face, and they’ll resent you. Instead, try subtly changing the subject. For example, suppose the group is talking about Jane’s problems with her child, and of course Jane is absent from the group. Do some free association and try to come up with some topic that’s related to Jane or her child, but won’t involve gossip. Then, make a comment about that topic.
For instance, suppose you know that Jane’s child is involved in a sports league. Mention this fact, thereby linking the child and the league. Then, shift the conversation so that you’re now talking about the league rather than Jane’s child. You could ask when schedules will be published, or if they need parent volunteers. If you do it right, no one will even notice that you’ve moved them away from the gossip.
#5: Stay out of those talk-down-the-boss sessionsSuppose your co-workers start complaining about the boss. If you join in, it makes you look disloyal to the boss. If you don’t, it looks awkward in the group. What can you do? As with the situation of gossip, try changing the subject by linking the boss to another topic, then talking about that topic instead. Or you could simply respond to your co-workers with a smile and a tongue-in-cheek, “Come on, aren’t we exaggerating? [name of boss] really isn’t THAT bad.” Be careful, though, because it could be taken as an admission by you that the boss is bad.
#6: Be a straight arrowThe best way to keep out of trouble politically is to be seen as someone who doesn’t play office politics — in other words, a straight arrow. Do what you say you’re going to do, alert people to problems, and admit your mistakes. Others will respect you, even if they don’t always agree with you. More important, you have a lower chance of being a victim of politics.
#7: Address the “politics” issue openly when appropriateMany times, when I do organizational assessments, I sense anxiety on the part of client staff. To address this anxiety, I tell people I interview that I’m not there to get people fired. I’m there to help the organization function better. It might not completely allay their fears and suspicions, but at least I’ve brought up the issue and addressed it.
Think about doing the same thing if you believe politics is an underlying theme at your company. Tell people you’re not interested in scoring political points but only in getting the job done. It might not work, but unless you bring the matter up, there’s no chance at all that they will believe you. So if a co-worker is unavailable, and you have to act on that person’s behalf, consider saying to that person, “I had to act because of your absence. I wasn’t trying to go behind your back and I wasn’t trying to show you up.”
#8: Document thingsNothing saves a job or career more than having a written record. If you believe a matter will come back to haunt you, make sure you keep a record of the matter, either via e-mail or document. Documentation is also an effective way to highlight of your own accomplishments, which can help you when your performance evaluation is conducted.
#9: Set incentives to foster teamworkIf you’re a manager or senior executive, take a close look at your incentives. Are you unwittingly setting up your staff to work against each other? Do your metrics address only individual departments, or do they also address how departments could benefit the larger organization?
For example, suppose the hardware department of Sears reduced all its prices by half. If you measured only profitability of the department, you would conclude that it is performing horribly. However, that measurement would neglect to account for increased volume in all other departments because of the hardware department.
If you reward employees in a department based only on how well that department does, you may inadvertently cause destructive competition among departments. Each one will be competing against every other one, and all the departments could end up in a worse position. To minimize this possibility, give employees incentives based not only on department results but on organization results as well. That way, employees from different departments have more motivation to work together and less motivation to engage in destructive politics.
#10: Set an example for your staffPeople in an organization look to leadership to see how to act. Do you want your staff to refrain from negative politics? Do you want to see collaboration and teamwork instead of petty rivalries, jealousy, and back-stabbing? Act the way you want your staff to act, and they will follow you.
#1: Live at peace with othersThe easiest way to avoid problems with politics is to get along with people. I’m not saying you need to hug everyone and sing songs, and I’m not saying you have to be a pushover for everyone. You can be pleasant and professional, while at the same time being assertive when necessary. If you have a concern, focus only on the issue, not on the person. If you have to refuse a request, explain why and try to come up with alternative solutions.
Living at peace with others also means being careful about choosing sides during office power struggles. Aligning yourself with one faction or the other will prevent you from working effectively with people from the “other” side, thereby hampering your productivity and thus your performance. It’s even worse if “your” faction loses out. Instead, try to focus on your tasks, dealing with people in either faction on the basis of the tasks alone, and avoid talk on the political issue that separates the groups.
#2: Don’t talk out of school
Does your organization have issues? Have people told you things in confidence? Then keep those matters to yourself. Talking to outsiders about issues within your organization makes all of you look bad to that outsider. Furthermore, your boss or your boss’s boss will not appreciate that behavior. People will find out that you spoke about what they told you, and they’ll lose confidence in you and respect for you.
#3: Be helpfulWe all have responsibilities and objectives, and those things should receive priority. Nonetheless, if it doesn’t take too much time, being helpful to others can reap benefits for you. Does someone need a ride in the direction you live? Did your co-worker leave headlights on in the parking lot? Is someone having trouble building an Excel macro? If you can help that person, especially if you can do so without taking too much of your time, you benefit yourself as well as the other person. By doing these things, you’re building political capital and loyalty. In doing so, you reduce the chances that you will be the victim of political intrigue.
#4: Stay away from gossip
Nothing destroys the dynamics of an office more than gossip. Stay away from it, because nothing good comes from it. Just be sure you avoid the “holier than thou” attitude of lecturing your co-workers on the evils of gossip. You’ll make them lose face, and they’ll resent you. Instead, try subtly changing the subject. For example, suppose the group is talking about Jane’s problems with her child, and of course Jane is absent from the group. Do some free association and try to come up with some topic that’s related to Jane or her child, but won’t involve gossip. Then, make a comment about that topic.
For instance, suppose you know that Jane’s child is involved in a sports league. Mention this fact, thereby linking the child and the league. Then, shift the conversation so that you’re now talking about the league rather than Jane’s child. You could ask when schedules will be published, or if they need parent volunteers. If you do it right, no one will even notice that you’ve moved them away from the gossip.
#5: Stay out of those talk-down-the-boss sessionsSuppose your co-workers start complaining about the boss. If you join in, it makes you look disloyal to the boss. If you don’t, it looks awkward in the group. What can you do? As with the situation of gossip, try changing the subject by linking the boss to another topic, then talking about that topic instead. Or you could simply respond to your co-workers with a smile and a tongue-in-cheek, “Come on, aren’t we exaggerating? [name of boss] really isn’t THAT bad.” Be careful, though, because it could be taken as an admission by you that the boss is bad.
#6: Be a straight arrowThe best way to keep out of trouble politically is to be seen as someone who doesn’t play office politics — in other words, a straight arrow. Do what you say you’re going to do, alert people to problems, and admit your mistakes. Others will respect you, even if they don’t always agree with you. More important, you have a lower chance of being a victim of politics.
#7: Address the “politics” issue openly when appropriateMany times, when I do organizational assessments, I sense anxiety on the part of client staff. To address this anxiety, I tell people I interview that I’m not there to get people fired. I’m there to help the organization function better. It might not completely allay their fears and suspicions, but at least I’ve brought up the issue and addressed it.
Think about doing the same thing if you believe politics is an underlying theme at your company. Tell people you’re not interested in scoring political points but only in getting the job done. It might not work, but unless you bring the matter up, there’s no chance at all that they will believe you. So if a co-worker is unavailable, and you have to act on that person’s behalf, consider saying to that person, “I had to act because of your absence. I wasn’t trying to go behind your back and I wasn’t trying to show you up.”
#8: Document thingsNothing saves a job or career more than having a written record. If you believe a matter will come back to haunt you, make sure you keep a record of the matter, either via e-mail or document. Documentation is also an effective way to highlight of your own accomplishments, which can help you when your performance evaluation is conducted.
#9: Set incentives to foster teamworkIf you’re a manager or senior executive, take a close look at your incentives. Are you unwittingly setting up your staff to work against each other? Do your metrics address only individual departments, or do they also address how departments could benefit the larger organization?
For example, suppose the hardware department of Sears reduced all its prices by half. If you measured only profitability of the department, you would conclude that it is performing horribly. However, that measurement would neglect to account for increased volume in all other departments because of the hardware department.
If you reward employees in a department based only on how well that department does, you may inadvertently cause destructive competition among departments. Each one will be competing against every other one, and all the departments could end up in a worse position. To minimize this possibility, give employees incentives based not only on department results but on organization results as well. That way, employees from different departments have more motivation to work together and less motivation to engage in destructive politics.
#10: Set an example for your staffPeople in an organization look to leadership to see how to act. Do you want your staff to refrain from negative politics? Do you want to see collaboration and teamwork instead of petty rivalries, jealousy, and back-stabbing? Act the way you want your staff to act, and they will follow you.
Tuesday, July 29, 2008
Five good security reads
Novels
The first part of the list is of novels I have read in the last year that have a strong IT security focus, are well written, and can teach the security interested IT professional something about security. If you haven’t read them yet, they should definitely be on your reading list.
They’re listed in the order I read them, which is conveniently also alphabetical order.
Cryptonomicon
This Neal Stephenson novel is a trifle unique in that it is actually two tales, each with its own plot, in one. The narrative switches between these tales regularly, one set during World War II, the other in the modern world. Specific modern technologies are often fictionalized (e.g. Finux, a thinly veiled reference to Linux, and Ordo, an encryption system that doesn’t exist in the real world but very well could), while more general technologies (e.g. cryptographic technologies in general) are entirely real.
The story introduces the reader to concepts that, for most of us, may be new. It ends up being kind of accidentally educational in that respect, presenting ideas about cryptographic currencies, principles of cryptographic technology, and some of the history of modern computing and modern cryptography in forms easily digestible for the technically inclined reader. It even presents a rather unique demonstration of basic cryptographic principles in action in the form of the Solitaire cipher, a cryptographic system invented by Bruce Schneier specifically for Cryptonomicon that can be employed without a computer, via a normal deck of playing cards. It’s not a trivial, toy cryptographic system, however: it is meant to be a form of strong cryptography and, in fact, when Cryptonomicon was published with the Solitaire cipher algorithm printed within its pages in the form of a Perl script, saving that script in a file on a computer in the US and emailing it to someone in another country would have violated US munitions export laws because it qualifies as “strong encryption”.
Halting State
Probably the least directly educational of the three, this novel by Charles Stross is most interesting for its speculations on virtual currencies, virtual realities in meatspace, cyber-terrorism, and the social implications of all of the above. The primary characters are involved in the investigation of what starts out looking like the “robbery” of a virtual bank in a near-future MMORPG, but quickly spins out of control as they discover that all is not as it at first seems.
It is written primarily in the second person, reminiscent of old text based adventure games, which I found a little difficult to get into at first — especially with the switching between perspective characters in different chapters. It’s an engrossing tale, with a well constructed plot, however.
Little Brother
Cory Doctorow set out to write this novel for “young adults” (i.e. teenagers), with an intentionally educational thread throughout. The main character, a high school student with a perhaps more than healthy interest in learning what others don’t want him to know (and using that knowledge), is a hacker in the original sense who, written in the first person perspective, spends a fair bit of time explaining matters of IT security to the reader.
Little Brother is probably the best-written work of fiction that doubles as an educational text I have ever read, in part because it presents basic concepts within the context of the story and encourages the reader to pursue further knowledge on his or her own. If you read the entire novel and don’t find yourself inspired to read more on the subjects and concepts presented, you may just not be cut out to be a technologist at all. It’s the kind of book I wish I had in my hands when I was thirteen — but even now, about two decades older, it was a thoroughly enjoyable and inspiring read.
The plot surrounds the events following a terrorist attack on the Bay Bridge in San Francisco, in a future so near it was quite a while before I was sure it wasn’t written to basically take place in the present. Politically, it looks like it may take place around 2011 some time, though it is flexible enough that it might believably take place any time in the next decade. The technologies are essentially the technologies we know today, with a few specific additions that could well arise in the next few years.
Like usual, Doctorow’s challenges to the dominant paradigm go beyond the content of his fiction: this novel is not only available at bookstores and libraries, but also as a free download under the terms of a Creative Commons license. If you like reading full-length novels in digital file formats, you can get it there as a plain text, PDF, or HTML formatted file. I personally prefer having a physical book in my hands, so that’s the form of the novel I read.
For a more personal take on Little Brother, check out my brief review in my personal Weblog.
Related reading
The second part of the list is works that aren’t novels — in one case, a book-length essay on the development of operating systems, and in the other a collection of short stories.
In the Beginning was the Command Line
People who enjoy Cryptonomicon may also want to read Stephenson’s In the Beginning was the Command Line, a lengthy essay examining the history of operating systems. It was written in the late 1990s, and is a little dated now, but the lessons it conveys are no less valuable. While it doesn’t directly address security, it does provide some insights into the design philosophies and necessities of operating systems, the collective mindset of their users, and other matters that provide a basis for understanding the security characteristics of systems incorporating various OSes and real-life end users. It has been published as a short book, but is also available for download as a Mac Stuffit or Zip compressed plain text file, free of charge. Among the rest of the works in this list, this is the only one I read for the first time before 17 July 2007. I have read it several times, however, the most recent being a few months ago. It’s not only worth reading once — it’s worth revisiting.
Overclocked: Stores of the Future Present
Doctorow’s Overclocked: Stories of the Future Present is a collection of short stories by the author of Little Brother. Many of them, individually, seem tailor-made to challenge the comfortable preconceptions of the modern technologist, illustrating in science fiction prose the possible consequences of contemporary technology policy. Like Little Brother, and most if not all the rest of Doctorow’s fiction, it is available as a free download as well as in dead-tree hardcopy editions.
Recommendations
If you’re a technology enthusiast, and there’s anything in the above list of works that you haven’t read, you should rectify that oversight soon. They’re all well written, informative, and often inspiring. Three of them are even available for free online, so the excuses for failing to read them lie somewhere between slim and none.
The first part of the list is of novels I have read in the last year that have a strong IT security focus, are well written, and can teach the security interested IT professional something about security. If you haven’t read them yet, they should definitely be on your reading list.
They’re listed in the order I read them, which is conveniently also alphabetical order.
Cryptonomicon
This Neal Stephenson novel is a trifle unique in that it is actually two tales, each with its own plot, in one. The narrative switches between these tales regularly, one set during World War II, the other in the modern world. Specific modern technologies are often fictionalized (e.g. Finux, a thinly veiled reference to Linux, and Ordo, an encryption system that doesn’t exist in the real world but very well could), while more general technologies (e.g. cryptographic technologies in general) are entirely real.
The story introduces the reader to concepts that, for most of us, may be new. It ends up being kind of accidentally educational in that respect, presenting ideas about cryptographic currencies, principles of cryptographic technology, and some of the history of modern computing and modern cryptography in forms easily digestible for the technically inclined reader. It even presents a rather unique demonstration of basic cryptographic principles in action in the form of the Solitaire cipher, a cryptographic system invented by Bruce Schneier specifically for Cryptonomicon that can be employed without a computer, via a normal deck of playing cards. It’s not a trivial, toy cryptographic system, however: it is meant to be a form of strong cryptography and, in fact, when Cryptonomicon was published with the Solitaire cipher algorithm printed within its pages in the form of a Perl script, saving that script in a file on a computer in the US and emailing it to someone in another country would have violated US munitions export laws because it qualifies as “strong encryption”.
Halting State
Probably the least directly educational of the three, this novel by Charles Stross is most interesting for its speculations on virtual currencies, virtual realities in meatspace, cyber-terrorism, and the social implications of all of the above. The primary characters are involved in the investigation of what starts out looking like the “robbery” of a virtual bank in a near-future MMORPG, but quickly spins out of control as they discover that all is not as it at first seems.
It is written primarily in the second person, reminiscent of old text based adventure games, which I found a little difficult to get into at first — especially with the switching between perspective characters in different chapters. It’s an engrossing tale, with a well constructed plot, however.
Little Brother
Cory Doctorow set out to write this novel for “young adults” (i.e. teenagers), with an intentionally educational thread throughout. The main character, a high school student with a perhaps more than healthy interest in learning what others don’t want him to know (and using that knowledge), is a hacker in the original sense who, written in the first person perspective, spends a fair bit of time explaining matters of IT security to the reader.
Little Brother is probably the best-written work of fiction that doubles as an educational text I have ever read, in part because it presents basic concepts within the context of the story and encourages the reader to pursue further knowledge on his or her own. If you read the entire novel and don’t find yourself inspired to read more on the subjects and concepts presented, you may just not be cut out to be a technologist at all. It’s the kind of book I wish I had in my hands when I was thirteen — but even now, about two decades older, it was a thoroughly enjoyable and inspiring read.
The plot surrounds the events following a terrorist attack on the Bay Bridge in San Francisco, in a future so near it was quite a while before I was sure it wasn’t written to basically take place in the present. Politically, it looks like it may take place around 2011 some time, though it is flexible enough that it might believably take place any time in the next decade. The technologies are essentially the technologies we know today, with a few specific additions that could well arise in the next few years.
Like usual, Doctorow’s challenges to the dominant paradigm go beyond the content of his fiction: this novel is not only available at bookstores and libraries, but also as a free download under the terms of a Creative Commons license. If you like reading full-length novels in digital file formats, you can get it there as a plain text, PDF, or HTML formatted file. I personally prefer having a physical book in my hands, so that’s the form of the novel I read.
For a more personal take on Little Brother, check out my brief review in my personal Weblog.
Related reading
The second part of the list is works that aren’t novels — in one case, a book-length essay on the development of operating systems, and in the other a collection of short stories.
In the Beginning was the Command Line
People who enjoy Cryptonomicon may also want to read Stephenson’s In the Beginning was the Command Line, a lengthy essay examining the history of operating systems. It was written in the late 1990s, and is a little dated now, but the lessons it conveys are no less valuable. While it doesn’t directly address security, it does provide some insights into the design philosophies and necessities of operating systems, the collective mindset of their users, and other matters that provide a basis for understanding the security characteristics of systems incorporating various OSes and real-life end users. It has been published as a short book, but is also available for download as a Mac Stuffit or Zip compressed plain text file, free of charge. Among the rest of the works in this list, this is the only one I read for the first time before 17 July 2007. I have read it several times, however, the most recent being a few months ago. It’s not only worth reading once — it’s worth revisiting.
Overclocked: Stores of the Future Present
Doctorow’s Overclocked: Stories of the Future Present is a collection of short stories by the author of Little Brother. Many of them, individually, seem tailor-made to challenge the comfortable preconceptions of the modern technologist, illustrating in science fiction prose the possible consequences of contemporary technology policy. Like Little Brother, and most if not all the rest of Doctorow’s fiction, it is available as a free download as well as in dead-tree hardcopy editions.
Recommendations
If you’re a technology enthusiast, and there’s anything in the above list of works that you haven’t read, you should rectify that oversight soon. They’re all well written, informative, and often inspiring. Three of them are even available for free online, so the excuses for failing to read them lie somewhere between slim and none.
Bignum arithmetic and premature optimization
Donald Knuth, the patron saint of algorithm analysis, once famously said “We should forget about small efficiencies, say about 97% of the time: premature optimization is the root of all evil.” Programmers of a thoughtful bent constantly argue over what this means, and at times whether it is even true. Mostly, they ignore its effect on security.
As new programming languages become ever-more “high level” and dynamic, they get further and further from forcing the programmer to cater to the way computers “think”. This provides significant advantages for developing software swiftly and easily, sometimes at significant costs to the efficiency of the code itself. Moore’s Law, however, ensures that for many (if not most) cases those efficiency costs are absorbed by the hardware so thoroughly that users never see the difference, at least in a one-to-one comparison of general software functionality. In fact, for the same general functionality, software written in a higher level language will often outperform software written in a lower level language, if each is run on hardware contemporary with the language’s inception.
Of course, featuritis — a separate phenomenon entirely — often adds far greater weight to an application that combines with the greater resource usage of higher level dynamic languages to slow things down to the point where we start noticing something is wrong. That, however, is an entirely separate matter.
There are those who will argue that choosing a language based on the comparative performance characteristics of programs written in that language is a case of premature optimization. When all you need is a command line utility that will complete its task in under half a second, and Ruby can fill that need, resorting to assembly language to eke maximum performance out of the program certainly seems like a bad trade, if the tendency of Ruby programs to be much easier to write and maintain is considered.
There is certainly a case to be made for lower level languages contributing to greater security. Knowing assembly language, or even a higher level “portable assembly” language such as C, helps the programmer wrap his brain around the concepts of von Neumann architecture computation. Even if you write all your software in a very high level language like Ruby, knowing what’s going on “under the hood”, as it were, can yield great rewards when some careful, precise tinkering is necessary — and in understanding the implications of what you’re doing with all those high level language constructs. This applies to security implications as much as to performance, portability, and stability implications.
Don’t take anything said here as dissuading you from learning lower level, static languages such as C or assembly. Even if you never use them in earnest, knowing these languages will help you really understand what you’re doing with higher level, dynamic languages, and may help you make your code more secure.
On the other hand, high level dynamic languages such as Ruby provide a lot of time saving linguistic constructs that, often as a happy accident, actually improve the security of your code without any effort on your part. An example is “bignum” handling.
In programming languages such as C, integers have limits to how big they can get. For instance, an unsigned integer variable might be limited to 16 bits — between 0 and 216-1 (i.e. 0 to 65535). In unsigned 16 bit integer arithmetic, usually 65535 + 1 = 0, because the short integer type is incapable of representing a numeric value outside the range of 0-65535. In some cases, trying to stick a larger value than a data type can handle into a variable of that data type can crash the program, provide improper access to memory, or cause any of a number of other potential security issues. For this reason, programmers in languages like C need to be careful about how they use limited precision data types.
Arbitrary precision arithmetic, also known as “bignum arithmetic”, is an arithmetic technique implemented in a programming language whereby the extent of an integer’s value is limited only by the restrictions of the hardware itself — essentially, by how much RAM the system has. This can, for instance, take the form of an automatic extension of the value that can be handled by the data type as it is needed, rather than limiting the value to an extent defined before a value is entered into a variable or otherwise handled by the program. As this greatly reduces the inherent danger of accepting overly large inputs, bignum arithmetic can prove a great boon to the security of a program.
Such arbitrary precision arithmetic capabilities can be had with languages such as C, via libraries like BigDigits, the GNU MPL, and CLN, but this is not the default behavior of the language and requires explicit use by the programmer. Languages such as Ruby, on the other hand, employ bignum arithmetic by default, as it is needed, without requiring any intervention on the part of the programmer to specify that extensibility of the values that can be handled by numeric data types. It’s important to understand concepts like fixed integer arithmetic, of course, but it’s not important to use it all the time — or even most of the time.
There are programmers who would complain at this implication, because arbitrary precision arithmetic generally imposes an efficiency penalty on programs that make use of it. In most cases, however, such concerns constitute a case of Knuth’s “premature optimization”, because unnecessary use of fixed precision arithmetic can lead to surprising behavior from your software if you make a mistake in development and some unexpected input overflows an integer.
For security purposes, it’s generally the case that Ruby’s way of doing this is the right way to do it: default to avoiding the all too common dangers of fixed precision arithmetic altogether. The only fly in the ointment is the rare occasion where the performance penalties of arbitrary precision arithmetic really matters — or the rare field of endeavor where it matters often.
When the importance of a nanosecond improvement in runtime is not needed, choose the tools that will make it easy to write more secure code.
As new programming languages become ever-more “high level” and dynamic, they get further and further from forcing the programmer to cater to the way computers “think”. This provides significant advantages for developing software swiftly and easily, sometimes at significant costs to the efficiency of the code itself. Moore’s Law, however, ensures that for many (if not most) cases those efficiency costs are absorbed by the hardware so thoroughly that users never see the difference, at least in a one-to-one comparison of general software functionality. In fact, for the same general functionality, software written in a higher level language will often outperform software written in a lower level language, if each is run on hardware contemporary with the language’s inception.
Of course, featuritis — a separate phenomenon entirely — often adds far greater weight to an application that combines with the greater resource usage of higher level dynamic languages to slow things down to the point where we start noticing something is wrong. That, however, is an entirely separate matter.
There are those who will argue that choosing a language based on the comparative performance characteristics of programs written in that language is a case of premature optimization. When all you need is a command line utility that will complete its task in under half a second, and Ruby can fill that need, resorting to assembly language to eke maximum performance out of the program certainly seems like a bad trade, if the tendency of Ruby programs to be much easier to write and maintain is considered.
There is certainly a case to be made for lower level languages contributing to greater security. Knowing assembly language, or even a higher level “portable assembly” language such as C, helps the programmer wrap his brain around the concepts of von Neumann architecture computation. Even if you write all your software in a very high level language like Ruby, knowing what’s going on “under the hood”, as it were, can yield great rewards when some careful, precise tinkering is necessary — and in understanding the implications of what you’re doing with all those high level language constructs. This applies to security implications as much as to performance, portability, and stability implications.
Don’t take anything said here as dissuading you from learning lower level, static languages such as C or assembly. Even if you never use them in earnest, knowing these languages will help you really understand what you’re doing with higher level, dynamic languages, and may help you make your code more secure.
On the other hand, high level dynamic languages such as Ruby provide a lot of time saving linguistic constructs that, often as a happy accident, actually improve the security of your code without any effort on your part. An example is “bignum” handling.
In programming languages such as C, integers have limits to how big they can get. For instance, an unsigned integer variable might be limited to 16 bits — between 0 and 216-1 (i.e. 0 to 65535). In unsigned 16 bit integer arithmetic, usually 65535 + 1 = 0, because the short integer type is incapable of representing a numeric value outside the range of 0-65535. In some cases, trying to stick a larger value than a data type can handle into a variable of that data type can crash the program, provide improper access to memory, or cause any of a number of other potential security issues. For this reason, programmers in languages like C need to be careful about how they use limited precision data types.
Arbitrary precision arithmetic, also known as “bignum arithmetic”, is an arithmetic technique implemented in a programming language whereby the extent of an integer’s value is limited only by the restrictions of the hardware itself — essentially, by how much RAM the system has. This can, for instance, take the form of an automatic extension of the value that can be handled by the data type as it is needed, rather than limiting the value to an extent defined before a value is entered into a variable or otherwise handled by the program. As this greatly reduces the inherent danger of accepting overly large inputs, bignum arithmetic can prove a great boon to the security of a program.
Such arbitrary precision arithmetic capabilities can be had with languages such as C, via libraries like BigDigits, the GNU MPL, and CLN, but this is not the default behavior of the language and requires explicit use by the programmer. Languages such as Ruby, on the other hand, employ bignum arithmetic by default, as it is needed, without requiring any intervention on the part of the programmer to specify that extensibility of the values that can be handled by numeric data types. It’s important to understand concepts like fixed integer arithmetic, of course, but it’s not important to use it all the time — or even most of the time.
There are programmers who would complain at this implication, because arbitrary precision arithmetic generally imposes an efficiency penalty on programs that make use of it. In most cases, however, such concerns constitute a case of Knuth’s “premature optimization”, because unnecessary use of fixed precision arithmetic can lead to surprising behavior from your software if you make a mistake in development and some unexpected input overflows an integer.
For security purposes, it’s generally the case that Ruby’s way of doing this is the right way to do it: default to avoiding the all too common dangers of fixed precision arithmetic altogether. The only fly in the ointment is the rare occasion where the performance penalties of arbitrary precision arithmetic really matters — or the rare field of endeavor where it matters often.
When the importance of a nanosecond improvement in runtime is not needed, choose the tools that will make it easy to write more secure code.
Five ways to show business value of M-F authentication
There’s more to selecting an enterprise second-factor authentication method than meets the retina scanner. As with any IT project, each dollar spent must produce business value. With M-F authentication, this translates to value beyond simply verifying an employee’s identity.
Too often, security professionals are mesmerized by regulatory or best practice multi-factor (M-F) authentication mantras. They don’t see that selling M-F solutions to management requires more than a strategically placed HIPAA, SOX, or CoBIT two-by-four. Besides, using regulatory requirements to squeeze additional security dollars out of the IT budget is an argument with diminishing returns.
There are five basic characteristics of an M-F solution that affect its potential for showing business value: an acceptable probability of success in verifying identity, easy enrollment, enhanced productivity, enables single sign on (SSO), and user acceptance.
1. Achieves business-defined probability of success in verifying identity – This is the obvious function of an M-F solution. It should supplement the primary authentication method, usually password-based, by meeting a business-defined threshold for positive verification.Expecting an M-F method to produce 100 percent accuracy is the first mistake of many security managers. Even the effectiveness of finger-print recognition is determined by its error rate. Unless you’re guarding the crown jewels or defense department secrets, the cost of solutions that achieve zero errors is usually higher than necessary to achieve reasonable and appropriate protection. The level of success necessary depends on the strength of your passwords, business tolerance for risk, and the existence and effectiveness of other access controls.
2. Easy enrollment – Enrollment should take less than two minutes and be easily integrated into the new-hire process. Presenting a solution to management that requires employees to juggle three balls while whistling Dixie is not going to help your cause. For example, I just looked at a solution last week that required users to answer over 60 questions to get set up. The solution, currently an academic exercise only, achieved a probability of success that was high enough, but enrollment challenges make it almost impossible to gain management acceptance.
3. Enhances productivity – The user experience should be improved, eliminating existing authentication challenges that go beyond regulatory compliance. In fact, selling a solution to management might require demonstrating how it can solve other issues. For example, many health care organizations deploy shared computers to nurses stations. Several nurses use these devices, logging in many times, during each shift. Their ability to provide care might be enhanced by an M-F solution that quickly verifies their identity and performs fast user switching, eliminating lost time dealing with system authentication issues. Proximity detection can make this happen before the nurse even gets to the keyboard.Another enhancement is SSO-like functionality. Although users have to authenticate to each application, the use of M-F technology can often eliminate the need to enter a user ID and password every time.
4. Enables SSO – The M-F solution should be compatible with future SSO implementations. Selecting an M-F technology without considering SSO is a big mistake. The cost of M-F solutions can be high, and ripping it out if it isn’t compatible with the SSO technology you choose is a career-limiting exercise. According to Forrester, the best approach is selecting an SSO solution first, even if implementation is two to three years in the future. Implementation of an M-F solution should be within the context of your SSO vision. Share that vision with management, positioning your biometrics or smart-card solution as an incremental step toward an improved user experience.
5. Acceptable to users – The solution must be easy to use and actually improve the way users see the security that protects information assets. Nothing kills an M-F rollout faster than user revolt. User resistance is often based on one or more of the following,
- Fear that the company stores unique personal information
- Fear that the company is collecting personal health information (retinal scans look at patterns that are also used to determine certain health conditions) for insurance purposes
- Fear that the red light in retinal scanning sensors is physically harmful
- Fear of contracting diseases through contact with publicly used sensors
- High error rate, without an easy alternative to logging in
The first four bullets under the fifth business value characteristic can be assuaged with pre-rollout discussions with users or user representatives, helping them understand the actual facts about the M-F technology selected. The last item is a technology challenge.
As I wrote early in this post, M-F technology isn’t perfect. There will be errors. One error that frustrates users is a rejection of authorized login attempts. Frustration levels can be controlled by ensuring your solution includes an easy way to deal with these issues as they arise. Remember, this is supposed to improve user experience
Too often, security professionals are mesmerized by regulatory or best practice multi-factor (M-F) authentication mantras. They don’t see that selling M-F solutions to management requires more than a strategically placed HIPAA, SOX, or CoBIT two-by-four. Besides, using regulatory requirements to squeeze additional security dollars out of the IT budget is an argument with diminishing returns.
There are five basic characteristics of an M-F solution that affect its potential for showing business value: an acceptable probability of success in verifying identity, easy enrollment, enhanced productivity, enables single sign on (SSO), and user acceptance.
1. Achieves business-defined probability of success in verifying identity – This is the obvious function of an M-F solution. It should supplement the primary authentication method, usually password-based, by meeting a business-defined threshold for positive verification.Expecting an M-F method to produce 100 percent accuracy is the first mistake of many security managers. Even the effectiveness of finger-print recognition is determined by its error rate. Unless you’re guarding the crown jewels or defense department secrets, the cost of solutions that achieve zero errors is usually higher than necessary to achieve reasonable and appropriate protection. The level of success necessary depends on the strength of your passwords, business tolerance for risk, and the existence and effectiveness of other access controls.
2. Easy enrollment – Enrollment should take less than two minutes and be easily integrated into the new-hire process. Presenting a solution to management that requires employees to juggle three balls while whistling Dixie is not going to help your cause. For example, I just looked at a solution last week that required users to answer over 60 questions to get set up. The solution, currently an academic exercise only, achieved a probability of success that was high enough, but enrollment challenges make it almost impossible to gain management acceptance.
3. Enhances productivity – The user experience should be improved, eliminating existing authentication challenges that go beyond regulatory compliance. In fact, selling a solution to management might require demonstrating how it can solve other issues. For example, many health care organizations deploy shared computers to nurses stations. Several nurses use these devices, logging in many times, during each shift. Their ability to provide care might be enhanced by an M-F solution that quickly verifies their identity and performs fast user switching, eliminating lost time dealing with system authentication issues. Proximity detection can make this happen before the nurse even gets to the keyboard.Another enhancement is SSO-like functionality. Although users have to authenticate to each application, the use of M-F technology can often eliminate the need to enter a user ID and password every time.
4. Enables SSO – The M-F solution should be compatible with future SSO implementations. Selecting an M-F technology without considering SSO is a big mistake. The cost of M-F solutions can be high, and ripping it out if it isn’t compatible with the SSO technology you choose is a career-limiting exercise. According to Forrester, the best approach is selecting an SSO solution first, even if implementation is two to three years in the future. Implementation of an M-F solution should be within the context of your SSO vision. Share that vision with management, positioning your biometrics or smart-card solution as an incremental step toward an improved user experience.
5. Acceptable to users – The solution must be easy to use and actually improve the way users see the security that protects information assets. Nothing kills an M-F rollout faster than user revolt. User resistance is often based on one or more of the following,
- Fear that the company stores unique personal information
- Fear that the company is collecting personal health information (retinal scans look at patterns that are also used to determine certain health conditions) for insurance purposes
- Fear that the red light in retinal scanning sensors is physically harmful
- Fear of contracting diseases through contact with publicly used sensors
- High error rate, without an easy alternative to logging in
The first four bullets under the fifth business value characteristic can be assuaged with pre-rollout discussions with users or user representatives, helping them understand the actual facts about the M-F technology selected. The last item is a technology challenge.
As I wrote early in this post, M-F technology isn’t perfect. There will be errors. One error that frustrates users is a rejection of authorized login attempts. Frustration levels can be controlled by ensuring your solution includes an easy way to deal with these issues as they arise. Remember, this is supposed to improve user experience
Use tcpdump for traffic analysis
The tcpdump tool is an old mainstay of network debugging and security monitoring, and security experts all over the world swear by its usefulness. It is a command line tool that eschews all the makeup and jewelry of other traffic analysis tools such as Ettercap and Wireshark, both of which provide packet sniffing functionality with a convenient captive interface. In contrast to such tools, tcpdump takes a command at the shell, with options specified at that time, and dumps the results to standard output. This may seem primitive to some users, but it provides power and flexibility that isn’t available with the common captive interface alternatives.
Options
The tcpdump utility provides dozens of options, but I’ll just cover a few of them here:
-A: Print each packet in ASCII.
-c N: Where the letter N is a number, this option tells tcpdump to exit after N packets.
-i interface: Capture packets on the specified network interface.
-n: Don’t resolve addresses to names.
-q: Provide less verbose (”quiet”) output so output lines are shorter.
-r filename: Read packets from the specified file rather than a network interface. This is usually used after raw packets have been logged to a file with the -w option.
-t: Don’t print a timestamp on each line of output.
-v: Provide more verbose output. Verbosity can be increased more with -vv, and even more than that with -vvv.
-w filename: Write raw packets to the specified file.
Expressions
The tcpdump utility also supports command-line expressions, used to define filtering rules so that you get exactly the traffic you want to see, ignoring “uninteresting” packets. Expressions consist of a number of primitives and, optionally, modifier terms. The following primitives and modifiers do not constitute a comprehensive list, but they are among the most commonly useful.
Primitives
dst foo: Specify an address or hostname to limit captured packets to traffic sent to a particular host.
host foo: Specify an address or hostname to limit captured packets to traffic to and from a particular host.
net foo: Specify a network or network segment using CIDR notation to limit packet capture.
proto foo: Specify a protocol to limit captured packets to network traffic using that protocol.
src foo: Specify an address or hostname to limit captured packets to traffic sent by a particular host.
Modifiers
and: Use this to chain together primitives when you want to limit captured packets to those that meet the requirements of the expressions on both sides of the and.
not: Use this modifier just before a primitive when you want to limit captured packets to those that do not meet the requirements of the following expresssion.
or: Use this to chain together primitives when you want to limit captured packets to those that meet the requirements of one or more of the expressions on either side of the or.
Examples
All of these options and expression primitives and modifiers, along with others listed in the tcpdump manpage, can be used to construct very specific commands that produce very precise output.
tcpdump -c 50 dst foo can give you information that may help identify the source of heavy incoming traffic targeting an overloaded server with hostname “foo”, dumping the first 50 packets as output.
tcpdump -c 500 -w `date +"%Y%j%T"`.log dumps 500 packets to a file named with a current time/date stamp (e.g. 200820715:16:31.log) so that they can later be filtered according to the information you want to see. I have the command date +"%Y %j%T" aliased to stamp in my shell’s rc file, so I can shorten a command like this to tcpdump -c 500 -w `stamp`.log, saving me from having to remember all the formatting options for the date command off the top of my head.
tcpdump proto ssh src or dst foo and src and dst not bar produces ongoing output that shows all SSH activity originating from or targeting host “foo” unless it is originating from or targeting host “bar”. If foo is only supposed to be accessed via SSH by bar, this command will allow ongoing monitoring of unauthorized SSH traffic to and from foo. You could even start a number of persistent monitoring processes with tcpdump like this within a tmux session on a dedicated monitoring server.
As you can no doubt see, tcpdump’s expressions capabilities are roughly equivalent to a simple domain specific programming language that is extremely easy to understand. With that kind of power and flexibility at my fingertips, there’s little need to use anything else for general traffic analysis tasks.
Options
The tcpdump utility provides dozens of options, but I’ll just cover a few of them here:
-A: Print each packet in ASCII.
-c N: Where the letter N is a number, this option tells tcpdump to exit after N packets.
-i interface: Capture packets on the specified network interface.
-n: Don’t resolve addresses to names.
-q: Provide less verbose (”quiet”) output so output lines are shorter.
-r filename: Read packets from the specified file rather than a network interface. This is usually used after raw packets have been logged to a file with the -w option.
-t: Don’t print a timestamp on each line of output.
-v: Provide more verbose output. Verbosity can be increased more with -vv, and even more than that with -vvv.
-w filename: Write raw packets to the specified file.
Expressions
The tcpdump utility also supports command-line expressions, used to define filtering rules so that you get exactly the traffic you want to see, ignoring “uninteresting” packets. Expressions consist of a number of primitives and, optionally, modifier terms. The following primitives and modifiers do not constitute a comprehensive list, but they are among the most commonly useful.
Primitives
dst foo: Specify an address or hostname to limit captured packets to traffic sent to a particular host.
host foo: Specify an address or hostname to limit captured packets to traffic to and from a particular host.
net foo: Specify a network or network segment using CIDR notation to limit packet capture.
proto foo: Specify a protocol to limit captured packets to network traffic using that protocol.
src foo: Specify an address or hostname to limit captured packets to traffic sent by a particular host.
Modifiers
and: Use this to chain together primitives when you want to limit captured packets to those that meet the requirements of the expressions on both sides of the and.
not: Use this modifier just before a primitive when you want to limit captured packets to those that do not meet the requirements of the following expresssion.
or: Use this to chain together primitives when you want to limit captured packets to those that meet the requirements of one or more of the expressions on either side of the or.
Examples
All of these options and expression primitives and modifiers, along with others listed in the tcpdump manpage, can be used to construct very specific commands that produce very precise output.
tcpdump -c 50 dst foo can give you information that may help identify the source of heavy incoming traffic targeting an overloaded server with hostname “foo”, dumping the first 50 packets as output.
tcpdump -c 500 -w `date +"%Y%j%T"`.log dumps 500 packets to a file named with a current time/date stamp (e.g. 200820715:16:31.log) so that they can later be filtered according to the information you want to see. I have the command date +"%Y %j%T" aliased to stamp in my shell’s rc file, so I can shorten a command like this to tcpdump -c 500 -w `stamp`.log, saving me from having to remember all the formatting options for the date command off the top of my head.
tcpdump proto ssh src or dst foo and src and dst not bar produces ongoing output that shows all SSH activity originating from or targeting host “foo” unless it is originating from or targeting host “bar”. If foo is only supposed to be accessed via SSH by bar, this command will allow ongoing monitoring of unauthorized SSH traffic to and from foo. You could even start a number of persistent monitoring processes with tcpdump like this within a tmux session on a dedicated monitoring server.
As you can no doubt see, tcpdump’s expressions capabilities are roughly equivalent to a simple domain specific programming language that is extremely easy to understand. With that kind of power and flexibility at my fingertips, there’s little need to use anything else for general traffic analysis tasks.
Saturday, June 28, 2008
Computer Use 101: Rule number one
What’s the first rule of using a computer? I’d wager that nine out of ten support staff would agree on this one. We might all think it’s a no-brainer, but for as long as I’ve been in this business (20+ years), rule number one was to save often. I’m amazed at how many people don’t. Here are some of the things I see.
I recently upgraded a bunch of computers in the office, and to accommodate busy work demands, I would swap the boxes after hours. More times than not, I would find that people went home for the day leaving any number of files open. Of course, when I closed them, I was asked if I wanted to save the changes. That can only mean that it wasn’t saved before that person went home. Some of them didn’t even have a proper file name, since I was asked if I wanted to save Document1, or Workbook1, or some other default name. Personally speaking, I never even walk away from my computer without saving, much less go home for the night without doing it. In fact, I seldom leave anything open when I leave for the day.
Someone approached me recently with a gripe about how Microsoft will sometimes automatically reboot his computer after an upgrade. I have these computers scheduled to check for upgrades late at night so people aren’t interrupted with it during the day. Of course, his gripe wasn’t really about the automatic reboot, but rather how he lost some work because of the files he left open — without saving. One question will put an abrupt end to that gripe: Didn’t you save your work before you went home?
Another person called me over not too long ago because, for some unknown reason, our primary application software, AutoCAD, threw a rare hissy fit and displayed an unrecoverable error message. Nothing was responding, and the only way to proceed was to end the task. Of course, this meant the file couldn’t be saved. When was your last save, I asked? The three-hours-ago answer she gave was a tough one to hear. However, all might not have been lost, I thought, since AutoCAD has a nice auto-save feature. But for some reason, the file created by that auto-save was incomplete. I’m not sure why, but it probably has something to do with how AutoCAD references different files and such. But for whatever reason, it just wasn’t there.
Okay, maybe this is all a minor rant, but after repeating rule number one — save often — over and over (probably into the thousands of times over the years), it’s still something a good number of people obviously don’t do. I have to wonder why, but the answer remains elusive.
Okay, one more minor rant: Someone asked me today why his e-mail was not getting out of his outbox. Just a hunch, I said, but perhaps it’s the 47 MB file attachment you’re trying to send!
P.S. I’ll be on vacation for the next week, so I’ll look forward to replying to any comments after I get back.
I recently upgraded a bunch of computers in the office, and to accommodate busy work demands, I would swap the boxes after hours. More times than not, I would find that people went home for the day leaving any number of files open. Of course, when I closed them, I was asked if I wanted to save the changes. That can only mean that it wasn’t saved before that person went home. Some of them didn’t even have a proper file name, since I was asked if I wanted to save Document1, or Workbook1, or some other default name. Personally speaking, I never even walk away from my computer without saving, much less go home for the night without doing it. In fact, I seldom leave anything open when I leave for the day.
Someone approached me recently with a gripe about how Microsoft will sometimes automatically reboot his computer after an upgrade. I have these computers scheduled to check for upgrades late at night so people aren’t interrupted with it during the day. Of course, his gripe wasn’t really about the automatic reboot, but rather how he lost some work because of the files he left open — without saving. One question will put an abrupt end to that gripe: Didn’t you save your work before you went home?
Another person called me over not too long ago because, for some unknown reason, our primary application software, AutoCAD, threw a rare hissy fit and displayed an unrecoverable error message. Nothing was responding, and the only way to proceed was to end the task. Of course, this meant the file couldn’t be saved. When was your last save, I asked? The three-hours-ago answer she gave was a tough one to hear. However, all might not have been lost, I thought, since AutoCAD has a nice auto-save feature. But for some reason, the file created by that auto-save was incomplete. I’m not sure why, but it probably has something to do with how AutoCAD references different files and such. But for whatever reason, it just wasn’t there.
Okay, maybe this is all a minor rant, but after repeating rule number one — save often — over and over (probably into the thousands of times over the years), it’s still something a good number of people obviously don’t do. I have to wonder why, but the answer remains elusive.
Okay, one more minor rant: Someone asked me today why his e-mail was not getting out of his outbox. Just a hunch, I said, but perhaps it’s the 47 MB file attachment you’re trying to send!
P.S. I’ll be on vacation for the next week, so I’ll look forward to replying to any comments after I get back.
Fixing the fault, fixing the customer
Let’s face it, we all deal with the fault on a PC or network as a matter of routine, but how often do we consider that we also need to fix the customer? It may be that their confidence in the equipment/service/company has been strained and maybe even broken, and it may be that some work may be needed to restore the customer’s faith in your work.
Is it enough to mend a fault and leave? It may be that the customer has concerns that a few words and a minute or two of listening might make the difference between leaving a happy customer and leaving somebody considering a move to another support service. A few nods and an “I see” or two and some other empathetic noises can make all the difference. One of my worst failings is to listen to the customer, right up to the point where I think I know what the problem is, then I switch off as I start the fix. There may be more to the problem than I’ve heard from the user, and I have often had to backtrack and hear the rest of the story.
In my keenness to get on and fix the fault, I often forget about the customer and get too involved in the technicalities. I recall an incident when the customer had been reporting some minor fault or other on an almost daily basis. After a couple of “no fault found” callouts, I began to wonder if the problem was with the equipment or with the user, so I decided to get them to show me the fault instead of just describing it. It very soon became obvious that the problem lay with a lack of training, and I was able to sort out the problems quite quickly.
I seem to spend a lot of my time banging on about people skills or soft skills, as they are often referred to. Sometimes you can win with soft skills where you fail on the technical fix. Sometimes we have to give bad news, or maybe we can’t fix the fault straightaway; we may have to wait for parts or get a problem fixed on a remote service. It is the way we communicate this kind of information to the customer that determines whether we leave them happy or anxious that we haven’t appreciated the seriousness of the situation.
How do we give bad news without annoying the customer? First, we have to understand that no matter how well you communicate a problem, you can’t always leave the customer happy. It is foolish to think otherwise and could lead to your suffering a lot of stress in the process. Give the news straight and tell the customer what you are going to do about it. If that isn’t good enough, ask what they would like you to do. If you have an idea that might provide a workaround to the problem, run it past them. You will nearly always be able to come to an agreement that will mollify both parties, but it is important to remember that, provided that you have done all you can, you can leave with a clear conscience. Above all else, don’t take the problem home with you.
Is it enough to mend a fault and leave? It may be that the customer has concerns that a few words and a minute or two of listening might make the difference between leaving a happy customer and leaving somebody considering a move to another support service. A few nods and an “I see” or two and some other empathetic noises can make all the difference. One of my worst failings is to listen to the customer, right up to the point where I think I know what the problem is, then I switch off as I start the fix. There may be more to the problem than I’ve heard from the user, and I have often had to backtrack and hear the rest of the story.
In my keenness to get on and fix the fault, I often forget about the customer and get too involved in the technicalities. I recall an incident when the customer had been reporting some minor fault or other on an almost daily basis. After a couple of “no fault found” callouts, I began to wonder if the problem was with the equipment or with the user, so I decided to get them to show me the fault instead of just describing it. It very soon became obvious that the problem lay with a lack of training, and I was able to sort out the problems quite quickly.
I seem to spend a lot of my time banging on about people skills or soft skills, as they are often referred to. Sometimes you can win with soft skills where you fail on the technical fix. Sometimes we have to give bad news, or maybe we can’t fix the fault straightaway; we may have to wait for parts or get a problem fixed on a remote service. It is the way we communicate this kind of information to the customer that determines whether we leave them happy or anxious that we haven’t appreciated the seriousness of the situation.
How do we give bad news without annoying the customer? First, we have to understand that no matter how well you communicate a problem, you can’t always leave the customer happy. It is foolish to think otherwise and could lead to your suffering a lot of stress in the process. Give the news straight and tell the customer what you are going to do about it. If that isn’t good enough, ask what they would like you to do. If you have an idea that might provide a workaround to the problem, run it past them. You will nearly always be able to come to an agreement that will mollify both parties, but it is important to remember that, provided that you have done all you can, you can leave with a clear conscience. Above all else, don’t take the problem home with you.
What can support pros learn from their auto mechanics?
When I was recently arranging a routine service appointment for my automobile, I was struck by the fact that, for once, the shoe was on the other foot. I’m used to being the expert who has to explain a complicated technical issue to a nontechnical customer. When it comes to repairing cars, I know just enough to make myself sound stupid. Suddenly, I find myself in the position where I have to have things explained to me, often more than once.
I have a great mechanic, so when I work with him, I’m seeing customer service done really well. My visit to the garage got me thinking about some of the practices of good auto service professionals, and I realized that the techniques that produce a positive car repair experience could serve as a guide for creating a positive support experience for my users. Here’s the list I jotted down while waiting for my car to come down off the lift.
Triage effectively. My mechanic, Jim, is great about making sure that emergency situations are given special attention. Engine threw a cylinder on the highway? He’ll immediately send a wrecker to pick you up. Just need your oil changed? If there are more pressing tasks, Jim will gracefully let you know he’s too busy and will ask you to drop off your car in a day or two. The takeaway here is that most customers don’t mind waiting for nonemergency service, as long as they’re given a firm date when they can expect attention.
Provide an estimate. When I work with Jim, his estimates usually have two parts: the cost and the timeframe in which the work will be done. Cost may not always be a factor when the help desk is serving a user, but there are other things to take into account. It may be necessary to order replacement parts, for instance. Providing your customers with estimates of what the work will entail and when it will be completed will manage their expectations and lower their stress level.
Offer alternate arrangements. In the auto-service industry, this takes the form of the courtesy car. Consider keeping a couple of serviceable machines on hand as cold spares that you can loan to users whose regular workstations may need significant repair. With a “courtesy computer,” at least the client can continue his or her work.
Update the customer. Mechanics revise their estimates; sometimes it’s necessary because the work required is more extensive. This can happen when a machine is on the repair bench, too. If the situation has changed — for the worse or for the better — make sure that the customer is informed.
Explain things clearly. Think of it this way: your customers won’t appreciate your work if they don’t understand your description of it. Avoid jargon as much as possible. Put the situation in terms that are easily understood, and contextualize things for the users. If they have an understanding of how you’ve helped, they’ll feel better about the experience.
Suggest future maintenance. Lots of car trouble can be avoided if the owner takes care of the vehicle. The same holds true for computers. If there’s a way that the user can avoid the inconvenience of future problems, share that knowledge with them.
I recommend my mechanic to anyone I overhear complaining about the last time their car had to be serviced. There may be a guy out there with more qualifications than Jim, but his work is solid, and his customer service is second-to-none. When I’m in a situation where I’m out of my depth, I appreciate working with a professional who is concerned about the quality of my experience. Your users will, too.
I have a great mechanic, so when I work with him, I’m seeing customer service done really well. My visit to the garage got me thinking about some of the practices of good auto service professionals, and I realized that the techniques that produce a positive car repair experience could serve as a guide for creating a positive support experience for my users. Here’s the list I jotted down while waiting for my car to come down off the lift.
Triage effectively. My mechanic, Jim, is great about making sure that emergency situations are given special attention. Engine threw a cylinder on the highway? He’ll immediately send a wrecker to pick you up. Just need your oil changed? If there are more pressing tasks, Jim will gracefully let you know he’s too busy and will ask you to drop off your car in a day or two. The takeaway here is that most customers don’t mind waiting for nonemergency service, as long as they’re given a firm date when they can expect attention.
Provide an estimate. When I work with Jim, his estimates usually have two parts: the cost and the timeframe in which the work will be done. Cost may not always be a factor when the help desk is serving a user, but there are other things to take into account. It may be necessary to order replacement parts, for instance. Providing your customers with estimates of what the work will entail and when it will be completed will manage their expectations and lower their stress level.
Offer alternate arrangements. In the auto-service industry, this takes the form of the courtesy car. Consider keeping a couple of serviceable machines on hand as cold spares that you can loan to users whose regular workstations may need significant repair. With a “courtesy computer,” at least the client can continue his or her work.
Update the customer. Mechanics revise their estimates; sometimes it’s necessary because the work required is more extensive. This can happen when a machine is on the repair bench, too. If the situation has changed — for the worse or for the better — make sure that the customer is informed.
Explain things clearly. Think of it this way: your customers won’t appreciate your work if they don’t understand your description of it. Avoid jargon as much as possible. Put the situation in terms that are easily understood, and contextualize things for the users. If they have an understanding of how you’ve helped, they’ll feel better about the experience.
Suggest future maintenance. Lots of car trouble can be avoided if the owner takes care of the vehicle. The same holds true for computers. If there’s a way that the user can avoid the inconvenience of future problems, share that knowledge with them.
I recommend my mechanic to anyone I overhear complaining about the last time their car had to be serviced. There may be a guy out there with more qualifications than Jim, but his work is solid, and his customer service is second-to-none. When I’m in a situation where I’m out of my depth, I appreciate working with a professional who is concerned about the quality of my experience. Your users will, too.
Supporting (installing) financial software: My most difficult install
Over the years, other than providing basic computer technology support, I’ve had little responsibility for the financial software used by the company. Of course, I’d help the bookkeeper get the initial installation process going, and I helped her set up an adequate backup system (both on-site and off-site), but otherwise, I remained pretty much out of the financial software picture. (Privacy, confidentiality, and all that stuff, I suppose.)
However, the newest version of our financial software has me jumping through more hoops than I’ve ever had to endure. For one thing, while all past versions of the software could be installed on a stand-alone workstation, this one is for a server installation only; it can’t be installed on a domain controller, so I had to provide a dedicated server just for the application (not that I’d want to install it on my domain controller anyway), which meant we had to provide an additional computer and buy another Server OS with the appropriate CALs. It uses SQL database and Microsoft .NET Framework, neither of which are really within my area of expertise; and the software company doesn’t provide a DVD for the installation, but rather makes it available by Internet download only — a total of six files (two of which are large documentation files), whose sizes total a whopping 800MB, taking a long time to download.
The four downloaded installation files had to be executed in a particular order, which is understandable, I suppose, but I’m pretty sure they could have been integrated somehow to be run in the proper order by a simple installation routine. Nonetheless, executing the first installation file generated a CRC error about 30 minutes into its installation process (something about not matching the setup’s .cab file). We determined that the file became corrupted during download, so I had to download that one again (well over 100 MB and more download time). The second try was successful, but it took about 45 minutes to finish.
The second file started to install, but it stopped to inform me that I first had to install the required Microsoft .NET Framework (version 1.1). That was easy enough to find and download from Microsoft’s support site, and I decided it would be a good idea to download and install the accompanying SP1 while I was at it. That was about a two-hour detour by the time it was all said and done (and installed). After running the second installation file for the second time, it finally did finish after more than an hour.
The third installation file generated the same CRC error as the first one. Of course, I had to download that one again as well. The only difference was the file size and the time it took to download — twice the size and twice the time of the first file. Oh, there was another difference — this one crashed as well! After putting in a call to the software’s tech support folks, they directed me to a different FTP site from which I could download the file. The file on the initial site might have some problems, they said. (I think that might fall into the DUH! category.)
Was the third try with the third file a charm? It would have to wait until the next day. It was still downloading when I went home for the day. However, on my way home, it occurred to me that this might not be the installation files at all. While these are large files, it shouldn’t take that long to download over a business-class broadband connection. Before I proceed any further, I believe some testing of my Internet connection, modem, and firewall router is in order. The new financial software is a real pain, but the download time might be another issue entirely.
Funny, I was talking about one problem, and segued right into another.
Anyway, what are some of your challenging installations?
However, the newest version of our financial software has me jumping through more hoops than I’ve ever had to endure. For one thing, while all past versions of the software could be installed on a stand-alone workstation, this one is for a server installation only; it can’t be installed on a domain controller, so I had to provide a dedicated server just for the application (not that I’d want to install it on my domain controller anyway), which meant we had to provide an additional computer and buy another Server OS with the appropriate CALs. It uses SQL database and Microsoft .NET Framework, neither of which are really within my area of expertise; and the software company doesn’t provide a DVD for the installation, but rather makes it available by Internet download only — a total of six files (two of which are large documentation files), whose sizes total a whopping 800MB, taking a long time to download.
The four downloaded installation files had to be executed in a particular order, which is understandable, I suppose, but I’m pretty sure they could have been integrated somehow to be run in the proper order by a simple installation routine. Nonetheless, executing the first installation file generated a CRC error about 30 minutes into its installation process (something about not matching the setup’s .cab file). We determined that the file became corrupted during download, so I had to download that one again (well over 100 MB and more download time). The second try was successful, but it took about 45 minutes to finish.
The second file started to install, but it stopped to inform me that I first had to install the required Microsoft .NET Framework (version 1.1). That was easy enough to find and download from Microsoft’s support site, and I decided it would be a good idea to download and install the accompanying SP1 while I was at it. That was about a two-hour detour by the time it was all said and done (and installed). After running the second installation file for the second time, it finally did finish after more than an hour.
The third installation file generated the same CRC error as the first one. Of course, I had to download that one again as well. The only difference was the file size and the time it took to download — twice the size and twice the time of the first file. Oh, there was another difference — this one crashed as well! After putting in a call to the software’s tech support folks, they directed me to a different FTP site from which I could download the file. The file on the initial site might have some problems, they said. (I think that might fall into the DUH! category.)
Was the third try with the third file a charm? It would have to wait until the next day. It was still downloading when I went home for the day. However, on my way home, it occurred to me that this might not be the installation files at all. While these are large files, it shouldn’t take that long to download over a business-class broadband connection. Before I proceed any further, I believe some testing of my Internet connection, modem, and firewall router is in order. The new financial software is a real pain, but the download time might be another issue entirely.
Funny, I was talking about one problem, and segued right into another.
Anyway, what are some of your challenging installations?
Lines in the sand: Three requests support techs should turn down
One problem with running a service-oriented help desk is that people keep coming to you for help.
OK, that’s meant mostly as a joke. Mostly. In my experience I’ve found that creating strong relationships with one’s clients will lead to more service calls. It has something to do with inhibition and intimidation. If customers have a positive experience with a tech, they’ll feel reassured about the support process, and this will make them more inclined to ask for assistance in the future.
Creating comfortable clients is ideal for a freelance or contract technician, who gets paid by the call or by the hour. Every service request is money in one’s pocket. Comfortable clients can be less ideal for a standing in-house support team, though. Users’ inhibitions can become so low that they start asking the help desk to provide support that’s outside appropriate boundaries. This is especially likely in environments that don’t impose any checks on the urge to file a support request, like fees, departmental charge-backs, or ticket accounting.
Responsible IT departments should have published policies about what they’ll support. Even if those policies are out there, though, that won’t keep techs from getting requests for assistance that are beyond the help desk’s authority. Being aware of the types of inappropriate—and sometimes informal—support requests will let you anticipate them and will let you prepare your techs to handle such things, if and when they appear.
Project work or IT engineering tasks. The role of the help desk is, first and foremost, to provide incident-based support to the client. Many places, including my own office, economize by having support techs also work within project teams developing new services. Help desk issues should always trump project work, though. If an IT project or engineering task is important enough that it can’t be set aside in favor of addressing emergent support requests, then it’s important enough that the project’s manager should have dedicated personnel working on it, rather than counting on the help desk techs having slack time.
Requests not related to work. Whether it’s answering questions about problematic home computers or fielding requests to set up MP3 players on company-owned machines, there’s no reason for help desk techs to spend work time answering non-business requests. Let me be clear, I’m not an unfeeling robot. I’ll chat for a minute or two with colleagues about problems they may be having with machines at home, or I’ll provide shopping advice. That’s the extent of it, though. Our support policy excludes privately owned hardware and clearly outlines what’s supported on company-owned machines. That’s where the responsibility of our techs ends, and I’ve had to explain this to a number of users.
Shop talk during social events or off hours. There’s an old cliché that insists that doctors are always being solicited for professional advice at cocktail parties and the like. I don’t know about whether that’s actually true for M.D’.s or not, but it’s certainly true for IT pros. I’ve been at many an office social event, only to have a colleague bring up a problem that they’ve been having. Support pros deserve the opportunity to unplug from work responsibilities now and again. I don’t hesitate to let my users know when I’m “off the clock.”
Those are the three types of inappropriate inquiries I see most often as an office support tech. If you have any others to offer, let me know in the comments.
OK, that’s meant mostly as a joke. Mostly. In my experience I’ve found that creating strong relationships with one’s clients will lead to more service calls. It has something to do with inhibition and intimidation. If customers have a positive experience with a tech, they’ll feel reassured about the support process, and this will make them more inclined to ask for assistance in the future.
Creating comfortable clients is ideal for a freelance or contract technician, who gets paid by the call or by the hour. Every service request is money in one’s pocket. Comfortable clients can be less ideal for a standing in-house support team, though. Users’ inhibitions can become so low that they start asking the help desk to provide support that’s outside appropriate boundaries. This is especially likely in environments that don’t impose any checks on the urge to file a support request, like fees, departmental charge-backs, or ticket accounting.
Responsible IT departments should have published policies about what they’ll support. Even if those policies are out there, though, that won’t keep techs from getting requests for assistance that are beyond the help desk’s authority. Being aware of the types of inappropriate—and sometimes informal—support requests will let you anticipate them and will let you prepare your techs to handle such things, if and when they appear.
Project work or IT engineering tasks. The role of the help desk is, first and foremost, to provide incident-based support to the client. Many places, including my own office, economize by having support techs also work within project teams developing new services. Help desk issues should always trump project work, though. If an IT project or engineering task is important enough that it can’t be set aside in favor of addressing emergent support requests, then it’s important enough that the project’s manager should have dedicated personnel working on it, rather than counting on the help desk techs having slack time.
Requests not related to work. Whether it’s answering questions about problematic home computers or fielding requests to set up MP3 players on company-owned machines, there’s no reason for help desk techs to spend work time answering non-business requests. Let me be clear, I’m not an unfeeling robot. I’ll chat for a minute or two with colleagues about problems they may be having with machines at home, or I’ll provide shopping advice. That’s the extent of it, though. Our support policy excludes privately owned hardware and clearly outlines what’s supported on company-owned machines. That’s where the responsibility of our techs ends, and I’ve had to explain this to a number of users.
Shop talk during social events or off hours. There’s an old cliché that insists that doctors are always being solicited for professional advice at cocktail parties and the like. I don’t know about whether that’s actually true for M.D’.s or not, but it’s certainly true for IT pros. I’ve been at many an office social event, only to have a colleague bring up a problem that they’ve been having. Support pros deserve the opportunity to unplug from work responsibilities now and again. I don’t hesitate to let my users know when I’m “off the clock.”
Those are the three types of inappropriate inquiries I see most often as an office support tech. If you have any others to offer, let me know in the comments.
Monday, May 5, 2008
Wi-Fi security for the road warrior; revisited
Defining public Wi-Fi
To make sure we’re all on the same page, let’s first define public Wi-Fi networks as those that allow unrestricted access. That’s a simplistic definition, but what’s typically available at venues like airports, hotels, and hotspots. Since unrestricted access eliminates the ability to encrypt Wi-Fi traffic, it also means there’s no real security.
Is there more risk at airports?
So, is there more risk to using public Wi-Fi access at an airport lounge when compared to an upscale hotel? I would say yes, but not for technical reasons. People who steal information and identities want to do so using the least amount of effort. That means airports, simply because there are more targets of opportunity. I certainly see this whenever I’m traveling. At any given airport, it’s very easy to capture copious amounts of unencrypted digital traffic.
I hope that explanation made sense, but I’m concerned that many people share DonnaKline’s viewpoint. With that in mind I would like to discuss some high level Wi-Fi security concepts. Theoretically, achieving information security and lowering risk is simple. If the information is undecipherable to everyone except the intended viewer, it’s secure. In real life information security is anything but simple. That’s why an informed Wi-Fi user is the most powerful security tool available.
Three distinct security zones
I find it helps to divide the path that digital traffic travels along into distinct security zones. By doing so, attention is focused on the entire connection, not just the initial Wi-Fi portion. To keep it simple, I use the three following zones:
Wi-Fi security zone: This zone is the one most people are aware of, as it is first step to gain access to the Internet.
Wired security zone: This zone is the in house infrastructure that acts as a go between for the Wi-Fi network and the Internet.
Internet security zone: This zone is the conglomeration of linked networks that can traverse significant geographical areas. OK, I should just say the Internet.
To many, realizing that all three zones are important for secure transmission of their information is a new concept. The following example clearly points this out. My financial adviser, who is near and dear to me, argues that Internet access at her favorite coffee shop is secure since she has to enter a new WPA passcode each time she visits. Using my security zone concept, we can see that the Wi-Fi security zone is covered, but how secure is my advisor’s information as it traverses the wired and Internet security zones?
To explain, that particular coffee shop could be capturing customer’s personal information as it passes through the wired security zone. I’m not saying that it’s being done, but it could be. It’s also possible for people who steal information and identities to setup capture equipment in the coffee shop without the owner’s permission. Now that my financial adviser understands that there are different security zones, it’s easier for her to make an informed decision about what security measures to use.
Proper tool for the job
Good news for road warriors is the availability of security tools that will protect information traveling across all three security zones or any combination thereof. From a security expert’s viewpoint, utopia would be everyone using an IPsec VPN (pdf) at all times. Nice, but let’s get back to the real world. Security does not come free and it’s the user that carries the additional burden created by increased security. Let’s continue using my financial adviser in the two following examples, which depict situations where both security and convenience are considered:
Highly sensitive traffic: My adviser needs to access the office database from the coffee shop. Since the data is very sensitive, the security tool used should produce the maximum amount of security. That would be some sort of VPN application. So she enables the computer’s VPN client, creating a digital tunnel that traverses all three security zones connecting to the VPN server at the office. Once the VPN tunnel is setup, digital traffic is encrypted and sent through the tunnel. If any of this traffic was captured by an attacker it would be complete gibberish and virtually impossible to decipher. That’s about as good as it gets and most security experts would be happy.
Anonymity and local security: Next, my adviser wants to surf the Internet. Checking out some vacations spots, now that April 15 has past. She’d rather not use the VPN, since it’s piped through the office’s Internet access and may create an unnecessary bottleneck. Only thing, there’s this rather odd looking guy using a notebook with a strange antenna attached to it sitting in the next booth. What if he’s snooping? Does he know the encryption pass-code? Wait a minute, I convinced her to get an “IronKey” for safe portable file storage. Luckily, it’s configured to connect to a SSL proxy server. Using that to access the Internet, my adviser has the Wi-Fi, wired, and a portion of the Internet security zones covered. No worries about that guy snooping and it’s simpler than a VPN connection to use.
Final thoughts
The two examples are only meant to show what’s possible, not to advocate specific devices or methodology. That’s unrealistic, since each encountered situation is unique. It is my goal to help enlighten and make it easier for road warriors to determine the best security option for a given situation. I hope that this post and the information in “10 Wi-Fi security tips for the road warrior” will be good additions to the road warrior’s security tool kit.
To make sure we’re all on the same page, let’s first define public Wi-Fi networks as those that allow unrestricted access. That’s a simplistic definition, but what’s typically available at venues like airports, hotels, and hotspots. Since unrestricted access eliminates the ability to encrypt Wi-Fi traffic, it also means there’s no real security.
Is there more risk at airports?
So, is there more risk to using public Wi-Fi access at an airport lounge when compared to an upscale hotel? I would say yes, but not for technical reasons. People who steal information and identities want to do so using the least amount of effort. That means airports, simply because there are more targets of opportunity. I certainly see this whenever I’m traveling. At any given airport, it’s very easy to capture copious amounts of unencrypted digital traffic.
I hope that explanation made sense, but I’m concerned that many people share DonnaKline’s viewpoint. With that in mind I would like to discuss some high level Wi-Fi security concepts. Theoretically, achieving information security and lowering risk is simple. If the information is undecipherable to everyone except the intended viewer, it’s secure. In real life information security is anything but simple. That’s why an informed Wi-Fi user is the most powerful security tool available.
Three distinct security zones
I find it helps to divide the path that digital traffic travels along into distinct security zones. By doing so, attention is focused on the entire connection, not just the initial Wi-Fi portion. To keep it simple, I use the three following zones:
Wi-Fi security zone: This zone is the one most people are aware of, as it is first step to gain access to the Internet.
Wired security zone: This zone is the in house infrastructure that acts as a go between for the Wi-Fi network and the Internet.
Internet security zone: This zone is the conglomeration of linked networks that can traverse significant geographical areas. OK, I should just say the Internet.
To many, realizing that all three zones are important for secure transmission of their information is a new concept. The following example clearly points this out. My financial adviser, who is near and dear to me, argues that Internet access at her favorite coffee shop is secure since she has to enter a new WPA passcode each time she visits. Using my security zone concept, we can see that the Wi-Fi security zone is covered, but how secure is my advisor’s information as it traverses the wired and Internet security zones?
To explain, that particular coffee shop could be capturing customer’s personal information as it passes through the wired security zone. I’m not saying that it’s being done, but it could be. It’s also possible for people who steal information and identities to setup capture equipment in the coffee shop without the owner’s permission. Now that my financial adviser understands that there are different security zones, it’s easier for her to make an informed decision about what security measures to use.
Proper tool for the job
Good news for road warriors is the availability of security tools that will protect information traveling across all three security zones or any combination thereof. From a security expert’s viewpoint, utopia would be everyone using an IPsec VPN (pdf) at all times. Nice, but let’s get back to the real world. Security does not come free and it’s the user that carries the additional burden created by increased security. Let’s continue using my financial adviser in the two following examples, which depict situations where both security and convenience are considered:
Highly sensitive traffic: My adviser needs to access the office database from the coffee shop. Since the data is very sensitive, the security tool used should produce the maximum amount of security. That would be some sort of VPN application. So she enables the computer’s VPN client, creating a digital tunnel that traverses all three security zones connecting to the VPN server at the office. Once the VPN tunnel is setup, digital traffic is encrypted and sent through the tunnel. If any of this traffic was captured by an attacker it would be complete gibberish and virtually impossible to decipher. That’s about as good as it gets and most security experts would be happy.
Anonymity and local security: Next, my adviser wants to surf the Internet. Checking out some vacations spots, now that April 15 has past. She’d rather not use the VPN, since it’s piped through the office’s Internet access and may create an unnecessary bottleneck. Only thing, there’s this rather odd looking guy using a notebook with a strange antenna attached to it sitting in the next booth. What if he’s snooping? Does he know the encryption pass-code? Wait a minute, I convinced her to get an “IronKey” for safe portable file storage. Luckily, it’s configured to connect to a SSL proxy server. Using that to access the Internet, my adviser has the Wi-Fi, wired, and a portion of the Internet security zones covered. No worries about that guy snooping and it’s simpler than a VPN connection to use.
Final thoughts
The two examples are only meant to show what’s possible, not to advocate specific devices or methodology. That’s unrealistic, since each encountered situation is unique. It is my goal to help enlighten and make it easier for road warriors to determine the best security option for a given situation. I hope that this post and the information in “10 Wi-Fi security tips for the road warrior” will be good additions to the road warrior’s security tool kit.
Treating users equally, but differently
I try to treat all my users with equality, but sometimes equal doesn’t exactly mean equal. What I mean is that I treat them all equally depending on the level of support required. One type of person, for example, might approach me and describe a problem or issue, and I can simply tell them what I think and what I might try. Another person with exactly the same issue, however, might require more personal attention, where I would actually go and do it myself. It’s the same problem, but different users with different needs, and both requiring a different approach.
The first one I described might actually prefer to do it himself, but the second one might not. So in this case, equal means to give them what they require. The challenge lies in determining exactly what kind of attention is both necessary and appropriate. Another challenge is keeping my personal frustration level in check. I can’t get frustrated because User-A can’t understand something the same way User-B does. I simply have to be more patient and empathetic with some people.
I find that the timid user actually presents the greatest challenge. This is a person who does her job quite well and is very proficient with an application, but if just one little thing goes awry, she doesn’t know what to do; she’s totally lost. This is also the type of user who has a hard time understanding things over and above that norm. I might try to explain certain things, but some users just can’t seem to get it. Even more dangerous is when they might appear to get it, but they really don’t.
Then I might have the real hands-on user, one who would rather dig-in and do it himself, even though he might not be the best one suited to do it. I might have to find a non-offensive way to tell someone to move over to the co-pilot’s seat (or out of the cockpit all together), and that I need to have my own hands on the controls.
Another type of user is one who might automatically tell me the solution instead of articulating the problem. It might take a bit of finesse to take that bit of information, work backwards, and try to pull-out the real underlying problem. Often times that proposed solution isn’t the real solution at all. In this case, I have to resist the urge to simply tell them they’re wrong, but rather lead them into another way of thinking.
I’m here to try and provide what they might need, but peoples’ needs are all different. I have to adapt my style to their needs and personality, not the other way around. At least I try.
What are some of your biggest challenges in this regard? What kinds of users do you support? What kinds of approaches have you found successful?
The first one I described might actually prefer to do it himself, but the second one might not. So in this case, equal means to give them what they require. The challenge lies in determining exactly what kind of attention is both necessary and appropriate. Another challenge is keeping my personal frustration level in check. I can’t get frustrated because User-A can’t understand something the same way User-B does. I simply have to be more patient and empathetic with some people.
I find that the timid user actually presents the greatest challenge. This is a person who does her job quite well and is very proficient with an application, but if just one little thing goes awry, she doesn’t know what to do; she’s totally lost. This is also the type of user who has a hard time understanding things over and above that norm. I might try to explain certain things, but some users just can’t seem to get it. Even more dangerous is when they might appear to get it, but they really don’t.
Then I might have the real hands-on user, one who would rather dig-in and do it himself, even though he might not be the best one suited to do it. I might have to find a non-offensive way to tell someone to move over to the co-pilot’s seat (or out of the cockpit all together), and that I need to have my own hands on the controls.
Another type of user is one who might automatically tell me the solution instead of articulating the problem. It might take a bit of finesse to take that bit of information, work backwards, and try to pull-out the real underlying problem. Often times that proposed solution isn’t the real solution at all. In this case, I have to resist the urge to simply tell them they’re wrong, but rather lead them into another way of thinking.
I’m here to try and provide what they might need, but peoples’ needs are all different. I have to adapt my style to their needs and personality, not the other way around. At least I try.
What are some of your biggest challenges in this regard? What kinds of users do you support? What kinds of approaches have you found successful?
Don’t waste your time supporting problems that don’t exist
We’re moving some staff into a new suite of offices, which means that we’re shopping for new furniture. This is also a great opportunity for us to choose some new workstation equipment to standardize on, and I’ve been talking with a very competent sales rep that has been helping us pick out new keyboard trays and task seating.
I ran into a problem with the demo keyboard tray that our sales rep, Kurt, left for me to evaluate. I decided to leave him an email, even though I knew that he was going to be on vacation. Kurt’s really customer-focused, and even though he was out of the office, he saw my email and asked his OEM contact to give me a call.
The OEM’s rep, Jim, came out and replaced a worn part on the key tray that Kurt had left with me, and he must have smelled an opportunity. After getting some background on what our plans were for our new offices, Jim started up-selling me.
His company makes articulating display arms as well as keyboard decks and chairs, and Jim came on really strong about the ergonomic advantages of getting the computer’s display off of the desk. I told him that all of the LCDs that we have in our department already offer significant adjustability: height, tilt, pan — they’ll even rotate from a landscape orientation to operate in portrait mode. So, I told Jim that I think the equipment we have has been fitting my users pretty well. In response, Jim broke out one of his brochures. It showed how a display arm can let users reclaim their work surfaces for other purposes…laying out papers, and things like that. Well, Jim made a persuasive case, and I let him leave me a display arm to try out around the office.
Once I’d installed the display arm, I started inviting people into my office to try it out. I was expecting that a lot of my users would respond favorably to the setup, you know, because of all that space on my desk surface I had reclaimed. Quite the opposite occurred, surprisingly. Everyone was completely underwhelmed by the ‘advantages’ the display arm provided. After inquiring why they weren’t more excited by the demonstration, I realized that articulating display arms solve a problem that we don’t have.
No one has ever complained to me about their display cluttering their desk too much. In fact, my users seem to welcome even more clutter, as long as there’s a reason for it; to benefit from the increased productivity that comes with having a second display, for instance. I had bought into Jim’s hype, and thought that he could provide a solution to an actual problem, one that I was afraid I had missed. I’m glad I actually looked beyond the pitch and asked for feedback from my users. I was saved a lot of expense and installation headaches that would have come from an over-engineered solution to a non-existent problem.
It’s good to be out in front of things, and to try and anticipate your clients’ needs. Take a moment, though, and talk to a focus group of your users. This will help you make sure that you’re on target with your assessment of their situation, and keep you from buying a white elephant.
I ran into a problem with the demo keyboard tray that our sales rep, Kurt, left for me to evaluate. I decided to leave him an email, even though I knew that he was going to be on vacation. Kurt’s really customer-focused, and even though he was out of the office, he saw my email and asked his OEM contact to give me a call.
The OEM’s rep, Jim, came out and replaced a worn part on the key tray that Kurt had left with me, and he must have smelled an opportunity. After getting some background on what our plans were for our new offices, Jim started up-selling me.
His company makes articulating display arms as well as keyboard decks and chairs, and Jim came on really strong about the ergonomic advantages of getting the computer’s display off of the desk. I told him that all of the LCDs that we have in our department already offer significant adjustability: height, tilt, pan — they’ll even rotate from a landscape orientation to operate in portrait mode. So, I told Jim that I think the equipment we have has been fitting my users pretty well. In response, Jim broke out one of his brochures. It showed how a display arm can let users reclaim their work surfaces for other purposes…laying out papers, and things like that. Well, Jim made a persuasive case, and I let him leave me a display arm to try out around the office.
Once I’d installed the display arm, I started inviting people into my office to try it out. I was expecting that a lot of my users would respond favorably to the setup, you know, because of all that space on my desk surface I had reclaimed. Quite the opposite occurred, surprisingly. Everyone was completely underwhelmed by the ‘advantages’ the display arm provided. After inquiring why they weren’t more excited by the demonstration, I realized that articulating display arms solve a problem that we don’t have.
No one has ever complained to me about their display cluttering their desk too much. In fact, my users seem to welcome even more clutter, as long as there’s a reason for it; to benefit from the increased productivity that comes with having a second display, for instance. I had bought into Jim’s hype, and thought that he could provide a solution to an actual problem, one that I was afraid I had missed. I’m glad I actually looked beyond the pitch and asked for feedback from my users. I was saved a lot of expense and installation headaches that would have come from an over-engineered solution to a non-existent problem.
It’s good to be out in front of things, and to try and anticipate your clients’ needs. Take a moment, though, and talk to a focus group of your users. This will help you make sure that you’re on target with your assessment of their situation, and keep you from buying a white elephant.
Saturday, March 29, 2008
A primer on array-based and network-based replication
Replication helps protect your data and files by producing a duplicate copy at a second site, server, or storage array. I covered host-based replication in a previous blog.
In this blog, I’ll cover two other types of replication — array-based replication and network (or fabric) based replication.
Array-based replication
Array-based replication requires a central data storage unit (SAN or NAS) and a partner unit. With array-based replication, the SAN or NAS processes the data and the commands to process and validate the data being replicated.
Advantages of array-based replication
The work is offloaded from the servers to the storage device.
You only need one location to control many replications of multiple servers.
Hosts (Servers) are not required at the second site or to be attached to the second SAN/NAS.
A central SQL server can be set up to replicate with the servers that actually present applications to users, such as order tracking applications.
The right software can queue databases to ensure that transactions and the database are in a recoverable state.
Disadvantages of array-based replication
Cost per device can be high, especially when you’re not replicating all of the data on the SAN.
Only SAN or NAS based data can be replicated or controlled.
A second SAN or NAS is required, increasing the cost for the solution.
There could be compatibility problems of replication technology/software between SAN/NAS hardware and vendors.
Examples of array-based replication software
HP StorageWorks XP
EMC SANCOPY - Supports EMC and some other vendor arrays
EMC MirrorView - EMC only replication
NetApp SnapMirror
Network-based replication
The last type of replication is network (or fabric) based replication. This type of replication works separately from the hosts (servers) and the storage devices. A device on the network intercepts packets being sent to and from hosts and arrays and copies them. These copies are replicated to a second device that then replays the packets at a second location. The devices are, in essence, splitters. The data goes in and then it’s split out to different sources.
Advantages of network-based replication
It’s a separate component from the SAN/NAS or the hosts.
Processing is independent to the host and SAN/NAS.
It allows replication between multi-vendor products.
Disadvantages of network-based replication
The cost of implementing devices to support this kind of replication is high.
Newer technology for the data center, standards, and process are still being worked out.
There are a limited number of “players” in this area of replication.
In this blog, I’ll cover two other types of replication — array-based replication and network (or fabric) based replication.
Array-based replication
Array-based replication requires a central data storage unit (SAN or NAS) and a partner unit. With array-based replication, the SAN or NAS processes the data and the commands to process and validate the data being replicated.
Advantages of array-based replication
The work is offloaded from the servers to the storage device.
You only need one location to control many replications of multiple servers.
Hosts (Servers) are not required at the second site or to be attached to the second SAN/NAS.
A central SQL server can be set up to replicate with the servers that actually present applications to users, such as order tracking applications.
The right software can queue databases to ensure that transactions and the database are in a recoverable state.
Disadvantages of array-based replication
Cost per device can be high, especially when you’re not replicating all of the data on the SAN.
Only SAN or NAS based data can be replicated or controlled.
A second SAN or NAS is required, increasing the cost for the solution.
There could be compatibility problems of replication technology/software between SAN/NAS hardware and vendors.
Examples of array-based replication software
HP StorageWorks XP
EMC SANCOPY - Supports EMC and some other vendor arrays
EMC MirrorView - EMC only replication
NetApp SnapMirror
Network-based replication
The last type of replication is network (or fabric) based replication. This type of replication works separately from the hosts (servers) and the storage devices. A device on the network intercepts packets being sent to and from hosts and arrays and copies them. These copies are replicated to a second device that then replays the packets at a second location. The devices are, in essence, splitters. The data goes in and then it’s split out to different sources.
Advantages of network-based replication
It’s a separate component from the SAN/NAS or the hosts.
Processing is independent to the host and SAN/NAS.
It allows replication between multi-vendor products.
Disadvantages of network-based replication
The cost of implementing devices to support this kind of replication is high.
Newer technology for the data center, standards, and process are still being worked out.
There are a limited number of “players” in this area of replication.
Five new developments in storage infrastructure solutions
First there was Ethernet. Then, there was IP over Ethernet. Next came the mixed use of Ethernet, IP, and the SCSI command set (iSCSI) to simplify storage and to bring down the cost and complexity of storage. Today, iSCSI and Fibre Channel are fighting it out in all but the largest enterprises, and both have their pros and cons. Even though these are the two primary contenders in today’s block-level shared storage market, there are some other alternatives. The line is continuing to blur between these solutions as new initiatives are brought to market. Let’s take a look at some new developments in storage infrastructure solutions.
Faster Fibre ChannelTwo Gbps and 4 Gbps Fibre Channel are very common in the marketplace, and manufacturers are just now beginning to demonstrate 8 Gbps Fibre Channel gear. There are also standards in the works for Fibre Channel running at 10 Gbps and 20 Gbps. This venerable technology continues to improve to meet the increasingly robust storage needs demanded by the enterprise. In some cases, Fibre Channel solutions on the market rival iSCSI solutions from a price perspective (i.e., Dell/EMC AX150) for simple solutions. However, faster Fibre Channel still has the same skill set hurdles to overcome. Just about every network administrator knows IP, but Fibre Channel skills are a different matter.
iSCSI over 10G EthernetiSCSI has become a technology that deserves short-list status… and at a gigabit per second, no less. Many iSCSI naysayers point to its slower interlink speed as a reason that it won’t stack up to Fibre Channel. However, iSCSI solutions are now on the cusp of moving to 10 Gbps Ethernet, meaning that iSCSI’s link speed could surpass even the fastest Fibre Channel solutions on the market. Of course, iSCSI still has IP’s overhead and latency, so we’ll see how well 10 Gbps Ethernet performs in real-world scenarios when compared to 8 Gbps Fibre Channel.
Further, 10 Gbps Ethernet gear is still extremely expensive, so, for the foreseeable future, 10 Gbps-based iSCSI solutions probably won’t fit the budgets of many organizations considering iSCSI as a primary storage solution. All this said, interlink speed is not necessarily the primary driver for replacement storage infrastructure in the enterprise. Performance boosts are often achieved by adding more disk spindles to the infrastructure or by moving to faster disk drives (i.e., SATA to 15K RPM SAS or Fibre Channel).
Fibre channel-over-IP (FCIP)Fibre Channel-over-IP (FCIP) is a method by which geographically distributed Fibre Channel-based SANs can be interconnected with one another. In short, FCIP is designed to extend the reach of Fibre Channel networks over wide distances.
Internet Fibre Channel Protocol (iFCP)Internet Fibre Channel Protocol (iFCP) is an effort to bring an IP-based infrastructure to the Fibre Channel world. Much of the cost of Fibre Channel is necessary infrastructure, such as dedicated host bus adapters (HBAs) and switches. These components can, on a per-port basis, add thousands of dollars to connect a server to the storage infrastructure. In contrast, transmitting Fibre Channel commands over an IP network would drive down infrastructure costs in a major way, requiring only gigabit Ethernet connections, which are already found on most servers. Further, even high-density Gigabit Ethernet switches cost only a couple thousand dollars. The main drawback to this proposal is the limitation to 1 Gbps Ethernet; although 10 Gbps gear is available, it would negate some of the cost benefit. On the plus side, iFCP (even on 10 Gbps Ethernet) would open Fibre Channel solutions to administrators that have IP-based skill sets. iFCP was ratified by the Internet Engineering Task Force in late 2002/early 2003.
ATA-over-Ethernet (AoE)ATA-over-Ethernet (AoE) hasn’t enjoyed the popularity of iSCSI, but this isn’t due to any technical hurdles. The AoE specification is completely open and only eight pages in length. AoE doesn’t have the overhead of IP as does iSCSI since it runs right on top of Ethernet. Of course, this does limit AoE’s use to single locations, generally, since raw Ethernet can’t be routed. You can find more about AoE in one of my previous posts.
SummaryThe future of storage is wide open. Between iSCSI, Fibre Channel ,and even AoE, solutions abound for organizations of any size and as the lines blur between some of these technologies, cost becomes less of an issue across the board.
Faster Fibre ChannelTwo Gbps and 4 Gbps Fibre Channel are very common in the marketplace, and manufacturers are just now beginning to demonstrate 8 Gbps Fibre Channel gear. There are also standards in the works for Fibre Channel running at 10 Gbps and 20 Gbps. This venerable technology continues to improve to meet the increasingly robust storage needs demanded by the enterprise. In some cases, Fibre Channel solutions on the market rival iSCSI solutions from a price perspective (i.e., Dell/EMC AX150) for simple solutions. However, faster Fibre Channel still has the same skill set hurdles to overcome. Just about every network administrator knows IP, but Fibre Channel skills are a different matter.
iSCSI over 10G EthernetiSCSI has become a technology that deserves short-list status… and at a gigabit per second, no less. Many iSCSI naysayers point to its slower interlink speed as a reason that it won’t stack up to Fibre Channel. However, iSCSI solutions are now on the cusp of moving to 10 Gbps Ethernet, meaning that iSCSI’s link speed could surpass even the fastest Fibre Channel solutions on the market. Of course, iSCSI still has IP’s overhead and latency, so we’ll see how well 10 Gbps Ethernet performs in real-world scenarios when compared to 8 Gbps Fibre Channel.
Further, 10 Gbps Ethernet gear is still extremely expensive, so, for the foreseeable future, 10 Gbps-based iSCSI solutions probably won’t fit the budgets of many organizations considering iSCSI as a primary storage solution. All this said, interlink speed is not necessarily the primary driver for replacement storage infrastructure in the enterprise. Performance boosts are often achieved by adding more disk spindles to the infrastructure or by moving to faster disk drives (i.e., SATA to 15K RPM SAS or Fibre Channel).
Fibre channel-over-IP (FCIP)Fibre Channel-over-IP (FCIP) is a method by which geographically distributed Fibre Channel-based SANs can be interconnected with one another. In short, FCIP is designed to extend the reach of Fibre Channel networks over wide distances.
Internet Fibre Channel Protocol (iFCP)Internet Fibre Channel Protocol (iFCP) is an effort to bring an IP-based infrastructure to the Fibre Channel world. Much of the cost of Fibre Channel is necessary infrastructure, such as dedicated host bus adapters (HBAs) and switches. These components can, on a per-port basis, add thousands of dollars to connect a server to the storage infrastructure. In contrast, transmitting Fibre Channel commands over an IP network would drive down infrastructure costs in a major way, requiring only gigabit Ethernet connections, which are already found on most servers. Further, even high-density Gigabit Ethernet switches cost only a couple thousand dollars. The main drawback to this proposal is the limitation to 1 Gbps Ethernet; although 10 Gbps gear is available, it would negate some of the cost benefit. On the plus side, iFCP (even on 10 Gbps Ethernet) would open Fibre Channel solutions to administrators that have IP-based skill sets. iFCP was ratified by the Internet Engineering Task Force in late 2002/early 2003.
ATA-over-Ethernet (AoE)ATA-over-Ethernet (AoE) hasn’t enjoyed the popularity of iSCSI, but this isn’t due to any technical hurdles. The AoE specification is completely open and only eight pages in length. AoE doesn’t have the overhead of IP as does iSCSI since it runs right on top of Ethernet. Of course, this does limit AoE’s use to single locations, generally, since raw Ethernet can’t be routed. You can find more about AoE in one of my previous posts.
SummaryThe future of storage is wide open. Between iSCSI, Fibre Channel ,and even AoE, solutions abound for organizations of any size and as the lines blur between some of these technologies, cost becomes less of an issue across the board.
Rolling back device driver updates in Windows Server 2003’s Device Manager
When updating a device driver to solve a problem or improve the performance of a device, there may be other things included with the new driver that produce unexpected results or cause other aspects of your Windows Server 2003 system to function differently than you expect.
Fortunately, there is a safeguard for situations where you have updated driver files that aren’t performing as needed: You can roll back the updates.
In this tip, we’ll take a look at the process for rolling back driver updates.
Note: You will only be able to roll back the driver file if the driver has been updated. If it has not yet been updated, there will be no driver available to revert back to.
Rolling back driver updates is simple. Follow these steps:
Open the Computer Management Console by right-clicking the My Computer icon on the Start menu and selecting Manage.
In the left pane of the console, select Device Manager.
Once loaded in the right pane, expand the category for the device whose drivers you wish to roll back.
Right-click the device in the list and select Properties.
On the device’s Property sheet, select the Driver tab.
Click the Rollback Driver button.
Note: If the Rollback Driver button is grayed out, the driver has not been updated and cannot be rolled back.
The driver will roll back to the previously installed version. You should also keep in mind that some drivers from Windows Update may need rolling back due to conflicts within a system. This may not happen often, but is a great tool for correcting problems with driver updates.
Fortunately, there is a safeguard for situations where you have updated driver files that aren’t performing as needed: You can roll back the updates.
In this tip, we’ll take a look at the process for rolling back driver updates.
Note: You will only be able to roll back the driver file if the driver has been updated. If it has not yet been updated, there will be no driver available to revert back to.
Rolling back driver updates is simple. Follow these steps:
Open the Computer Management Console by right-clicking the My Computer icon on the Start menu and selecting Manage.
In the left pane of the console, select Device Manager.
Once loaded in the right pane, expand the category for the device whose drivers you wish to roll back.
Right-click the device in the list and select Properties.
On the device’s Property sheet, select the Driver tab.
Click the Rollback Driver button.
Note: If the Rollback Driver button is grayed out, the driver has not been updated and cannot be rolled back.
The driver will roll back to the previously installed version. You should also keep in mind that some drivers from Windows Update may need rolling back due to conflicts within a system. This may not happen often, but is a great tool for correcting problems with driver updates.
How do I… Add music and narration to a PowerPoint presentation?
The best presentations engage the audience using a number of creative tools. Sound effects, such as music and voice recordings can mean the difference between a good presentation and an outstanding presentation. You can energize your audience with a quick tempo, play your company’s latest jingle, or add narration to an on-demand presentation. At the very least, you can play music at the beginning and ending of a presentation as the audience enters and leaves the room. The only limits are good taste and your imagination.
Microsoft PowerPoint supports media clips, which include sound and video files. The computer playing your presentation will need a sound card and speakers. That doesn’t mean just the system you use to create the presentation, but any system on which you might play the presentation. Today, most systems come with everything you need, but older systems might need an upgrade. (It’s highly unlikely that you’ll encounter such an old system, but don’t rely on that — check it out first!)
Table A lists the media files PowerPoint supports, although this article deals only with sound files.
Table A: Media support
File Explanation Attributes
MIDI Musical Instrument Digital Interface Sound
WAV Microsoft Windows audio format Sound
MPEG Motion Picture Exerts Group Standard video format with a frame per
second rate
AVI Microsoft Windows video format Video format with a constant frame rate per second
GIF Graphical Interface Format 256 color picture that supports animation.
Like most special effects, sound can catch the attention of your audience and convey a message or emotion in a way words or pictures can’t. On the other hand, used poorly, sound can be distracting or even annoying. As always, your purpose will determine how much, if any, sound your presentation needs.
The basics — inserting soundIncluding sound is as simple as selecting a file:
Use existing clips by double-clicking one of the Title, Text and Media Clip layouts from the Slide Layout task pane. Double-click the media clip icon shown in Figure A to launch the Media Clip dialog box.
Figure A
Choose a media slide from the Slide Layout task pane
When you double-click a WAV or MIDI file, PowerPoint displays the prompt shown in Figure B. The options Automatically and When Clicked are self-explanatory.
Figure B
PowerPoint will play the sound file when the slide is current, or you can click the icon to play it
Work with unique sound files by choosing Movies and Sound from the Insert menu and then selecting Sound From File or Sound From Clip Organizer. You can also record sound or play a track from a CD. After selecting a file, PowerPoint prompts you to specify how to execute the file (see Figure B).
If PowerPoint doesn’t support a clip’s format, choose Object from the Insert menu and choose the appropriate object type. Alternately, you can convert the file to a supported type. Use a search engine to search for “video file conversion.” However, don’t be surprised if the converted file is less than satisfactory. It’s difficult to maintain quality when converting media files.
In PowerPoint 2007, you’ll find the Sound option in the Media Clips group on the Insert tab.
PowerPoint displays a sound clip as a small icon, which shows during Slide Show view. When the presentation plays the clip automatically, you might want to hide the icon. There’s really no good reason to display it.
To hide the icon, right-click the icon and choose Edit Sound Object from the resulting submenu. In the Sound Options dialog box, shown in Figure C, check the Hide Sound Icon During Slide Show option, and click OK. Double-click the icon in PowerPoint 2007 to find these options.
Figure C
Edit the file’s attributes
If you choose the click option, it’s worth mentioning that clicking the icon a second time doesn’t disable the sound — the file plays from beginning to end once you click it. In PowerPoint 2007, clicking the icon restarts the file.
To learn just how long a file lasts, right-click the icon and choose Edit Sound Object. The file’s playing time is in the Information section at the bottom (see Figure C). If you want the file to play continuously, while the slide is current, check the Loop Until Stopped option. Moving to the next or previous slide will cancel the loop.
Narrating a presentationTo record a unique sound or message, you’ll need a microphone. Unfortunately, some microphones that come with today’s systems aren’t very sophisticated. If you record someone talking, it may sound distorted when played. Suddenly, you may have a lisp or an accent! Specialized software can clear up some problems, but they’re expensive and that’s just one more piece of software you’ll have to learn. It might be more efficient to invest in a better microphone.
PowerPoint makes it easy to narrate a presentation, which is a plus in a Web-based, automated, or on-demand presentation. You might also use this feature to include a statement from an individual, such as a celebrity or your company’s CEO.
Don’t jump right into recording. First, write a script and rehearse it. Once you’re comfortable with your speaking part, you can record your narration:
Choose Record Narration from the Slide Show menu to open the Record Narration dialog box. In PowerPoint 2007, this option is in the Set Up group on the Slide Show tab.
Click Set Microphone Level to check your microphone. Read the sentence that appears in the Microphone Check dialog and let the Microphone Wizard adjust your microphone automatically. Click OK.
If you need to adjust the quality to CD, radio, or telephone, click Change Quality to open the Sound Selection dialog box. Just remember that quality increases the file’s size. If file size is a concern, you may have to compromise quality just a bit.
By default, PowerPoint stores the narration with the presentation. To store the sound file in a separate WAV file (in the same folder) check Link Narrations In. Click Browse to change the location of the separate WAV file, but use caution when doing so — only store the two separately when you have a good reason for doing so. If a sound file is over 50MB, you must link it.
Click OK and start recording. As PowerPoint displays your presentation, you narrate just as you want the message played. Continue to narrate each slide until you’re done.
At the end of the presentation, PowerPoint will prompt you to save the timings with each slide. This can be helpful if you didn’t get each slide just right and you need more practice.
Step five mentions linked files. If you’re using the same system to both create and show the presentation, linked files are fine, but not necessary. Linked files are a good choice if the sound files are large or if you plan to change the source file. By default, PowerPoint automatically links sound files that are larger than 100KB.
To change this setting, choose Options from the Tools menu, and then click the General tab and update the Link Sounds With File Size Great Than option. PowerPoint 2007 users will find this option by clicking the Office button, clicking the PowerPoint options button (at the bottom right) and then choosing Advanced. The option is in the Save section.
Use the Package for CD (PowerPoint 2003) or Pack And Go Wizard (PowerPoint 2002) to make sure you save linked files with the presentation. Names can be problematic: A linked file’s path name must be 128 characters or less.
More optionsNarration is only one type of recoding you might consider. If you can record it, you can include it in your presentation. To record a single message or unique sound, choose Movies and Sound from the Insert menu and choose Record Sound. In PowerPoint 2007, this option is in the Sound option’s dropdown list, in the Media Clips group on the Insert tab.
In the resulting Record Sound dialog box shown in Figure D, enter a description and name. Click Record when you’re ready to begin. Click Stop when you’re done. Use Play to listen to the new recording. Click OK to save the sound with the presentation. Or, click Cancel to exit and try again. If you save a sound, it appears as an icon, which you can use anywhere in the presentation you like. Mix this capability with action settings for a unique effect. Just don’t over do it!
Figure D
You can record sounds inside PowerPoint
Playing a CDPlaying music is a great way to begin or end a presentation. However, the music doesn’t have to be a top 10 tune. It only needs to be appropriate. For example, you might play Mendelssohn’s Wedding March if your presentation is about catering receptions. Or, pleasing dinner music might be the way to go. It’s really up to you; just keep your audience in mind. To include a song from a CD, do the following:
Insert the CD.
From the Insert menu, choose Movies and Sound. Then, select Play CD Auto Track to open the Insert CD Audio dialog box. In PowerPoint 2007, choose Play CD Audio Track from the Sound option’s dropdown list. You’ll find this option in the Media Clips group on the Insert tab.
The Start At Time and End At Time fields let you capture just part of a track instead of using the entire track.
Use the Sound Volume button to control the audio’s volume.
Check the Hide While Not playing option in the Display Options section if you don’t want the audio’s icon to show when the music isn’t playing.
Click OK when you’re done. PowerPoint lets you play the track by clicking or displaying the slide.
Like other sound files, Power Point displays a CD icon on the current slide. Just be careful that you don’t violate any copyright laws when including someone else’s music in your presentation.
A word on animationYou can use custom animation to control sound files to add a unique and creative dimension to your presentation. To get started, select a sound icon and display the Custom Animation task pane. PowerPoint offers a ton of options, and does a good job of disabling inappropriate choices for the selected clip.
Creating custom animation can be complicated and the truth is most presentations won’t need that much energy. However, the feature’s there and you might as well learn a bit about it. There’s an entire tab dedicated to animation in PowerPoint 2007. Click the Custom Animations option in the Animations group to create custom effects.
Design for effectMultimedia files can liven up any presentation and sound is definitely part of that mix. You can play an appropriate tune or your company’s jingle. With one click, you can play your company’s latest radio ad for the head honchos. Whether you’re pitching a new product or sharing photos of your new baby, use sound to set the mood.
Microsoft PowerPoint supports media clips, which include sound and video files. The computer playing your presentation will need a sound card and speakers. That doesn’t mean just the system you use to create the presentation, but any system on which you might play the presentation. Today, most systems come with everything you need, but older systems might need an upgrade. (It’s highly unlikely that you’ll encounter such an old system, but don’t rely on that — check it out first!)
Table A lists the media files PowerPoint supports, although this article deals only with sound files.
Table A: Media support
File Explanation Attributes
MIDI Musical Instrument Digital Interface Sound
WAV Microsoft Windows audio format Sound
MPEG Motion Picture Exerts Group Standard video format with a frame per
second rate
AVI Microsoft Windows video format Video format with a constant frame rate per second
GIF Graphical Interface Format 256 color picture that supports animation.
Like most special effects, sound can catch the attention of your audience and convey a message or emotion in a way words or pictures can’t. On the other hand, used poorly, sound can be distracting or even annoying. As always, your purpose will determine how much, if any, sound your presentation needs.
The basics — inserting soundIncluding sound is as simple as selecting a file:
Use existing clips by double-clicking one of the Title, Text and Media Clip layouts from the Slide Layout task pane. Double-click the media clip icon shown in Figure A to launch the Media Clip dialog box.
Figure A
Choose a media slide from the Slide Layout task pane
When you double-click a WAV or MIDI file, PowerPoint displays the prompt shown in Figure B. The options Automatically and When Clicked are self-explanatory.
Figure B
PowerPoint will play the sound file when the slide is current, or you can click the icon to play it
Work with unique sound files by choosing Movies and Sound from the Insert menu and then selecting Sound From File or Sound From Clip Organizer. You can also record sound or play a track from a CD. After selecting a file, PowerPoint prompts you to specify how to execute the file (see Figure B).
If PowerPoint doesn’t support a clip’s format, choose Object from the Insert menu and choose the appropriate object type. Alternately, you can convert the file to a supported type. Use a search engine to search for “video file conversion.” However, don’t be surprised if the converted file is less than satisfactory. It’s difficult to maintain quality when converting media files.
In PowerPoint 2007, you’ll find the Sound option in the Media Clips group on the Insert tab.
PowerPoint displays a sound clip as a small icon, which shows during Slide Show view. When the presentation plays the clip automatically, you might want to hide the icon. There’s really no good reason to display it.
To hide the icon, right-click the icon and choose Edit Sound Object from the resulting submenu. In the Sound Options dialog box, shown in Figure C, check the Hide Sound Icon During Slide Show option, and click OK. Double-click the icon in PowerPoint 2007 to find these options.
Figure C
Edit the file’s attributes
If you choose the click option, it’s worth mentioning that clicking the icon a second time doesn’t disable the sound — the file plays from beginning to end once you click it. In PowerPoint 2007, clicking the icon restarts the file.
To learn just how long a file lasts, right-click the icon and choose Edit Sound Object. The file’s playing time is in the Information section at the bottom (see Figure C). If you want the file to play continuously, while the slide is current, check the Loop Until Stopped option. Moving to the next or previous slide will cancel the loop.
Narrating a presentationTo record a unique sound or message, you’ll need a microphone. Unfortunately, some microphones that come with today’s systems aren’t very sophisticated. If you record someone talking, it may sound distorted when played. Suddenly, you may have a lisp or an accent! Specialized software can clear up some problems, but they’re expensive and that’s just one more piece of software you’ll have to learn. It might be more efficient to invest in a better microphone.
PowerPoint makes it easy to narrate a presentation, which is a plus in a Web-based, automated, or on-demand presentation. You might also use this feature to include a statement from an individual, such as a celebrity or your company’s CEO.
Don’t jump right into recording. First, write a script and rehearse it. Once you’re comfortable with your speaking part, you can record your narration:
Choose Record Narration from the Slide Show menu to open the Record Narration dialog box. In PowerPoint 2007, this option is in the Set Up group on the Slide Show tab.
Click Set Microphone Level to check your microphone. Read the sentence that appears in the Microphone Check dialog and let the Microphone Wizard adjust your microphone automatically. Click OK.
If you need to adjust the quality to CD, radio, or telephone, click Change Quality to open the Sound Selection dialog box. Just remember that quality increases the file’s size. If file size is a concern, you may have to compromise quality just a bit.
By default, PowerPoint stores the narration with the presentation. To store the sound file in a separate WAV file (in the same folder) check Link Narrations In. Click Browse to change the location of the separate WAV file, but use caution when doing so — only store the two separately when you have a good reason for doing so. If a sound file is over 50MB, you must link it.
Click OK and start recording. As PowerPoint displays your presentation, you narrate just as you want the message played. Continue to narrate each slide until you’re done.
At the end of the presentation, PowerPoint will prompt you to save the timings with each slide. This can be helpful if you didn’t get each slide just right and you need more practice.
Step five mentions linked files. If you’re using the same system to both create and show the presentation, linked files are fine, but not necessary. Linked files are a good choice if the sound files are large or if you plan to change the source file. By default, PowerPoint automatically links sound files that are larger than 100KB.
To change this setting, choose Options from the Tools menu, and then click the General tab and update the Link Sounds With File Size Great Than option. PowerPoint 2007 users will find this option by clicking the Office button, clicking the PowerPoint options button (at the bottom right) and then choosing Advanced. The option is in the Save section.
Use the Package for CD (PowerPoint 2003) or Pack And Go Wizard (PowerPoint 2002) to make sure you save linked files with the presentation. Names can be problematic: A linked file’s path name must be 128 characters or less.
More optionsNarration is only one type of recoding you might consider. If you can record it, you can include it in your presentation. To record a single message or unique sound, choose Movies and Sound from the Insert menu and choose Record Sound. In PowerPoint 2007, this option is in the Sound option’s dropdown list, in the Media Clips group on the Insert tab.
In the resulting Record Sound dialog box shown in Figure D, enter a description and name. Click Record when you’re ready to begin. Click Stop when you’re done. Use Play to listen to the new recording. Click OK to save the sound with the presentation. Or, click Cancel to exit and try again. If you save a sound, it appears as an icon, which you can use anywhere in the presentation you like. Mix this capability with action settings for a unique effect. Just don’t over do it!
Figure D
You can record sounds inside PowerPoint
Playing a CDPlaying music is a great way to begin or end a presentation. However, the music doesn’t have to be a top 10 tune. It only needs to be appropriate. For example, you might play Mendelssohn’s Wedding March if your presentation is about catering receptions. Or, pleasing dinner music might be the way to go. It’s really up to you; just keep your audience in mind. To include a song from a CD, do the following:
Insert the CD.
From the Insert menu, choose Movies and Sound. Then, select Play CD Auto Track to open the Insert CD Audio dialog box. In PowerPoint 2007, choose Play CD Audio Track from the Sound option’s dropdown list. You’ll find this option in the Media Clips group on the Insert tab.
The Start At Time and End At Time fields let you capture just part of a track instead of using the entire track.
Use the Sound Volume button to control the audio’s volume.
Check the Hide While Not playing option in the Display Options section if you don’t want the audio’s icon to show when the music isn’t playing.
Click OK when you’re done. PowerPoint lets you play the track by clicking or displaying the slide.
Like other sound files, Power Point displays a CD icon on the current slide. Just be careful that you don’t violate any copyright laws when including someone else’s music in your presentation.
A word on animationYou can use custom animation to control sound files to add a unique and creative dimension to your presentation. To get started, select a sound icon and display the Custom Animation task pane. PowerPoint offers a ton of options, and does a good job of disabling inappropriate choices for the selected clip.
Creating custom animation can be complicated and the truth is most presentations won’t need that much energy. However, the feature’s there and you might as well learn a bit about it. There’s an entire tab dedicated to animation in PowerPoint 2007. Click the Custom Animations option in the Animations group to create custom effects.
Design for effectMultimedia files can liven up any presentation and sound is definitely part of that mix. You can play an appropriate tune or your company’s jingle. With one click, you can play your company’s latest radio ad for the head honchos. Whether you’re pitching a new product or sharing photos of your new baby, use sound to set the mood.
Saturday, March 8, 2008
Securing end users’ pesky password problems
This is the first of a three-part series introducing simple fixes to security breaches that your end users might be committing.
If you are anything like me, you have worked with varying degrees of security requirements for some time now. Regardless of what you do in technology, there is a requirement, spoken or otherwise that you have at least an awareness of what policies are in place.
In most HIPPA/GLBA/SOX/PCI shops, the policy is likely to be something that you sign off on when you begin working and possibly before you are allowed to have access to the network. In many companies, you are required to listen to a lecture, take a training course, or participate in a Webinar. Generally, it will cover such things as password requirements, acceptable use, and possibly a component on social engineering and how to avoid it. It will, or should, also tell you how you will maintain paper documents and dispose of them. If that policy is really good, it will include information on the classification of documents.
If business has gone through all the trouble of making all that information available to you, they must have some intention of enforcing the policies, right? The answer is “sometimes.”
Don’t get me wrong, business wants those policies adhered to. In many cases, there are audit standards that must be met and those audit standards require compliance. Business just may not have considered the step of how to communicate the policies in a way that the average user can be compliant and still get the job done. This is a place that IT can step in and help out.
Let’s look at password length and complexity. Generally, a password requires uppercase and/or lowercase, numerals, and special characters. The most common minimum length I have run across is eight. Today’s user is generally managing multiple passwords on multiple systems and in frustration may find it easier to just write them down. I even had a user who took to writing them on the monitor bezel! (Some things you just can’t make up!) Most will make some effort to keep them from becoming public knowledge but many will leave their written copies in an easily accessible location. That is where I can help.
One solution is to consider password vault software. A utility on my Mac is called Keychain. It stores and manages passwords in an encrypted state until I provide a master password on challenge. It is a simple and useful tool. Another good one is the open-source Password Safe. It works on a master PIN. There are also a variety of enterprise-level tools available.
If your environment is anything like where I have worked, getting a new piece of software to the end user is tough. It is at least a lengthy process. So try a couple of other ideas.
Most cubicles have an overhead bin or lockable drawer. I encourage end users to store their password file there. At least it is locked. For laptop users who don’t have a lockdown cable but DO have a lockable bin or drawer, I encourage them to put their laptops away nightly. I recall coming in to the office early one morning to find one of the cleaning staff struggling with a trash can with several laptops in it. I have been vigilant ever since.
If you don’t have a key for your desk or bin, ask your manager how to obtain one or ask Facilities for one. If your company has a Compliance Officer, that person will likely be able to help you out. While I am sure it can happen, I have never heard of a key request being turned down.
Because the solution is simple, most end users don’t have a problem with complying. And that is really what is at the heart of failure to comply with security requirements at the end user level. It needs to be simple.
Sometimes in IT we forget that the end user is there to do a very different kind of job than we are. What they care about most is their work product– the ability to turn out work that meets or exceeds business needs. Anything that they perceive is in the way of that effort is likely to meet with resistance. When we take the time to work through roadblocks with them, that resistance will go away.
What kinds of advice do you give end users on being more secure with their multiple passwords?
If you are anything like me, you have worked with varying degrees of security requirements for some time now. Regardless of what you do in technology, there is a requirement, spoken or otherwise that you have at least an awareness of what policies are in place.
In most HIPPA/GLBA/SOX/PCI shops, the policy is likely to be something that you sign off on when you begin working and possibly before you are allowed to have access to the network. In many companies, you are required to listen to a lecture, take a training course, or participate in a Webinar. Generally, it will cover such things as password requirements, acceptable use, and possibly a component on social engineering and how to avoid it. It will, or should, also tell you how you will maintain paper documents and dispose of them. If that policy is really good, it will include information on the classification of documents.
If business has gone through all the trouble of making all that information available to you, they must have some intention of enforcing the policies, right? The answer is “sometimes.”
Don’t get me wrong, business wants those policies adhered to. In many cases, there are audit standards that must be met and those audit standards require compliance. Business just may not have considered the step of how to communicate the policies in a way that the average user can be compliant and still get the job done. This is a place that IT can step in and help out.
Let’s look at password length and complexity. Generally, a password requires uppercase and/or lowercase, numerals, and special characters. The most common minimum length I have run across is eight. Today’s user is generally managing multiple passwords on multiple systems and in frustration may find it easier to just write them down. I even had a user who took to writing them on the monitor bezel! (Some things you just can’t make up!) Most will make some effort to keep them from becoming public knowledge but many will leave their written copies in an easily accessible location. That is where I can help.
One solution is to consider password vault software. A utility on my Mac is called Keychain. It stores and manages passwords in an encrypted state until I provide a master password on challenge. It is a simple and useful tool. Another good one is the open-source Password Safe. It works on a master PIN. There are also a variety of enterprise-level tools available.
If your environment is anything like where I have worked, getting a new piece of software to the end user is tough. It is at least a lengthy process. So try a couple of other ideas.
Most cubicles have an overhead bin or lockable drawer. I encourage end users to store their password file there. At least it is locked. For laptop users who don’t have a lockdown cable but DO have a lockable bin or drawer, I encourage them to put their laptops away nightly. I recall coming in to the office early one morning to find one of the cleaning staff struggling with a trash can with several laptops in it. I have been vigilant ever since.
If you don’t have a key for your desk or bin, ask your manager how to obtain one or ask Facilities for one. If your company has a Compliance Officer, that person will likely be able to help you out. While I am sure it can happen, I have never heard of a key request being turned down.
Because the solution is simple, most end users don’t have a problem with complying. And that is really what is at the heart of failure to comply with security requirements at the end user level. It needs to be simple.
Sometimes in IT we forget that the end user is there to do a very different kind of job than we are. What they care about most is their work product– the ability to turn out work that meets or exceeds business needs. Anything that they perceive is in the way of that effort is likely to meet with resistance. When we take the time to work through roadblocks with them, that resistance will go away.
What kinds of advice do you give end users on being more secure with their multiple passwords?
Subscribe to:
Posts (Atom)