Technology Management Services

AOL was today accused of being the most infected network on the internet. Analysis from IT security consulting firm Prolexic claims that AOL's network hosts more
zombie-infected PCs than any other in the world. Infected machines can be used by remote hackers to instigate
distributed denial of service
(DoS) attacks.

From a European perspective the study also criticised Deutsche Telekom, Wanadoo and AOL as being Europe's top three offenders for harbouring infected PCs.

See story at:
http://www.computeractive.co.uk/vnunet/news/2137991/aol-accused-infected-network

This post originally appeared on an external website

As reported on CXOtoday.com earlier, SLYNUX is a new easy-to-use Linux distribution developed by a 15-year old Indian student Sarath Lakshman. The Knoppix-based live and installation CD comes with a wide variety of applications for web surfing, multimedia playback, image editing, and office tasks, as well as support for internal modems, digital cameras, printers, and most other common hardware. Besides English, the CD also includes Malayalam fonts and an on-screen keyboard for typing in Malayalam, the principal language of the South Indian state of Kerala. SLYNUX 2.0 is the first public release of the distribution, which is now available for free download from here: SLYNUX.ISO (713MB). More information about the project can be found on its home page.

This post originally appeared on an external website

The latest issue of

Red Hat Magazine

includes an interesting overview of the new

Fedora

Core 4, released earlier this week:

"The GNOME 2.10 desktop has several new productivity boosting tools along with some changes in the behavior of how pop-up windows work.
In previous versions of GNOME, when using instant messaging clients like GAIM, the moment a message appears, the window tends to steal focus from what you?re currently typing or doing, showing you your instant message. This behavior is similar to clicking on a link in an e-mail and having Firefox pop-up in front of your e-mail message."

Here is the full

story with screenshots

. Also in the same magazine:

Fedora Extras: Everything but the kitchen sink

and

Fedora status report

.

This post originally appeared on an external website

Will the next phase of FOSS be license enforcement? If so, what does this mean to a customer?

A majority of companies and governments have embraced the concept of open computing. In fact, a recent survey by Forrester Research indicates that 60 percent of large companies surveyed have already adopted or plan to adopt open open source technology, and half of them use open source technology for mission-critical applications. A significant driver behind this adoption trend is the IT organizations inside large companies. An IT group inside a larger organization is able to grapple with the technical complexities of FOSS installation/configuration. But in order for the trend in FOSS adoption to continue into Medium and Small businesses, the complexities of installation/configuration will have to be smoothed out. For example, consider a FOSS package licensed under GPL and intended for a non-developer to be able to develop robust HTML code (think of it as a FOSS version of Microsoft's Front-Page) with the following installation instructions;

"...'cd' to the directory containing the packages source code and type './configure' to configure the package for your system. If you're using 'csh' on an old version of System V, you might need to type 'sh ./configure' instead to prevent 'csh' from trying to execute 'configure' itself. Running 'configure' takes awhile. While running, it prints some messages telling which features it is checking for." The instructions continue with the familiar 'make' and 'make install' information.

Now all of this maybe old hat to those individuals working in an IT function within a large organization but, to the intended audience of the software (remembering that the audience would be the same group adopting Microsoft Front Page) the installation instructions alone would be enough reason for them to purchase closed source software.

SETUP.EXE

Now enter enterprising "OpenSource Supporting Company A" which publishes a piece of software that is a web interface to the GPL software mentioned previously and includes a 'setup.exe'. The software is now branded, packaged and licensed with a closed license. The software is also priced less than Microsoft FrontPage. The addition of the new web interface and 'setup.exe' allows the customer to easily install and use the software to support their business. On the whole this would appear to be a 'win win' scenario.

Ah, but there is that small matter of the newly introduced 'closed license' which somehow replaced the 'GPL'. But who is really hurt by this? The customer? Maybe not. The customer wasn't comfortable with the traditional installation instructions and one could assume that the customer would not perceive having access to the source code as any significant benefit. After all they are already using the software that satisfies their immediate business requirements at less cost than other similar software packages.

Enterprising "OpenSource Supporting Company A" is certainly not harmed by this scenario. They have created a satisfied customer, generated revenue and did not have to spend significant hours on product creation. They are instead able to focus on customer support which is after all their core business, being as they are an OpenSource consulting firm.

Innovation suffers

Unfortunately, this scenario is becoming increasingly familiar. Ultimately the entire FOSS community suffers if currently available GPL source is simply repackaged for a new audience and then, improperly made available with a license other than the original FOSS. While the adoption of FOSS may increase, the rate of innovation will suffer, without the 'improvements' being fed back into the base project. I have encountered at least one enterprising "OpenSource Supporting Company A" who, when questioned about the license issue claimed not to be in violation of the original GNU GPL since they uploaded their modifications to the project. Fair enough I suppose. However as I am not an expert in software licensing I cannot help wondering if this practice is onside with the GPL. Even if it is, I am ultimately left with a non-quantifiable gut feeling that it is wrong. I was always taught that if it feels wrong then it is wrong. But maybe I'm talking about ethics here and not software licensing?

If you think you see a violation of the GPL (or the LGPL, or the GFDL) the first thing you should do is....

Is the next phase of FOSS adoption license enforcement? Are businesses and users going to be vigilant complying with license terms for FOSS? What is their motivation to do so? The motivation for organizations to carefully comply with 'closed licenses' is the threat of software audits, seized hardware and monitory penalties. But if a business or user is enjoying improperly licensed FOSS, are they going to have their down kicked-in and somebody hand them source code?

It is obvious to me that the penalty would be the harm caused to the FOSS community and the resulting impact on software innovation. But is this as obvious to an organization that just needs to be able to install software via 'setup.exe'?

This post originally appeared on an external website

A recent discussion thread on TechRepublic about providing "free advice" for fellow employees Home computers caught me off guard. I was totally surprised by the large number of replies advising the original poster to say No or, to provide the service but only in a 'moonlighting' capacity.

It seems obvious to me that not providing IT services/advice for your fellow employees only continues to feed the perception that IT groups are unapproachable (at best) and not helpful (at worst). In an era when internal IT groups are constantly under pressure to demonstrate business-value and differentiate themselves from outsourced service offerings, I would think that the last thing an internal IT group would want to do is turn away a customer.

My experience has been that quite a few employees are using home-computers for work purposes. It is as if, as the cost of USB data storage keys has declined - the relative weight of company issued laptops has increased to a point where employees will frequently elect not to take the corporate laptop home to complete some job related activities. My point being that frequently the Home computers of employees become a defacto extension of the organization's computing environment. Wouldn't any IT Administrator like to make certain those Home computers are 'virus free' before that USB data storage key returns to the office and gets plugged back in the network?

My advice is that internal IT groups should develop a policy that:

*Allows employees to open a proper HelpDesk ticket allowing the internal IT group to clean/debug/reload Home PCs during work-hours, on a lowered priority basis (service metrics are critical for an internal IT group).

*Requires internal IT staff to service Home computers within the IT HelpDesk bench. This ensures that the level of service will be of high standard and ensure that all of the required tools/utilities are available. It also protects the organization since IT staff should NOT under any circumstances make a house call to an employees home (this should make the corporate lawyer, HR and, internal IT staff very happy).

*Provides 'Home Edition' CAL's for commercial AV software for every employee to use at home. I also recommend that the policy stipulate that the annual 'renewal' cost of the commercial AV software is the employees responsibility (the first year is paid for by the company). Now before objecting to the perceived 'cost' associated with the company supplying the AV software license make certain that you have compared this cost against the costs of a virus outbreak/incident inside the organization by calculating the Annualized Loss Expectancy.

*When the internal IT group works on an employees Home computer, the AV software will be installed/updated/configured, a personal firewall will be downloaded/installed/configured, Anti-SpyWare installed and, of course the Microsoft Windows Update service turned on and brought current.

I have found that the results from this approach are terrific. First, employees are able gain access to IT staff in a non-emergency/non-critical project deadline scenario - obtain some free computing advice while learning about each other ("It all started after my son installed something called BitTorrent and...."). That kind of social interaction pays dividends for the internal IT group later on. Second, employees are being gently educated on IT security and, hopefully will be empowered to deal with the 'kid/computer' relationship at home since many parents feel that the children are more knowledgeable about computers than themselves. Lastly, you have done a good thing as an IT professional by maybe helping to reduce the number of insecure PC's found in today's "always on" home environment.

Is this Altruistic? Nope! You have also reduced the risk that your organization's computing environment is going to be infected from the inside.

So, my reply/advice in the discussion thread is to say, Yes. If the internal IT group can properly manage the employees expectations and provide them with more value than they bargained for they will increase the internal IT group's customer satisfaction in a big way.

This post originally appeared on an external website

Bruce Byfield has contributed to NewsForge an article comparing the beta

of OOo Writer 2.0 with Microsoft Word 2003. Check it out.

This post originally appeared on an external website

Alongside commercial VoIP implementations from Cisco and Avaya is an open source offering called Asterisk. Asterisk provides voice gateway and PBX functionality for significantly less cost.

With Asterisk you can replace an existing PBX system, connected POTS or ISDN circuits with a standard Intel server. IP services are then proivded by one of the many voice phones available from companies such as; Polycom, Cisco or, a standard telephone by means of a Digium FXS interface (known as an IAXy).

Asterisk can trunk outgoing and incoming calls via VoIP providers, or using local circuits. Digium, which supports the Asterisk project, sells all the hardware required to interface with POTS, ISDN PRI and T1/E1. Connecting branch offices together can be done over IP, avoiding the need for expensive voice circuits when DSL or cable IP services are available.

Asterisk is full featured and will deliver traditional PBX functions such as call transfers, music on hold, conference calling, voicemail, call parking and more. Mobile users can access their voice services remotely and have their calls forwarded. Asterisk can be set up an extension to call a variety of end points, including SIP phones, standard phones via a VoIP provider, an extension hanging off a channel bank, or a local number out of an ISDN circuit.

In the following example, Asterisk will call a SIP phone and a external number at the same time for ten seconds. If the call is not answered or the call fails, it will call a cellular telephone for five seconds before resorting to voicemail. If when trying to connect to the SIP phone a busy signal is recieved, the call will route to voicemail immediately but with a busy rather than out of office message.

exten => 200,1,Dial(SIP/mlewis&IAX2/nufone/19055551234,10,tr)
exten => 200,5,Dial(IAX2/nufone/19055551500,5,tr)
exten => 200,6,VoiceMail(u200)
exten => 200,7,Hangup()
exten => 200,102,VoiceMail(b200)
exten => 200,103,Hangup()
exten => 200,106,VoiceMail(b200)
exten => 200,107,Hangup()

Mike Lewis at SYS-NET Solutions can provide more information. Mike can be reached on his Asterisk PBX at 905-206-9412 ext 200.

This post originally appeared on an external website

The results of a quick Google Search can confirm that "...small business is the engine that powers our economy". As a small business owner I can also confirm that there is a wealth of information and resources available to me and my business on the internet. However, the best intentions will sometimes still leave the small business owner with incomplete information.

For example, the Canadian Federation of Independent Business has a Technology Guide available for download as an aid to small business.

Now I'm all for information sharing especially with fellow small business owners but the section entitled "Licensing and the Law" does not provide a small business owner with the complete details regarding software licensing. Take the following for example:

What type of licence can you acquire?
You can acquire licenses in three fundamentally different ways:
1. In a box, from a retailer.
2. Software already installed on a new PC.
3. Volume licensing ? when you need five or more licenses.

The Technology Guides make no mention of Open Source software to the small business owner even though a majority of companies and government have embraced the concept of open computing. In fact, a recent survey by Forrester Research indicates that 60 percent of large companies surveyed have already adopted or plan to adopt open source technology, and half of them use open source technology for "mission-critical" applications. Further, Linux as become the fastest growing server platform in the market today. Linux server revenues topped $1B in third quarter 2004, with a year-0ver-year revenue growth rate of 42.6%, as reported by IDC in November 2004.

It has become clear that open source software (OSS) has an important role to play in the IT industry and in business, in general. Yet there is considerable confusion about the strengths and weaknesses of OSS. Some believe it will eventually replace the commerical software model. Others decry OSS as the single greatest threat to capitalism and the principles of intellectual property - the ruin of Western society. Of course, neither of these extremes is accurate1.

What does Open Source Software refer too?

Open source does not just mean access to source code and while there is agreement on the broad term "open source" as meaning approximately what is captured in the Open Source Definition the term has, ironically, now become so popular that it has lost some of its precision. However, the distribution terms of open source licenses specify the following concepts in a variety of ways;

• Free distribution. The license does not restrict the work from being sold or given away.
• Source code. The license usually allows distribution of source code as well as compiled form.
• Derived works. The license will allow modifications and derived works, and allow them to be distributed under the same terms as the license of the original software.
• Source code. The license usually allows distribution of source code as well as compiled form.
• Derived works. The license will allow modifications and derived works, and allow them to be distributed under the same terms as the license of the original software.
• License not specific to product. The rights attached to the work must not depend on the works being part of a particular distribution of work.
• License will not restrict other works. The license must not place restrictions on other work that is distributed along with the licensed work. For example, the license must not insist that all other programs distributed on the same medium must be open-source software.
• License should be technology neutral. No provision of the license may be predicated on any individual technology or style of interface.

Taken from: "The Open Source Definition" , http://www.opensource.org/docs/definition.php

Open source works evolve through community cooperation. These communities are composed of individual programmers as well as very large companies. Some examples of open source initiatives are Linux, Eclipse, Apache, and Mozilla. A comprehensive but, incomplete listing of the various licenses can be accessed at the Free Software Foundation.

This post originally appeared on an external website

The first thing that most new users shifting from Windows will find

confusing is navigating the Linux filesystem. The Linux filesystem

does things a lot more differently than the Windows filesystem.

This article explains the differences and takes you through the

layout of the Linux filesystem.

This post originally appeared on an external website

If you are considering migrating some or all of your IT infrastructure to Linux, this recent article in CIO will probably be of interest to you. It covers many issues and lessons learned for one company which completed such a migration.

The article is available here: http://www.cio.com/archive/070105/cendant.html

/djs

This post originally appeared on an external website

This article looks like some of the methodologies used by investigators are fairly aggressive and that the FTC will be looking into these practices. For more information on this please visit the following link:

http://www.informationweek.com/showArticle.jhtml?articleID=165701674

/djs

This post originally appeared on an external website

Alfred E. Newman,CISSP?

More than 30% of those polled by the National Cyber Security Alliance (NCSA) think they'll take a bolt of lightning through the chest before they see their computers violated in an Internet attack.

What these businesses are failing to realize is that in the Internet era, with always on connections providing easy access formass, indiscriminate attacks, a business or organization does not have to be a target to be a victim! Some of the factors that make SMB?s susceptible to mass attacks include the fact that they tend to be pretty homogenous in terms of their computing infrastructure.

According to Gartner, 90% of SMB?s are running Windows ontheir servers, 80% are using Outlook and Exchange as their e-mail clients and servers, and 70% are using SQL databases. In addition, SMB?s typically lack the specialized, dedicated, and highly trained security staff that can address IT security. Unlike the situation at large IT organizations, where there is likely to be a significant staff whose sole responsibility is securing the IT environment, at most SMB?s security is likely to be a part time responsibility for someone on theIT staff. Gartner research indicates that more than 60% of midsize businesses in North America do not have a dedicated resource to manage security. The situation at small businesses is undoubtedly even worse.

Network Security and the SMB

Network security is an issue for all businesses. The challenges faced by small-to-medium size businesses (SMBs) are unique and significant. While larger businesses have substantial resources with which to identify and defend against network security threats, all businesses face the same significant and constant risks. A large business can afford to dedicate staff time to network security, or hire an outside firm, or both, but SMBs (generally) cannot. The issue at hand is that SMBs rely on technology and networks as much as any business.

Matt Hawley, has authored a paper intended as a guide for service providers and consultants seeking to enhance the security posture of SMBs, which acknowledges the unique challenges that SMBs face. This paper will provide an interested SMB owner in understanding network security threats and remedies and proposed solutions offered by service providers/consultants. Mr. Hawley's paper is not a comprehensive step-by-step, but a guide and overview that references many significant security resources available. Such as: NIST, CERT/CC, Insecure.org, CERIAS, and SANS.

Spy vs. Spy? Eight Actions to take to create a more secure network.

1. Model the threats to your business, and perform a security risk assessment.
Because each organization is unique, it is important to think through the potential threats to your business. This will be a brainstorming exercise that produces a long list of potential threats. Building upon this list, management and IT staff will then want to think through which of these threats are worth worrying about. A risk assessment will examine all of the relevant security risks, in terms of which risks are applicable to the business, what the expected number of annual occurrences might be for each, and the expected loss per occurrence. This will result in an annual loss expectancy for each identified risk. Armed with this information, it then becomes easier for the business to decide which risks to address in which order, and what level of remediation expenditure makes sense for each risk. There may be risks where the annual loss expectancy is lower than the cost of remediation, where the business will choose to just accept the risk.

2. Develop an information security policy, and educate your users.
Every organization of any size should have an acceptable use policy for their computing resources, defining how employees may use IT resources, including the internet, and an e-mail policy, defining acceptable uses and practices for company e-mail. SANS has a great resource, the SANS Security Policy Resource, that can speed the development of sound information security policies. The web page contains templates for many areas where an organization may need to develop a security policy. Templates for these and many other security-related IT policies can be found on the SANS website.

3. Design a secure network, implement packet filtering in the router,implement a firewall, and use a DMZ network for servers requiring Internet access.There are many considerations in designing a secure network. Some ofthe key factors to consider include the following:

• Use a ?defense-in-depth? strategy in designing a secure network. Thisbasically means not relying on a single device or product to enforcesecurity, but instead using the security capabilities of a router, and firewall, and ensuring that software on hosts and servers are up-to-datewith patches. In more sophisticated environments, it may also mean thatsome or all of the following advanced security solutions might be called for- intrusion detection/prevention devices, host intrusion preventionsoftware, application firewalls, or encryption solutions.

• Implement a firewall- ideally one that provides stateful packet inspection. The firewall will need at least three interfaces- LAN, WAN, and DMZ. The LAN interface will be used to connect all of the user workstations, and Network Address Translation should be used to hide the actual addresses of allworkstations. The mail server and web server will be placed on a network segment using the DMZ interface, where the traffic into and out of these devices can be subjected to different filtering rules. Address translation should be applied to these devices as well.

• Use the ?principle of least privilege? in determining appropriate access to network resources. This essentially means that if a given group of users,be they internal or external, do not need access to certain systems, or applications, then they should be restricted from this access.

• Test each of the components after installation, to ensure that they areperforming as expected. For example, test to ensure that a firewall that is configured to only allow inbound web access to the web server located on the DMZ actually blocks other attempted web access, to other hosts. A study of firewall configuration errors concluded that almost 80% of firewalls examined had ?gross mistakes? in their actual implementation.

4. Use anti-virus software, both at the gateway, and on each desktop. Given the proliferation of viruses, using AV software is a must. Implementing gateway anti-virus software will ensure that all incoming and outgoing e-mail is scanned for viruses. It is also wise to consider blocking some categories of attachments (i.e. those that can introduce a virus or Trojan, for example .exe files and other programs, scripts, and even .xls and .doc files that can contain harmful macros). Using AV software on each desktop is also recommended, as any viruses that get introduced from somewhere other than the Internet can be caught at the desktop (for example a laptop user picking up the virus while at home, and then spreading it upon reconnection to the corporate network).

5. Know your network, harden systems by removing unnecessary applications, and maintain an aggressive program of patching operating systems and applications. It is important to know what is running on each system on your network, and to ensure that appropriate patches are applied. Frequent patching will reduce the exposure from newly found vulnerabilities. This is very important, as the time lag between vulnerabilities being found and exploits and attacks being launched has shrunk significantly in the past few years.

6. Use Strong Authentication. Left to their own devices, most users will pick short and frequently predictable passwords. There are many attack tools that try to guess user ID/password combinations, based upon a brute force approach (trying every possible combination) or that use a dictionary approach (trying common words from an electronic dictionary). Many operating systems provide the ability to force minimum password standards, including length (longer is better), avoidance of using dictionary terms, and use of special characters (using punctuation characters, for instance, makes passwords less susceptible to dictionary attacks). Anything that can be done to avoid using standard dictionary words will help to improve security with regards to authenticating users. In addition, many solutions exist that can enhance authentication through the use of security tokens. These products use cryptographic techniques to produce ?one time? passwords. This is referred to as ?two factor? authentication, wherein users are only permitted access after verifying ?something you know? (the valid user login and PIN), and ?something you have or possess? (the security token that produces the one-time password). A third approach for the truly paranoid can include ?something you are?, or a unique biometric characteristic such as a fingerprint.

7. Use personal firewalls, particularly on laptops used by mobile users

8. Develop a computer incident response plan. Even small companies need to think through how to respond in the event of a security incident. The computer incident response plan should identify the resources that will be involved in analyzing the incident, and the plan for analyzing and recovering from the incident. For small businesses, the resources that are called in may be external resources, for examples consultants or integrators. Here is a real world example- one evening your ISP calls and tells you that an IP address that is registered to your company is sending out massive amounts of SPAM, and that they will be removing your internet access until the problem is solved. If your business depends on the Internet in any way, you will need a plan to analyze what is happening, identify the resources that have been compromised, pull them offline, clean and rebuild the systems, and resolve the problem ASAP.

The downside of trying to condense the topic of securing a network to a action list is that the result will inevitably leave out some very important actions. Businesses should, in addition to the eight actions listed above, also have a
business continuity plan that looks at business-impacting disasters and plans for and tests responses. SMB?s should backup critical data frequently, and test that the backup/restore process actually works. SMB?s should also evaluate their physical security- looking at how access to physical IT equipment is controlled and secured. They may also want to consider having an outside organization actually test their security- this is called a penetration test, and can help to identify security problems and weaknesses.

Security is worth investing in. The downside of doing nothing may well be that the business ceases to exist when a malicious attack destroys customer records or valuable proprietary data. However, addressing the problem needn?t necessarily mean hiring direct, expensive staff. There are many great security systems integrators and managed security service providers who can assist an SMB to implement the appropriate solutions. When considering using a third party to assist with solving security problems, it is important to make sure that the organization has qualified personnel, and proven expertise. One way to ensure that this is the case is to look for partners who have recognized expertise in information security- with respected certifications such as the SANS/GIAC certification series (GSEC, GCFW, GCIH, et al), and the ISC2 CISSP certification.

As far as your chances go....1 Canadian in 5 million is struck by lightning every year. Whereas, Pandasoft estimates that 34% of the PC's in Canada are currently infected with a virus.

This post originally appeared on an external website

vnunet.com has reported on an argument over intellectual property rights in software that manages train sets. Provides an interesting view of the risks with developing and using open source software.

Full story at vnunet.com....

See also a posting dicussing the dispute at Naked Law.

Adsense

patent

This post originally appeared on an external website

Asahi.com reports that in June, Fujitsu Ltd. will release a desktop PC with a 37-inch screen.

Read full story...

This post originally appeared on an external website

Lot's of buzz about Web 2.0 but what is it? O'Reilly has a terrific article "What Is Web 2.0" that brings the idea into focus.

Some examples that we're excited about are:

• Prosper: the online marketplace for people-to-people lending.
• Zopa: the first lending and borrowing exchange.
• Upcoming.org: a collaborative event calendar, completely driven by the user community. Users enter in the events they're attending, comment on events entered by others.

Goran Matic of metaInspire sums the Web 2.0 idea this way, "...the social networking component is really taking off - i think Web 2.0 will prove to be about that somehow, extending the boundaries of things and involving more people."

Here is hoping that others will be inspired to participate. And, here is hoping network neutrality provisions will find their way into law and ensure equal access for free participation.

Adsense

web 2.0

This post originally appeared on an external website

I was recently asked about my lack of blog posting productivity. The reason? In September 2005 I joined the Info-Tech Research Group as a Research Lead.

Security presentation, Adaptive Security Part 1 - IT Infrastructure Management Conference & Expo - Las Vegas, November 2006

Security presentation, Adaptive Security Part 2 - IT Infrastructure Management Conference & Expo - Las Vegas, November 2006

Q9 prescribes data centre solution for Medic-Alert - IT business.ca, May 2006

Speaker at Fifth Annual Canadian IT Security Conference - Strategy Institute, April 2006

Novell targets Microsoft with new Linux offering - ComputerWorld Canada, April 2006

SMEs Confused about Identity Management - CIO India, March 2006

Compliance drives identity management growth - Computer World Canada, March 2006

Is Sun the 'Dot' in Dot-Com Again? - Internet.com, March 2006

Non-profits choose the migration route - Computer World Canada, March 2006

Network monitoring tools: Buying tips for the network-enabled SMB - ITBusiness.ca, December 2005

A blueprint for IP - Network World Canada, November 2005

Visionael tracks assets for network vulnerability - Network World Canada, November 2005

Citrix outlines its new three-tier access plan - Computer World Canada, October 2005

How to take the stress out of mobility management - EQ Monthly, September 2005

Legacy Data: One Solution For Two Big Problems - InformationWeek, June 2000

Web-Enabling MGA Services - LOMA's CyberTalk, November 1999

Extranet Technology transforming life insurance business operations - Insurance Journal, April 1999

Adsense

stahl

This post originally appeared on an external website

From Wired, "Mandarin Chinese is already the most popular first language on the planet, beating out English by 500 million speakers. And it's the second-most-common language on the Internet. Now, just as China requires students to learn English, Beijing wants to make Chinese the must-take language for English speakers - and everyone else. Ma figures there are currently 30 million people around the world learning Chinese as a second language. Hanban aims to increase that to 100 million over the next four years."

Link:
http://www.wired.com/wired/archive/14.04/mandarin_pr.html

Back in the mid-1980's (jesh am I old or what?), I took conversational Japanese courses having become convinced that Japan's economic engine was going to make it a dominate player. Now in 2006, Japan's economic engine is chugging along quite nicely but they are by no means the calibur player that we - or at least I - thought they were going to be. The good news? With my pocket "cheat sheet" I can conjour up just enough conversational Japanese to amuse native speakers of the language while maneuvering through small daily transactions.

Is China's emerging economy potential different than Japans? Well, it certainly has the potential to be larger. However, with a significant language barrier - Mandarin is incredibly difficult to learn ( a friend exposed me to Mandarin for a while) wouldn't we be better served by leaning economically toward India in the near term?

Hmm...Hindi or Mandarin?
I like Chinese food much more than Indian food so practical applications abound! Therefore, maybe Mandarin classes are inorder. In twenty years time I'll be able to amuse a larger group of speakers in a language that I barely know - while maneuvering my way through small daily transactions.

Maybe a countries economic success on the world stage is directly proportional to the popularity of its cuisine? If Sushi was more popular in North America and tossed into SUV's from drive-through-windows, Japan would have become the powerhouse I thought they were going to be become?

/djs

This post originally appeared on an external website

From PCMag.com -
"Frustrated Microsoft Windows users often fantasize about moving to Linux, but most never take the plunge, fearing the switch will be too difficult. Xandros Desktop OS 3 makes the transition from Windows to Linux easy?and it's well within reach of anyone new to Linux." Read more...

From Linux-Watch.com -
"Xandros debuts a Linux-based replacement for Windows Small Business Server, on April 25 at the LinuxWorld Toronto." Read more...

From Mad Penguin -
"Many people may disagree with me, but I firmly believe that until Linux can successfully mingle with Windows machines, on Windows terms, it will never succeed to the extent that it should. Sure, in a perfect world we wouldn't need to worry about such things, but let me assure you we live in a world that is far from ideal and Windows currently dominates it. What this means is we either have to play by their rules (to an extent) or maintain a relatively low share of the market. It's really that simple. How many distributions available today have the functionality it takes to be a part of a full-fledged Windows domain? The answer is simple: One. " Read more...

Adsense

xandros

linux

This post originally appeared on an external website

From NewsForge.com -

Read full story...

In 2006, Canadians can fill out their census forms online for the first time -- but not if they use GNU/Linux, or are free software advocates who prefer not to install a proprietary version of Java.

If you are a Canadian user of FOSS, you may want to contact -- and educate -- your local Member of Parliament about the situation. You might also contact the Census Help Line (1-877-594-2006), Statistics Canada (1-800-263-8863), and Public Works and Government Services Canada (1-800-622-6232) to state your concerns. If enough people do, then maybe the Canadian government will realize that all residents have the right to access online services, not just those who use the approved (proprietary) software.

This post originally appeared on an external website

Voice-over Internet protocol (VoIP) is a technology that enables data packet networks to transport real-time voice traffic. It consists of hardware and software that allow telephone conversations over data networks.

A VoIP call has the same basic steps as a regular plain old telephone service (POTS) call, but these steps take place over a computer network instead of a private telephone company?s special-purpose phone network. The VoIP call could take place over the Internet or an intranet.

Figure 1 illustrates the difference between a POTS call and a VoIP call.

Voice networks such as POTS use circuit-switching technologies. This requires a dedicated path to be set up between all communicating parties. It is a reliable but inefficient use of bandwidth. By contrast, data networks dynamically allot bandwidth using packet switching. This allows the available bandwidth to be used far more efficiently for data. However, transporting voice using packet switching is less efficient, as voice is very sensitive to delay and quality can also suffer.

VoIP technology allows networks to be built using either a centralised or distributed architecture. In centralised architectures, the network intelligence is centralised and endpoints have limited or not-native features. Distributed architectures are associated with H.323 and session initiation protocols (SIPs). These protocols allow network intelligence to be distributed between endpoints and control devices.

The four main components specified by the popular H.323 standard shown in Figure 1?POTS Calls vs. VoIP Calls are:

• Terminals, which can support audio, video or data communications

• Gateways to connect two dissimilar networks, e.g., an H.323 terminal and the PSTN

• Gatekeepers, which are the focal point for H.323 calls and provide addressing, authorisation of terminals and gateways, bandwidth management, accounting and routing

• Multipoint control units (MCUs), which provide support for conferences of three or more H.323 terminals

Benefits of VoIP

The Internet has become a ubiquitous means of communication and, according to DataQuest, quickly surpassed traditional voice (circuit-switched) network traffic. It is anticipated that voice services will be one of the next major applications to take full advantage of IP. In addition, data traffic is growing by 50 percent each year, compared with only 8 percent for voice. VoIP provides a number of benefits:

As Internet traffic exceeds voice traffic in terms of volume, it makes more sense to transfer voice over data networks rather than data over voice networks (i.e., modems).

• Cost savings by reducing or eliminating the toll charges associated with the PSTN. There is no longer a need to pay a telephone company to build and maintain an expensive, special-purpose network. Additional capacity does not need to be added until needed.

• Open standards enable businesses and service providers to purchase equipment from multiple vendors, which is generally more cost-effective than proprietary solutions.

• By making voice ?just another IP application,? companies can build truly integrated networks for voice and data. These integrated networks not only provide the quality and reliability of today?s PSTN, but also enable companies to quickly and flexibly take advantage of new opportunities within the changing world of communications.

• Network management can be centralised and consolidated.

Concerns With VoIP

The two major concerns when implementing VoIP are quality of service (QoS) and security.

Quality of Service

Voice quality is directly affected by three major factors:

1. Packet loss?Ideally, there should be no packet loss delay for VoIP. While most local area network (LAN) environments lose less than .01 percent of all transmitted packets, packet loss over the common wireless area network (WAN), Internet and Internet service providers (ISPs) may be much higher.

2. Jitter?A successful VoIP implementation must suffer from a minimal level of jitter. However, jitter buffers (used to compensate for varying delay) further add to the end-to-end delay and are usually effective only on delay variations of less than 100 milliseconds, resulting in the receiver discarding received packets. Essentially, packets being discarded and not played, exceeding the endpoint?s jitter buffer time tolerance limits, cause jitter.

3. Latency or delay considerations?Latency is the amount of delay between sending the IP packet and its delivery to the recipient. Within the Rapid Transport Protocol (RTP) standard, used by H.323 and SIP, an underlying requirement is for each audio packet to be issued with a time stamp upon transmission for the recipient?s use. If the latency is within the H.323 standard, the audio packet is processed; otherwise, the packet is not processed, resulting in audio loss. Eventually, excessive packet loss causes a degradation in voice quality.

Security Issues

Voice security is a much more sensitive topic than data security. Users often expect that all voice communications are confidential.

Any VoIP device is an IP device; therefore, it is vulnerable to the same types of attacks as any other IP device. A hacker or virus could potentially bring down the data and voice networks simultaneously in a single attack. Also, VoIP networks are still vulnerable to sniffing, denial of service (DoS), traffic-flow disruption and toll fraud. Sniffing would allow the disclosure of sensitive information, such as user information, resulting in identity theft, which may be used to attack other data subsystems. Port scanning is often a precursor to a potential sniffing of the VoIP network. The ability to network sniff is becoming easier as many tools are readily available from open-source web sites as opposed to highly expensive speciality diagnostic equipment used for time division multiplexing (TDM).

Denial of service, or the flooding of the data network with data, is a common issue in the protection of data networks but needs to be revisited as QoS becomes implemented for VoIP networks. The IP endpoint is often overlooked but it can be singled out as a point of attack and flooded with data, causing the device to reboot and eventually become unusable.

Traffic flow disruption allows further exploitation of the previous two vulnerabilities, whereas the redirecting of packets facilitates the determination of packet routes, increasing the likelihood of sniffing.

Voice packets travel ?in the clear? over IP networks, so they may be vulnerable to unauthorised sniffing. Unless network-based encryption is used, all voice RTP packets travel in the clear over the network and could be captured or copied by any network-monitoring device.

VoIP networks have a number of characteristics that make for special security requirements. There is no such thing as scheduled downtime in telephony. Outages result in massive, widespread customer panic or outrage. There could also be disclosure of confidential information, which, like the loss of other kinds of data, could adversely affect the organisation. Many security teams spend most of their time preventing outside attackers from penetrating a corporate firewall or Internet-accessible bastion servers. However, most companies spend little or no effort protecting the internal network infrastructure or servers from inside attack. In the context of voice communications, a prime example is an employee listening to another employee?s personal or company-confidential phone calls.

VoIP Controls

The various controls that can be put in place to address the issues identified include those described in the following sections.

Firewall Controls

Firewall controls can be placed at different points on the network depending on the type of connection (figure 2). They include:

• Outgoing IP calls?With outgoing IP calls, the risk is that unauthorised traffic will be allowed back. Therefore, a stateful firewall should support temporary openings at firewall interfaces. These openings are created when specified traffic exits the internal network through the firewall. The openings allow returning traffic (that would normally be blocked) and additional data channels to enter the network through the firewall. The traffic is allowed back only if it is part of the same session as the original traffic that triggered when exiting through the firewall. Return traffic is permitted through the firewall only if the state table indicates that the packet belongs to a permissible session.

• Incoming PSTN to VoIP calls (via the gateway)?The PSTN?IP gateways that form part of the softswitch may be located inside the secure network behind the firewalls. Although these gateways? connections with the PSTN network pose no specific security risks for the IP network, it is important to apply operating system (OS) security measures, as is the case for any critical machine in the network.
  This provides some guarantee that, in case of an internal network compromise, the gateway remains protected from tampering.

• IP to PSTN telephony?Telephone hacking is not new. But, traditional telephony networks are hard networks to hack, as they tend to be a controlled, closed universe. Largely due to the proprietary nature of the protocols, access is limited and information is scarce. The Internet, on the other hand, is much easier to hack, resulting in another example of the tension between functionality vs. security. Putting control of telephony networks on the Internet means anyone could compromise a service provider?s network over the web. The gateway protocols can turn control of telephony networks over to authorised, and also unauthorised, Internet control.

• Incoming customer IP calls?VoIP incoming calls (from an end user?s push to talk or equivalent) have to be handled by a correctly configured firewall. Both H.323 and SIP initially were not designed to allow connections over a firewall, so the firewall needs to be configured to minimise exposure whilst allowing full functionality.

VPN Considerations

Intersite audio streams could be sent over leased lines, open Internet connections, virtual leased lines or virtual private networks (VPNs).

Reasons for using VPNs include:

• Leased lines are considered secure but provide an inflexible and often expensive solution, especially as the number of locations increases.

• Open Internet connections are the cheapest, but they send the audio in the clear of unmanaged connections, the quality of which cannot be guaranteed. Therefore, this is usually not a recommended solution for mission-critical purposes.

VPNs are typically the solution of choice for intersite traffic. Encryption guarantees confidentiality of all data, and the different sites can be handled as one bigger virtual site. These long distances and encryption/decryption add delay, which can be acceptable of VoIP as long as the VPN connections are dimensioned correctly and use QoS mechanisms to assure proper prioritisation of the VoIP packets.

SLA for QoS

QoS has become an important factor in the acceptance, planning and implementation of multiservice networks. As a result of the integration of voice traffic with an array of complex data applications, each with its own unique service requirements, the necessity of service level agreements (SLAs) combined with the application of QoS should be emphasised. SLA mainly guarantees that the uptime and overall performance of the network will consistently deliver a perfect audio experience. Any good deployment should use a network that is supported by an SLA.

Conclusion

Although the use of voice-over packet networks is relatively limited at present, there is considerable user interest, and trials are beginning. End-user demand is expected to grow rapidly over the next five years. Frost & Sullivan and other research firms have estimated that IP phone and appliance revenues for the total world market will reach US $2.7 billion in 2006. It is clear that a market has already been established; a window of opportunity exists for developers to bring their products to market and for consumers to realise significant savings.

Some basic controls that could be implemented include:

• Restrict physical access to any of the VoIP softswitch servers and gateways.

• Set up strict security policies.

• Set up good authentication, authorisation and auditing (AAA) policies to control who is authorised to do what and trace when activities take place.

• Apply known security patches systematically.

• Apply IP networking security measures correctly.

• Deploy the VoIP on a separate virtual LAN1 (VLAN) with proper inter-VLAN access control and/or firewalls to minimise the potential for data packets to adversely impact voice packet delivery.

• Implement logging and monitoring to detect any breaches of security.

• Stop any web servers that are used for initial setup, and adequately secure Internet Information Services (IIS).

• Carry out encryption of packets using PGP or other vendor-specific products.

• Use appropriate SLAs to guarantee the uptime and overall performance of the network.

Web References

http://www.hippoinc.com/whitepapers/voipover.htm
http://www.comtest.com/tutorials/VoIP.html
http://www.voipwatch.com/about_us.php3?op=viewarticle&artid=7
http://puredata.com/solutions/technologies/wp/ip.htm
http://www.internetwk.com/reviews00/rev082100-2.htm
http://www.voipwatch.com/article.php3?sid=101
http://www.computerbusinessreview.com/research_centres/e80c33fe8ff3a8b280256d350047d197

https://www.isaca.org/Template.cfm?Section=Home&Template=/MembersOnly.cfm&ContentID=18399

Endnotes

1 A group of resources, such as servers, that behave as if they were connected to a single network segment even though they may be spread around the organisation.

Adsense

VoIP

This post originally appeared on an external website

Mr. F. N. ScopeCreep, VP Business Development, BigCompany.com

Dave Berlind's Blog entry introducing an interview with Philip Greenspun was certainly thought provoking for me this morning. Keen and full of coffee I was inclined to agree with Mr. Berlin's notion about Mr. Greenspun that, "With several successful ventures on his resume, Greenspun?s business insights are worth listening to." Until I read the transcripted portion from the interview.

Below Mr. Greenspun provides us an example of the business leader tendency to demonize software tools rather than holding the business management responsible for a failure.

"Kaye: But that?s true of whether it?s open source or not.

Greenspun: No, because if it?s closed source, they can?t just download the TAR file and have their IT people make the needed changes. They have to go to you to make the customizations. So that?s something that investors in an open source company have to be aware of ? that it?s a more brittle business and inefficiencies that cascade and pile up on each other can devastate your business in a question of months. So, where I had been making a profit every month, the venture capitalists managed to go through nearly $50 million in cash in about a year before they flamed out. So, that?s a word to the wise. If you?re going to be an investor in one of these companies, really watch to make sure they don?t put in any costly or slow management structures."

This is not a open or closed source problem. It is simply poor business management.

Jesh and I though it was the stupid hammer!

Adsense

FOSS

This post originally appeared on an external website

One of the best features of Thunderbird is cross-platform ability. This is a big benefit for me. I find that I must run a dual boot laptop configuration with Fedora Core 3 and Windows XP. I was able to install Thunderbird on both partitions but have my e-mail data files reside on a Shared Partition . This allows me to use Thunderbird as my email reader on either operating system and have access to the same inbox, rules, filters, calendar, addressbook. Try that with any other email reader!

This post originally appeared on an external website

This is a list of the most common keyboard shortcuts in Firefox, and the equivalents in Internet Explorer and Opera.

• Rendering. [from www.linuxformat.co.uk print edition May 2005]. "Firefox pauses for a quarter of a second before drawing web content, but you can override that and force it to draw content immediately. To do this, enter about:config into the location bar, and look for nglayout.initialpaint.delay setting. If it's not there, right-click and select New > Integer, and give it that name. The default value is 250 (milliseconds), but you can set it to 0 to make Firefox feel much snappier."
• HTTP Pipelining. [from www.linuxformat.co.uk print edition May 2005]. "Send your network performance through the roof by enabling HTTP pipelining, a neat trick that allows Firefox to request multiple files simultaneously.
  To do this, enter about:config into the location bar, set network.http.pipelining to true, and set network.http.proxy.pipelining to true. Next set network.http.pipelining.maxrequests to some number like 30. This means it will make 30 requests at once.
  
  

This post originally appeared on an external website

From
vnunet.com
:

The
Debian Linux
distribution has been certified under the
Open Source Development Lab
's (OSDL's)
Carrier Grade Linux
(CGL) specifications.

Read full story
here
...

The Open Source Development Labs' (OSDL) Carrier Grade Linux (CGL) working group includes over three dozen representatives from platform vendors, Linux distribution suppliers, network equipment providers, carriers and development community members worldwide.

The International Telecommunications Union created the
Open Communications Architecture Forum (OCAF)
Focus Group in
May 2004
. The group released it's
Carrier Grade Open Environment Reference Model - Basis version 1.0
in May 2005.

Community based working groups ensure that IT managers seeking to adopt Linux can deploy distributions certified as having carrier-grade availability and reliability in their own server rooms. That is unless they are using Red Hat.

Red Hat's FAQ regarding CGL can be found
here
....

This post originally appeared on an external website

From freshment.net: Editorials - Joseph Carter has spent "countless hours" working on licensing issues with the KDE team in the hopes of fixing the problems that have kept KDE out of the Debian distribution. In today's editorial, he gives his view of the impasse that has been reached and why it's been a loss for everyone in the community. Read full text here...

Adsense

Debian
KDE
freshmeat
Linux

This post originally appeared on an external website

GoblinX is a Live-CD that is based on the Slackware distribution. GoblinX comes in two flavours; Premium and Mini. Get GoblinX Premium at www.goblinX.com.br or on a Live CD at on-disk.com.

Adsense

GlobinX
Slackware
Linux Live
Linux

This post originally appeared on an external website

Release dates for version 4.0 of Xandros Desktop OS have been officially announced : June 21, 2006 for the home edition and September 2006 for the business edition. Xandros 4.0 Home Edition will be released in two versions : Home Edition (formerly known as the Standard Edition of Xandros) and Home Edition Premium (formerly known as the Deluxe Edition of Xandros).

The exact feature set for Xandros Desktop OS Version 4 has yet to be disclosed, but the company said it will support Wireless Profiles to help laptop users connect to Wi-Fi hotspots and store settings. It will also feature Xandros Security Suite, a set of tools including a personal firewall and antivirus features to protect PCs against spam, spyware and viruses.

Earlier versions of Xandros offered seamless file sharing on Windows networks through authentication to Primary Domain Controllers and Active Directory servers.

The new edition will extend this with the ability to read and write to an NTFS partition, the native file system used by Windows.

Included with the Business edition is the Xandros Desktop Management Server (xDMS), which gives administrators a graphical tool for deploying Xandros to client systems across a network.

Xandros Desktop 4 will also ship with the latest versions of Mozilla?s Firefox browser and Thunderbird mail client, as well as the OpenOffice.org productivity suite and CodeWeavers? CrossOver Office, which enables Linux systems to run Microsoft Office and a selection of other Windows applications.

Adsense

xandros

linux

This post originally appeared on an external website

I found this gem on a Microsoft Technet blog. In the post a Microsoft employee uses political labels to contextualize or vilify users of Linux as 'leftist'. "...a leftist and progressive gentleman, and naturally he likes Linux. I am a rightist and conservative folk, and naturally like Windows."

Nice one fellas.

This post originally appeared on an external website