Monday, November 14, 2016

Mirai or Mirage? The True Story Behind the DDOS Attack.

The true story behind the October 20th massive DDOS attack on the IoT

It was a Test and a Distraction, just as planned.


Yes, the latest DDOS attack was a test.  It was a test of capabilities, wits and the weaponization of US ProTech has spent years in the field of Cyber and related wargames and this use of targeted IP based devices was in one manor simple, which is also why it was successful.  This attack, while seemingly massive, is nothing short of a distraction where you get to see what one hand is doing, while the other magically hides another quarter behind a child’s ear.  Imagine the chaos this attack created, now imagine how it what likely used to hide its real purpose.  US ProTech and the Cyber community will quickly be searching for clues… and will likely find all the usual suspects.  Other firms such as Flashpoint traced Friday’s widespread internet outage to the IoT, according to another industry expert, Brian Krebs.
malware.  It was a test in America’s ability to respond and deal with this ever growing threat, a reality which is sure to be us for a very long time.

Consequently, the cyber-attacks which affected popular websites from Twitter to Reddit are the result of malware called “Mirai”, which manipulated smart technology to take the sites offline. The malware used vulnerable technology to launch a Distributed Denial of Service attack, overwhelming the web service DYN with traffic resulting in slow Internet speeds and offline sites.  You’re going to ask questions so here are 5 things you need to know about ‘Mirai’:

1. IoT Botnet ‘Mirai’ Targets Vulnerable ‘Smart’ IoT Technology and Turns Them into ‘Bots’

Like a parasite, ‘Mirai’ will use a host to launch cyber-attacks. The botnet scans the Internet for IoT systems protected by factory default or hard-coded usernames and passwords, according to Kreb’s blog KrebsOnSecurity. Botnets can exploit weak security measures such as standard password and username combination (eg admin, 1111) across devices. These systems are infected with malware, which directs them to a central control system, where they are prepared to launch an attack to take websites offline. Here is a list of the services that were down.

According to HackRead, ‘Mirai’ can break into a wide range of IoT devices from CCTV cameras to DVRs to home networking equipment turning them into ‘bots’. There are nearly half a million Mirai-powered bots worldwide, according to telecommunications company and internet service provider (ISP) Level 3 Communications. Here are the countries with the highest concentrations of IoT devices:

United States: 29 percent
Brazil: 23 percent
Colombia: 8 percent

2. ‘Mirai’ Took Out Amazon, Spotify, Twitter and More Websites in a DDOS Attack

The morning of October 21 saw widespread internet outages caused by a massive DDOS attack, which overwhelmed the web service with traffic. Krebs reported that cybersecurity firm Flashpoint traced the hack to Mirai. The journalist’s own website, krebsonsecurity.com, was taken down by Mirai-powered DDOS attack. The cyber-attack on Friday targeted Internet traffic company DYN, which provides services for websites like Amazon, Spotify and Twitter. Other botnets may have been behind the attack reports Politico’s cybersecurity reporter Eric Geller.

In an interview with CNBC, DYN said that the attacks were “well planned and executed, coming from tens of millions IP addresses at same time.” The Department of Homeland Security and White House are also looking into the attack. NBC News reports that one official ruled out North Korea as a suspect.

3. ‘Mirai’s Author Has an Avi of Anime Character Anna Nishikinomiya and Mirai Means “Future” in Japanese

The person who created the botnet is nicknamed ‘Anna-Senpai’ and has an avi of the anime figure Anna Nishikinomiya. Anna appears in the Japanese novel series Shimoseka, which is set in a dystopian future filled with morality police.

As the student council president of a prominent ‘morality school’ Anna is the enforcer of public morality laws according to MyAnimeList. The word ‘Mirai’ also has Japanese origins meaning ‘future’ in Japanese. A manga series called ‘Future Diary’ also describes a dystopian society modeled after the battle royale (think Hunger Games) where each contestant has a diary with notes written from the future.

‘Mirai’ is also part of a family of malware that infects IoT devices through default usernames and passwords. The other malware that has been used to create an IoT device army is called “Bashlight”. While these two strains of malware compete with each other, research from Level 3 suggests that they target some of the same devices. Currently, “Bashlight” is creating an army of a million IoT devices.

“Both [are] going after the same IoT device exposure and, in a lot of cases, the same devices,” said Dale Drew, Level3’s chief security officer told KrebsOnSecurity.

4. You Can Wipe Off the Malware from an IoT System but Recurrence is Likely

It’s possible to clean an IoT system infected by ‘Mirai’, but the botnet scans systems so often that there’s a high chance of recurrence. You can destroy the malicious code by rebooting the computer, but experts warn that vulnerable IoT devices can be re-infected in minutes.
This is bad news for cybersecurity as the IoT devices market heats up as people buy into the smart, automated systems. Gartner Inc. projects connected devices to rise to 6.4 billion worldwide in 2016 with almost 5.5 million devices being connected daily.

Telecommunications company Level 3 advised users to upgrade devices and set strong passwords, according to the Wall Street Journal. For a more sustainable solution to DDOS attacks, Krebs says ISPs will need to protect their networks from spoofing, where the attacker sends messages as the victim website and generates a huge amount of traffic. He added that the lack of these safeguards could lead to online censorship.

5. Source Code for ‘Mirai’ Botnet was Released Publicly Which Opens the Door for Future Botnet Attacks

After weathering an attack from the ‘Mirai’ botnet, KrebsOnSecurity reported that the code that powers ‘Mirai’ was made publicly available on HackForums. The hacking community has access to information they can use to infect millions of smart devices. The source code for the scanner is also located on Github and has been copied at least 700 times as of this posting.

So today, I have an amazing release for you. With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs been slowly shutting down and cleaning up their act. Today, max pull is about 300k bots, and dropping.

Special thanks to Edward Cox of Heavy and assistance in the compilation of data.

About US ProTech:
Intelli-Flex partner, US ProTech offers clients Certified Technical Security Engineers with a wide background of specialization including experts from every branch of the United States military.  Their vulnerability assessment process has been independently evaluated, tested and has received U.S. Government (USGCB) Configuration Baseline validation by the U.S. Dept. of Commerce; it exceeds NIST High-Impact (military-grade) standards and is SCAP Approved.

As a result of it US Government Approved process, US ProTech offers a broad range of award winning cyber-security assessment and management services and today holds significant contracts throughout America, Canada, Mexico and Western Europe.  “We maintain a focus on clients who seek demonstrable cyber-security and business process improvement”, says Goetsch “We have saved our clients hundreds of millions of dollars in Cyber-Liabilities and do so with an expert staff and a proprietary set of tools.”

Monday, October 10, 2016

The Final Steps in the Cybersecurity Kill Chain

Are You Concerned About a Potential Backdoor?  

Better still…. Are You Ready to Do Something About It?

Take Action

This 7-Step Cybersecurity Kill-Chain Will Stop Your Enemy Cold!  (But Not Before Gathering the Highly Prized Intelligence they want)

Intelli-Flex partner US ProTech has Mastered the Cybersecurity Kill Chain framework 1st developed with the DOD and in preparation for the CyberSecurity Summit, we wanted to share this information.  It’s part of a process they have termed the “Intelligence Driven Defense model” for the identification and prevention of cybersecurity intrusion activity. The model identifies what 7-steps the adversaries must complete in order to achieve their objective and more importantly how and when to kill their presence.

We are going to run this in this series of 3 blog posts, that will provide you the critical info needed to take action against the greatest threat of our time – Hackers using APT’s. We've already covered steps one through four.

1. RECONNAISSANCE
a. Harvesting email addresses, conference information, etc.
b. The first step of any APT attack is to select a target.

2. WEAPONIZATION
a. Coupling exploit with backdoor into deliverable payload
b. Next, attackers will re-engineer some core malware to suit their purposes using sophisticated techniques.

3. DELIVERY 
a. The three most prevalent delivery vectors for weaponized payloads by APT actors, as observed by the US ProTech Computer Incident Response Team (USPT-CIRT) for the years 2005-215, are email attachments, websites, and removable media such as a USB stick.

4. EXPLOITATION
a. At this stage exploiting a vulnerability to execute code on victim’s system command channel for remote manipulation of victim is the objective.

Today, let’s discuss the final steps:

5. INSTALLATION  
a. At this stage the installation of a remote access Trojan or backdoor on the victim system allows the adversary to maintain persistence inside the environment. Installing malware on the asset requires end-user participation by unknowingly enabling the malicious code. Taking action at this point can be considered critical.  One method to effect this would be to deploy a HIPS (Host-Based Intrusion Prevention System) to alert or block on common installation paths, e.g. NSA Job, RECYCLER. It’s critical to understand if malware requires administrator privileges or only user to execute the objective.  Defenders must understand endpoint process auditing to discover abnormal file creations.  They need to be able to compile time of malware to determine if it is old or new.  Answers to the following questions should be consider mandatory:  How does it last, survive, etc.  Does it use Auto run key, etc.  Does Backdoor need to run to provide access.  Can you identify any certificates and extract any signed executables?

REAL LIFE EXAMPLE:
a. A Watering Hole Attack on Aerospace Firm
b. Exploits CVE-2015-5122 to Install IsSpace Backdoor
i. See: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5122
Case Study: http://bit.ly/cybersecuritycase

6. COMMAND AND CONTROL
This stage is the defender’s “last best chance” to block the operation: by blocking the Command and Control channel.  If adversaries can’t issue commands, defenders can prevent impact.   Typically, compromised hosts must beacon outbound to an Internet controller server to establish a Command & Control (aka C2) channel.  APT malware especially requires manual interaction rather than conduct activity automatically. Once the C2 channel establishes, intruders effectively have “hands on the keyboard" access inside the target environment.  Let’s remember that seldom is Malware automated, normally this command channel is manual.  The general practice of intruders is:  Email – in, Web = Out.  The trick for them is to have established the control over many work stations in an effort to “exfiltrate” data without setting off any anomalies or other monitoring applications based upon content, quantity, frequency, etc.  Hence, the reason it is essential to have the proper tools in place that can identify, track, observe, stop and destroy these campaigns within your arsenal of capabilities.

7. ACTIONS ON OBJECTIVES
The longer an adversary has this level of access, the greater the impact.  Defenders must detect this stage as quickly as possible and deploy tools which will enable them to collect forensic evidence.  One example would include network packet captures, for damage assessment.  Only now, after progressing through the first six phases, can intruders take actions to achieve their original objectives. Typically, the objective of data ex-filtration involves collecting, encrypting and extracting information from the victim(s) environment; violations of data integrity or availability are potential objectives as well. Alternatively, and most commonly, the intruder may only desire access to the initial victim box for use as a hop point to compromise additional systems and move laterally inside the network.  Once this stage is identified within an environment, the implementation of prepared reaction plans must be initiated.  At a minimum, the plan should include a comprehensive communication plan, detailed evidence must be elevated to the highest ranking official or governing Board, the deployment of end-point security tools to block data loss and preparation for briefing a CIRT Team.  Having these resources well established in advance is a “MUST” in today’s quickly evolving landscape of cybersecurity threats.

900,833,392+ Records Breached During 5,063 Reported Data Breaches**Explanation about this total

Coming Soon:
5. INSTALLATION  
6. Real-Life Example “IsSpace Backdoor”
7. COMMAND & CONTROL
8. ACTIONS ON OBJECTIVES 

CONTACT US for a demonstration

REGISTER TODAY for the Inland Southern California Cybersecurity Summit (#ISCCS)

ISCCS ARTICLE

Guest Blogger - Jonathan Goetsch, Speaker and Panelist at ISCCS

Jonathan Goetsch is the CEO of US ProTech, Inc., a highly recognized Cybersecurity services company that has been established since 1999 serving thousands of clients.  Based in Las Vegas, NV with operations in California, Texas and Belgium, US ProTech’s Cyber-Expertise serves mid-market to large enterprise business and Governmental agencies in six countries.  As an Offensive-Side Red-Team Cyber Penetration Testing Team, US ProTech specializes in cybersecurity processes that are approved by the U.S. Government, validated by the U.S. Department of Commerce to exceed US Military Standards under NIST (National Institute of Standards and Technology) and accommodates SCAP (Security Content Automation Protocol).  Jonathan’s work in the Cybersecurity community spans the past 20+ years and he’s regularly recognized by the media and his peers for exceptional industry insight, contributions to the community and has been named to The Top 20 List as Global Providers of Cyber Security Services each of the past two years.

Wednesday, September 14, 2016

This 7-Step Cybersecurity Kill-Chain Will Stop Your Enemy Cold!

Are You Concerned About a Potential Backdoor?  

Better still…. Are You Ready to Do Something About It?

Take Action

This 7-Step Cybersecurity Kill-Chain Will Stop Your Enemy Cold!  (But Not Before Gathering the Highly Prized Intelligence they want)

Intelli-Flex partner US ProTech has Mastered the Cybersecurity Kill Chain framework 1st developed with the DOD and in preparation for the CyberSecurity Summit, we wanted to share this information.  It’s part of a process they have termed the “Intelligence Driven Defense model” for the identification and prevention of cybersecurity intrusion activity. The model identifies what 7-steps the adversaries must complete in order to achieve their objective and more importantly how and when to kill their presence.

We are going to run this in this series of 4 blog posts, that will provide you the critical info needed to take action against the greatest threat of our time – Hackers using APT’s.

Today, let’s discuss steps three and four in the process of seven:

1. RECONNAISSANCE
a. Harvesting email addresses, conference information, etc.
b. The first step of any APT attack is to select a target.

2. WEAPONIZATION
a. Coupling exploit with backdoor into deliverable payload
b. Next, attackers will re-engineer some core malware to suit their purposes using sophisticated techniques.

3. DELIVERY 
a. The three most prevalent delivery vectors for weaponized payloads by APT actors, as observed by the US ProTech Computer Incident Response Team (USPT-CIRT) for the years 2005-215, are email attachments, websites, and removable media such as a USB stick.

The transmission and delivery of weaponized bundles to the victim’s targeted environment is the objective but these efforts arrive with some digital fingerprinting.  This stage represents the first and most important opportunity for defenders to block an operation; however, doing so defeats certain key capabilities and other highly prized data.  At this stage we measure of effectiveness of the fractional intrusion attempts that are blocked at the delivery point.

4. EXPLOITATION
a. At this stage exploiting a vulnerability to execute code on victim’s system command channel for remote manipulation of victim is the objective.

Here traditional hardening measures add resiliency, but custom defense capabilities are necessary to stop zero-day exploits at this stage.  After the weapon is delivered to victim host, exploitation triggers intruders’ code. Most often, exploitation targets an application or operating system vulnerability, but it could also more simply exploit the users themselves or leverage an operating system feature that auto-executes code.  In recent years this has become an area of expertise in the hacking community which is often demonstrated at events such as Blackhat, Defcon and the like.

900,833,392+ Records Breached During 5,063 Reported Data Breaches**Explanation about this total

Coming Soon:
5. INSTALLATION  
6. Real-Life Example “IsSpace Backdoor”
7. COMMAND & CONTROL
8. ACTIONS ON OBJECTIVES 

CONTACT US for a demonstration

REGISTER TODAY for the Inland Southern California Cybersecurity Summit (#ISCCS)

Guest Blogger - Jonathan Goetsch, Speaker and Panelist at ISCCS

Jonathan Goetsch is the CEO of US ProTech, Inc., a highly recognized Cybersecurity services company that has been established since 1999 serving thousands of clients.  Based in Las Vegas, NV with operations in California, Texas and Belgium, US ProTech’s Cyber-Expertise serves mid-market to large enterprise business and Governmental agencies in six countries.  As an Offensive-Side Red-Team Cyber Penetration Testing Team, US ProTech specializes in cybersecurity processes that are approved by the U.S. Government, validated by the U.S. Department of Commerce to exceed US Military Standards under NIST (National Institute of Standards and Technology) and accommodates SCAP (Security Content Automation Protocol).  Jonathan’s work in the Cybersecurity community spans the past 20+ years and he’s regularly recognized by the media and his peers for exceptional industry insight, contributions to the community and has been named to The Top 20 List as Global Providers of Cyber Security Services each of the past two years.

Wednesday, August 31, 2016

900,833,392+ Records Breached During 5,063 Reported Data Breaches*

Are You Concerned About a Potential Backdoor?  

Better still…. Are You Ready to Do Something About It?

Take Action

This 7-Step Cybersecurity Kill-Chain Will Stop Your Enemy Cold!  (But Not Before Gathering the Highly Prized Intelligence they want)

Intelli-Flex partner US ProTech has Mastered the Cybersecurity Kill Chain framework 1st developed with the DOD and in preparation for the CyberSecurity Summit, we wanted to share this information.  It’s part of a process they have termed the “Intelligence Driven Defense model” for the identification and prevention of cybersecurity intrusion activity. The model identifies what 7-steps the adversaries must complete in order to achieve their objective and more importantly how and when to kill their presence.

We are going to run this in this series of 4 blog posts, that will provide you the critical info needed to take action against the greatest threat of our time – Hackers using APT’s.

Today, let’s discuss the first two steps in the process of seven:



1. RECONNAISSANCE
a. Harvesting email addresses, conference information, etc.
b. The first step of any APT attack is to select a target.

Depending on the motive(s) of the APT actor, the victim could be any company or person with information the attacker(s) sees as valuable. Attackers “fingerprint” the target to create a blueprint of IT systems, organizational structure, relationships, or affiliations and search for vulnerabilities—both technical and human— to exploit and breach the network. As large organizations tend to invest in multiple layers of security, this step could take weeks, even months. However, the more knowledge the APT actor acquires on its target, the higher the success rate of breaching the network.



2. WEAPONIZATION
a. Coupling exploit with backdoor into deliverable payload
b. Next, attackers will re-engineer some core malware to suit their purposes using sophisticated techniques.
Depending on the needs and abilities of the attacker, the malware may exploit previously unknown vulnerabilities, aka “zero-day” exploits, or some combination of vulnerabilities, to quietly defeat a network’s defenses. By re-engineering the malware, attackers reduce the likelihood of detection by traditional security solutions. This process often involves embedding specially crafted malware into an otherwise benign or legitimate document, such as a press release or contract document, or hosting the malware on a compromised domain.

*Explanation about this total

Coming Soon:
3. DELIVERY 
4. EXPLOITATION 
5. INSTALLATION  
6. Real-Life Example “IsSpace Backdoor”
7. COMMAND & CONTROL
8. ACTIONS ON OBJECTIVES 

CONTACT US for a demonstration

REGISTER TODAY for the Inland Southern California Cybersecurity Summit (#ISCCS)

Guest Blogger - Jonathan Goetsch, Speaker and Panelist at ISCCS

Jonathan Goetsch is the CEO of US ProTech, Inc., a highly recognized Cybersecurity services company that has been established since 1999 serving thousands of clients.  Based in Las Vegas, NV with operations in California, Texas and Belgium, US ProTech’s Cyber-Expertise serves mid-market to large enterprise business and Governmental agencies in six countries.  As an Offensive-Side Red-Team Cyber Penetration Testing Team, US ProTech specializes in cybersecurity processes that are approved by the U.S. Government, validated by the U.S. Department of Commerce to exceed US Military Standards under NIST (National Institute of Standards and Technology) and accommodates SCAP (Security Content Automation Protocol).  Jonathan’s work in the Cybersecurity community spans the past 20+ years and he’s regularly recognized by the media and his peers for exceptional industry insight, contributions to the community and has been named to The Top 20 List as Global Providers of Cyber Security Services each of the past two years.

Monday, June 27, 2016

SD-WAN – a.k.a. A Three Stranded Cord Is Not Easily Broken

Many of us have heard the adage: "A Three Stranded Cord is Not Easily Broken."  Inherently, we understand that this is true. We see this in demonstrated for example when we purchase rope: lots of strings intertwined.  Over the years as the cords weaken, one may break but the rope still holds.  With this basic explanation, you now understand SD-WAN.  


Now let me explain a little further.

Whenever a new technology solution arrives on the scene it takes a while before its widespread adoption. Part of the reason is that new terms are created and blended with our existing vocabulary creating confusion. SD-WAN is a new technology born out of a recognition that one of the major expenses for many organizations is their bandwidth.  Over the years numerous technologies have been introduced to reduce these cost:
  • MUXes
  • Voice over Frame-Relay
  • VoIP
  • WAN Optimizers

Just to name a few.  

The carriers have also been trying to stretch and maximize their investments. For most of us the network has become a utility.  We expect an always on network and use it constantly. Just look around, the proliferation of hand held mobile devices with a plethora of applications that allow non-stop communication, entertainment, and access to information (Maps, Google, Starbucks) has created a demand for bandwidth that is frankly challenging to meet.  Each of the respective carriers is adding bandwidth daily.  I work with a number of them and Time Warner, AT&T and others are laying fiber all over metropolitan areas.  Private companies have cropped up that lay and sell both dark and lit fiber. 

We also see that the cellular companies are adding and upgrading cell sites and working to partner with other cellular companies to exchange bandwidth. The appetite for bandwidth is so high that 3rd party companies are building cell sites and selling or renting them to the highest bidder. 

Enough said, back to SD-WAN.

This demand for higher amounts bandwidth is a challenge for most, if not all, organizations. Every CIO is faced with the need to increase the amount of bandwidth, while trying to maintain costs. IT Budgets are consistently flat¹ and 80% of the IT budget is spent just maintaining the status quo. The reality of today is that the network IS a utility and if it goes down, most organizations come to a grinding halt. “All the while, of course, the IT department is expected to deliver value for money by minimizing capital expenditure and operational costs wherever possible.” ²  My focus is SDN over SPB, and while I seek to build secure, resilient, "always on" infrastructures that are easy to manage and deploy, eventually we have to leave the premise and traverse the WAN. Whenever I have to extend my network fabric over the WAN I am faced with the reality that the single MPLS pipe they pay for becomes my single point of failure. It doesn’t matter that my SDN network built on SPB has sub-second failover, if that WAN link is the only link, my network is down. Those virtual servers and applications are cutoff from the users. I now bring in my carriers and help the customers to create a more resilient WAN. 

Enter in SD WAN.   

Talari and other companies have developed technologies and algorithms that allow the bonding together of multiple lower costs links from different carriers into a single, higher aggregate bandwidth pipe, that has higher availability and throughput than a traditional more expensive MPLS network. In addition, because we have spread the bandwidth over different medium (cable, fiber, G4, etc), and different companies, the failure of any one link does not bring the network down and is therefore more resilient. So, the adage:  A three stranded cord… applies. 

There are a number of organizations that are offering SD-WAN³, and there are a number of great white papers available⁴ for those of you that would like to get a better understanding of what, how, who, etc.  Most traditional router/WAN Optimize vendors have begun to develop products in this area, so make sure, when investigating them to do your research. I work with a number of carriers and they are starting to include this as part of their service. They provide multiple connections over different technologies and incorporate the SD-WAN service as a bundle. I suspect that this trend will become common place. It seems like a win-win to me. As with most technologies today, there are hosted and premise offerings and many include firewalls, etc.  Make sure if you opt for a hosted solution, that behind the scenes, they are not creating a single point of failure. As always: Caveat Emptor a.k.a. get references. 

Good luck.

Wednesday, April 20, 2016

Shhh… It's a secret! Third Party Maintenance

Ever find out about something new only to find out that it wasn't really new at all? Not only that, but that many before you had made the discovery and were already reaping the benefits.   That's fine, as Alexander Pope said:  "Be not the 1st by which a new thing is tried, nor the last to lay the old aside."  So, rather than lamenting over what cannot be reclaimed, I have come to embrace that I am now blessed with the ability to take advantage of it and can't wait to share the news with others, who like me were previously in the dark.

For years I had been working with customers and encouraging them to make sure to keep their equipment warrantied by the manufacturer.  Advising them "Don't go on the tightrope without a net."  The risks to the business were too critical. 

Fast forward to today.  80% of our customers IT budgets are spent to maintain status quo and a large portion of this it tied to vendor maintenance.  That leaves only 20% of their budgets available to bring on new applications that enable the organizations to take advantage of the technologies and services I offer.  Technologies and services that can bring about transformation of their businesses.   In trying to solve this conundrum for our customers and help them to recognize the benefits of revitalizing their organizations through improved communications services, I stumbled upon Third Party Maintenance (TPM).  These TPM Services offer lower cost technical support for the key vendor offerings.  I am talking substantially reduced rates with easier administration because they are provided through a single source.   So we have centralized contract and support administration.  Yes, Virginia there is a Santa Claus!  The same technical support for products and applications, hardware replacement, patching, etc.  So how is it that I never knew about this?  Well reality is that the Vendors are never going to share this information, they count on maintenance dollars.  Many sell hardware just to get the maintenance.  So, and unless you were among the select group of companies using these services by these exclusive organizations, you didn't realize it.  Recently however, Gartner, Forrester and IDC² all published articles on the topic and so the secret is out.  Savings can be achieved in a number of key areas:

1.       Lower Hardware Replacement costs
2.       Reduced TAC (Technical Assistance Centers) - Live help
3.       Eliminated Software Support costs
4.       Extended refresh cycles on hardware and software

This is really good news for all of us.  These saving can be used to accomplish a number of key initiatives such as funding for: 

1.       Outsourcing IT to a managed service  - allowing exiting staff to refocus on core competencies and project completion
2.       New technology introduction (SPB/SDN) that will enable faster, non-disruptive new application introduction
3.       New applications that improve business processes and revitalize communications
4.       Additional staffing, enabling project completion

Now, "any change, even for the better is always accompanied by drawbacks and discomforts¹".
For example: 

Quality Concerns:  Some will be will be fearful that they will not get the same levels and quality of service.   This was my initial concern, but having investigated this a bit, and seeing organizations such as Walt Disney, I was put at ease.  Disney does NOT accept lower quality service, I suspect that it is actually better.
 
Vendor Resistance:  Guaranteed, you will hear resistance and pushback from the Vendors.  No doubt, your Cisco Rep is NOT going to be happy to see you cut off SmartNet (Smart for them, expensive for you).   Maybe a few less Box Tickets to your favorite sporting events.

Refresh Policies:  You may also need to redo some long engrained policies around hardware refresh.   But Gartner/Forrester/IDC are all saying the same thing:  Why replace equipment that is performing the exact same function it was when purchased and that is still working, has an MTBF (Mean Time Before Failure) of 15+ Years?²

So, consider a change that will allow you to be the hero to the team, because you will be able to say yes to some of the projects on hold for budget, and can help your organization begin its transformation.

¹ Arnold Bennett
² Challenging the Status Quo on Maintenance Contracts and Refresh Cycles to Lower Costs

Wednesday, April 6, 2016

What Exactly is the Internet of Things?

Internet of Things/Internet of Anything/BYOT (Bring Your Own Thing)?  Pick one.  They all work.

I apologize in advance for the excessive use of alphabet soup acronyms, it is the way of the industry.  If you don't know what they are, Wikipedia is a good start.

What exactly is the Internet of Things?  It is a world where IP addresses are applied to non-traditional network devices that allows them to be controlled by network management (Software Define Networking/SDN).  It is kind of humorous, but a perfect example is seen in YouTube videos that people post.  Videos of them watching their pets on their PC's/Smart Phones, doing the oddest things while they are away via IP cameras installed in their homes.

All this is done is being transmitted over the Internet.  Your turn. You think of something you'd like to do.  How about being able to check your groceries in when placing them into your refrigerator or freezer, track the contents and create recipes based on what you have on hand?

Yes, you could correlate what you have in your cupboards to recipes on the Internet, even tie them to your diet preferences (Gluten Free, Dairy Free, Low Fat, Low Carb, and Weight Watchers) and voila!  You now have a meal based on what you have on hand, or even, create a shopping list based on what you have used.  No longer do you need to call some to check to see if you need milk, etc.  You just login to your home and check to see if there is milk in your refrigerator.

Far-fetched?  Not really.  The capabilities exist today.  The concept of tying your devices to  a network (home or office) and the Internet and then doing a Mashup¹ to combine the information with other information available on the Internet to create useful usable knowledge from information.

Another example is aligned with the PoE+ standards.  PoE+ (Power over Ethernet)  The updated IEEE 802.3at-2009[7] PoE standard also known as PoE+ ² that allows devices that are not traditionally considered network devices (lights, HVAC [*Heating/Ventilation/Air Conditioning], water heaters, refrigeration, and other devices) to be IP enabled and thus monitored and controlled by standard network protocols (Ethernet/IP(Internet Protocol)/SNMP (Simple Network Management Protocol)).

Beyond this there is the draft-unbehagen-11dp-spb-00, dated December 31, 2014, that speaks to an extension of the RFC 6329³ to allow Auto Attachment of devices to an SPB (Shortest Path Bridged Network 802.1aq)⁴ network using the LLDP (Link Layer Discovery Protocol- 802.1AB)⁵.  This means that dumb devices, like unto Wireless Access Points (APs), Cameras, LED Lighting, etc. could be provisioned to use the existing protocols as defined by the IEEE Institute of Electrical and Electronics Engineers) to attach to a network and securely connect to the appropriate services.

What it means to businesses?  A worker or person (perhaps your Grandmother) that knows nothing about networking can connect these devices to an Ethernet port and it will auto-provision.

I promise you I am not purposely intending to confuse you by using all these acronyms.  

Once connected to the network these devices can be remotely monitored and controlled by a person or persons that is authorized to do the provisioning.  It is all there, pre-built and it makes complete sense.  Every day, new devices are being added to the list of IP/Internet enabled devices can connect to an Ethernet PoE+ switch, get power and automatically join the network and be securely managed.

Over the next few years, you can expect to hear about smart buildings that have very low power consumption (PoE+) partly due to the use of lighting products that are comprised of LEDs that require minimal power and phones and devices that connect to the Ethernet switches to get power an allow control.   These smart buildings will be able to be fully automated via software to meet the needs of the tenants, while maximizing the efficiency and customizing the facilities to meet the specific needs of the occupants.   I am looking forward to the day when every office has its own climate control.

Ordinarily, my immediate concern would be for security, but thanks to SPB (802.1aq & RFC 6329) these networks can be stealth networks (read that as invisible) and therefore inaccessible to malevolent probing entities.  The Access Control will be defined in Software Profiles (SDN -Software Defined Networks).  So, the access to the network and control will be restricted to those users on approved devices, having the proper security profiles.   No hijacking of the network, no ransoms.

Tomorrow is a whole new world, and with the IOT and BYOT (Bring Your Own Thing) you will find happier employers and employees.  No longer will a bright, talented worker arrive at an organization only to receive two year old technology.  Instead, they will bring their computing device of choice (MAC, Android, Windows, and Linux) to the job and it will attach to the network with a profile that grants it access to only those records that are necessary to perform their duties.

The companies will no longer have to concern themselves with the capital and operational expenditures for PCs, Phones, Tablets, etc.  Each user will bring their own (they may need to provide some monitors and/or universal docking stations).  Cabling will be minimized, also reducing costs.  As WiFi matures and we move into 802.11ac Phase 2, speeds and densities will be sufficient to untether our users and allow them to work….where ever:  Where ever they are, on whatever device they choose, using whatever mode they prefer (Text/IM, Voice, Video, Immersive Collaboration).

So, let your imagination go and imagine what Thing you will attach.

The IoT Playbook for Wireless LAN

References:  
¹ "A mashup, in web development, is a web page, or web application, that uses content from more than one source to create a single new service displayed in a single graphical interface. 

From <https://en.wikipedia.org/wiki/Mashup_(web_application_hybrid)> "
² PoE plus, provides up to 25.5 W of power.[8] The 2009 standard prohibits a powered device from using all four pairs for power.[9]

From <https://en.wikipedia.org/wiki/Power_over_Ethernet> 
³ RFC 6329 - An IETF Standards Track defining the extensions to the IS-IS standards for Shortest Path Bridging 802.1aq using SPBM (MAC-in-MAC 802.1ah) and SPBV (Virtual LANs).
⁴SPB (Shortest Path Bridged Network 802.1aq) - IETF Standard that defines shortest path forwarding in a mesh Ethernet network using multiple equal cost paths.
⁵LLDP Link Layer Discovery Protocol, an IEEE Standard for LAN/MAN Media Access Control Connectivity Discovery

From <https://en.wikipedia.org/wiki/Institute_of_Electrical_and_Electronics_Engineers> 

⁶SDN is an evolving standard based on both Open Flow/Open Stack that allows centralized control to network access.  Specific deployment options vary from Vendor to Vendor.  SDN is championed by numerous organizations including ONF (Open Networking Foundation), IEEE, Avaya, HP, Sun, etc.