Tag Archives: Anthony Ricigliano

Google Applications

Posted on by
Reply

When other tools aren't available, many employees simply use a variety of Google apps to satisfy their need to collaborate with peers, customers, and other business partners. In some cases, management actually authorizes the use of easily-accessible programs like Google messaging, Google Docs, Gmail, and Google Calendar because these programs are seen as useful, free resources that solve a legitimate business need. At other times, frustrated employees turn to these familiar apps out of frustration. Every business owner should examine this practice to decide if these cloud-based technologies provide enough security to safeguard their company’s sensitive electronic resources.

Although using these Google apps actually means that company resources are stored on non-proprietary servers in the “cloud,” Google assures everyone that the data is both safe and secure. In fact, this Internet giant uses a multi-disciplined approach to safeguard all data stored on their servers whether it is personal or business in nature. Here are the primary methods used by Google to accomplish this goal:

 

Corporate Policies

Google’s commitment to information security is documented in a detailed set of corporate policies that each employee must read and agree to follow. The corporate security policy is reviewed and updated on a regular basis. Employees are also educated frequently on best-practice security procedures for the Tech Industry as a whole.

Organizational Security

Google has hired a team of leading experts in the fields of information, network, and application security to make sure each and every security policy is followed and that all facets of the infrastructure include state-of-the-art security features. This team monitors all Google networks for suspicious activity to quickly recognize and correct any security threats. Google also performs internal audits as an additional safety point and has a highly-trained team of physical security experts to keep all Google facilities safe from physical intrusions.

Asset Control

Google uses a widely-distributed network of servers to ensure that no single machine is a point of failure or a dedicated storage device for all the information owned by a single account or enterprise. All requests for access are verified, authenticated, and authorized to ensure each one is valid even within Google’s own network. Access to the production environment by Google staff to perform maintenance tasks is always controlled by secure shell authenticated connections. Google uses a three-phased approach to media disposal to ensure data is completely eliminated.

Personnel Security

All Google job candidates are subjected to an extensive background check in addition to signing a confidentiality agreement prior to officially becoming a Google employee. Every employee is given security training relative to their position in the company.

Physical Security

Google is composed of many different physical locations so that a single breach wouldn’t compromise the entire organization. Each building is safeguarded with a variety of different security measures depending on its location and the area’s perceived risk. These measures may include alarm systems, security cameras, software systems, and security guards. All facilities are restricted to authorized employees, visitors, and third-party agents.

Operational Security

Google takes every step possible to prevent malware from infecting its user’s computer systems. This involves both automated and manual monitoring as well as blacklisting. Google employs several teams including vulnerability management, incident management, network security, and operating system security to ensure a safe infrastructure for both Google employees and Google users.

Controlled Access

Every Google employee is required to use a unique user ID to access the system. This ID is used to track their activities and to control their access. Google requires the highest level of password strength and immediately disables each account when an employee leaves the company.

Systems Development

Google evaluates the security impact of every new system in addition to modifications to existing applications. A dedicated security team reviews each change and implementation plan to ensure that all security policies are followed. Software developers are trained to follow the latest security measures, and the security team is available for consultations if any questions or problems arise during the development process.

Disaster Recovery

Through data replication, regular backups, and geographical diversity, Google has minimized the chances of any wide-spread outages due to a localized event. The company also has a continuity plan in place for its Mountain View, CA headquarters to cover any major disaster in that area.

Compliance with Regulations

Google follows all privacy regulations when faced with third-party requests for data access. The Google Legal Team thoroughly evaluates each request to ensure it’s valid before releasing the information. Except for legal requirements and emergencies, the owner of the data is notified. Google has developed a strong privacy policy and has passed a SAS 70 external security audit.

Although Google has implemented a well-rounded set of security precautions to safeguard user data, there is always some level of risk when corporate data is stored on non-corporate servers. While this risk may not be acceptable for mission-critical data, the level of security may be sufficient for non-confidential communications in exchange for the cost savings of free applications.

Virtual Storage

Posted on by
1

While it’s true that information is king, he’s definitely a greedy ruler! As the business world continues to demand the storage of more and more data for longer periods of time, the need for increased amounts of disk space grows exponentially larger each year. To compound the issue, the low price of storage space means that many software developers no longer feel the need to make their products space efficient, and government regulations seem to increase legislative requirements for the retention of critical information each year. As the business units see the price tag on servers and disk space become more affordable, they can’t understand why adding just one more should be a problem. They fail to recognize that the cost of a growing computer room includes more than just the initial cost of the storage units.

The Shocking Cost of Maintaining Storage Units

Most non-IT workers would be shocked to find out that the cost of managing each storage unit can be as much as four to 10 times the original purchase price. In addition to putting a big dent in the IT budget, ever increasing storage units lead to server sprawl and a constantly declining operating efficiency. Increased maintenance can also be disruptive, expensive, and burdensome to the entire enterprise. To solve this problem, system engineers have been working on file virtualization methods to eliminate these issues. Their goal is to reduce storage and server inefficiencies while permitting infinite growth. Let’s take a look at exactly how they intend to accomplish this lofty goal.

Breaking the Tight Connection between Clients, Servers, and Storage

The old strategy of tightly coupling storage space with clients and servers is a big reason that adding a new storage unit becomes expensive to maintain. When machines from a variety of vendors are added to the network, they may not all integrate seamlessly creating individual islands of storage to manage. When applications are physically mapped to a specific server for storage, any changes, including additions, require modifications to this complex mapping algorithm. In some cases, adding a new device or moving a system to a storage unit with more space requires expensive and annoying downtime. This often leads to an under-utilization of the actual storage space, an expensive proposition, because system administrators over-allocate space to minimize the need to take an outage. To break free from this outdated methodology, file virtualization relies on the ability to remove this static mapping process to allow storage resources to freely move between applications as needed without restricting access to the data.

Adding a Layer of Intelligent Design to the Network

File virtualization adds a layer of intelligence to the network to decouple logical data access from the physical retrieval of the actual files. This separates the application and the client from the physical storage devices so that static mapping is no longer needed. With this change, the existing bank of servers can be maintained without disrupting the core system or the user’s access to valuable information. After implementing a file virtualization strategy, many IT shops find that they can consolidate storage units and increase their overall utilization. In this way, they may be able to simplify the system configuration by decommissioning older storage devices that are no longer needed or that they can go much longer than anticipated without adding additional disk space.

In today’s IT world, most shops are finding that using a file virtualization system is not only a “best practice," it’s a must-do to continue operating. IT shops with budgets that continued to rise each year just a short time ago are seeing their available funds shrink more and more each year. With increasing pressure to reduce costs or keep the flat, file virtualization is also a virtual requirement.

Tarpon Fishing in Puerto Rico

Posted on by
Reply

What spirit possesses the tarpon? A fierce fish, known to taunt fishermen by hiding in the depths, only to finally take the bait and thrash its way upward into trees, onto shore, and on occasion even onto a boat, the tarpon is a kind of living enigma, passionate and utterly unpredictable. Anglers remark that the fish’s tendency to struggle and its notable size tires them, but if they are honest with themselves, there is something in the tarpon’s fighting spirit that proves irresistible. Catching a tarpon is the true measure of a fisherman’s strength and soul; without tenacity, flexibility, and courage, a man can never hope to land such a fish.Record Tarpon-Anthony Ricigliano

Baby tarpons usually weigh under 15 pounds, while the majestic full sized silver king can register at 150 pounds or more. Different fishing wire is recommended for each size; a 20 pound line is best for the heaviest fish, while a 12 pound will do for the smallest versions. Research has shown that tarpons do not even need to the rise to the surface for air; they do it partly out of adolescent reflex, and partly because they like to. When they are in the mood, tarpons emerge onto the surface of the water in a process known as ‘rolling.’ Sometimes, they do it in groups, with many hundreds of fish popping up for a quick roll in the sun. To try and bait them during this process is an exercise in frustration; a tarpon can be a single-minded creature. When a tarpon is rolling, biting is generally not on the agenda. However, when a tarpon does bite, a fisherman will need every ounce of concentration to bring the fish in. The tarpon’s considerable size makes each jump and thrash a difficult weight to bear.

Fishing for tarpons in Puerto Rico is an especially pleasurable way to spend time and energy. Chartered tarpon fishing expeditions occur on a regular basis, and are recommended for those fishermen who are unfamiliar with the area. The San Jose Lagoon and the Torecilla Lagoon are favorite haunts of the fish, and offer a relative abundance of baiting opportunities for the reclusive tarpon. This is partly due to the fact that the lagoon covers a former airport runway, which provides a shallow channel 22 feet at its deepest point. Bait fish swim in these trenches, often attracting a squadron of tarpons who pursue them mercilessly.

Are Smart Buildings Really Smart? by Anthony Ricigliano

Posted on by
Reply

News and Articles by Anthony Ricigliano: It’s actually surprising that the United States has the third largest ecological footprint per capita, behind the United Arab Emirates and Saudi Arabia. While we try to do the right thing we still face huge challenges in overcoming our environmental deficit. Sustainability comes in many forms with one of them being “smart buildings.”

What we need to do to truly make positive changes in terms of how we treat our environment is to consider the big picture of our actions to see whether we’re actually headed in the right direction. Let’s take a look at smart buildings and their role in reducing their inhabitants’ carbon footprint. Unfortunately, smart buildings may sound great in theory but could be falling short in a number of areas. In terms of sustainability and shrinking carbon footprints smart buildings fail the test under the following circumstances, according to TED.com, a non-profit organization devoted to "Ideas worth spreading”:

  • Employees are required to commute over long distances.
  • The energy they consume is carbon-intensive.
  • Their technology is too complicated to use or too difficult to maintain.
  • Their impact stops at the property line.
  • They deny the use of pre-existing infrastructure or building fabric.
  • They are conceived in isolation from larger, systemic environmental change.

By looking at the big picture, a smart building could actually do more harm than good simply by moving further away from the people that work there. Even a building that is self sufficient to the point of being off the grid will have a higher carbon footprint than a dilapidated old building if it encourages or requires dependence on an automobile to get there. To wit, shortening the daily commute of a typical person by six miles can save as much carbon as a 50 percent reduction in energy use for home heating.

"Green" buildings and green initiatives in a vacuum are not enough to make a material difference. What is required is a big picture approach to avoid the common practice of doing some good and then undoing it with an action that cancels out the position actions which preceded it.

In short, we must make the most of what we already have and be aware that all of our actions can have an impact. We have to get over the feel-good perception that going "green" and leaving it at that is the answer to all of our problems. By analogy, (also from TED.com) “the electric hybrid Toyota Prius is an energy-efficient car. However, when accounting for the energy used to manufacture a new Prius, one would actually save more energy by continuing to drive a mid-'90s Geo Metro.” This probably isn’t what Prius owners want hear but you get the picture.

Going green must become a behavior or a lifestyle as opposed to a series of isolated actions. It’s not going to easy and, by the way, this isn’t meant to diminish isolated actions. It’s often these very actions that act as the seed of change in our overall behavior.

By Anthony Ricigliano

Plugging Data Leaks Continues To Be a Worrisome IT Issue

Posted on by
1

Plugging Data Leaks Continues To Be a Worrisome IT Issue

October 31 2010 admin No comments

IT News by Anthony Ricigliano: The topic of data leaks has been making headlines in the world of IT professionals for some time now. With each passing year, it seems that more ways are being found to punch holes in security systems from both external and internal sources. As more companies become more conscious of their potential security risks, those seeking to circumvent the system are busy finding new ways to thwart their efforts to secure their data.

One of the easiest ways for even amateur hackers to gain access to your data is from emails sent by your employees. Perhaps an employee makes an inquiry by email regarding the availability of an item needed for the office. The vendor replies with a quote, and your employee responds with an email containing the company credit card number. By the time it is discovered that the number has been leaked, there can be thousands of dollars charged to the company card, requiring many hours to rectify.

Perhaps the company has employees who work from home or travel. Documents sent via email that contain information on an upcoming bid structure and amount can fall into the hands of the competition, who can then undercut your bid. Discussions of proposed acquisitions can destroy all chances of the purchase.

Your customers might innocently request that confidential information be sent as an email attachment. Perhaps you are an accountant, and the client would like to review his tax returns before you file them. He may request a list of his prices under a competitive pricing agreement that would create ill will among other customers if they knew he was receiving preferential pricing. The client can also initiate the data leak by emailing you information such as his social security number or bank routing information.

Many employees routinely email files to their personal email accounts so that they can access the data from home. This may be legitimate, as when he or she merely wants to work over the weekend or needs instant access to data when out of the office. However, it can also be a case of an employee providing the information to your competition.

Your employee data security can also be compromised easily. An email attachment of your employees’ names, home addresses, and phone numbers can be an issue if intercepted by an unauthorized user. If you add the employees’ social security numbers, birth dates, or anniversary dates, virtually everyone on the list is at risk of identity theft.

Fortunately, there are ways to prevent data leaks. The first step requires almost no expense and is simply a matter of implementing policies designed to protect your company’s information. Establish policies on who can connect, when it is allowable, and from where they can connect. Forbid logging in from public computers, such as Internet cafes or airport kiosks. Define a policy for file transfers to removable devices such as laptops, disks, or memory sticks. Include an audit trail so that you will be able to track who has downloaded what. Create a list of approved devices to help prevent hackers from downloading data.

Encrypt files at both the file and disk levels. Files that are encrypted while they are in motion are less likely to be of any use to a hacker even if intercepted. It also allows you to monitor your most sensitive data and see where it has been and who is accessing the files.

Establish a secure perimeter around your network. All data being sent out should be scanned for patterns or keywords that could identify a potential leak of sensitive information. If a match is found, the system can block the transmission.

Think of the business world as a desert through which you must navigate if you are to be successful. Now imagine that your company data is the bottle of water that will keep you going on your trek. As long as the bottle remains intact, you will be able to use the contents when needed. If it begins to leak, however, you are losing the lifeblood of your business. Other denizens in the desert can use the water you lose to sustain their own existence. They may be scavengers seeking an easy drink or predators out to cause you serious harm. Either way, your loss is their gain. Once the contents of the bottle have been leaked, the water is contaminated, and even if you can scoop it back into the bottle, you are likely to get a great deal of debris you do not want.

Anthony Ricigliano