New blog location

I am putting this blog to rest.  I will be writing about upcoming ideas, research, and industry happenings on my new work blog located here : http://blogs.gartner.com/jonah-kowall

Of course you can always find more relaxed, less structed Jonah on twitter at http://twitter.com/jkowall

Look forward to having you all follow me over to my new location, and hopefully you will enjoy my writing and insight.

Off to a new adventure

I am just starting a new position with Gartner as a research director in the IT Operations space : http://www.gartner.com/it/products/research/asset_129494_2395.jsp

I am very excited to be making this career change, and I believe I will be able to contribute heavily to the content and direction of the areas that I have a true passion for.

I will be moving my blog to a Gartner blog in the coming month, and writing there instead.  I will post a link to my new blog here once its online.  Please be patient as I move over to the new systems, and get acclimated with my new position.

Patching and updating for home and corporate

We all are well aware of the Microsoft patches and windows update.  Same goes for those of us who use itunes and iOS devices, we know Apple Software Update.  Some of us may even patch our Adobe products, which we should since they have been the largest attack vector (http://goo.gl/bOQ3D) for the past 2 years hands down.  This is just at home.... How do you expect the security experts to keep on top of all of these patches in a corporate environment.  The number of patches for Oracle alone is daunting to understand and analyze.

There are ways to do this, you can use some clever software which I will outline below, or you can read ~25 RSS feeds and analyze vendor security bulletins.  I do enjoy doing some of this, but I don't have time to keep on top of all the releases.  Here is some software for home and corporate use to help manage this.

Corporate Patch Management:

• Microsoft WSUS and SCCM - This is free and a no brainer for patching your desktops in a corporate environment.  If you need tighter control you can implement System Center Configuration Manager (SCCM, formerly SMS) which does a good job.  Microsoft has invested heavily in these products and brought them a lot way from the old SMS days.
• Shavlik HFnetchk pro - Great product, but the price hasn't fallen as the competition has heated up.  This product does a good job with other products outside of Microsoft, but doesn't support Linux or other *NIX variants.
• GFI Languard - Cheap tool and does a good job with patching servers or desktops.  Normally I recommend this for servers since it does a good job with general auditing too.  Works well on Linux as well.
• Lumension Patch Management (formerly Patchlink) - Used this previously, its a mixture of online services and software in house.  Its a good product, and can handle multiple operating systems.  Cost is medium in range.  I haven't used the other components of the suite, but I would be willing to test them out.  When I was using the product it did a great job on Solaris, Linux, and Windows.
• Manageengine Security Manager Plus - This product was missing some key features in managing the patch lists, but overall it worked well and it was inexpensive.  I love some of the other tools by these guys who also bring us the zoho products.  The product does support Linux as well as Windows.

Wish list : I wish spiceworks would get into this space!

Home Patch Management:

• Windows Update - Turn it on, and use it at home.  It also manages updates for other Microsoft products if you follow these directions to enable this feature : http://technet.microsoft.com/en-us/magazine/ff642466.aspx
• Secunia PSI - If you are a moderately advanced user this product does a great job managing updates to all of your other system software.  Highly recommend using this product.  I haven't tested the commercial versions of the products, I would be willing to test them if someone from Secunia contacts me.
• Mozilla Firefox/Thunderbird - These products and plugins do a good job with updating themselves, but when there is a new release, they don't auto update.  This is something that Secunia would handle, for example moving from Firefox 3.5 to 3.6... or soon from 3.6 to 4.0.  The extensions update themselves well on any of the products from Mozilla.
• Chrome - This product has the smartest best update system of any.  Since the application resides not in program files, but within the users home directory it doesn't have restrictions on what it can do to its own files.  This is both a blessing and curse in the security realm.  The downside is that if there is a security issue it could compromise the browser binary itself, versus something which is installed in a "secured" location such as program files.  The product will notify you, via a small icon that it has downloaded a new version.  When you close the browser and start it again its switched to it.  

Antivirus and Antispyware for the Home and Corporate user

Since endpoint protection is of growing importance in the security industry, you will see some major technical advanced this year.  I expect this to be one of the hot buttons for acquisition as technologies such as whitelisting and more connected heuristics create a more advanced software landscape.

Since I have quite a bit of experiance and I do keep on top of the industry I believe that I should outline some of the tools I recommend in both cases.

One side note, I do not use MacOS so I cannot recommend any software for Macs.  If Apple can apply some of the success they have had with iOS to OSX then I may have to spend more time thinking about them on the PC front.

Corporate AV/Antispyware:

• Mcafee - Does a good job with a suite, but ePO is still a bloated tool which is hard to manage effectively without creating gaps.
• Symantec - I don't recommend the products for endpoint protection, in my experience I see too many missed viruses with the product.
• Trend Micro - Does a good job at a lower price point than the big two in AV
• GFI Vipre - My personal favorite, this is a cheap easy endpoint antivirus solution which works very well.  There are a few gaps in the product they should shore up in the next 6 months, but overall I would recommend this product in a corporate environment.

I have more I would recommend, but I am not going to cover them.  Products I would like to test for corporate use:  Avast and Microsoft.  If I have time I will try both of them in the next couple weeks.

Personal AV/Antispyware:

• Microsoft Security Essentials - This is what I would tell my mom to use, it works, and its maintenance free!  Sometimes this is the best option for a typical end user.
• Avast - This is what I recommend and run.  In version 6.0 they have added a lot of new features and improvements.  
• AVG - Another very good option, this would probably be my second choice personally
• Microsoft Defender - Its free and does a decent job preventing spyware
• Spybot S&D - Free and works great for spyware infections
• CCleaner - Free, and this is a great overall system cleanup tool.  It will fix spyware issues, registry issues, and other problems.  If you don't run this type of tool every month or so, your windows installation will slow down in a much shorter amount of time.

Time to move on, and time to learn

Sorry its been a while since I have posted last.  I decided to move on from my previous position.  I learned at a lot there, but it was getting somewhat slow the last 6 months.  My skills are better used for more complex problems that the IT world is facing.  I have had some pretty interesting discussions and interviews in the last week.  I was hoping to enjoy my unemployment a little bit more.... maybe after my offer is signed.

Some non-technical notes, since I have a diverse set of skills I find my resume geared towards one type of career path and not another.  This limited my opportunities to "get in the door" for some positions I think I would be well suited for.  I have started by making some more detailed and targeted versions of my resume which are geared towards some of the other fields that I have experience in.

I wish there was a better way to manage and express all of your skills without having a 15 page resume, or 4 versions that are mostly the same.  If anyone has comments or ideas please leave them!

If anyone wants to discuss any openings with me, there is a digsby chat here, or you can email me from the blog.

Now for some technology projects and learning: 

Since I have some free time and feel that I have been off my Oracle game for the last 2-3 years I am evaluating and testing several products.  Expect another post later this week on these products:

1.  Oracle 11g and Weblogic (used these, but it was 3-4 years ago)
2.  Oracle Enterprise Manager - Specifically around the VM management parts
3.  Oracle Linux
4.  Oracle VM
5.  Oracle Real User Experience Insight - Never heard of this before, but it looks interesting!

I am looking at these to see where Oracle/Sun have gone the last couple years, and just as a general educational experience for me.

Sonicwall 5.8 New Features

I'm very impressed by all the new features that Sonicwall has added to v5.8.  I spoke to Jock Breitwieser and Eric Crutchlow who gave us a nice overview of some of the features.  I wanted to make sure I didn't miss anything as there were quite a few changes.  There are even more NG (Next Generation) Firewall features coming this year in v6.0.  Sonicwall has been a great vendor for us, I am very happy we moved to their platforms.

Here is some of the new features (screenshots) with some explanation above the screen capture.

Before you can turn on the netflow sender (and built in netflow collector) you need to consider the impact this will have on your firewall.  You should keep an eye on your CPU and ensure you aren't running above 50%, or you will probably have CPU contention issues.  You also need to be aware that the memory usage of the netflow database and visualization will reduce your peek connections.  This model is a NSA 3500 (http://www.sonicwall.com/us/products/NSA_3500.html) which previous to netflow could handle 35,000 stateful connections can only handle 49,152 when I have all of the DPI (Deep packet inspection) and Netflow enabled.  This includes gateway antivirus, content filtering, IDS/IPS, and more.  As you can see we don't go over 4000 which makes this a non-issue.  Most firewalls can handle much higher workloads for connections and CPU than people are using.

First you have to turn on flow reporting.  You can turn it on internally and or file it off to another netflow collector :

http://www.networkuptime.com/tools/netflow/
http://www.solarwinds.com/downloads/ - Solarwinds makes a nice free netflow collector as well.

Once you have netflow turned on you can see the applications below being collected, there are many views, graphs, and other options:

Here is a user list with our AD users and how much traffic, connections, and throughput they are doing.  You will need to setup SSO for this to work (more on that later):

Here is the realtime monitor, this is the default view, which shows the main applications, you can filter by interface or by application and see realtime usage:

Here is a view of just some of the applications I picked : evernote, twitter, wikipedia, google, twitter:

Now for the SSO, you need to setup a small program on a windows host which will get requests from the firewall and lookup the users via active directory in order to correlate the DHCP (we use windows DHCP) address with the username.  Here is the SSO setup screen:

When you click configure next to the "SonicWALL SSO Agent" then you get the following screen where you can setup the agent and view the stats to the agent process:

Sonicwall has also added in application control, which are rules which allow for much more customized actions based on the application detection engine.  Before you can use these rules you need to turn App Control on (below), and then turn it on for a zone.  After that you can control the applications.  I have attached some additional applications below as well:

You can also define you own custom applications as well which can be used in rules :

The Content Filter can use Users/Zones (legacy) or App Rules which are far more flexible.  They can be restricted and bandwidth controlled:

Email addresses and content can also be included in App Rules:

Here are the Action objects (what you want to do if an App Rule is matched).  You can also define your own.  Note that you have options such as Bandwitch Management, Blocking, Ignoring DPI, or enabling a packet capture session (for debugging those difficult to find issues).  

If you have any question please leave a comment or hit me up on twitter or instant messenger.  I hope you found this useful!

Dealing with Information Overload

I follow a lot of different sites.  I tend to read my news every other day.  I'm always trying the best tools to deal with my data on multiple devices (iphone, ipad) and multiple computers (google crome OS, Windows).  I have found the best combination to be the following:

1.   Master feeds on google reader (works great on any device)
2.   Feeddemon (Windows)

FeedDemon is a great app, it will sync with my google feeds and give me the same view of what I have read and what I have not.  You have a better user interface for getting through all that data.  I also customize the views to work for the way that I want to fly through all my news.  These kinds of user interface tweaks aren't possible with google reader yet, but it will improve.  Google reader is a great app and works great on mobile or desktop browsers.

I always use google chrome as my primary browser, it wins the speed race hands down, and supports the critical extensions I need.  I have moved of Firefox as my primary browser over 6 months ago.  I love the fact that my extensions and data (most of them) sync across every system and even the google netbook.

List of extensions I use:


AdBlock - Version: 2.2.19
Browser Button for AdBlock - Version: 0.0.12
gCast Weather - Version: 2.1.2
Google Translate - Version: 1.2.3.1
Google Voice (by Google) - Version: 2.2.3.4
IE Tab - Version: 1.4.30.4
LastPass - Version: 1.70.11
Lazarus: Form Recovery - Version: 3.0.1
PriceBlink - Version: 2.1
Tweetbeat Firsthand - Version: 0.6.3
Weather Window Beta by WeatherBug - Version: 1.0.5
Woot! - Version: 1.1
Xmarks Bookmark and Password Sync - Version: 0.9.0
Yoono Web - Version: 1.0.0.1

Google Chrome Netbook

I came home today to find a strange looking box with odd shapes on the outside of it. Once I opened it I didn’t expect to find a small netbook there shipped from google. This is the Chrome OS Netbook they shipped to me for free. It’s a nice form factor, not too large and not too small. Once the OS booted up, you just hook it up to wifi, login with your google account, snap a profile picture, and you are off. After some time it upgraded itself, similar to chrome. It required a reboot after the update. It runs very well.

It does a good job with flash and other web media. It took quite a while to get my full extension sync from the PC, but most of my extensions worked without a hitch. The major one which doesn’t work is lastpass, which I really need! I tried many sites on it, and everything looks like it works well. I also installed several “apps” from the store which make for easy access to my google products and other sites I use a lot. It will make a good ipad type tool, something to grab and use. I haven’t setup the broadband yet, but I will soon.

The physical design is nice and very “black” I really like the additional of reload, forward, back, and search buttons. They are handy to have. I would have loved to have a “@” key. There is no need to have caps lock anymore, so it was nice to see it gone. The keyboard keyout is a little “off” for my touch typing, but I will get used to it. The control and alt keys are very large. If you multitouch on the trackpad it scrolls which is pretty handy once you get used to it.

The downsides to the design are the mouse, which allows for left and right click but doesn’t use buttons. It uses the click type pad that the macs use, which is somewhat annoying since I am used to having two hands on the trackpad. One hand for clicking and one hand for moving. If you try to do this with the trackpad it screws it all up. I would love to have page up and page down keys, as well as home/end keys. I am a power user and I use the page up and page down keys even more than the arrow keys when I am using the web.

Overall it’s a cool device and I’m looking forward to using it more extensively.

Great freeware system admin tools

Thanks to the awesome community and software over at spiceworks - www.spiceworks.com I found these great free tools from Netwrix - www.netwrix.com that are superb for any system admin dealing with windows systems. I could have used this fileserver monitor freeware in the past for basic audits. I wish I had known about it sooner. The other really useful tools we are using are the following freeware tools. Essentially the free versions just email you at 3am every night with changes or reports. You can change the schedule using the scheduled task control panel:

Password Expiration Notifier - http://www.netwrix.com/password_expiration_notifier_freeware.html
This tool emails the end users when their passwords are expiring, its good for us because we have some remote users and mac users who do not get notified. This should prevent the lockouts we see when passwords expire.

AD Change Reporter - http://www.netwrix.com/active_directory_change_reporting_freeware.html
This product will show you changes in Active Directory, Exchange, and Group Policy. This is something I have been wanting to have for a while, but it was always too expensive. Now you can have it for free!

I emailed the company a few days ago to get pricing on the commercial products, but

Using AWS for larger business

Netflix is one of those really secretive companies, there have beens some interesting articles how they run the operations for the disc delivery, but not much on the way the deliver digital content. I came across this really cool article on how they use AWS:

http://www.readwriteweb.com/cloud/2010/11/why-netflix-switched-its-api-a.php

Pretty interesting read. Not sure I agree with some of the statements about less system admin and less database folks when they use AWS. I can understand less datacenter staff, but managing virtual or cloud infrastructure is just as much work. Obviously this is only the case when its running customized software and databases built internally (such as netflix). You still need to release software, manage the databases, and handle the same problems you would if you were doing it all in house.

The only items you don't need to worry about would be the following:

Backups
Provisioning new hardware (which is pretty simple if you run your own vmware in house)

This is another good read on a website I read. They moved to EC2, and wrote a review 1 year later:

http://4sysops.com/archives/4sysops-one-year-in-the-cloud-part-1-costs/

The costs seem to be higher than using a normal colo server, so I'm not sure what the ROI would be for companies moving to EC2 or AWS. It would be good to see some more detailed comparisons of how companies use the services, and what the ROI is.

PCI compliance and SSLv2

So I am doing a PCI audit, and one of the requirements is that there must not be weak cipher support enabled on systems which collect credit cards from the web. I started doing some testing around some of the larger ecommerce sites out there, and it had some pretty startling findings. SSLv3 has been in Browsers since 1996 (think mozilla 2.0... way before we had firefox).

http://blog.zenone.org/2009/03/pci-compliance-disable-sslv2-and-weak.html

From my testing these sites to have SSLv2 disabled: google, paypal, delta, etrade

These sites don’t have SSLv2 disabled, this is strictly against PCI: Home depot, bank of America, Scottrade, Microsoft, Amazon, QVC, Dell, Orbitz

Really concerning that these big commerce sites allow something like that to slip by the auditors. Time to hire me to fix your compliance :)

Akamai user conference

Had a good time in Miami for a few days this week, got a lot of good content from the conference. I'm going to go over my notes some more next week, but there are some of the highlights from the show:

New offering
Fraud detection and scoring - Akamai does tokenization removing PCI scope, and they can build a profile on the end users and given them scores.

Cybersource - they are one of the processors of the akamai pci solution.

Edge encryption - Encrypts the data at the edge all the way to the database Only privledged systems can decrypt the data from the database. (might be useful, not sure)

Siteshield - ACL only allowing requests from specific akamai servers (protects against ddos)

ADS - Predictive analytics
Shows the proper ads based on what they are looking at across all sites
Look across 500+ shopping sites, on 160M users
Don't use pixels to allocate ads (slows down the site)

Akamai - Velocitude mobile reformatting on the fly - http://www.akamai.com/html/about/press/releases/2010/press_061010.html
Special tagging system which takes content and displays it for the proper device. Resized images and content done on the fly. Includes all data.

Dnssec
Verisign:
2010 - .NET
2011 - .COM

Akamai implement at end of 2010. Ga early 2011.
signed by Akamai. No need to manage it.
Need to look at godaddy. (they do some of our DNS along with Akamai)
Kpi. You make your own key and keep private key.
Look into internally. Microsoft dns support.
 
Ipv6
Need to start looking into routing ipv6. Check on firewalls (security support for ips and others) lb.
Geolocation for v6?
Look at ipv6 mtu issues
Idea Use Akamai edsgescape for geolocation versus what we do now.
Google support for ga and other tools? We use. Reporting infrastructure.
 
Q4.
Whitepaper
Roadmap
 
Q1 2011
Tech preview

Q1 2012
Limited availability
 
Akamai will nat to v4 for you.

HP Upgrades – QC,QTP,PC

Before I go into these 3 suites of tools, when is HP finally going to update BAC, RUM, or Diagnostics? It seemed like these tools have been really stagnate the last 3 years. I’m not going to HP Software Universe anymore, and I keep getting new account reps, so I have no idea what the roadmap is these days. That’s enough HP bashing, onto the good stuff.

We did the yearly HP upgrade over the last couple weeks, here is the rundown on the technologies and what was involved in each:

1. QTP – Very easy upgrade, did this on our terminal server and a desktop. The license server is now supported on 64-bit machines, so we moved the license server off an older 2003 box onto a 2008R2 system. No issues with the upgrade, and there seems to be a lot of improvements. Still waiting for feedback from our QA team on the improvements.

2. PC – Ended up building a couple new VMs for this, as we moved it onto Windows 2008R2 (64-bit) as well. There were no issues with the reinstall or moving our scripts and data over to the new systems. The tool itself didn’t have a lot of changes, but the fact that it runs on 64-bit is a good step to us getting rid of our 2003 systems.

3. QC – This one is the problem child. Initially we were going to be doing a larger rollout of QC10, so we built 2 VMs. One was for the DB and one for the app. The DB needed to be on an older OS and such, which was annoying. I ended up reinstalling it onto a Windows 2008 (32-bit) system along with moving to SQL 2008. They don’t yet support SQL 2008 R2 or Windows 2008 R2 from looking at the documentation. It was not all that clear. I have a case open with HP, as during the setup it doesn’t seem to want to connect to the database. I have checked the SQL Server TCP settings, and verified the login/password both locally and over the network. More on this one as HP helps me with the issues.

Sorry for the lack of updates, I should have a few posts coming up now.

Password management

Personally I am a big fan of proper password management procedures. For my personal data I always used the open source tool Keepass (http://keepass.info/) for my passwords, but it was always missing two items:

1. Better browser integration (I know you can use the form filling plugins, but they aren't very well done or supported)
   
2. Distribution (I know you can use dropbox or something else and it works fine)
   

For my encrypted data I always built hidden share volumes using another open source tool Truecrypt (http://www.truecrypt.org/). The product works great, but I find that I need to encrypt less and less of my data these days.

I just replaced them all with Lastpass (http://lastpass.com/), which is a very impressive product. It integrates with pretty much every major browser out there and it's all centralized and allows for web access for all of your data. It allows for import from pretty much any browser database, or product (such as keepass). Its $12 per year for premium, I buy products like this because the value is high and the cost is low. If we don't support companies like this then they are not around for us.

For our enterprise I have used several nice distributed products in the past, but one always stands out as a cheap and well built solution. The product we use is Password Manager Pro (http://www.manageengine.com/products/passwordmanagerpro/), we don't use the enterprise products from them which allow for centralized password reset and such. All systems, regardless of if they are Linux, or windows use active directory for authentication (thanks winbind).

The product is a great secure repository, and it allows us to share relevant passwords with finance, HR, Marketing, Development, or the Database teams. It allows for dynamic groupings which are very flexible based on the content of the resources defined.

OpenSolaris

At my previous company we were a heavy user of Solaris, and we also had a lot of legacy specific SCO systems as well. 3-4 years ago, some person (who shall remain nameless) was pushing Opensolaris as "the future", personally I thought the guy was way off base. He did deploy some of it, and it worked well, the problem would be the support and future for another player in the x86/64 market. There was no future, I saw it, but apparently other people in management didn't. I then read this article:

http://www.infoworld.com/d/open-source/requiem-os-opensolaris-board-closes-shop-961?source=rss_infoworld_news

I love being right J

Sorry to see you go, but it's for the better. Oracle hopefully will invest more resources into Linux which it hasn't been doing as much since the Sun purchase.

Thoughts on the McAfee Intel purchase

I've been waiting for quite a while for a major security firm to be purchased by one of the big boys. I am glad that Intel was the first one to start this trend, because they are generally only a hardware player. If security were embedded at that level it would create a differentiator from other competitors, weather they are x64 based or other chips (Oracle, IBM). Security has become very commoditized and consolidated over the last several years.

You haven't seen much innovation in several years either. Is that because we've solved the problem? I think not… Is that because there isn't capital in this market? Nope… I think the main reason is due to the massive consolidation and the work needed to integrate all of these smaller companies together. You are also seeing players like Microsoft developing a larger security portfolio, as well as network vendors integrating more security features and products into their appliances. If you look back 5 years ago, there wasn't much as far at UTM (Unified Threat Management) devices, now every firewall vendor has one, you can find hundreds of products both commercial and open source in this area.

Some other thoughts on how security is being embedded across the stack are by Bruce Schneier, who is a superb writer and author as well as a great cryptographer.

http://www.schneier.com/blog/archives/2010/08/intel_buys_mcaf.html

http://www.schneier.com/essay-196.html

http://www.schneier.com/news-060.html

ESXi 4.0 – 4.1 Planning

Writing this thanks to gogo wireless… Love this service.

I'm going to start upgrading our hosts to 4.1 next weekend probably. Going to try update manager even though it crashed and burned on my 3.5-4.0 upgrade and I ended up using the host utility. I know the command line upgrader works.

I read this on the spiceworks message board:

Resolution:

This is worth knowing as it's a bug and definate gotcha.

VMWare said:

"I had one of the escalation engineers for Update Manager look at the log and here is what he said

The customer imported the pre-upgrade offline bundle which is NOT needed and in fact causes problems.

[2010-07-28 13:36:55:781 'DownloadOfflinePatchTask.DownloadOfflinePatchTask{9}' 3700 INFO] [vciTaskBase, 530] Task started...

[2010-07-28 13:36:55:781 'DownloadOfflinePatchTask.DownloadOfflinePatchTask{9}' 3700 INFO] [downloadOfflinePatchTask, 123] Upload offline bundle: C:\Windows\TEMP\vum8205261630712700578.pre-upgrade-from-ESX4.0-to-4.1.0-0.0.260247-release.zip

We are working on correcting the situation so this doesn't happen. The existing pre-upgrade bundle will be replaced and we are working on a KB for those that have gotten into the situation (iKB 1024805). Unfortunately, there is no easy workaround once VUM is in this situation. A reinstall/DB reinit is suggested."

The end result is that VUM didn't want to reinstall cleanly so I had to nuke my Vcenter server and rebuild it from scratch.

So, DON'T APPLY THE PRE-UPGRADE PACKAGE IF YOU ARE USING UPDATE MANAGER TO UPGRADE YOUR ESX HOSTS!

:)

 

Maybe useful next weekend J

Vmware 4.1

Let me start off, by just saying that this site is great, its always entertaining and filled with great data : http://get-admin.com/blog/

I'm very happy that Vmware released 4.1 recently. After the horror stories I read about 4.0U1 we decided to skip them and wait for 4.1. There wasn't a lot in the updates we cared for anyways. There are quite a few interesting features in 4.1, and one of the good things that Vmware has done is finally killed off ESX (after this release). ESXi has been great for us over the last couple years, and I haven't had any complaints with switching over to it from ESX in previous years. I found using update manager was not the most reliable when moving from 3.x to 4.x on the physical systems themselves, so we opted to use the host upgrade tool. This is not a supported method to move from 4.x to 4.1. We will probably have to give the update manager another run, which concerns me. At least its not as complex as upgrading Hyper-v J

I will probably start upgrading our enterprise (not production) systems to 4.1 in the next couple weeks, and I will post my findings on the blog as I go.

Thoughts on IBM BigFix Purchase

Bigfix makes some excellent products, and they have been moving in great directions over the last couple years. They have moved out of pure remediation and into configuration management and control. I would have loved to have purchased them for use at my current company, but the pricing was a bit higher than I'm using for Shavlik HFNetchk Protect, which is another good product, but is far more limited. I wanted to have one tool to patch Linux and Windows systems.

IBM has been really struggling to provide a good provisioning and patch management tool for years and years. First they were pushing TPM which is probably the worst product I have seen IBM release. Unfortunately a company I worked for previously was obsessed with using this product that most Tivoli enterprise customers get for free and completely disregard. I spent a good amount of time looking at the product and its capabilities, or lack thereof. I'm concluding my rant now, but its happy to see IBM adding a superb replacement for TPM and adding additional security related products they will acquire with the Bigfix purchase.

I was also quite surprised at the cost of the purchase at $400m. I know Bigfix has a lot of customers, and they sell a service, which makes it nice for both operating business as well as the customers who can bill this against opex versus capex. I would have assumed they would have had to pay more for the company. It will be interesting to see what features IBM takes from them and puts into Tivoli, and which other ones become part of the ISS portfolio over time.

Simplify and Automate

Now that the workload has reduced a bit over the last month or so we can spend time doing project work. It's always been my philosophy to simplify as much as possible, this is normally because I end up having to fix messes, which are normally caused by undue complexity. Complexity can affect performance, availability, and manageability. Automation can often create complexity, as can requests by various people in the business who don't necessarily plan the projects or requests they make of others (especially development and operations).

This being said I often get blocked when I try to simplify things, because people want to build things out in a more redundant manner than is required for the business needs. There are a lot of ways to create a redundant system without creating complexity, you just have to step back and look at the overall configuration and requirements to come up with the best solution.

We get a lot of requests from our QA team to reload various Resin app servers, and other processes. What we are doing now is creating a web based interface for them to do the reloads on their own. This eliminates the need for operations to run the scripts, and saves time and resources.