Welcome to the The Phygital World

Standards for 'Things'

That thing, next to the other thing, talking to this thing needs something to make it interoperate properly. That's the goal of the Industrial Internet Consortium (IIC) which hopes to establish common ways that machines share information and move data.

IBM, Cisco, GE and AT&T have all teamed up to form the Industrial Internet Consortium (IIC), an open membership group that’s been established with the task of breaking down technology silo barriers to drive better big data access and improved integration of the physical and digital worlds. The Phygital World. The IIC will work to develop a ‘common blueprint' that machines and devices from all manufacturers can use to share and move data. These standards won’t just be limited to internet protocols, but will also include metrics like storage capacity in IT systems, various power levels, and data traffic control.

Sensors are getting standards. Soon.

As more of these chips are getting installed on street lights, thermostats, engines, soda machines and even into our own body the IIC will focus on testing IoT applications, produce best practices and standards, influence global IoT standards for Internet and industrial systems and create a forum for sharing ideas. Explore new worlds so to speak. I think it's nuts that we're in an age where we are trying to figure out how the blood sensor talks to the fridge sensor which notices there is no more applesauce and auto-orders from the local grocery to have it delivered that afternoon. Almost there.

Initially, the new group will focus on the 'industrial Internet' applications in manufacturing, oil and gas exploration, healthcare and transportation. In those industries, vendors often don't make it easy for hardware and software solutions to work together. The IIC is saying, 'we all have to play with each other.' That will become critically important when your imbedded sleep monitor/dream recorder notices your blood sugar levels rising indicating that you're about to wake up, which kicks off a series of workflows that start the coffee machine, heat & distribute the hot water and display the day's news and weather on the refrigerator's LCD screen. Any minute now.

It will probably be a little while (years) before these standards can be created and approved, but when they are they’ll help developers of hardware and software to create solutions that are compatible with the Internet of Things. The end result will be the full integration of sensors, networks, computers, cloud systems, large enterprises, vehicles, businesses and hundreds of other entities that are 'connected.'

With London cars getting stolen using electronic gadgets and connected devices as common as electricity by 2025, securing the Internet of Things should be one of the top priorities facing the consortium.

ps

Related:

• Consortium Wants Standards for ‘Internet of Things’
• AT&T, Cisco, GE, IBM and Intel form Industrial Internet Consortium for IoT standards
• IBM, Cisco, GE & AT&T form Industrial Internet Consortium
• The “Industrial” Internet of Things and the Industrial Internet Consortium
• The Internet of Things Will Thrive by 2025
• Securing the Internet of Things: is the web already breaking up?
• Connected Devices as Common as Electricity by 2025
• The ABCs of the Internet of Things
• Some Predictions About the Internet of Things and Wearable Tech From Pew Research
• Car-Hacking Goes Viral In London

Technorati Tags: iot,things,internet of things,standards,security,sensors,nouns,silva,f5

Connect with Peter:	Connect with F5:

PCI Turns 2.0

…Or 6 years old in human time.  When PCI DSS was born, it was actually five different procedures from each of the major credit card issuers: Visa, MasterCard, American Express, JCB and Discover.  Each program was comparable in that they wanted merchants to have minimum security requirements when handling (process, transmit, store) cardholder data as a protection mechanism.  The industry came together and formed the PCI Security Standards Council (SSC) which aligned the distinctive policies and then released the Payment Card Industry Data Security Standard (PCI DSS) v1.0.  Over the years there have been clarifications, slight revisions, wireless guidelines, the addition of PIN Entry devices and of course, version updates – 1.1, 1.2 and 1.2.1, the most recent standard.  PCI DSS v2.0 was released on Oct 28, 2010 and went into effect January 1, 2011.  Organizations have until New Year’s Eve 2011 to implement and comply with the new changes and can actually still validate compliance against v1.2 until the ball drops again in 360 days.

It’s been an interesting ride for PCI with supporters hailing it’s mission and others complaining that it’s expensive, confusing and subjective.  If nothing else, it’s made business focus on and consumers more aware of Data Security, which is a good thing.  PCI v2.0 does not have any extensive new requirements but it does clarify some requirements for easier understanding and makes adoption, especially for small merchants, simpler and easier.  Some of the important updates include the need for a comprehensive audit prior to assessment to understand where all the cardholder data resides within the infrastructure.  Knowing all the locations and flows of sensitive data can help in protecting those assets.  An evolving requirement is allowing merchants to execute a risk-based approach, based on business circumstances, for ranking, addressing and prioritizing vulnerabilities.  I’ve mentioned before that Security is really about Risk-Management, and while I’m not sure that merchants with limited IT security experience could determine if they are more susceptible to Forceful Browsing, Hidden Field Manipulation, or SQL Injection, I do think it’s a step in the right direction in terms of an exercise.  It encourages organizations to conduct a risk-assessment and focus on areas that are the most vulnerable.  This can help a smaller merchant target their limited resources to a specific area of concern. 

Another evolving requirement is the need for more effective and centralized log management.  Scouring logs from various systems looking for that one nasty IP address can be cumbersome and the ability to centralize log management is important whether you’re trying to be PCI compliant or not.  Cloud Computing comes to mind as a big beneficiary of centralized management.  And speaking of the Cloud, there is also some guidance on virtualization – not much – but some.  For one, they’ve included virtualization in that, they’ve expanded the definition of system components to include virtual components.  You can only implement one primary function per server, so functions like web, app, db, DNS and so forth should be running on separate virtual machines.  They want to avoid situations where different functions that may have different security levels are cohabitating on the same server.  Also, since VMs can move around, if only one of your VMs is handling cardholder data, then the entire virtual infrastructure must comply.

The following is taken directly from the PCI DSS 2.0 and PA-DSS 2.0 Summary of Changes – Highlights document.

And so begins the new 3 year lifecycle for standards development but minor revisions can be added, if necessary, during that time.  While the temptation is to wait until you absolutely have to comply or just test against the old standard, it’s better to get going on two-dot-oh sooner than later.  You really don’t want to be worried about implementing PCI updates when the 2011 holiday shopping season is in full swing or when staff is limited due to the holidays.  If you need to comply, do yourself a favor and get it done early.

ps

Resources:

• PCI Security Standards Council
• PCI 2.0 Summary of Changes – Highlights (pdf)
• How PCI DSS 2.0 affects virtualization compliance
• PCI 2.0 guide: How have PCI compliance requirements changed?
• PCI Compliance Changes Promote Log Management
• PCI Compliance Thoughts for the New Year
• In 5 Minutes or Less - BIG-IP ASM v10.1 PCI Reporting
• Cloud Balancing, Reverse Cloud Bursting, and Staying PCI-Compliant
• Will you Comply or just Check the Box?
• F5 Security Compliance Solutions

Connect with Peter:	Connect with F5:

Technorati Tags: F5, PCI DSS, virtualization, cloud computing, Pete Silva, security, cloud, credit card, compliance, web, internet, cybercrime, holiday shopping, identity theft,

CloudFucius Has: Déjà Vu and Amnesia…

…at the same time!  Wow, faster than you can mutter, ‘Survey Says…’ more cloud computing survey results appear.  Just last week, CloudFucius reported on 4 cloud surveys which confirmed the trend of our Love/Hate Relationship with the cloud.  Before the week was over, a couple more surveys reiterated our feelings toward cloud computing.  We love it since it helps IT with cost control, yet we’re still very cautious about deployments due to the concerns about security and control. 

The results of the Eighth Annual Global Information Security Survey were released last week and once again the theme is, ‘we see the value and understand the benefits but still scared about the provider’s ability to secure critical data and IT’s ability to control access to that data.  CSO, CIO and PriceWaterhouseCoopers surveyed 12,847 technology and business executives from around the world and 62% of you have little or no confidence in your ability to secure any data in the cloud.  49% have ventured into the cloud but of those, 39% still have major questions about cloud security.  Sounds familiar huh?  The greatest risk to their own (your own) cloud computing strategy is the ability to enforce security policies at the cloud provider’s site.  Inadequate knowledge/training and IT auditing also made the list.  If you remember the PhoneFactor survey from last week, the biggest security concern was preventing unauthorized access to company data.  Enforce security policy and prevent unauthorized access is almost the same thing.  Enforcing a security policy should prevent unauthorized access.  There needs to be more specific guidelines as to what types of data are acceptable for the cloud along with how to handle regulatory reporting of data in the cloud.

The CSO survey also found security concerns in regards to ‘third parties’.   There is a concern about cloud vendors who use third parties to host data centers and hardware along with serious fears about our third party business partners.  The vendor issue has to do with not knowing any of the people hired to work on your systems; with partners, many organizations are concerned that their own security is at risk if their associate’s or partner’s security has taken a hit over the last year.  77% felt that their strategic partners had been weakened by the recession over the last year.  If you remember Verizon  Business' "2009 Data Breach Investigations Report (pdf)" 32% of the data breaches implicated a business partner and in fact, the majority was due to lax security practices at the connection level from the third-party.  In 2009, it was usually the third-party systems that were compromised and the attacker used the trusted connection to make inroads to the target.  Since it’s coming from a ‘trusted’ authorized connection, these are difficult to detect and stop.  The more things change, the more they stay the same.

Speaking of surveys, Lauren Carlson, a CRM Market Analyst asked me to share her short survey with you.  Software Advice, a company that reviews CRM software, is conducting a survey on their blog to see who the real leader is in CRM.

And one from Confucius: Ignorance is the night of the mind, but a night without moon and star.

ps

The CloudFucius Series: Intro, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24

Resources:

• Survey: Cloud Security Still a Struggle for Many Companies
• Business partners a growing security concern
• Four Indicators That CIOs Are Ready to Embrace Enterprise Cloud Computing
• Cloud computing sparks corporate IT budget growth
• Financial services firms look to cloud, grid, and clusters to allay fears over data explosion
• Cloud Computing Services on the Rise, Survey Finds
• Early Adopters Now Running 60 to 70 Percent of Business Applications in the Cloud
• Can my PAN ride the LAN out the WAN?
• The Domino Effect

Technorati Tags: F5, infrastructure 2.0, integration, cloud computing, Pete Silva, security, business, education, technology, application delivery, cloud, context-aware, infrastructure 2.0, web, internet

twitter: @psilvas

The Inter-Cloud: Will MAE become a MAC?

If public, private, hybrid, cumulus, stratus wasn’t enough, the ‘Inter-Cloud’ concept came up again at the Cloud Connect gathering in San Jose last week.  According to the Wikipedia entry, it was first introduced in 2007 by Kevin Kelly, both Lori MacVittie and Greg Ness wrote about the Intercloud last June and many reference James Urquhart in bringing it to everyone’s attention.  Since there is no real interoperability between clouds, what happens when one cloud instance wants to reference a service in another cloud?  Enter the Inter-Cloud.  As with most things related to cloud computing, there has been lots of debate about exactly what it is, what it’s supposed to do and when it’s time will come. 

In the ‘Infrastructure Interoperability in a Cloudy World’ session at Cloud Connect, the Inter-Cloud was referenced as the ‘transition point’ when applications in a particular cloud need to move.  Application mobility comes into play with Cloud Balancing, Cloud Bursting, disaster recovery, sensitive data in private/application in public and any other scenario where application fluidity is desired and/or required.  An Inter-Cloud is, in essence, a mesh of different cloud infrastructures governed by standards that allow them to interoperate.  As ISPs were building out their own private backbones in the 1990’s, the Internet needed a way to connect all the autonomous systems to exchange traffic.  The Network Access Points (NAPs) and Metropolitan Area Ethernets (now Exchange – MAE East/MAE West/etc) became today’s Internet Exchange Points (IXP).  Granted, the agreed standard for interoperability, TCP/IP and specifically BGP, made that possible and we’re still waiting on something like that for the cloud; plus we’re now dealing with huge chunks of data (images, systems, etc) rather than simple email or light web browsing.  I would imagine that the major cloud providers already have connections the major peering points and someday there just might be the Metro Area Clouds (MAC West, MAC East, MAC Central) and other cloud peering locations for application mobility.  Maybe cloud providers with similar infrastructures (running a particular hypervisor on certain hardware with specific services) will start with private peering, like the ISPs of yore. 

The reality is that it probably won’t happen that way since clouds are already part of the internet, the needs of the cloud are different and an agreed method is far from completion.  It is still interesting to envision though.  I also must admit, I had completely forgotten about the Inter-Cloud and you hear me calling it the ‘Intra-Cloud’ in this interview with Lori at Cloud Connect.  Incidentally, it’s fun to read articles from 1999 talking about the Internet’s ‘early days’ of ISP Peering and those from today on how it has changed over the years. 

ps

Related:

• Now is the conference of our discontent…
• Cloud Federation and the Intercloud
• The Inter-Cloud and The Cloud of Clouds
• Pursuit of the Intercloud Is Premature
• Improving service delivery in cloud computing
• Blueprint for the Intercloud - Protocols and Formats for Cloud Computing Interoperability
• The Three Reasons Hybrid Clouds Will Dominate
• Intercloud: The Evolution of Global Application Delivery
• The Intercloud makes Networks Sexy Again
• Here Comes the Intercloud
• The Inter-Cloud and internet analogies

Technorati Tags: MacVittie, F5, infrastructure 2.0, integration, collaboration, standards, cloud connect, Pete Silva, F5, security, application security, network security, business, education, technology, application delivery, intercloud, cloud, greg Ness, context-aware, infrastructure 2.0, automation, context, web, internet, blog

Lori MacVittie Interview at Cloud Connect

I got a chance to sit down with another member of the Technical Marketing Team at F5, Lori MacVittie at the Cloud Connect conference in Santa Clara this week.  We chat about Web 2.0, Infrastructure 2.0, dynamic networks, cloud interoperability standards, what 3.0 looks like and a few other things.  Thanks Lori!

ps
Technorati Tags: MacVittie, F5, infrastructure 2.0, integration, collaboration, standards, cloud connect, Pete Silva,F5,security,application security,network security, business, education, technology