Monday, February 9, 2015

Are You A Farmer Maybe A Network Engineer?

John Deer Tractor
While I'm not a farmer at hand I have dabbled with backyard gardening tools and have proudly planted and harvested several groupings of tomato plants and boy were they delicious.  Did I own the tools, the knowledge and the capability?  I thought so...but boy have times changed.

Today I'm reading a wired article and learning that farmers need to improvise and tinker around just as much as any one else in order to keep important and valuable machinery at work - working.  However the article which you can find here: http://www.wired.com/2015/02/new-high-tech-farm-equipment-nightmare-farmers/ tells a story which applies much further then a central Illinois corn farmer sitting on top of his combine.

The story written by Kyle Wiens of Wired brings up a great point.  Who really owns it and what does it hold for me, the owner?  A farmer in Wiens article spends over a hundred thousand for is top flight John Deer Tractor let's say and at the end of the day the question prevails, who really owns it?  You buy a top flight network appliance and we ask you, who really owns it?

While the seller wants you to buy their state of the art machinery or device, they do not release the software, hardware or for that matter everything inside which makes the machine or network device in the very first place so invaluable.  You of course get to ride it sometimes and use it for its intended purpose watch the lights bubble on/off.  You even get to clean it and shine it up with wax and polish if so inclined or just dust it off.  But if this 100,000 dollar baby decides to shut down or its circuits get glued or jammed up what you own is a 100,000 dollar shinny piece of metal and perhaps a bill for getting it towed off your lot or pulled off your network when it decides to shut down.

Like so many things today from a John Deer Tractor to a state of the art upstream protection appliance for your network the question prevails who really owns it?  The point being that you really need to be reading the fine print upon purchase, understand your operating system, learn about the configuration and understand what the long term consequences would be for owning such a machine or device.  In one case after the next we're witnessing not the lack of budget to purchase an upscale machine or network appliance but the long term ongoing problems associated with ownership, such as: maintenance, upgrades, proper configuration, segmentation, alarming and enumeration. 

While I'm not a farmer, things are rapidly changing and we'd better be changing with them or for sure the consequences will lay right in our own laps.  Failure to fully understand the value of modern day machinery/network devices, lack of service level agreements or understanding thereof, maintenance contracts whether your a farmer or network engineer machinery breaks down and so do network devices.  Of course if they are not setup and configured correctly in the first place you could say you're just throwing money out the window.  Times are changing, better be nimble and change with them.  Its not just about buying that state of the art "thing" but understanding the long term consequences of ownership can be just as expensive as "Ownership" in the first instance.  Buyer beware.

1 comment:

Unknown said...

Ownership of devices and appliances, aside, the greater question is, where does your expertise lie? Are you responsible for understanding what goes on "under the hood" of your infrastructure components? Historically, as technology progresses, the industry makes the technology easier to use and both available and more appealing to its consumer base. Some might call it "dumbing down" the technology; more recently, others have called it "plug and play". Practically speaking, progress tends to divorce the mechanics of a technology -- and its associated feeding and care -- from its benefits. I used to change my car's oil, myself. Now, in some newer cars, I'd be lucky to be able to FIND the filter and pan plug. In my latest car, the engine is even covered to make it look nicer, but also, I suspect, to discourage owner-made repairs. Only your dealer-based mechanic is allegedly qualified -- and often has (and can afford) the tools -- to perform the now complex maintenance and repairs. The advancements in technology demand specialization and a higher skill set. With specialization, however, comes a price: the lack of sufficient understanding of the details not only to make your own modifications and repairs but to make informed decisions. Do you not usually take your mechanic's recommendation when he or she tells you that you need to fix or replace a component? (Or, at least, do you get a second opinion and THEN act accordingly?) We find appropriate partners to trust, and then we trust their advice.

Our IT systems and the technologies required to protect them have become sufficiently complex that security specialists are now the norm. Not just general security specialists, but professionals highly skilled in individual disciplines within the field of security and sometimes even individual technologies. We purchase products and services from security suppliers and all too often allow their in-house or third party specialists to configure these components in a one-size-fits-all fashion without the benefit of fully understanding our individual needs and customizing the implementation accordingly. Worse yet, these products and services are installed and not configured at all, leaving manufacturer supplied defaults in place.

The result is a false sense of security. We expect that we are protected from certain types of adverse actions and conditions, while in truth, gaping holes are left in our security. Our expectations do not match reality, and we are not prepared for the unanticipated consequences.

A fully informed understanding of our systems, the risks associated with their use, the controls placed to appropriately manage the risks, and the technologies, products, and services employed to effect, maintain, and manage these controls is essential to protecting our businesses. No sensible organization would have a third party manage their financial records and controls without having a deep understanding of the decisions made and the potential consequences of those decisions. Neither should they do so with their technology and its controls.