7 Layers?

Tuesday, August 17, 2004

Discussion on ROI [patch management]

Susan’s Reply

As a beancounter if I hear Return on Investment one more time.......

these are the same CFO's that say in the trade journals that viruses cost them billions of dollars [or millions ...who's counting?] .... add that to your ROI calculator. Now tell me they can't afford this and yet they can afford to do the cleanup? Sorry but that doesn't make any sense. Loss of productivity is not easily quantified. They aren't counting their total costs and just kidding themselves. And pardon me, but aren't these the same CFOs who just demanded that software vendors make more secure software?

So... how many local administrators you have on those 10,000 seats?

Where's your ROI on cleaning up a Windows 98 machine after it gets nailed with viruses?

Migration isn't trival period, I'll grant you. But neither is lack of control. And every day that goes by where you can't roll these patches out to any machine no matter what the operating system in a quick and timely manner, that firm is accepting the risk ....and I'd love to see the SOX 404 report on that entity.

I know I'm lucky down in SBSland. We have less people to convince. :-)

Might want to read the Wilcox blog... looks like Microsoft has changed [lengthened product support]

http://www.microsoftmonitor.com/archives/002993.html

---------------------------------------------------------------
David to Susan


Susan...excellent for you that you took the one OS, one world solution.
> But it's not a trivial thing in many organziations, and your comment
> that "....any company can afford it..." does not hold water. Talk to
> a Fortune 500 CFO and tell her why she should approve the millions of
> dollars to do a sweeping OS migration across 10,000 desktops.
>
> CFO: "Where is the ROI?"
>
> You: "Wellllll, they'll be easier to manage...we can get patches out
> and testing done faster..."
>
> CFO: "Where is the ROI for the two million dollars you are asking me
> for?"
>
> You: "Welllll, it will make life easier in IT if we only have one OS
> to worry about...we will make it secure more easily"
>
> CFO: "Will this reduce our controllable expenses by over 2 million
> dollars in the next 24 months? In other words, is IS willing to take
> 1 million dollars a year out of their expense budget if I approve this?"
>
Ahhhh but if you answer "Yes"......
Similar trajectory here albeit in a much smaller setup. We were willing to give up a (projected) additional person to buy patch management software and some licenses for semiautomated updates. Cheaper for whole, argueably more effective for IT. We may come to regret the decision (the tipping point changes over time) but it was defensible way back in late 2003 [sic].

> CFO: "You just wasted 10 minutes of my day...talk to me when you have
> a legitimate ROI...good day"
>
> NOTE: If you think I invented the above discussion, you do not/have
> not managed in a F500 environment. It's about the business and the
> bottom line. I agree that a unfified environment is a nice
> thing...but you have it backwards with regard to who can and can't
> afford it. A smaller scale organization has a much easier time driving a change like this, Susan.



Mr. A

Patch management

Patch ManagementThis is the very important part to manage any network these days. This term is not a new term. You must be very well area of this. I'm not gonna write too much technical about this. There many products available for patching the systems like Microsoft’s SUS, MS SMS, Shavlik's HFTNetCheck etc. Here I'm giving a link which will tell you How does Microsoft apply the patches to their networked system.

http://www.directionsonmicrosoft.com/sample/DOMIS/update/2004/01jan/0104cpam.htm

This link is provided by ROD Trents at patch management group http://patchmanagement.org

If you want to get more info subscribe to this very informative website.

Regards Mr. A


Monday, August 16, 2004

Focus on Security

The purpose of having this web presence is to share my real life experience with you (ITpeople). As I'm moving more towards the Security side so I'll try my best to put the actual scenario and daily life problem (professional ofcourse :). All my discussion will be related to Microsoft's products but you have the liberty to add irrespective of any vendor.

Today networks are laid down, systems are implemented and Internet is going to be the part of everyone's life. Now the requirement is for smooth network connectivity, virus-free network, ease of management etc. One should not do the experience but should learn from other's experience.

Here you can access to the Techtalks which I normally have with Microst's representative. It doesn't mean that I'm a Tech reporter, the thing is that I never miss the chance to attend the workshops and seminars organized by them.

I'd like to suggest some book which are not related with security or networking but these boks will give you a better idea about howto top fortune companies made the success stories.Management is very important part whether related to life or with our work. One should know howto to manage all things together. I'm not telling you to read the books on politics or about any sports but do read books on management and on numbers. To get more details on numbers and how does it work read Robert T. Kiyosaki's book.

After reading these few books I got a very clear picture about career and howto proceed. These are very famous books by Industry leaders. 'The Road Ahead' & 'Business@ the speed of thought' both written by 'Bill Gates'. & 'What Management IS' by Joan Magretta. 'Rich Dad and Poor Dad' by Robert T. Kiyosaki.

Here are some useful links
SecurityFocus, Microsoft Security, CERT, Astalavista, Very good security stuff

Regards Mr. A

Network Management

Network Management, the most interesting part for me. Specially when you are having the task to manage an enterprise network where you have Webservers, Databases, File servers, and clients running common application on their desktop. So if you are going to implement a new infrastructure then you can have an ideal setup but on the other side in an existing network you may have to face many difficulties.

The most common question ever asked is 'How much', means how much is gonna cost me (your client). What is the advantage of having this and doing this. Why shoul I pay this much and what is the return on this. People sometimes ask ridiculous questions but you have to convince them. There are two important factors 1.How strong is your background in I.T.?2.Do you have the skills to convince others?

If you both of these qualities then you are the successful I.T. professional otherwise you'll lack something in your professional life.

In my next post of the Network Management I'll put articles on Proper Network Managment whether it is a corporate LAN or Data Center or a Small office network. Different network have different policies, different strategies and different priorities. I'll try my best to give you a clear picture about it.

Your comments and suggestion are welcomed.

Regards
Mr. A