Avoiding Vendor Bloat

Some IT software vendors may hate me for this blog post, but I want to write it anyway. During my decade as an IT consultant for businesses of varying sizes, I’ve observed a particularly annoying phenomenon, which I call “Vendor Bloat.” What happens here is an organization’s IT decision makers identify some need and immediately look for technical solutions that will meet that need. This is not always a bad idea, but in many situations, the organizations fail to realize that they already have technical solutions that meet the need and end up with a massive number of  technical solutions from different vendors. This results in an IT environment that is constantly fighting with appliances, servers, and software solutions. The end result is a terrible IT infrastructure that ends up hurting the business instead of helping the business meet its goals. The IT support team has numerous vendors to talk to for support and those vendors don’t help them get the solutions working with all the other stuff they have.

In one extreme example I recall going in to an organization that had 3 email security appliances; a spam filter, an email encryption appliance, and an email archiving appliance. They were constantly having issues with mail delivery delays and failures and just couldn’t figure out what was causing the problem. I took one look and just had to shake my head in frustration. I went through the architecture of the environment with the client and showed them how a single cloud service could provide all three of their email security needs. Once they switched to that method, the email delivery problem mysteriously disappeared.

IT Unitaskers

The core of the problem is due to a type of IT “Unitasker” solution that meets only a single organizational need. If you haven’t seen TV Chef Alton Brown’s tirade against Kitchen Unitaskers, go watch it to get a little background on the term “Unitasker.”

Basically, IT software solutions or appliances that only do a single thing are dumb, and are often very close to being scams. They cost lots of money, do very little, and do more to hurt your IT environment than help. You should know that most of the quality solutions out there have the ability to meet multiple needs without third party additions.

Following the Email Security example, you want to look for a spam filtering solution that provides some form of email encryption and either archiving or spooling services as well. An email encryption solution should also provide Data Loss Prevention capabilities or have spam filtering features as well, and even a solution for managing Whole Disk Encryption or Endpoint Security can add great value.

Aside from the general annoyance of dealing with different support frameworks to fix a problem, you do not want to have multiple vendors handling your mail-flow. It’s a nightmare to troubleshoot issues with more than one vendor or two vendors in the mix, and issues are bound to happen when you have your email bouncing through multiple servers or appliances before hitting a mailbox.

So how do we avoid Vendor Bloat?

Don’t Be Lazy

The first step to avoiding Vendor Bloat is getting over the desire to avoid work. There is a lot of work and careful examination involved in properly assessing the need for an IT solution. But that work must be done if you don’t want to have someone take advantage of you and sell you things you don’t need. You should never ever cede oversight of the IT environment to a vendor.

Honest Self-Assessment

One of the first bits of work you need to do is to honestly and thoroughly assess your environment’s existing infrastructure as well as the need you have. If, for instance, there is a phishing attack on the environment, you need to carefully assess the damage before looking at solutions to keeping them from happening.

The process here requires you to examine existing costs, budgetary constraints, solution need, and cost to continue as-is (including hidden costs like reduced efficiency). If the aforementioned phishing attack only cost you a few headaches and you’ve only been hit with a single similar attack in the past decade, a $100k+ solution isn’t likely to be a good purchase.

Technical Examination

Take a look at your existing IT infrastructure and determine the capabilities of what you already have. You’ve spent lots of good money building your IT infrastructure already, so you need to make sure you don’t already have the ability to meet the need you have without spending tons of money.

Exchange server (and Exchange Online), for instance, is already capable of providing partner-based forced Email encryption through the use of Mutually Authenticated TLS encryption (Also known as Domain Authenticated TLS). Setting this up usually only requires about an hour of work per partner organization, so if you have a limited set of companies that you need to ensure email encryption with, it’s worth it to set that relationship up with Exchange rather than spend thousands on an appliance or cloud solution that only does email encryption.

It helps to consider least effort solutions when being faced with a problem in IT. There are a lot of good reasons for this. First off, creative solutions with your existing environment will allow you to maintain the existing support framework without having to expand or train employees to manage and use new solutions.

If you are a high-level decision maker, be sure that you have access to technical advisors to assist in assessing need. This is particularly true if the need is in an area that you aren’t familiar with.

Vendor Pushback

Whenever a vendor tries to tell you how to meet your company’s needs with their software or service, push back! Don’t let the vendors control the conversation. You have a need and they need to prove that they can meet more than just that need. You have to ask, “What else does this do?”

There are also a lot of hidden costs that need to get added to the equation when you add a new system to an existing IT infrastructure. You have to train your own staff to manage it, you have to adjust your processes to account for the new services, and other managerial issues will pop up once the solution is in place. A vendor’s pitch to you will not account for the hidden costs, so you need to be vigilant and serious when interacting with vendors. Don’t be distracted by the flashy lights and cool tech, and don’t be afraid to say, “I don’t need this.”

Conclusion

Vendor Bloat can become a very serious problem quickly, aside from the general need to have an IT environment where all the pieces work together properly. It is possible, however, to avoid getting yourself stuck in the vendor bloat trap if you are honest, careful, and smart about assessing the need to actually buy a new solution.

Advertisements

Data Encryption – How it Works (Part 1)


I’ve decided to start a short series of posts on data encryption, which is becoming an increasingly important subject in IT as government regulations and privacy concerns demand ever increasing levels of privacy and security.

In this series, I’ll try to cover the more confusing concepts in encryption, including the three main types of encryption systems used today; Private Key encryption, Public Key Encryption, and SSL/TLS encryption. I will cover how those types of encryption function and vary from one another. I will also get some coverage on one of the most confusing topics in IT security, Public Key Infrastructure. If you haven’t already read by article on Digital Certificates, I would highly recommend doing so before going on to part two of this series, since digital certificates underpin the vast majority of encryption standards today.

What is Encryption?

The goal of encryption is to make any message or information impossible to understand or read without permission. Perfect encryption is (currently) impossible. What I mean by that is there is no way to encrypt data so that it can’t *possibly* be read by someone who isn’t authorized to do so. There are an unlimited number of ways to encrypt data, but some methods are significantly more effective at preventing unauthorized disclosure of data than others.

Encryption Parts

Every encryption system, however, has a few things in common. First, there’s the data. If you don’t have something you want to keep private or secret, there’s no reason to encrypt your data, so no need for encryption. But since we live in a world where secrecy and privacy are occasionally necessary and desirable, we are going to have stuff we want to encrypt Credit card numbers, social security numbers, birth dates, and things like that, for instance, need to be encrypted to prevent people from misusing them. We call this data “Clear-text” because it’s clear what the text says.

The next part is the “encryption algorithm”. Encryption is based very heavily in math, so we have to borrow some mathematical terminology here. In math, an algorithm is all the steps required to reach a conclusion. The algorithm for 1+1 is identified by the + sign, which tells use the step we need to take to get the correct answer to the problem, which is to add the values together. Encryption algorithms can be as simple as adding numbers or so complicated that they require a library of books to explain. The more complicated the algorithm, the more difficult it is (in theory) to “crack” the encryption and expose the original clear-text.

Encryption algorithms also require some value to be added along with the clear-text to generate encrypted data. The extra value is called an encryption “key”. The encryption key has two purposes. First, it allows the encryption algorithm to produce a (theoretically) unique value from the clear-text. Second, it allows people who have permission to read the encrypted data to do so, since knowing what the key is will allow us to decrypt, or reveal, the clear-text (more on this in a bit).

These three pieces put together are used to create a unique “Cipher-text” that will appear to be just gobbledygook to casual inspection. The cipher-text can be given to anyone and whatever it represents will be unknown until the data is “decrypted”. The process we go through to do this is fairly simple. We take the clear-text and the key, enter them as input in the encryption algorithm, and after the whole algorithm is completed with those values, we get a cipher-text. The below image shows this:

Encryption

 

Every encryption algorithm requires the ability to “reverse” or “decrypt” the data, so they all have a different decryption algorithm. For instance, in order to get back to the original value of 1 after adding 1 to it to get 2, you would have to reverse that process by subtracting 1. In this case, we know what input (1) and algorithm (adding) was used to reach the value, so reversing it is easy. We just subtract whatever number we need to get back to the original value (1 in this case). In general, decryption algorithms will take the key and cipher-text as input to the algorithm. Once everything in the algorithm is done, it should result in the original clear-text, as shown below:

Decryption

Simple Examples

Two early examples of encryption come to us from Greek and Roman history. The Skytale was a fairly ingenious encryption tool that used a wooden block of varying size and shape as its key. The clear-text was written (or burned) on a strip of leather that was wrapped around the key on a single side of the key, which was usually hexagonal. The person who was supposed to receive the message had a key of similar shape and size. Wrapping the leather strip around the other key would allow the recipient to receive the message. Using the above terminology, the Clear-text is the message, the key is the block of wood, and the encryption algorithm is wrapping a strip of leather around the key and writing your message along with some fake gobbledygook on all the other sides. Unwrapping the leather from the block gives a cipher-text. Decryption is just wrapping the strip around a similarly shaped and sized block, then look at all sides to see which one makes sense.

One of the more famous encryption algorithms is called the “Caesar Cipher” because it was developed by Julius Caesar during his military conquests to keep his enemies from intercepting his plans. You’ve probably used this algorithm before without knowing it if you ever enjoyed passing notes to friends in school and wanted to keep the other kids (or the teacher) from knowing what the message said if they “intercepted” it.

The Caesar Cipher is fairly simple, but works well for quick, easy encryption. All you do is pick a number between 1 and 26 (or the number of letters in whatever language you’re using). When writing the message, you replace each letter with whatever letter whose space in the alphabet is equal to the number you chose above or below in the alphabet. For instance, “acbrownit” is “bdcspxmju” in a +1 Caesar Cypher. Decrypting the message is a simple matter of reversing that. For a Caesar Cypher, the key is whatever number you pick, the clear-text is the message you want to send, the algorithm is to add the key to the clear-text’s letters, outputting cipher-text.

Key Exchange

For any encryption algorithm to function properly as a way to send messages, you must have a way to ensure that the recipient of the message has the correct key to decrypt the message. Without a key, the recipient will be forced to “crack” the encryption to read the message. So you need to be able to provide that key to the recipient. The process of ensuring that both the sender and recipient have the keys to encrypt and decrypt the message (respectively), a “key exchange” must occur. This is often as simple as telling your friend what number to use with your Caesar cipher.

But what do you do if you need to exchange keys in a public place, surrounded by prying eyes (like, for instance, the Internet)? It becomes much more difficult to exchange keys when needed if there is significant distance between the sender and recipient, which means that the biggest weakness in any encryption standard is making sure that the recipient has the key they need to decrypt the message. If the key can be intercepted easily, the encryption system will fail.

The exchange method used will usually depend on they type of key required for decryption. For instance, in World War II, the German military developed a mechanical encryption device called “Enigma” that was essentially a typewriter, but it changed the letters used when typing out a message with a mechanical series of gears and levels. If you pushed the I button on the keyboard, depending on the key used it would type a J or a P (or whatever). The keys were written down in a large notebook that was given directly to military commanders before they departed on their missions, and the index location of the key assigned to the message was set on the machine itself to encrypt and decrypt messages. The process of creating that key book and handing it to the commander was a key exchange. It was kept secure by ensuring that the only people who had the notebook of keys were people that were allowed to have them. Commanders were ordered to destroy their Enigma machines and accompanying notebooks if capture was likely. The Allies in the war were able to capture some of these machines eventually, which allowed a lot of incredibly smart people a chance to examine them and learn the algorithm used to encrypt data, which ultimately resulted in the Enigma machines becoming useless.

Modern encryption systems utilize a number of different methods for exchanging keys. For example, there are VPN tunnels that utilize “hardware” keys. In these solutions, the networks on each side of the tunnel have a device that is connected to another over the internet through a VPN. Before a connection between each side can be established, a small electronic dongle (about the size of a flash drive) has to be plugged in on each side. The dongle contains the key used to encrypt and decrypt data. The key exchange in this scenario involves having an authorized individual take a key to each site and plug it in. This is a very low-tech kind of key exchange, but is extremely secure because, as long as the individual carrying the keys is trustworthy, we can be sure that no one else has a copy of the key.

There are many other kinds of key exchanges that can occur in an encryption system, but most people don’t realize when a key exchange is even happening on the Internet. Whenever you visit an encrypted website, there are actually two different kinds of key exchange that have to happen before the website is presented. Without the technology to perform those exchanges, entering your credit card to purchase the latest gadget online would be a much more complicated and annoying process.

The Future of Encryption

Encryption techniques have come a long way since the early days of leather straps around wooden blocks. Encryption is also used in more ways, by more people, and for more purposes than you can imagine. Despite the improvements and technological developments that have come along, there is still no such thing as a perfect, unbreakable encryption technique. It’s always possible to decrypt data without permission. All we can do is ensure that the time it takes to “crack” the encryption is prohibitive. AES encryption, for example, can take as long as the universe has existed to crack using brute force techniques (based on the average computer’s processing power). The future, though, will require better, more ingenious encryption systems. Why? Because, theoretically, a sufficiently powerful quantum computer (which doesn’t exist yet) can crack even the strongest encryption in almost no time at all. Rest assured, however, that someone (or a group of someones) will develop a better system that will be much more difficult for quantum computers to crack.

Summing it Up

Encryption is a part of our daily lives, whether we realize it or not. Understanding how it works is becoming more important as time goes on and the need to protect ourselves from prying eyes increases. Hopefully, after reading this article, you can see why encryption is important and what it really does for everyone.