A few people asked me to post my presentation, but I have found that my current job as the COO at Powertek Corporation has caused me to miss many of my self-imposed deadlines for doing many things, including updating my blog.

However, has now been overcome, at least for a few moments, and here it is.

UMUC Slides 

My talk was divided into four parts:

• Context where I discussed what I call First Principals, what I feel are the underlying causes of much of the technological disruptions happening these days
• Some thoughts on security trends, after all this was a Cybersecurity Symposium
• Comments about the demand for security professionals, after all this also was a Job Fair
• Ending with some thoughts on the goals for security and some general advice

I think the slides are pretty self-explanatory though I keep hoping to turn some of them into individual blog entries.

I had two key pieces of advice.

First, I related an old joke by Steve Martin that talked about how to make a million dollars and not pay taxes. The first step was to ‘find a million dollars’. I find that many proposed solutions to security, well, actually to almost anything hard is the functional equivalent of that first step.

Second, I told them to remember that the primary mission of almost every organization they will work for is NOT security. Because of that fact, one of the primary jobs of a senior security professional is to learn how to articulate the reasons for security investments in the context of the actual mission goal. Otherwise, organizational senior management will not make the right decisions.

Naturally I had more than two cents worth of thoughts about the issue and most likely my take was so orthogonal to what they were working on that it ended up being of marginal utility.

On the other hand, it gave me an excuse to think about the topic and allowed me to fill out another blog post. With Wyatt’s permission, the rest of the entry is what I sent to him in response to his request.

Thoughts On 2010 Technologies That Will Be Important to the Government, Pick 3-5

This is a pretty interesting question to answer.

Digital technologies are becoming integrated so tightly into almost everything that we do. Thus one’s answer depends to some extent as to who we are trying to answer for: the internal technologists, the operations managers, the CIO, or the people responsible for mission implementation.

In addition we are in a period of increasingly rapid and radical changes. Thus not only do we need to make a judgment about what technology might ‘win’, e.g. your thought of 4G Wireless winning out over WiMax, but also the impact of the technology; who could have predicted Apps for Democracy happening as a result of the increased capability and comfort level with 2.0 technologies.

Let me focus on those that will have the potential to cause dramatic change either in how Government relates to its external or internal stakeholders or manages itself. I will suggest four that I would pay attention to in 2010:

• Government 2.0
• Virtualization
• Real-time Security Situation Awareness
• Mobile Network Endpoints

 and one that I would start to pay attention to in 2010 but is just starting to reshape our approach to network and business architectures:

• Sensors.

The first two represent technologies whose 2010 importance are that they are moving from the edge of the art, or at least not as used by senior management, to mainstream.

Government 2.0 Where 2009 was a year where 2.0 technologies started to become used in general and where President Obama’s team pushing their use could be news, 2010 will be a year where every Government agency will be expected to have a robust 2.0 presence just to get to average. The culture changes needed to allow the exposure of increasing amounts of information, even in intermediate form, will take energy to overcome. But the result is extremely powerful allowing external interested parties to create mashups and produce much more interesting and often more user-friendly versions of the data which the Government might never have achieved.

This will also lead to greater use of 2.0 technologies to implement various versions of crowd sourcing. Where Intellipedia and Aspace are big news, internal wiki’s will become more second-nature. Pilots associated with prediction markets, using groups to predict things like project results or other public facing data, are starting to be piloted by early adopters.

Virtualization. In this case I am referring to virtualization computing resources, not virtual environments which I mention later. It is the maturing of virtualization of servers, still utilized by too few agencies, that has allowed the frenzy around cloud computing, with a dash of high-speed networking and ability to manage multi-tenancy on the servers also required.; though there is likely to be as much or more work done with private or community clouds than public usage in 2010.

This is a big tool for the going Green supporters as well.

Combine this with desktop virtualization and you start to get the incredibly big fight going on between desktop-client versus remote-client providers; the short-hand would be Microsoft vs Google. The implications are enormous in terms of technical architecture, application development, procurement, and security.

Real-time Security Situation Awareness. And speaking of security, I believe the big trend in 2010 will be away from static analysis focused on perimeter protection toward situational awareness used to enable mobile and distributed applications to run even while under attack.

This change underlies a lot of the ferment going on with how to rework the FISMA process.  It also ties back to the thought that it is increasingly necessary to prioritize security investments based on risk rather than trying to do everything everywhere; and thus nothing anywhere; moving from whack-a-mole security to a risk-based focus emphasizing availability and resiliency first.

For those interesting in a practical example, I would recommend looking at what the Department of State is doing in this space, which draws upon the Consensus Audit Guidelines (CAG) effort put together by John Gilligan and Alan Paller, which I had the honor of participating in.

Increasing Power of Mobile Network Endpoints. Cell phones, personal digital assistants (PDAs) continue to proliferate as their computing and communications capabilities increase and their interface to the Internet becomes increasingly robust and integrated.

Here also, three big arguments are being played out:

.   the previously mentioned desktop-client versus remote-client

.  commercialization versus standardization

.  data sharing versus data privacy

Each of these are being dealt with inconsistently across the Federal Government. Their resolution will result in winners and losers organizationally and commercially.

Sensors. While I don’t believe most Government agencies will necessary pay attention to this topic, in fact their increasing power and distribution may overwhelm all of the other suggestions. They bring about two broad changes when they become ubiquitous:

.  they become participants in the network – creating an Internet of Things

.  they allow the collection of real-time data which can then be processed in real-time

This latter change allows virtual environments to become increasingly comingled with physical environments, here virtual refers to environments as Second Life.  Smart cities which interact with their citizens, like San Francisco where it is possible in some places to find out the location of empty parking spaces on your cell phone as you drive around; or the NYU/Cornell experiment wiring some of the NYC rivers so you can check on status from the web including from your cell phone. Applications like layar which provides information about where you are based on web-provisioned information will in the future pick-up its information from the physical surroundings as everything becomes an IP address and/or twitter participant.

Secure SCADA – Dec 2009 a

The presentation consists of two parts.

Part I was prepared by me and talks about the economic basis associated with the impact of the Internet, wanders through a number of topics I like to kick around (‘from earth centered to sun centered to nothing centered and what that means for Enterprise Architecture’, my thought that everything is a cloud, …), and touches on what the Government is thinking about regarding security.

Part II is a subset of what Rus Records, a fellow CSC’er, prepared which provided some thoughts on the state of SCADA systems in the Chemical, Energy, and Natural Resources areas (what CSC refers to as CENR).

I hope to expand on a number of these topics in future blog entries.

My focus, as usual, will be on the strategic reasons behind the movement to SCADA. Oops, perhaps I should back up. SCADA is an abbreviation for Supervisory Control and Data Acquisition. It usually is used as a catch-all term dealing with computer controlled equipment or machinery (or plants or smart grids or, well you get the idea).

Many of these systems were controlled individually by locally provised systems and thus security, while relevant, wasn’t the most critical factor when designing such solutions. Now that many of these systems are managed over the Internet and an increasing percentage of what most would consider our/US economic critical infrastructure touches these systems, cyber issue have become a very hot topic.

So my presentation will focus on why this is happening and also touch a bit on some of the issues the Government is facing in this space. The second presenter from CSC is an industry expert in the utility, chemical and natural resource market and will provide some more detailed oversight and advice.

I adapted some of my past talks on this issue starting with my standard discussion about transaction cost economics and the internet and then push on to cloud computing.

I have started to try and generalize the concept of cloud computing and wanted to get some feedback from anyone who cared to give it regarding what I wrote up. This does NOT include the second part of the presentation which I mention above.

Dan’s SCADA Presentation

My thought is that in a sense every computer and in fact in a broader sense every aspect of an organization could be looked at as being part of a private, community, or public cloud. Your desktop could be considered a small, generally unoptimized private cloud for example.

For the purposes of this presentation, each ‘thing’ has a governance question relating to how decisions are made and a security question relating to how security is provisioned or at least who is responsible for the provisioning of it.

The purpose of this thought experiment ties back to my premise as to why cloud computing has taken off, transactional cost economics + some technological developments, and the difficulty in avoiding these implications.

The whole thing needs work but I think the direction I am heading is increasingly clear.  All feedback welcome either as comments to this post or as emails directly to me.

 Before I get to the topic of this blog entry, sensors, I wanted to mention that I have been privileged to play a small role in the Government 2.0 Expo, www.gov2expo.com, occurring Tuesday, September 8^th, and the  Government 2.0 Summit, www.gov2summit.com, occurring Wednesday and Thursday, all at the DC Convention Center.

 The fact that so many people around the country are interested in experimenting with 2.0 technologies to improve the way Government interfaces to its external and internal stakeholders and in a fundamental fashion rethink how it should operate, is wonderful.

 Democracies only work well when there is vigorous debate and participation in the public square.  I encourage anyone who reads this blog, recently calculated in the ten’s of viewers, to access these web sites and get active in future such activities.

 Sensors

One of the ways to look at the development of Information Technology is the increased capabilities of fast computers, fast networks and fast sensors.

It is my contention that much of what we consider the recent revolution in social networking and the increasing impacts on organizations is a result of the maturing of the first two: fast computers and fast networks.

In particular, the impact of having broadband capabilities at the end-points of the network was the tipping point for this revolution. The term broadband refers to the ability to transmit a ‘broad’ range of frequencies of communications at once. The net impact is that the transmission speeds possible goes up a great deal when broadband communication is used.

Broadband allows high-speed uploads and more importantly downloads from the Internet, including streaming audio or video. End-points of the network, which started out as desktop computers and moved to laptop computers, now includes personal digital assistants, PDA’s, and cell phones in general.

When we have ubiquitous, fast, intelligent sensors distributed throughout a network, there are two very interesting developments that occur.

First, the way a sensor participates in an architecture changes. Historically sensors were passive participants in an implementation. One sent instructions to the sensor indicating what to measure or what to do. The sensor sent back information that it collected and/or information on what it was doing.

Now however, the sensor becomes an active agent. Using rules based approaches or some other more robust version of artificial intelligence, the sensor not only measures it also makes decisions and acts. To the extent that this has been true in a limited sense, we now start to approach behavior that starts to mimic Turing-quality; making it hard to distinguish whether there is a person reacting or a ‘non-person’ acting.

Listening to my in-laws talk to their GPS is only the tip of this particular iceberg.

Second, we are able to generate much more robust simulations; real-time simulations based on real-time data. When there is a serious car accident or a bridge collapses, we will be able to simulate the traffic implications and react to those simulations with data based not only on historical data but updated and enhanced by the real-time traffic data being collected after the event occurred.

So What Does This All Mean

I will talk about all of this in greater detail in future blog entries, but in this entry wanted to note one specific implication, the blurring of the division between real and artificial environments.

With sensors pulling in real-time data in real-time and the increasing ability to utilize this data in real-time, it will not be obvious as to whether we are touching the real-environment experiencing the real-data first hand or a virtual-environment experiencing the real-data virtually. In fact, it becomes less clear as to whether the division even makes sense anymore.

If we were in an office together, I would now slap my hand against my desk or on a table. I would note that in fact my hand is not ‘feeling’ the table, rather my brain is interpreting the sensations that are generated when my hand hits the table which is understood to be the same sensations one would feel if a hand were slapped on a table.

We can already experience in visual and auditory form and soon physically, it is possible to replicate all of that in a simulation. Perhaps a future generation of ‘Wi’ will allow us to physically touch that hula-hoop one can exercise with on the screen.

When a drone in Afghanistan is operated by a pilot based in the United States, what is the reality and what the virtual environment from the perspective of the pilot? How far are we from having a surgeon in St. Louis operate on a patient in New York?

When scientists have studied younger people, those generation Y digital natives; they have found that they look at themselves, news, information, and, in fact, reality differently than people who did not grow surrounded by the 7×24, always on, always available, easily editable Internet.

While these developments have changed all of our lives in many ways, the digital native’s relationship to all of their external environment is different in fundamental ways than, for example, mine who grew up with black and white TV’s and Peter Pan appearing once a year on TV (also, a topic for a later blog entry).

I would contend that the wide-distribution of sensors which will lead to the rapid development and integration of virtual environments, will cause the next generation of the next generation to look at reality even more radically differently with potentially dramatic social consequences.