ENISA cloud computing security doc
Life without SSH : https://www.youtube.com/watch?v=fEuN5LkXfZk
ENISA cloud computing security doc
Life without SSH : https://www.youtube.com/watch?v=fEuN5LkXfZk
Most people who know me are somewhat aware that I travel quite a lot. I love visiting new places, and I really enjoy being on the move. One thing that often bugs me, however, is how awkward using money in different countries can be.
Getting local cash at a decent rate can be a pain. Using an ATM abroad incurs fees from your bank, and you don’t necessarily get good rates. Going to a currency exchange can be a hassle too. I usually carry some dollar notes on me anyway, because they’re accepted almost everywhere.
Using your debit or credit card abroad incurs yet more fees, with unpredictable and usually poor rates.
This is where my new Curve card comes in. A Curve card essentially acts as a proxy between the world and your existing cards. You can add multiple credit and debit cards to it, and select which one to use for each payment (or even change it afterwards!). Using your Curve card doesn’t incur any currency conversion fees, and you receive a better rate than most high street currency exchanges.
Cleverly, all the transactions on your Curve appear as purchases on the “source” cards, which means you can also take cash out of an ATM using your Curve card, and choose to source the cash from any of your cards, including credit cards (without incurring the cash advance fees that you normally would), debit cards and pre-paid cards.
So what does this mean for travelers? Firstly, using your Curve card saves you money abroad, both when using it to purchase goods and services, or getting cash from an ATM.
Secondly, it’s far more secure. Just take your Curve out with you, and leave your main cards in the safe at the hotel, or simply keep them elsewhere on your person. If your Curve card gets stolen or lost, simply open the app and deactivate it. Even if it somehow got cloned by some unscrupulous bartender or waiter, you’ll receive instant alerts of any payments, so you’d know the instant it was used, which means you could instantly disable the card and request a refund.
Thirdly, you get real-time feedback and notifications, making budgeting far easier. You can tag your purchases, add notes, and scan receipts to add to purchases. This means you can keep track of your spending, check how much you’re spending on travel, food, shopping, etc, and even use it to form the basis of your expenses claim if travelling for business.
In my opinion, Curve is still lacking a few features though. You can’t yet add it to Apple Pay, which would streamline payments even further. You can’t add a single debit or credit card to multiple Curve accounts either. The reason for this is that when travelling as a group or a couple, you could all add some money into a shared pre-paid card (e.g. Monzo), and then add that to your individual Curves. This would solve all those split-payment problems when you’re paying for supplies or travel costs for the whole group. If there’s any “debate” around a certain item being charged to the group card, it’s easy to “go back in time” (as Curve put it), and charge it to a different (i.e. personal) card.
I’m pretty sure the group payment challenge is solvable, either with existing tech, or by someone shortly bringing out fintech joint accounts. Either way, using Curve has definitely made my travelling life a lot easier, and I’m excited to see what they do next.
Shameless promo: sign up for Curve here with code NPWZA and you’ll get £5, and so will I.
Over the years in my career so far, I’ve found that in some (many) situations, my speaking style in meetings doesn’t always “work” effectively.
Some background: when I was young, I was diagnosed with dyspraxia, and had trouble forming sentences and speaking properly. I had speech therapy until the age of around 8 years old. The word “hammer” was a particular challenge for me, apparently. I don’t know why. I can say hammer really well now. Try me.
As a result of this (or maybe it’s just coincidental), I often pause before speaking, particularly when in a larger group, or in a situation where what I say really matters. It’s partly to formulate the content, the idea, the concept, but also to establish the “how” of it; i.e. how to structure the sentences, what phrasing to use, and how the statement is to be delivered.
Now, this pause is useful for everyone. It allows for a more cogent, relevant and useful discussion.
But, people seem to feel the need to fill this audible space. Whether that’s a result of a discomfort with silence, or a desire to be the one speaking and presenting their ideas instead of me, I don’t know. I suspect both, in different scenarios. I don’t really care though, as it gives me more time to build my response anyway.
I guess I could be concerned that some might interpret a pause as a weakness, as some kind of hesitation because I don’t understand the subject matter, but I choose to ignore that concern, and focus instead on being me, and how I function best.
I wonder if we should all try to pause a little more. Think about what we say, how we say it, and how we deliver it. Imagine if meetings were 30% less talk, but with 50% better quality contributions as a result.
Embrace the silence. Embrace your own, and allow others to use theirs.
While I was putting together a talk for an introduction to AWS, I was considering how to structure it and thought about the “layers” of cloud technology. I realised that the more time I spend talking about “cloud” technology and how to best exploit it, manage it, develop with it and build business operations using it, the more some of our traditional terminologies and models don’t apply in the same way.
Take the OSI model, for example:
When we’re managing our own datacentres, servers, SANS, switches and firewalls, we need to understand this. We need to know what we’re doing at each layer, who’s responsible for physical connectivity, who manages layer three routing and control, and who has access to the upper layers. We use the terms “layer 3” to describe IP-based routing or “layer 7” to describe functions interacting at a software level, and crucially, we all know what each other means when we use these terms.
With virtualisation, we began to abstract layers 3 and above (layer 2? Maybe?) into software defined networks, but we were still in control of the underlying layers, just a little less “concerned” about them.
Now, with cloud tech such as AWS and Azure, even this doesn’t apply any longer. We have different layers of control and access, and it’s not always helpful to try to use the OSI model terms.
We pay AWS or Azure, or someone else, to manage the dull stuff – the cables, the internet connections, power, cooling, disks, redundancy, and physical security. Everything we see is abstract, virtual, and exists only as code. However, we still possess layers of control and management. We may create multiple AWS accounts to separate environments from each other, we’ll create different VPCs for different applications, multiple subnets for different functions, and instances, services, storage units and more. Then we might hand off access to these to developers and testers, to deploy and test applications.
The point is that it seems we don’t yet have a common language, similar to the OSI model, for cloud architecture. Below is a first stab at what this might be. It’s almost certainly wrong, and certainly can be improved.
Let’s start with layer 1 – the physical infrastructure. This is entirely in the hands of the cloud provider such as AWS. Much of the time, we don’t even know where this is, let alone have any visibility of what it looks like or how it works. This is analagous to layer 1 of the OSI model too, but more complex. It’s the physical machines, cabling, cooling, power and utilities present in the various datacentres used by the cloud providers.
Layer 2 is the hypervisor. The software that allows the underlying hardware to be utilised – this is the abstraction between the true hardware and the virtualised “hardware” that we see. AWS uses Xen, Azure uses a modified Hyper-V, and others use KVM. Again, we don’t have access to this layer, but a GUI or CLI layered on top. For those of us who started our IT careers managing physical machines, then adopted virtualisation, we’ll be familiar with how layer 2 allowed us to create and modify servers far quicker and easier than ever before.
Layer 3 is where we get our hands dirty. The Software Defined Data Centre(SDDC). From here, we create our cloud accounts and start building stuff. This is accessed via a web GUI, command line tools, APIs or other platforms and integrations. This is essentially a management layer, not a workload layer, in that it allows us to govern our resources, control access, manage costs, security, scale, redundancy and availability. It is here that “infrastructure as code” becomes a reality.
Layer 4. The Native Service (such as S3, Lambda, or RDS) or machine instance (such as EC2) layer. This is where we create actual workloads, store data, process information and make things happen. At this level, we could create an instance inside a VPC, set up the security groups and NACLs, and provide access to a developer or administrator via RDP, SSH, or other protocol. At this layer, humans that require access don’t need Layer 3 (SDDC) access in order to do their job. In many ways, this is the actual IaaS (Infrastructure as a Service) layer.
Layer 5. I’m not convinced this is all that different to layer 4, but it’s useful to distinguish it for the purpose of defining *who* has access. This layer is analogous to layer 7 of the OSI, that is, it’s end-user-facing, such as the front end of a web application, the interactions taking place on a mobile app, or the connectivity to IoT devices. Potentially, this is also analogous to SaaS (Software as a Service), if you consider it from the user’s perspective. Layer 5 applications exist as a function of the full stack underneath it – the physical resources in datacentres, the hypervisor, the management layer, virtual machines and services, and the code that runs on or interacts with the services.
Whether something like an OSI model for cloud becomes adopted or not, we’re beginning to transition into a new realm of terminology, and the old definitions no longer apply.
I hope you found this useful, and I’d love to hear your feedback and improvements on this model. Take a look at ISO/IEC 17788 if you’d like to read more about cloud computing terms and definitions.
Finally, if you’d like me to speak and present at your event or your business, or provide consultation and advice, please get in touch.
The three ways are one of the underlying principles of what some people call DevOps (and what other people call “doing stuff right”). Read on for a description of each approach, which when combined, will help you drive performance improvements, higher quality services, and reduce operational costs.
1. Systems thinking.
Systems thinking involves taking into account the entire flow of a system. This means that when you’re establishing requirements or designing improvements to a structure, process, or function, you don’t focus on a single silo, department, or element. This principle is reflected in the “Toyota way” and in the excellent book “The Goal” by Eliyahu M. Goldratt and Jeff Cox. By utilising systems thinking, you should never pass a defect downstream, or increase the speed of a non-bottleneck function. In order to properly utilise this principle, you need to seek to achieve a profound understanding of the complete system.
It is also necessary to avoid 100% utilisation of any role in a process; in fact it’s important to bring utilisation below 80% in order to keep wait times acceptable. See the graph below.
2. Amplification of feedback loops.
Any (good) process has feedback loops – loops that allow corrections to be made, improvements to be identified and implemented, and those improvements to be measured, checked and re-iterated. For example, in a busy restaurant kitchen, delivering meatballs and pasta, if the guy making the tomato sauce has added too much salt, it’ll be picked up by someone tasting the dish before it gets taken away by the waiter, but by then the dish is ruined. Maybe it should be picked up by the chef making the meatballs, before it’s added to the pasta? Maybe it should be picked up at hand-off between the two chefs? How about checking it before it even leaves the tomato sauce-guy’s station? By shortening the feedback loop, mistakes are found faster, rectified easier, and the impact on the whole system – and the product – is lower.
3. Continuous Improvement.
A culture of continual experimentation, improvement, taking risks and learning from failure will trump a culture of tradition and safety every time. It is only by mastering skills and taking ownership of mistakes that we can take those risks without incurring costly failures.
Repetition and practice is the key to mastery, and by considering every process as an evolutionary stage rather than a defined method, it is possible to continuously improve and adapt to even very dramatic change.
It is important to allocate time to improvement, which could be a function of the 20% “idle” time of resources if you’ve properly managed the utilisation of a role. Without allocating time to actually focus on improvement, inefficiencies and flaws will continue and amplify well beyond the “impact” of reducing utilisation of said resource.
By utilising the three ways as above, by introducing faults into systems to increase resilience, and by fostering a culture that rewards risk taking while owning mistakes, you’ll drive higher quality outcomes, higher performance, lower costs and lower stress!
For my presentation on the Three Ways, click here. Feel free to use, adapt, and feed back to me 🙂
In our service desk, where a device is reported as being slow, broken, malfunctioning, or for any other reason the user wishes to have it replaced, we first determine the age of the device. If the device is outside of the standard hardware lifecycle, it will be replaced, because the maintenance and TCO (Total Cost of Ownership) of devices older than the standard lifecycle is more costly than the replacement costs. If it’s within the life cycle, it will either be repaired, or we’ll evaluate if the user actually needs a more capable machine to carry out their role.
TCO vs age:
In very general, cumulative terms, the TCO of a device increases over time. When the annual TCO exceeds the cost of a new device, it is overdue to be replaced.
An example of a standard hardware lifecycle is:
This is standard across the IT industry, although many science/tech firms may have dramatically shorter lifecycles due to the higher workloads that devices are expected to handle.
The above lifecycle means that we will maintain a life cycle of replacing 33% of our laptops each year, 25% of our desktops, 20% of our monitors, and so on. This is the staggered approach; some firms employ the forklift approach which means replacing (e.g) the entire laptop fleet once every three years. This impacts cash flow harder, and can be more disruptive during the change, but has the advantage of delivering a perfectly uniform fleet of hardware each time. Many contact centre-style businesses employ this approach.
The only time I’ve modified this life cycle is when the company I’ve worked for has gone through cash flow difficulties, and we’ve extended the replacement period with a “promise” to pull it back in-line when cash allows. Of course, the promise is rarely fulfilled…
Q. How do you know that you could improve as a leader?
A. You’re still breathing.
Check out Jenifer Richmond and find out more about her excellent executive coaching services. I’ve been working with Jenifer for some time now, and she has helped me hugely in identifying my career goals and, through questioning and challenging, helped me to make difficult decisions and changes of direction where necessary. I really can’t recommend her enough.
Have I missed anything? I’m sure I have, so let me know by commenting.
Either ask for a review or 1-1 with your manager, or wait until the next scheduled one. I’d prefer one of my team to ask me for a chat about salaries rather than ambush me with a request, but whatever works with your company culture.
In terms of negotiating, use the following:
All university-level education should be free. Those people crying out for the good old days when fewer people went to university have got completely the wrong end of the stick.
100 years ago, the same could be said for high/secondary school – why do we need our working classes to be able to read and write, do reasonably complex maths, understand any scientific principles at all?
We live in an age where (almost) everything we do, everything we work with, play with, consume and produce are linked inextricably to very complex scientific products and concepts. Some of the people arguing here went to school before DNA was discovered, for heaven’s sake.
School children now learn about the structure and principles of DNA, particle physics, climate modelling, computing science, software development, and other stuff that didn’t exist 30 years ago.
It’s simply not the case that there’s an “ideal” percentage of the population that should have a university education. As society and technology progresses, there is simply more to know and more to understand. This has been the case since the dawn of human civilisation and will continue to be the case until civilisation ceases to be.
As a society, we owe it to ourselves to aim to provide a university (and higher, if possible) education to every person that desires it and is able to do so. The progress and survival of the human race to some degree relies upon us getting this right, not penny-pinching and making people pay for the “privilege” of developing their (and as a result, society’s) skillset and knowledge.
Just as we reap the benefits of all children going to school up to the age of sixteen, the benefits of nearly everyone in society having a higher level education wouldn’t take long to be realised, through the development of life-enhancing and preserving technologies, to more rapidly developing alternative energy sources and mitigating climate change.
There is also such a thing as knowledge for knowledge’s sake. A more educated society is a fairer, more equal, and (hopefully) happier society.
Put simply, higher education benefits all of us, not just the person being educated.