Feeds

BOFH: Unfriendly ghosts

The expense of defence

  • alert
  • submit to reddit

Application security programs and practises

Episode 33

"But why can't we visit the site?" the Boss bleats one morning when we shoot his idea of seeing the ghost facility down.

"It's a defence site," I lie. "They host defence computers as well as stuff for companies like us. They're probably not allowed to show people through their server rooms."

"We should just turn up unannounced and say there's some server problem that we have to fix urgently that can't be fixed over the network," the Boss suggests.

"That would assume (a) that we can create some legitimate sounding problem requiring a site visit, and (b) that we even knew where their site is," I counter.

"You don't know where our servers are?!" the Boss gasps.

"Of course not," the PFY says. "It's part of the contract. If we knew where our servers were, we could theoretically compromise the security of the country's distributed IT defence systems."

"Exactly what defence data is held at these sites?"

"We could tell you, but then we'd have to kill you."

"Perhaps we'll skip that bit then?"

"So we don't have to tell you?" the PFY says.

"Look," the Boss says, ignoring him. "We pay good money - no, VERY good money for this external hosting arrangement, and I'd like to know how it's being spent. I'm not paying top dollar for hosting when our critical services could be operating out of the back room of some office building! I want to see what we're paying for!"

"They don't let you visit," the PFY repeats "It's a security thing."

"Then perhaps we shouldn't pay!" the Head Beancounter responds, entering Mission Control from his lurk-point outside. "That's a financial thing!"

I realise now that this is a setup and the Boss has been committing IT treason in actively conspiring with the Beancounters to find some unmet SLA in our external hosting service contract, so as to derail the 'external hosting' gravy train of the PFY and myself...

"Maybe we can get some photos?" the PFY suggests.

"We'd want to see the facility," the Boss says.

"Both of us," the Beancounter adds.

"I'll make some calls," I say.

Half an hour later the PFY and I have a rough plan of them being hooded (for 'security reasons') at night (to 'coincide with shift changes') bundled in the back of a van and driven around local streets for half an hour before being brought up through the freight elevator to our ghost facility.

To disguise the server room a little, the PFY's going to flip all the floor tiles upside down, remove the rack doors and slap lots of anti-terrorism posters everywhere. We've also lined up a bouncer from a local pub to dress in khaki and 'act military', dropping the occasional bit of IT patter. To complete the picture we've asked the Boss and Beancounter to supply scans of their passports 'for ID verification and validation purposes'.

. . .

A day later and the Boss and Beancounter are ushered out of the freight elevator looking slightly dishevelled - thanks to the PFY's high speed negotiation of a couple of the city's parks.

"So this is it then?" the Beancounter asks angrily. "All that money for this?"

"State of the art facility, this," our bouncer says.

"It's no better or worse than we have in our own building!" the Boss snaps.

"It may as well be our building," the Beancounter fumes. "We're being ripped off!"

I'm wondering if the PFY can hear any of this, watching us - as he is - from the CCTV monitor beside the Halon release in the next room...

"And we pay all that money for THIS?" the Boss snarls as our security guard departs 'to do his rounds'.

"It's a state of the art room with redundant UPS, Environme-"

"I don't care if it's got state of the art bloody environmental monitoring with round the clock surveillance..."

"Actually, it has," I murmur.

"...we're being ripped off! This is never a defence facility! I worked in defence and they'd never use this sort of equipment."

"I think..."

"There's no log book!" the Boss says triumphantly.

"Pardon?"

"There's no log book - we didn't sign in and out - I'm sure that's part of the contract!" the Boss says triumphantly.

"They got photocopies of your passports."

"Yes, but we didn't sign in and out - it says they'll do that, in the contract!" the Beancounter says happily.

"So you're going to void the contract over a technicality?" I ask, rubbing my jaw thoughtfully.

"YOU BET!" the Boss says.

"And we'll go back to hosting it ourselves?"

"Hell no!" the Beancounter says. "The current on site facility cost us a fortune - there's no way we're going to expand it to house these servers! No, we've found an excellent hosting place in Luton which is dirt cheap."

"You're going host our servers in Luton?" I ask, looking at the CCTV camera, thinking about that scene at the end of Wag the Dog.

"Yes. Only it's cheaper if we provide the technical support - so one of you's going to have to be relocated to Luton."

"Luton?! Yes. Yes, I'm sure we can work something out," I say, creaking the door open. "I'll just let the security guy know we'll be leaving..."

*Nod*

>Slam<

HISSSSSSSSSSSSSSSSSSSSSSSSSSSSS

Bridging the IT gap between rising business demands and ageing tools

More from The Register

next story
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Attack of the clones: Oracle's latest Red Hat Linux lookalike arrives
Oracle's Linux boss says Larry's Linux isn't just for Oracle apps anymore
THUD! WD plonks down SIX TERABYTE 'consumer NAS' fatboy
Now that's a LOT of porn or pirated movies. Or, you know, other consumer stuff
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
EU's top data cops to meet Google, Microsoft et al over 'right to be forgotten'
Plan to hammer out 'coherent' guidelines. Good luck chaps!
US judge: YES, cops or feds so can slurp an ENTIRE Gmail account
Crooks don't have folders labelled 'drug records', opines NY beak
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.