Archive for the 'General Technology' Category

Sample chapter from “Don’t Make Me Think” - Web Usability!

Tuesday, July 22nd, 2008

Chapter 2
How we really use the Web

Why are things always in the last place you look for them?
Because you stop looking when you find them.
  —Children’s riddle

In the past five years I’ve spent a lot of time watching people use the Web, and the thing that has struck me most is the difference between how we think people use Web sites and how they actually use them.
When we’re creating sites, we act as though people are going to pore over each page, reading our finely crafted text, figuring out how we’ve organized things, and weighing their options before deciding which link to click.
What they actually do most of the time (if we’re lucky) is glance at each new page, scan some of the text, and click on the first link that catches their interest or vaguely resembles the thing they’re looking for. There are usually large parts of the page that they don’t even look at.
We’re thinking “great literature” (or at least “product brochure”), while the user’s reality is much closer to “billboard going by at 60 miles an hour.”
What we design for vs. The reality
As you might imagine, it’s a little more complicated than this, and it depends on the kind of page, what the user is trying to do, how much of a hurry she’s in, and so on. But this simplistic view is much closer to reality than most of us imagine.
It makes sense that we picture a more rational, attentive user when we’re designing pages. It’s only natural to assume that everyone uses the Web the same way we do, and—like everyone else—we tend to think that our own behavior is much more orderly and sensible than it really is.
If you want to design effective Web pages, though, you have to learn to live with three facts about real-world Web use.

Fact of life #1:
We don’t read pages. We scan them.
One of the very few well-documented facts about Web use is that people tend to spend very little time reading most Web pages.1  Instead, we scan (or skim) them, looking for words or phrases that catch our eye.
The exception, of course, is pages that contain documents like news stories, reports, or product descriptions. But even then, if the document is longer than a few paragraphs, we’re likely to print it out—since it’s easier and faster to read on paper than on a screen.
Why do we scan?

  • We’re usually in a hurry. Much of our Web use is motivated by the desire to save time. As a result, Web users tend to act like sharks: they have to keep moving, or they’ll die. We just don’t have the time to read any more than necessary.
  • We know we don’t need to read everything. On most pages, we’re really only interested in a fraction of what’s on the page. We’re just looking for the bits that match our interests or the task at hand, and the rest of it is irrelevant. Scanning is how we find the relevant bits.
  • We’re good at it. We’ve been scanning newspapers, magazines, and books all our lives to find the parts we’re interested in, and we know that it works.

The net effect is a lot like Gary Larson’s classic Far Side cartoon about the difference between what we say to dogs and what they hear. In the cartoon, the dog (named Ginger) appears to be listening intently as her owner gives her a serious talking-to about staying out of the garbage. But from the dog’s point of view, all he’s saying is “blah blah GINGER blah blah blah blah GINGER blah blah blah.”
What we see when we look at a Web page depends on what we have in mind, but it’s usually just a fraction of what’s on the page.
What designers build vs. What users see
Like Ginger, we tend to focus on words and phrases that seem to match (a) the task at hand or (b) our current or ongoing personal interests. And of course, (c) the trigger words that are hardwired into our nervous systems, like “Free,” “Sale,” and “Sex.”

Fact of life #2:
We don’t make optimal choices.
We satisfice.
When we’re designing pages, we tend to assume that users will scan the page, consider all of the available options, and choose the best one.
In reality, though, most of the time we don’t choose the best option—we choose the first reasonable option, a strategy known as satisficing.2  As soon as we find a link that seems like it might lead to what we’re looking for, there’s a very good chance that we’ll click it.
I’d observed this behavior for years, but its significance wasn’t really clear to me until I read Gary Klein’s book, Sources of Power: How People Make Decisions.3  Klein has spent fifteen years studying naturalistic decision making: how people like fire fighters, pilots, chess masters, and nuclear power plant operators make high-stakes decisions in real settings, with time pressure, vague goals, limited information, and changing conditions.
Klein’s team of observers went into their first study (of field commanders at fire scenes) with the generally accepted model of rational decision making: faced with a problem, a person gathers information, identifies the possible solutions, and chooses the best one. They started with the hypothesis that because of the high stakes and extreme time pressure, fire captains would be able to compare only two options, an assumption they thought was conservative. As it turned out, the fire commanders didn’t compare any options. They took the first reasonable plan that came to mind and did a quick mental test for problems. If they didn’t find any, they had their plan of action.
So why don’t Web users look for the best choice?

  • We’re usually in a hurry. And as Klein points out “Optimizing is hard, and it takes a long time. Satisficing is more efficient.”
  • There’s not much of a penalty for guessing wrong. Unlike the firefighters, the penalty for guessing wrong on a Web site is usually only a click or two of the Back button, making satisficing an effective strategy. Of course, this assumes that pages load quickly; when they don’t, we have to make our choices more carefully—just one of the many reasons why most Web users don’t like slow-loading pages.
  • Weighing options may not improve our chances. On poorly designed sites, putting effort into making the best choice doesn’t really help. You’re usually better off going with your first guess and using the Back button if it doesn’t work out.
  • Guessing is more fun. It’s less work than weighing options, and if you guess right, it’s faster. And it introduces an element of chance—the pleasant possibility of running into something surprising and good.

Of course, this is not to say that users never weigh options before they click. It depends on things like their frame of mind, how pressed they are for time, and how much confidence they have in the site.

Fact of life #3:
We don’t figure out how things work.
We muddle through.
One of the things that becomes obvious as soon as you do any usability testing—whether you’re testing Web sites, software, or household appliances—is the extent to which people use things all the time without understanding how they work, or with completely wrong-headed ideas about how they work.
Faced with any sort of technology, very few people take the time to read instructions. Instead, we forge ahead and muddle through, making up our own vaguely plausible stories about what we’re doing and why it works.
It often reminds me of the scene at the end of The Prince and the Pauper where the real prince discovers that the look-alike pauper has been using the Great Seal of England as a nutcracker in his absence. (It makes perfect sense—to him, the seal is just this great big, heavy chunk of metal.)
And the fact is, we get things done that way. I’ve seen lots of people use software and Web sites effectively in ways that are nothing like what the designers intended.
My favorite example is the people (and I’ve seen dozens of them myself) who will type a site’s entire URL in the Yahoo search box every time they want to go to there—not just to find the site for the first time, but every time they want to go there, sometimes several times a day. If you ask them about it, it becomes clear that some of them think that Yahoo is the Internet, and that this is the way you use it.4
Users type URLs in Yahoo's search box
And muddling through is not limited to beginners. Even technically savvy users often have surprising gaps in their understanding of how things work. (I wouldn’t be surprised if even Bill Gates has some bits of technology in his life that he uses by muddling through.)
Why does this happen?

  • It’s not important to us. For most of us, it doesn’t matter to us whether we understand how things work, as long as we can use them. It’s not for lack of intelligence, but for lack of caring. In the great scheme of things, it’s just not important to us.5
  • If we find something that works, we stick to it. Once we find something that works—no matter how badly—we tend not to look for a better way. We’ll use a better way if we stumble across one, but we seldom look for one.

It’s always interesting to watch Web designers and developers observe their first usability test. The first time they see a user click on something completely inappropriate, they’re surprised. (For instance, when the user ignores a nice big fat “Software” button in the navigation bar, saying something like, “Well, I’m looking for software, so I guess I’d click here on ‘Cheap Stuff’ because cheap is always good.”) The user may even find what he’s looking for eventually, but by then the people watching don’t know whether to be happy or not.
The second time it happens, they’re yelling “Just click on ‘Software’!” The third time, you can see them thinking: “Why are we even bothering?”
And it’s a good question: if people manage to muddle through so much, does it really matter whether they “get it”? The answer is that it matters a great deal because while muddling through may work sometimes, it tends to be inefficient and error prone. On the other hand, if users “get it,”

  • There’s a much better chance that they’ll find what they’re looking for, which is good for them and for you.
  • There’s a better chance that they’ll understand the full range of what your site has to offer—not just the parts that they stumble across.
  • You have a better chance of steering them to the parts of your site that you want them to see.
  • They’ll feel smarter and more in control when they’re using your site, which will bring them back. You can only get away with a site that people muddle through until someone builds one down the street that makes them feel smart.

If life gives you lemons…
By now you may be thinking (given this less than rosy picture of the Web audience), “Why don’t I just get a job at the local 7-11? At least my efforts might be appreciated.”
So, what’s a girl to do?
The answer: if your audience is going to act like you’re designing billboards, then design great billboards.
[The next chapter is Billboard Design 101]

1 See Jakob Nielsen’s October 1997 Alertbox column, “How Users Read on the Web” available at www.useit.com.  BACK
2 Economist Herbert Simon coined the term (a cross between satisfying and sufficing) in Models of Man: Social and Rational (Wiley, 1957).  BACK
3 The MIT Press, 1998.  BACK
4 In the same vein, I’ve encountered many AOL users who clearly think that AOL is the Internet. Good news for Yahoo and AOL.  BACK
5 Web developers often have a particularly hard time understanding—or even believing—that people might feel this way, since they themselves are usually keenly interested in how things work.  BACK
Excerpted from Don’t Make Me Think! A Common Sense Approach to Web Usability
A Circle.com Library book, published by New Riders
© 1997-2005  Steve Krug

Posted in General Technology | No Comments »

The Six Dumbest Ideas in Computer Security

Sunday, February 24th, 2008

There’s lots of innovation going on in security - we’re inundated with a steady stream of new stuff and it all sounds like it works just great. Every couple of months I’m invited to a new computer security conference, or I’m asked to write a foreword for a new computer security book. And, thanks to the fact that it’s a topic of public concern and a “safe issue” for politicians, we can expect a flood of computer security-related legislation from lawmakers. So: computer security is definitely still a “hot topic.” But why are we spending all this time and money and still having problems?

Let me introduce you to the six dumbest ideas in computer security. What are they? They’re the anti-good ideas. They’re the braindamage that makes your $100,000 ASIC-based turbo-stateful packet-mulching firewall transparent to hackers. Where do anti-good ideas come from? They come from misguided attempts to do the impossible - which is another way of saying “trying to ignore reality.” Frequently those misguided attempts are sincere efforts by well-meaning people or companies who just don’t fully understand the situation, but other times it’s just a bunch of savvy entrepreneurs with a well-marketed piece of junk they’re selling to make a fast buck. In either case, these dumb ideas are the fundamental reason(s) why all that money you spend on information security is going to be wasted, unless you somehow manage to avoid them.

For your convenience, I’ve listed the dumb ideas in descending order from the most-frequently-seen. If you can avoid falling into the the trap of the first three, you’re among the few true computer security elite.

#1) Default Permit

This dumb idea crops up in a lot of different forms; it’s incredibly persistent and difficult to eradicate. Why? Because it’s so attractive. Systems based on “Default Permit” are the computer security equivalent of empty calories: tasty, yet fattening.

The most recognizable form in which the “Default Permit” dumb idea manifests itself is in firewall rules. Back in the very early days of computer security, network managers would set up an internet connection and decide to secure it by turning off incoming telnet, incoming rlogin, and incoming FTP. Everything else was allowed through, hence the name “Default Permit.” This put the security practitioner in an endless arms-race with the hackers. Suppose a new vulnerability is found in a service that is not blocked - now the administrators need to decide whether to deny it or not, hopefully, before they got hacked. A lot of organizations adopted “Default Permit” in the early 1990’s and convinced themselves it was OK because “hackers will never bother to come after us.” The 1990’s, with the advent of worms, should have killed off “Default Permit” forever but it didn’t. In fact, most networks today are still built around the notion of an open core with no segmentation. That’s “Default Permit.”

Another place where “Default Permit” crops up is in how we typically approach code execution on our systems. The default is to permit anything on your machine to execute if you click on it, unless its execution is denied by something like an antivirus program or a spyware blocker. If you think about that for a few seconds, you’ll realize what a dumb idea that is. On my computer here I run about 15 different applications on a regular basis. There are probably another 20 or 30 installed that I use every couple of months or so. I still don’t understand why operating systems are so dumb that they let any old virus or piece of spyware execute without even asking me. That’s “Default Permit.”

A few years ago I worked on analyzing a website’s security posture as part of an E-banking security project. The website had a load-balancer in front of it, that was capable of re-vectoring traffic by URL, and my client wanted to use the load-balancer to deflect worms and hackers by re-vectoring attacks to a black hole address. Re-vectoring attacks would have meant adopting a policy of “Default Permit” (i.e.: if it’s not a known attack, let it through) but instead I talked them into adopting the opposite approach. The load-balancer was configured to re-vector any traffic not matching a complete list of correctly-structured URLs to a server that serves up image data and 404 pages, which is running a special locked-down configuration. Not surprisingly, that site has withstood the test of time quite well.

One clear symptom that you’ve got a case of “Default Permit” is when you find yourself in an arms race with the hackers. It means that you’ve put yourself in a situation where what you don’t know can hurt you, and you’ll be doomed to playing keep ahead/catch-up.

The opposite of “Default Permit” is “Default Deny” and it is a really good idea. It takes dedication, thought, and understanding to implement a “Default Deny” policy, which is why it is so seldom done. It’s not that much harder to do than “Default Permit” but you’ll sleep much better at night.

#2) Enumerating Badness

Back in the early days of computer security, there were only a relatively small number of well-known security holes. That had a lot to do with the widespread adoption of “Default Permit” because, when there were only 15 well-known ways to hack into a network, it was possible to individually examine and think about those 15 attack vectors and block them. So security practitioners got into the habit of “Enumerating Badness” - listing all the bad things that we know about. Once you list all the badness, then you can put things in place to detect it, or block it.

Figure 1: The “Badness Gap”
 The badness gap

Why is “Enumerating Badness” a dumb idea? It’s a dumb idea because sometime around 1992 the amount of Badness in the Internet began to vastly outweigh the amount of Goodness. For every harmless, legitimate, application, there are dozens or hundreds of pieces of malware, worm tests, exploits, or viral code. Examine a typical antivirus package and you’ll see it knows about 75,000+ viruses that might infect your machine. Compare that to the legitimate 30 or so apps that I’ve installed on my machine, and you can see it’s rather dumb to try to track 75,000 pieces of Badness when even a simpleton could track 30 pieces of Goodness. In fact, if I were to simply track the 30 pieces of Goodness on my machine, and allow nothing else to run, I would have simultaneously solved the following problems:

  • Spyware
  • Viruses
  • Remote Control Trojans
  • Exploits that involve executing pre-installed code that you don’t use regularly

Thanks to all the marketing hype around disclosing and announcing vulnerabilities, there are (according to some industry analysts) between 200 and 700 new pieces of Badness hitting the Internet every month. Not only is “Enumerating Badness” a dumb idea, it’s gotten dumber during the few minutes of your time you’ve bequeathed me by reading this article.

Now, your typical IT executive, when I discuss this concept with him or her, will stand up and say something like, “That sounds great, but our enterprise network is really complicated. Knowing about all the different apps that we rely on would be impossible! What you’re saying sounds reasonable until you think about it and realize how absurd it is!” To which I respond, “How can you call yourself a ‘Chief Technology Officer’ if you have no idea what your technology is doing?” A CTO isn’t going to know detail about every application on the network, but if you haven’t got a vague idea what’s going on it’s impossible to do capacity planning, disaster planning, security planning, or virtually any of the things in a CTO’s charter.

In 1994 I wrote a firewall product that needed some system log analysis routines that would alert the administrator in case some kind of unexpected condition was detected. The first version used “Enumerating Badness” (I’ve been dumb, too) but the second version used what I termed “Artificial Ignorance” - a process whereby you throw away the log entries you know aren’t interesting. If there’s anything left after you’ve thrown away the stuff you know isn’t interesting, then the leftovers must be interesting. This approach worked amazingly well, and detected a number of very interesting operational conditions and errors that it simply never would have occurred to me to look for.

“Enumerating Badness” is the idea behind a huge number of security products and systems, from anti-virus to intrusion detection, intrusion prevention, application security, and “deep packet inspection” firewalls. What these programs and devices do is outsource your process of knowing what’s good. Instead of you taking the time to list the 30 or so legitimate things you need to do, it’s easier to pay $29.95/year to someone else who will try to maintain an exhaustive list of all the evil in the world. Except, unfortunately, your badness expert will get $29.95/year for the antivirus list, another $29.95/year for the spyware list, and you’ll buy a $19.95 “personal firewall” that has application control for network applications. By the time you’re done paying other people to enumerate all the malware your system could come in contact with, you’ll more than double the cost of your “inexpensive” desktop operating system.

One clear symptom that you have a case of “Enumerating Badness” is that you’ve got a system or software that needs signature updates on a regular basis, or a system that lets past a new worm that it hasn’t seen before. The cure for “Enumerating Badness” is, of course, “Enumerating Goodness.” Amazingly, there is virtually no support in operating systems for such software-level controls. I’ve tried using Windows XP Pro’s Program Execution Control but it’s oriented toward “Enumerating Badness” and is, itself a dumb implementation of a dumb idea.

In a sense, “Enumerating Badness” is a special dumb-case of “Default Permit” - our #1 dumb computer security idea. But it’s so prevalent that it’s in a class by itself.

#3) Penetrate and Patch

There’s an old saying, “You cannot make a silk purse out of a sow’s ear.” It’s pretty much true, unless you wind up using so much silk to patch the sow’s ear that eventually the sow’s ear is completely replaced with silk. Unfortunately, when buggy software is fixed it is almost always fixed through the addition of new code, rather than the removal of old bits of sow’s ear.

“Penetrate and Patch” is a dumb idea best expressed in the BASIC programming language:

10 GOSUB LOOK_FOR_HOLES
20 IF HOLE_FOUND = FALSE THEN GOTO 50
30 GOSUB FIX_HOLE
40 GOTO 10
50 GOSUB CONGRATULATE_SELF
60 GOSUB GET_HACKED_EVENTUALLY_ANYWAY
70 GOTO 10

In other words, you attack your firewall/software/website/whatever from the outside, identify a flaw in it, fix the flaw, and then go back to looking. One of my programmer buddies refers to this process as “turd polishing” because, as he says, it doesn’t make your code any less smelly in the long run but management might enjoy its improved, shiny, appearance in the short term. In other words, the problem with “Penetrate and Patch” is not that it makes your code/implementation/system better by design, rather it merely makes it toughened by trial and error. Richard Feynman’s “Personal Observations on the Reliability of the Space Shuttle” used to be required reading for the software engineers that I hired. It contains some profound thoughts on expectation of reliability and how it is achieved in complex systems. In a nutshell its meaning to programmers is: “Unless your system was supposed to be hackable then it shouldn’t be hackable.”

“Penetrate and Patch” crops up all over the place, and is the primary dumb idea behind the current fad (which has been going on for about 10 years) of vulnerability disclosure and patch updates. The premise of the “vulnerability researchers” is that they are helping the community by finding holes in software and getting them fixed before the hackers find them and exploit them. The premise of the vendors is that they are doing the right thing by pushing out patches to fix the bugs before the hackers and worm-writers can act upon them. Both parties, in this scenario, are being dumb because if the vendors were writing code that had been designed to be secure and reliable then vulnerability discovery would be a tedious and unrewarding game, indeed!

Let me put it to you in different terms: if “Penetrate and Patch” was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years? If you look at major internet applications you’ll find that there are a number that consistently have problems with security vulnerabilities. There are also a handful, like PostFix, Qmail, etc, that were engineered to be compartmented against themselves, with modularized permissions and processing, and - not surprisingly - they have histories of amazingly few bugs. The same logic applies to “penetration testing.” There are networks that I know of which have been “penetration tested” any number of times and are continually getting hacked to pieces. That’s because their design (or their security practices) are so fundamentally flawed that no amount of turd polish is going to keep the hackers out. It just keeps managers and auditors off of the network administrator’s backs. I know other networks that it is, literally, pointless to “penetration test” because they were designed from the ground up to be permeable only in certain directions and only to certain traffic destined to carefully configured servers running carefully secured software. Running a “penetration test” for Apache bugs is completely pointless against a server that is running a custom piece of C code that is running in a locked-down portion of an embedded system. So, “Penetrate and Patch” is pointless either because you know you’re going to find an endless litany of bugs, or because you know you’re not going to find anything comprehensible. Pointless is dumb.

One clear symptom that you’ve got a case of “Penetrate and Patch ” is when you find that your system is always vulnerable to the “bug of the week.” It means that you’ve put yourself in a situation where every time the hackers invent a new weapon, it works against you. Doesn’t that sound dumb? Your software and systems should be secure by design and should have been designed with flaw-handling in mind.

#4) Hacking is Cool

One of the best ways to get rid of cockroaches in your kitchen is to scatter bread-crumbs under the stove, right? Wrong! That’s a dumb idea. One of the best ways to discourage hacking on the Internet is to give the hackers stock options, buy the books they write about their exploits, take classes on “extreme hacking kung fu” and pay them tens of thousands of dollars to do “penetration tests” against your systems, right? Wrong! “Hacking is Cool” is a really dumb idea.

Around the time I was learning to walk, Donn Parker was researching the behavioral aspects of hacking and computer security. He says it better than I ever could:
“Remote computing freed criminals from the historic requirement of proximity to their crimes. Anonymity and freedom from personal victim confrontation increased the emotional ease of crime, i.e., the victim was only an inanimate computer, not a real person or enterprise. Timid people could become criminals. The proliferation of identical systems and means of use and the automation of business made possible and improved the economics of automating crimes and constructing powerful criminal tools and scripts with great leverage.”

Hidden in Parker’s observation is the awareness that hacking is a social problem. It’s not a technology problem, at all. “Timid people could become criminals.” The Internet has given a whole new form of elbow-room to the badly socialized borderline personality. The #4th dumbest thing information security practitioners can do is implicitly encourage hackers by lionizing them. The media plays directly into this, by portraying hackers, variously, as “whiz kids” and “brilliant technologists” - of course if you’re a reporter for CNN, anyone who can install Linux probably does qualify as a “brilliant technologist” to you. I find it interesting to compare societal reactions to hackers as “whiz kids” versus spammers as “sleazy con artists.” I’m actually heartened to see that the spammers, phishers, and other scammers are adopting the hackers and the techniques of the hackers - this will do more to reverse society’s view of hacking than any other thing we could do.

If you’re a security practitioner, teaching yourself how to hack is also part of the “Hacking is Cool” dumb idea. Think about it for a couple of minutes: teaching yourself a bunch of exploits and how to use them means you’re investing your time in learning a bunch of tools and techniques that are going to go stale as soon as everyone has patched that particular hole. It means you’ve made part of your professional skill-set dependent on “Penetrate and Patch” and you’re going to have to be part of the arms-race if you want that skill-set to remain relevant and up-to-date. Wouldn’t it be more sensible to learn how to design security systems that are hack-proof than to learn how to identify security systems that are dumb?

My prediction is that the “Hacking is Cool” dumb idea will be a dead idea in the next 10 years. I’d like to fantasize that it will be replaced with its opposite idea, “Good Engineering is Cool” but so far there is no sign that’s likely to happen.

#5) Educating Users

“Penetrate and Patch” can be applied to human beings, as well as software, in the form of user education. On the surface of things, the idea of “Educating Users” seems less than dumb: education is always good. On the other hand, like “Penetrate and Patch” if it was going to work, it would have worked by now. There have been numerous interesting studies that indicate that a significant percentage of users will trade their password for a candy bar, and the Anna Kournikova worm showed us that nearly 1/2 of humanity will click on anything purporting to contain nude pictures of semi-famous females. If “Educating Users” is the strategy you plan to embark upon, you should expect to have to “patch” your users every week. That’s dumb.

The real question to ask is not “can we educate our users to be better at security?” it is “why do we need to educate our users at all?” In a sense, this is another special case of “Default Permit” - why are users getting executable attachments at all? Why are users expecting to get E-mails from banks where they don’t have accounts? Most of the problems that are addressable through user education are self-correcting over time. As a younger generation of workers moves into the workforce, they will come pre-installed with a healthy skepticism about phishing and social engineering.

Dealing with things like attachments and phishing is another case of “Default Permit” - our favorite dumb idea. After all, if you’re letting all of your users get attachments in their E-mail you’re “Default Permit”ing anything that gets sent to them. A better idea might be to simply quarantine all attachments as they come into the enterprise, delete all the executables outright, and store the few file types you decide are acceptable on a staging server where users can log in with an SSL-enabled browser (requiring a password will quash a lot of worm propagation mechanisms right away) and pull them down. There are freeware tools like MIMEDefang that can be easily harnessed to strip attachments from incoming E-mails, write them to a per-user directory, and replace the attachment in the E-mail message with a URL to the stripped attachment. Why educate your users how to cope with a problem if you can just drive a stake through the problem’s heart?

When I was CEO of a small computer security start-up we didn’t have a Windows system administrator. All of the employees who wanted to run Windows had to know how to install it and manage it themselves, or they didn’t get hired in the first place. My prediction is that in 10 years users that need education will be out of the high-tech workforce entirely, or will be self-training at home in order to stay competitive in the job market. My guess is that this will extend to knowing not to open weird attachments from strangers.

#6) Action is Better Than Inaction

IT executives seem to break down into two categories: the “early adopters” and the “pause and thinkers.” Over the course of my career, I’ve noticed that dramatically fewer of the “early adopters” build successful, secure, mission-critical systems. This is because they somehow believe that “Action is Better Than Inaction” - i.e.: if there’s a new whizzbang, it’s better to install it right now than to wait, think about it, watch what happens to the other early adopters, and then deploy the technology once it’s fully sorted-out and has had its first generation of experienced users. I know one senior IT executive - one of the “pause and thinkers” whose plan for doing a wireless roll-out for their corporate network was “wait 2 years and hire a guy who did a successful wireless deployment for a company larger than us.” Not only will the technology be more sorted-out by then, it’ll be much, much cheaper. What an utterly brilliant strategy!

There’s an important corollary to the “Action is Better Than Inaction” dumb idea, and it’s that:
“It is often easier to not do something dumb than it is to do something smart.”
Sun Tzu didn’t really write that in “The Art of War” but if you tell IT executives that he did, they’ll take you much more seriously when you counsel a judicious, thoughtful approach to fielding some new whizzbang. To many of my clients, I have been counselling, “hold off on outsourcing your security for a year or two and then get recommendations and opinions from the bloody, battered survivors - if there are any.”

You can see the “Action is Better Than Inaction” dumb idea all over corporate networks and it tends to correlate with senior IT managers that make their product-purchasing decisions by reading Gartner research reports and product glossies from vendors. If you find yourself in the chain of command of such a manager, I sincerely hope you’ve enjoyed this article because you’re probably far better acquainted with dumbness than I am.

One extremely useful piece of management kung-fu to remember, if you find yourself up against an “early adopter” is to rely on your peers. Several years ago I had a client who was preparing to spend a ton of money on a technology without testing it operationally. I suggested offhandedly to the senior IT manager in charge that he should send one of his team to a relevant conference (in this case, LISA) where it was likely that someone with hands-on experience with the technology would be in attendance. I proposed that the manager have his employee put a message on the “meet and greet” bulletin board that read:
“Do you have hands-on experience with xyz from pdq.com? If so, I’m authorized to take you to dinner at Ruth’s Chris if you promise to give me the low-down on the product off the record. Contact, etc…” The IT manager later told me that a $200 dinner expense saved them over $400,000 worth of hellish technological trauma.

It really is easier to not do something dumb than it is to do something smart. The trick is, when you avoid doing something dumb, to make sure your superiors know you navigated around a particularly nasty sand-bar and that you get appropriate credit for being smart. Isn’t that the ultimate expression of professional kung-fu? To get credit for not doing anything?!

The Minor Dumbs

These dumb ideas didn’t quite merit status as “The Dumbest” ideas in computer security, but they’re pretty dumb and deserve mention in passing:

  • “We’re Not a Target” - yes, you are. Worms aren’t smart enough to realize that your web site/home network isn’t interesting.
  • “Everyone would be secure if they all just ran ” - no, they wouldn’t. Operating systems have security problems because they are complex and system administration is not a solved problem in computing. Until someone manages to solve system administration, switching to the flavor-of-the-month is going to be more damaging because you’re making it harder for your system administrators to gain a level of expertise that only comes with time.
  • “We don’t need a firewall, we have good host security” - no, you don’t. If your network fabric is untrustworthy every single application that goes across the network is potentially a target. 3 words: Domain Naming System.
  • “We don’t need host security, we have a good firewall” - no, you don’t. If your firewall lets traffic through to hosts behind it, then you need to worry about the host security of those systems.
  • “Let’s go production with it now and we can secure it later” - no, you won’t. A better question to ask yourself is “If we don’t have time to do it correctly now, will we have time to do it over once it’s broken?” Sometimes, building a system that is in constant need of repair means you will spend years investing in turd polish because you were unwilling to spend days getting the job done right in the first place.
  • “We can’t stop the occasional problem” - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn’t think so.

Goodbye and Good Luck

I’ve tried to keep this light-hearted, but my message is serious. Computer security is a field that has fallen far too deeply in love with the whizzbang-of-the-week and has forsaken common sense. Your job, as a security practitioner, is to question - if not outright challenge - the conventional wisdom and the status quo. After all, if the conventional wisdom was working, the rate of systems being compromised would be going down, wouldn’t it?

taken from http://www.ranum.com/security/computer_security/editorials/dumb/

Posted in Miscellaneous, General Technology | Comments Off

Website Security

Monday, January 21st, 2008

I recently had a discussion with a business owner who, no matter how I reasurred her, refused to give her clients the option of online payment.  She said it wasn’t safe.  This is a concern for not just the baby boomer generation, but is a worry that has seeped through to even some high school students who believe their unsecure cell phone texting is more secure than online transactions. 

According to a recent study paying online is actually safer than by phone.  Phone payment can be a concern because you rely on people instead of computers to take down your information and use it appropriately.  Identity theft is also a hot button when talking about paying online.  The truth is that there is more identity theft person to person when someone overhears you giving your social security number or scanning your driver’s license.  Often times the reason people run into trouble with online payment is that they don’t follow a few simple internet rules.  The following is a list of great guidelines to follow:

  • Never respond to e-mail messages from third-party payment services asking you to confirm account details, such as passwords or other personal information. 
  • If you need to update your account information, visit the website and login.
  • Check if the seller has been a verified member of the payment service for a few months or more.
  • never use your account to transfer money for someone you don’t know. Always go through a website payment option.  (This is a good tip when using Ebay or Amazon).
  • Be careful when you purchase more expensive items such as jewelry (it doesn’t hurt to get a site recommendation for retail items from a friend or site ratings).

By being smart about your personal information, you can easily keep all of your private information private.  Jaymunda is an official Authorize.net reseller.  All of our clients have the option of adding this secure payment feature, many for less than the annual cost of a Paypal account.   If you are not a client and are interested in learning more, you can contact us through our website at www.jaymunda.com  

Posted in Miscellaneous, General Technology | Comments Off

Programming Notes: The Importance Of Hand Coding

Thursday, December 20th, 2007

Let’s be honest. Most people do not go into website design because they enjoy writing code, or because they want to root through hundreds of lines of seemingly non-sensical expressions. That comes later. Most people start with a visual idea and work from there, usually taking advantage of applications like Dreamweaver or GoLive to help them avoid writing code. While great for the beginner and available to the masses, it’s important for developers to ween themselves off these tools as soon as possible. Read the full article…

Posted in Miscellaneous, General Technology | No Comments »

An Asheville Web Design Success Story

Monday, September 24th, 2007
The Integration of Marketing Strategies, Advertising Campaigns, Administrative Operations and Web Technologies into Your Web Site


Here at Jaymunda Web Design we employ technical and marketing professionals to develop web sites created to serve your company on many different levels.  We will work with you to draft an Internet marketing and web site design plan with your goals in mind.  Our web sites produce:

-Increased efficiency
-Streamlined and better organized administrative operations
-Improved communications with customers and staff
-Increased profits
-ROI on marketing and advertising campaigns that can be tracked with web technology“Our goal is to introduce online automation tools and features to organizations through web technology.  This introduction is guaranteed to save them precious time and money,” states Syzdek. “After all, humans weren’t born to do data entry. We want to help organizations keep up with the changing times and leave the monotony to the computer” he continues, ”Technology can assist with time management, cost effectiveness, customer communications and marketing.”

“Our goal is to introduce online automation tools and features to organizations through web technology.  This introduction is guaranteed to save them precious time and money,” states Syzdek. “After all, humans weren’t born to do data entry. We want to help organizations keep up with the changing times and leave the monotony to the computer” he continues, ”Technology can assist with time management, cost effectiveness, customer communications and marketing.”


The Statistics Are In! Jaymunda Helps Episcopal Diocese of WNC Cut Postage and Printing Budget

In June of 2007 Jaymunda Web Design in Asheville, NC launched the newly redesigned Episcopal Diocese of Western North Carolina web site, http://www.diocesewnc.org. In two months the web site statistics have already proven the site’s potential for high performance.  “Our web site traffic has tripled since the launch,” says Alice Keenan, receptionist and web editor, “and the site will cut the cost of yearly postage for us by an estimated 40%.  A great example of this is the Dioscean Journal.  Previously we have printed and mailed 450 journals, now this is posted online and we only print and mail about 40 journals.” “Our office manages over 60 churches,” Keenan continues, “mailings we used to send once or twice a week are now posted online as well.”


Jaymunda = High Performance Web Design from Asheville to Atlanta


According to web statistics provided by Jaymunda http://www.diocesewnc.org has gone from 122,997 hits during June, 2007 to 138,077 hits in August, 2007.  The number of unique visitors has increased from 1,799 in June, 2007 to 2,888 in August, 2007.  Between June and August the site’s unique visitors increased by 1,089 and the number of hits by 15,080.  In addition to increased traffic the Diocese of Western North Carolina web site has marketing, advertising and administrative functions in the form of interactive features, including areas for church members and clergy. “One of the most popular features is the interactive calendar, “says Keenan, “Visitors can find event information, registration forms, and directions. Paypal is available for payment of event fees.”  “We have been able to post a lot of previously printed information on the web site, which makes it accessible to everyone and saves time and money,” she continues.

Posted in Miscellaneous, Marketing, General Technology | No Comments »

Programming vs. Marketing: How Web Site Design and Development Can Increase Sales and Profit

Tuesday, July 31st, 2007

In 2007 most professionals and companies know they “have to have a web site”, but many businesses don’t know WHY.  In order to receive the maximum return from your investment in a web site, it is essential that you work with a web design and development firm that employs marketing experts.  These web and Internet marketers will help you use technology so you and your customers achieve the ultimate goal: the sale!  If you were going to open a store there would be specific steps you would take to prepare and plan from a marketing standpoint.  First you must study data that profiles customers’ shopping and buying habits.  Then you can complete market research to identify what is hot and what is driving consumers.  Next you would hire architects and store planners to develop displays and map out traffic patterns.  Finally, skilled people would execute these design instructions.  Now you can open a store that is ready to serve your customers in the best way. Building a web site that serves your marketing needs and helps you achieve your sales goals is similar to opening a store.

The Phases of Web Design and Development

At Jaymunda we believe web site design is a process.  If you skip integral parts of this process your web site will not perform the way you imagined.  Our process consists of three distinct design and development phases.  Each phase has been created to support and accomplish your Internet marketing goals.

Phase 1: Discovery
This phase includes identifying web site design and development objectives, market research and analysis, completion of a site layout and generation of a strong and focused web site design and development plan.

Phase 2: Construction and Development
Phase two includes web site domain registration, a hosting plan, installation of the Internet framework, web site content development, custom web site programming, web site demos, testing and debugging and preparation for search engine optimization and marketing.

Phase 3: Launch Sequence
The third phase of web site design and development includes programming reviews, final client approvals, web site training for clients and their staff, creation of a user manual, development of SEO and marketing plans and the web site launch.

In order for your achieve the online success you desire it is imperative that you choose a web site design and development company that fully understands marketing and the technological strategies that will bring you the highest ROI on your web site investment.  Whether your target markets are national, in a bigger city like Atlanta or smaller cities like Asheville or Charlotte, NC completing all of the phases of our web site design and development process will insure your online success.  In the end you will have the web site bells and whistles you want, such as flash animation, sound, video, graphics and links.  You will also know without a doubt that the web site design features you have chosen are appropriate for your marketing and support the achievement of your sales goals.

To learn more about the Jaymunda process visit our home page and read our recently released white paper Programming vs. Marketing.

Posted in Miscellaneous, Marketing, General Technology | 1 Comment »

The Art of Website Marketing: 5 Tips for Web Site Development and Planning

Thursday, May 31st, 2007

The Internet is not only advanced technology or the virtual world, the Internet is a place where businesses succeed, where entrepreneurs make money, where consumers find what they are looking for and professionals learn more about their options for services and products. The Internet in 2007 is an amazing tool that allows businesses and individuals in upstate South Carolina to connect with companies in Atlanta or employees in Asheville, North Carolina to commute via the Internet and work with employers in Charlotte. The options are endless and when you are planning to build and market a website there are a few major things you should consider. If you keep these 5 tips in mind you are starting down the road to Internet success!

5 Tips to Successful Custom Website Design

Tip 1: Think carefully about the content and text you post on the web site. Keyword analysis is key to understanding target markets and current search engine trends. Hiring a web site marketing company that offers professional content development and keyword strategies can give you an excellent competitive edge.

Tip 2: Create a website that provides visitors and potential clients with the information and interactive features they need. Choose a web site design company that completes market research about your customers so it’s clear who they are and what they are searching for.

Tip3: Decide how your company wants to manage the website on a daily and weekly basis. Do you want the ability to make basic changes to text and images right from your office? Then purchase a Content Management System (CMS). Hire a web designer that has expertise in the implementation of CMS programs.

Tip 4: Choose your website pictures and photos with intention. What types of visual images will attract your target markets? Avoid photographs of your office, staff or production unless it pertains to a specific selling point. Any experienced and professional web site design firm will have stock photography available for purchase.

Tip 5: Keep your eye on the bigger picture. Unlike a physical location, your web site address can be accessed by potential customers all over the world. Although our office is located in Asheville, North Carolina we have the ability to reach customers in Atlanta, Georgia, Greenville-Spartanburg, South Carolina, Charlotte, North Carolina or anywhere else in the United States and even beyond. Find a web site design and marketing company that can assist you with expanding your market reach.

Posted in Miscellaneous, Marketing, General Technology | No Comments »

ok