Layer-3 Wi-Fi Fabric

Wi-Fi is like a layer-2 Oscar-Mayer hotdog. It looks better than it tastes. Every access point belongs to the same foot-long fabric. Does wireless mobility truly require that digital heartburn? Or is there a better choice on the menu?

The Low-Down

Most Wi-Fi designs extend Layer 2 so a client can keep the same IP while it roams. That gives you one big broadcast domain, tunnels, controllers in the data path, and extra glue when you leave the building. VLANs show up everywhere because the fabric itself never really left Layer 2.

I wanted something simpler. Treat the client’s IP as a stable identity. Announce it as a /32 host route in BGP from whichever access point the client is currently on. When the client moves, the route moves with it. No bridges, no GRE-style tunnels, no shared broadcast domain, and no VLANs.

The controller never sees client traffic. It only watches associations and pushes or withdraws the /32 on the APs. BGP does the rest.

Why bother?

A flat Layer 2 network (or a tunneled one) gives you a few familiar problems:

• ARP and mDNS floods hit every radio at the lowest management rate.
• Controllers become single points of failure and performance bottlenecks.
• Trunks, VLANs, and spanning tree touch every AP.
• Client isolation is usually a CPU-heavy bridge filter that breaks other things.
• Going between sites means yet another overlay.

A purely routed fabric sidesteps most of that. Each client lives on its own isolated segment. The IP follows the device. Policy can ride on BGP communities. Distance becomes just another BGP peer. And there are no VLANs to provision or trunk.

Layer-3 Roaming

Client associates to a new AP. Syslog fires. Controller sees the event, withdraws the /32 from the old AP, and announces it on the new one. BGP converges. Traffic follows.

With BFD and tight timers the whole thing can stay under a second on a small fabric. Existing TCP sessions survive. The client does not need to know anything changed.

Four pieces

1. Access points

MikroTik APs acting as leaves. Each runs BGP to the core. Base config is almost identical. The controller adds and removes network statements over the API. If the controller dies, existing routes stay up and traffic keeps flowing.

2. BGP core

Route reflector (CHR or physical). It accepts the client /32s tagged with the right communities and rejects everything else. Policy lives here. One connection-tracking rule can cover the whole client pool.

3. Controller

Lightweight Python container. Listens to CAPsMAN syslog, keeps a MAC→IP→AP table, and drives the RouterOS API. Never in the data path. Failure only stops new associations.

4. Dashboard

Shows who is where, roam history, BGP session health, and a simple isolation toggle. The BGP table itself is the second source of truth.

Communities for policy

Every /32 carries a community that says what the device is allowed to do:

65000:100  Corporate
65000:200  Guest
65000:300  IoT
65000:900  Quarantine

The controller maps authentication context to the community at association time. The spine enforces it. No per-client firewall rules, no VLAN sprawl. Change the community and the policy moves with the route.

What this buys you

• Roaming works from anywhere.  The controller can be down the hall, on another floor, across the campus, or on the other side of the state. 
• The IP belongs to the device. Firewall rules and logs follow the client, not the AP or the subnet.
• No vendor licensing.  It's simply aligning dynamic routing with clients.
• HA is simple.  Just add another controller and use local preference.  Existing sessions survive controller failure.
• Client isolation is topological instead of filter-based.
• No VLANs anywhere in the client path.

Requirements for a small POC

• Two MikroTik APs that support containers (RB5009, L009, hAP ax³). The older hAP ac² does not.
• One BGP route reflector (CHR or physical).
• A couple of client devices, including at least one Android.
• RouterOS 7.x on the controller host.
• Python container with a syslog listener, librouteros, and SQLite. Target is under 500 lines.

Optional later: 802.1X so communities come from RADIUS attributes, RSSI polling for flap prevention, mDNS reflection if you need discovery across the isolated segments.

Compared with the usual options

TCP session on roam: L2 bridge drops, L2 tunnel survives only while the controller is up, L3 per-AP subnet drops, this design survives.

Controller in data path: L2 bridge no, L2 tunnel yes, L3 per-AP no, this design no.

Broadcast scope: L2 bridge fabric-wide, L2 tunnel fabric-wide, L3 per-AP per AP, this design per client.

Geographic scale: L2 bridge poor, L2 tunnel moderate, L3 per-AP good, this design excellent.

Role-based policy: L2 bridge none, L2 tunnel proprietary, L3 per-AP static, this design BGP communities.

Licensing: L2 bridge low, L2 tunnel high, L3 per-AP low, this design zero.

Caveats

Convergence time.  Aggressive BGP and BFD timers will help.  Roam events, reassociation timing, and queueing must be measured.  The first working version is MikroTik-specific even if the idea is not.

None of that makes the approach nonsense. It's simply applying something BGP already does well to the access layer. The concept should be welcome for anyone who has fought with L2 roaming, GRE tunnels, or inter-controller mobility.  

The controller and dashboard are still in POC shape. The fabric itself is mostly ordinary BGP and RouterOS. That is the point.

Book Review:  IT Savvy: What Top Executives Must Know to Go from Pain to Gain by Peter Weill.

Peter Weill offers a simple digest on a complex topic:  Best practices and methodology for organizational information and communication.   Weill recognizes most organizations are IT challenged.  However, the right strategy can transform IT from a liability to an asset.

According to Weill, organizations that consistently use IT to elevate performance are IT Savvy. His research suggests that organizations that invest in IT savvy strategies have margins 20% higher than industry average. Organizations without an IT savvy strategy have margins 32% lower.

The IT Savvy model:

1. Define your Operating Model.
2. Revamp your IT funding model.  IT will support your operating model.
3. Build a digitized platform of business processes.  Standardize process that are not going to change. Concentrate on elements that do change. 
4. Exploit the digitized platform for growth.  Use IT to drive value and extract business. 

Case studies include situations from Aetna, Pfizer, Seven-Eleven Japan (SEJ), and UPS.  For example, Weill demonstrates how SEJ transformed their IT services from strategic liability into an asset.  Examples also include IT funding models, outcome-oriented business cases, and transparency innovations.

IT Savvy is an easy to read and informative book about IT execution.  This is a great book for executives, management, and IT professionals.  Weill provides practical strategies on how to implement IT process improvement throughout the organization.

Brief History of Mobile Technology; BYOD Methodology

by Steven Jordan, on December 16th 2013.

     BYOD refers to personal devices that connect to corporate networks.  BYOD may risk concomitant threats to vulnerable corporate systems.  BYOD policy is a network strategy that manages employees’ personal devices.  Companies without BYOD policy may be unprepared as employees overwhelm network resources with smart phones, tablets, and laptops.

          This literature review contributes to the adoption process of BYOD policy.  The adoption process is an initiation phase that consists of “gathering information, outlining and planning” (Bouman, et al., 2005).  Managers and network administrators may use it as reference to support decisions on whether to implement, or reject BYOD policy.

     This literature review explores the state of BYOD technology in three areas:  (a) historical influences of workplace technologies; (b) qualitative risk and benefit analysis for personal technology at the workplace; and (c) exploration on the selection of BYOD methodology.
  
Background

This literature review explores the origins of BYOD in chronological order, and is defined by four significant events: (a) Moore’s Law, as it relates to workplace technology; (b) Moore’s Law for Power Consumption; (c) Koomey’s Law, as it relates to mobile efficiency; and (d) Grove’s Law, as it relates to bandwidth controls.

     Moore’s Law.  Gordon Moore established the Intel Corporation in 1968 (Intel, 2013).  Moore’s Law is based on his prediction that states, “The number of transistors incorporated in a chip will approximately double every 24 months” (Intel, 2013).  More’s Law is specific to chip complexity, but it is an approximation for all components within a computer system (Koomey, Berard, & Sanchez, 2011, p. 47).  Perpetual innovation of computer systems has changed the way people work.

     Moore’s Law has influenced corporate computing for nearly a half century.  The first punch card tabulator was invented in the late 1880s and was used to automate U.S. census data (Carr, 2008, p. 45).  Punch cards were common by the 1930s (Carr, 2008, p. 47).  In the 1970s employees worked with terminals and datacenter mainframes (Carr, 2008, p. 52).  In the 1980s employees transitioned to desktop PCs (Carr, 2008, p. 55).  Modern workstations have become standard office technology.

      Moore’s law for power consumption.  The popularity of the workstation has created an imbalance between consumption and efficiency.  Workstations use an average 25% of their processing potential; storage capacities average under 50% utilization (Carr, 2008, p. 56).  Electricity is wasted when resources remain idle.  The workstation model is inefficient because it wastes scarce resources.

     Wu-Chen Feng introduced, “Moore’s law for power consumption – that is, the power consumption of computer nodes doubles every 18 months” (Feng, 2003).  Each generation of computer chips consumes more energy and generates more heat (Carr, 2008, p. 57).  Heat reduces computer component reliability as failure rates double with every 18°F increase in temperature (Koomey, Berard, & Sanchez, 2011, p. 49) (Feng, 2003).  Heat is especially harmful to lithium-ion powered gadgets (i.e., smartphones) (Herman, 2011).  Heat causes the average smart phone to lose 35% of its battery capacity per year (Herman, 2011).

     Moore’s law for power consumption presents an obstacle to mobile computing: (a) computers have an insatiable appetite for power consumption; and (b) heat has a negative impact on mobile efficiency.  The amount of energy required to operate PCs does not scale for mobile computing.  As a result, demand for power exceeds the available supply.  Functional scalability for mobile devices requires innovations in efficiency.

     Koomey’s Law.  Consumption and efficiency are important distinctions.  Koomey’s Law states that electrical efficiency of computations “doubled about every 1.5 years (Koomey, Berard, & Sanchez, 2011, p. 52).  Alternatively, the ratio of power per computation decreases 50% every 1.5 years (Koomey, Berard, & Sanchez, 2011, p. 52).  Koomey’s Law outlines two potential outcomes in regard to computational innovation:  (a) computational capability increases with no change in power consumption; or (b) no change in computational capability with decreases of power consumption.

     Simultaneous increases for power consumption and efficiency are ostensibly at odds. Both models scale well because each variance has different implications.  Consumption is insignificant for workstations because electric outlets supply power.  Efficiency gains are never realized while workstations consume power as their resources remain idle.  On the other hand, mobile devices are battery operated.  Efficiency benefits mobile devices because of their limited supply of power.  Efficiency gains are revolutionary for battery powered mobile devices (Koomey, Berard, & Sanchez, 2011, p. 50).  For example, assume a smart phone manufactured in 2013 will operate for 10 hours.  According to Koomey’s Law, a smart phone manufactured in 2016, with a similar CPU, will operate for 20 hours. Smart devices are available because of efficiency innovations.

     Grove’s Law.  Mobile devices require efficient power to operate.  Mobile devices also require sufficient bandwidth to be useful.  Grove’s Law says, “Telecommunications bandwidth doubles only every century” (Carr, 2008, p. 58).  Claude Shannon’s Information Theory developed the concept of bandwidth.  Shannon’s information formula calculates the maximum rate that data can be sent without error (Hardesty, 2010).

     Shannon’s Information Theory was developed in 1948 (Shannon, 1948).  It took nearly a half a century until large volumes of information (i.e., bandwidth) could be transferred over long distances.   Communication infrastructure was built upon copper cables (Carr, 2008, p. 57).  Data travels across copper cables in the form of alternating current.  Sign waves graph the positive and negative oscilations associated with alternting current (Odom, 2006, p.170).  Freaquency is a sign wave measurement that counts the number of contiguous oscilation cycles per second (i.e. alternating currnet) (Odom, 2006, p.22).  For example, 3400 cycles per second, indicates a frequency of 3400 Hetrz (Hz).  Incidentally, analog traffic uses the frequency range of 300 to 3400 Hz (Cisco, 2012).  The 3400 Hz frequency correlates with the 33.6 Kilobits per second (Kbps) analog modem; and demonstrates bandwidth is proportionate to frequency.  Copper cable restricted most commercial data transmission to the 300 to 3400 Hz frequency range until the 1990s (Cisco, 2012).

     Modern telecommunication infrastructure has “repealed Grove’s Law” (Carr, 2008, p. 60).  Internet fueled growth provides an abundance of fiber optic cable throughout the country (Carr, 2008, p. 59).  Fiber optic cable is an alternative to copper cable for data transport.  Copper cables use alternating currents to transport data.  Fiber optic cables use pulses of light to transport binary (i.e., digital) data (Odem, 2006, p. 149).

     Fiber optic cables differ from copper cables because they operate at higher frequencies (i.e.,  higher bandwidth capacity).  Long-haul copper cables have a maximum frequency of 100 MHz per km (Gambling, 2000, p. 1091). The bandwidth of long-haul copper cable is nearly 10 Megabits per second (Mbps).  Until 1992, fiber optic cables had a maximum frequency of 1000 GHz per km (Gambling, 2000, p. 1089).  The bandwidth of long-haul fiber optic cable is nearly 20 Gigabits per second (Gbps).  There is a 10,000 improvement factor from the introduction of fiber optic cable.  The invention of the erbium fiber amplifier (EDFA) in 1987, significantly increased existing fiber optic bandwidth capacity (Gambling, 2000, p. 1089).  Fiber optic cables, when amplified with EDFA, has a frequency of 5000 GHz per km.  Information pulses at 100 Gbps “over 1,000,000 km with zero error” (Gambling, 2000, p. 1089).

     Grove’s Law transcends bandwidth innovation from cables to the airwaves.  Copper and fiber optics transmit data using electrons and light (Odem, 2006, p. 152).  Wireless media uses complex analog radio waves to transmit data (Odem, 2006, p. 153).  Wireless frequencies encompass a wide scope of services: (a) LANs, (b) metropolitan-area networks (MANs), and (c) wide-area networks (WANs) (Froom, Sivaasubramanian, & Frahim, 2010, p. 425).

     Wireless LAN, MAN, and WAN services operate within the 2.4 GHz to 5 GHz range (Froom, et al., 2010, p. 424).  Wireless network technology was first introduced to the public in 2001 (Standage, 2004).  The Institute of Electrical and Electronic Engineers (IEEE) publish standards that outline wireless technologies (Table 1) (IEEE, 2013).  IEEE standards document substantial increases of wireless bandwidth.  The broadband revolution has begun to take shape and current designs favor mobility.
 

Risk-Benefit Comparison

     The literature review examines two potential effects of BYOD on an organization:  (a) advantages, and (b) disadvantages.

     Advantages.  ICT departments can be viewed as an institutional process that contributes value to organizations (Brynjolfsson, 2003).  The Alcohol and Tobacco Tax and Trade Bureau (TTB) reduced costs and increased security with their remote access thin client solution (Hughes, 2012).  The TTB policy prevents employees from storing sensitive data on personal property (Hughes, 2012).  TBB’s remote terminal solution reduced legal and compliance complexities (Hughes, 2012).

     Quantifying the value of ICT (e.g., BYOD) is difficult, but not impossible (Brynjolfsson, 2003).  Colgate-Palmolive estimates their BYOD policy saved over $1 million per year by eliminating BlackBerry corporate licenses (Hof, 2011, p. 2).  The savings were realized after BYOD policy allowed personal devices access to corporate email (Hof, 2011, p. 1).

     Organizations can also benefit from with returns on productivity and competitiveness (Brynjolfsson, 2003).  For example, Hyundai incorporates smart phones as part of their manufacturing process (BusinessKorea, 2013).  Workers share multimedia message service (MMS) text messages when defects are discovered on the production line (BusinessKorea, 2013).  Hyundai’s smartphone innovation increased overall production output (BusinessKorea, 2013).

     Disadvantages.  Wireless access points with weak encryption can expose organizations to external hacking attempts (Cisco, 2010, p. 180).  Risk is also introduced when an employee unknowingly connects a compromised device to the corporate network.  Smart devices can introduce malware that targets network equipment and servers (Donohue & Stewart, 2010).

     There was a 155% increase in mobile malware across all smartphone platforms from 2010 to 2011 (Juniper, 2012, p. 6).  There was an additional 614% increase in mobile malware from 2012 to 2013 (Juniper, 2013, p. 15).  Similarly, organizations are at risk when employees copy sensitive corporate data to their personal devices (Juniper, 2013, p. 18).  Statistics based on remote management applications indicate that 17% of mobile devices are lost or stolen on an annual basis (Juniper, 2013, p. 18).

     There are circumstances when BYOD policy exposes the privacy of its employees (Barnes, 2013).  Employees may unknowingly provide their employers with administrative control of personal devices (Barnes, 2013).  Employers gain control when employees use their personal devices to check corporate email (Barnes, 2013).  In theory, employers can read private emails (e.g., Gmail) and view personal pictures (Barnes, 2013).  Furthermore, employers have the ability to remotely wipe any smartphone that synchronizes with corporate email services (Juniper, 2013, p. 18).  There are inherent risks for both employers and employees.

Methodology Models

     Methodology provides the processes, assessments, and analysis necessary to determine if technology management facilitates company goals.  The literature review examines three ICT principles of (a) innovation diffusion, (b) general risk management, and (c) organizational design.

     ICT Diffusion. ICT is the science of organizations and technology.  ICT research explores the dissemination of innovations throughout the workplace.  The employee practice of BYOD is innovative because it changes the way people work.  Each step of the diffusion process is identified and documented.  There are four steps to innovation diffusion:

1. The adoption process identifies the need for innovation or change (Bouman, et al., 2005, p. 58).  Adoption includes information gathering and team building.

2. The implementation process puts a plan into action.  The broad approach identifies the whole diffusion process, adoption through effects, as a single implementation process (Bouman, et al., 2005, p. 92).


3. The users process identifies stakeholders.  Users can include individuals, groups, and organizations (Bouman, et al., 2005, p. 94).   For example, individuals use personal devices, and the organization uses BYOD policy.

4. The effects process examines the complete diffusion process.  Analysis provides aggregated results based on process observations.  Results can be expressed as qualitative generalizations or quantitative statistics (Bouman, et al., 2005, p. 117).
  
General Risk Management.  Network risk management is a loss control process.  Risk management is designed to assist decision makers:

1. Identify company assets (White, 2011, pp. 482).  Assets are company resources that are vulnerable from threats (White, 2011, p. 482).

2. Identify network threats (White, 2011, p. 482).  Threats are anything that causes harm to a company asset (White, 2011, p. 482).  NIST publishes a comprehensive list of threat events (NIST, 2012).

3. Identify system vulnerabilities (White, 2011, p. 482).  Vulnerabilities, are root conditions that exposes assets to harm (White, 2011, p. 482).  NIST publishes a comprehensive list of vulnerabilities (NIST, 2012).

4. Estimate the likelihood of an exploit (White, 2011, p. 482).  Likelihood estimates the probability that a threat will exploit a vulnerability (i.e., compromise the production servers) (White, 2011, p. 483).  Likelihood is determined with a risk assessment matrix.

5. Estimate the impact from a harmful event (White, 2011, p. 483).  Impact estimates the loss experienced from a vulnerability that is exploited by a threat (White, 2011, p. 483).  NIST publishes a comprehensive list of adverse impacts (NIST, 2012).

6. Estimate risk through a qualitative risk management matrix.

     Risk is estimated by multiplying vulnerability, impact, and likelihood:  R = V x I x L (Brock, 1999).  The assessment formula is calculated with the risk assessment matrix (Table 2).  The assessment team determines the risk matrix likelihood values.  Choosing the likelihood values requires majority quorum.  The assessment team assigns one risk value to each vulnerability: (a) high risk, (b) medium risk, (c) or low risk.
 

Organizational Design.

     The Star Model for Decision Making is an organizational design.  The Star Model outlines the problem in common language, forces designs based on long-term goals, and provides decision makers a series of understandable choices (Kates & Gakbraith, 2007, p. 2).  The approach begins by identifying the strategic goal.  Proceeding steps outline the goal’s structure, processes, incentives, and people.  The Star Model asks five main questions:  (a) What is being done?  (b) Who is doing it?  (c) Why are they doing it? (d) How are they doing it?  And, (d) should it be done? (Figure 1)  (Malone, Laubacher, & Dellarocas, 2010).



     This literature review concludes organizations will benefit from a network risk assessment process.  The recommendation is based on (a) the historical developments in technology; (b) examination of potential benefits and risks; and (c) BYOD methodology processes.

     History.  The use of personal technology in the workplace is a modern phenomenon.  Personal devices are possible because of recent innovations of power efficiencies and bandwidth.  BYOD is prevalent as a results from technology influencing use.

Benefits and risks.  Mobile personal devices are common tools.  Analysis indicates that organizations can benefit from financial, efficiency, and productivity gains.  On the other hand, personal devices can introduce threats to vulnerable system resources.

Methodology Processes.  There are various methodology processes that can assist organizations assess the potential benefits and risks introduced from mobile personal devices.


     The infrastructure goal states that production servers must be available to customers. The network has a successful record for continuous operations.  To date, customers have not experienced major disruptions of services.  Previous successes may be attributed to the collective knowledge and experience of the organization's ICT staff.  In any case, conjectural mitigation is not a prudent strategy.  New security controls are required because employees connect their personal devices to the company network.  Consequently, network threats may manifest as smart devices connect to the corporate network.

     The organization employs a sophisticated network but its mitigation resources are mostly undocumented.  Existing network security processes are unproven propositions because they are based on incomplete information.  Unfounded assumptions, “can lead to broken, misconfigured, or bypassed security mechanisms” (Cisco Press, 2010).  An effective network assessment allows companies to make informed decisions.

Methodology Overview

     This study seeks to align the use of employee personal technology with business strategy.  Methodology provides the processes, assessments, and analysis necessary to determine if technology management facilitates company goals.  It proposes a synthesized methodology, the ICT Risk Assessment Model (IRAM) which provides an in-depth understanding of BYOD policy through a process of systematic planning.  The IRAM model is based on three ICT principles of (a) innovation diffusion, (b) general risk management, and (c) organizational design (Figure 2).  Each principle uniquely contributes to the IRAM methodology goal.  Innovation diffusion provides IRAM with a framework through four diffusion phases.  Risk management identifies risk conditions and uses a qualitative assessment for evaluation.  Organizational design introduces a logical and straightforward interpretation.  Decision makers will benefit from a pithy interpretation.  

     


ICT Diffusion

     Innovation diffusion is the first phase of the IRAM methodology process.    Each step of the innovation diffusion process, (i.e., adoption, implementation, use, and effects) is documented:

1. This study identifies BYOD policy as the candidate for change within the organization.  Team participants will include those most familiar with network operations; system administrators and management.

2. This study uses a narrow interpretation of implementation and emphasizes the design and development.  The focal point for this implementation phase centers on the risk management assessment.

3. This study identifies users as stakeholders.

4. This study takes a narrow interpretation of effects and defers specific analysis to the IRAM organizational design process.  The completed analysis will determine if BYOD policy aligns with company goals.

Risk Management

     Risk management is the second phase of the IRAM methodology process.  Data attributes are identified and applied to the risk assessment.  Likelihood and impact are calculated by proxy of risk assessment:

1. This study identifies the production servers as the primary assets.

2. This study uses a broad interpretation of threats, and identifies four potential events: (a) changing data, (b) deleting data, (c) stealing data, and (d) disruption of services.  Future research may include a narrow scope for threat identification:  For example, viruses, Trojan Horses, worms, and Denial of Service (DoS) attacks.

3. This study uses a broad interpretation of vulnerabilities, and identifies four potential conditions:  (a) infrastructure design, (b) applications, (c) operations, and (d) people.  Future research may include a narrow scope of vulnerabilities:  For example, firewalls, custom macros, policies and procedures, and accidents.

4. Likelihood is expressed in qualitative format during the risk assessment.

5. This study uses a broad interpretation of impact and identifies three potential conditions:  (a) data confidentiality, (b) data integrity, and (c) data availability.  Future research may include a narrow scope of impact:  financial losses, customer losses, etc…

6. The Network assessment team identifies risk using the risk assessment matrix (Table 2).

Organizational Design

     The Star Model for Decision Making encapsulates IRAM methodology within a simple framework.  Star Model questions are framed according to the project scope.  The results formalize the IRAM methodology into two formats: (a) pithy report, and (b) tabular reference (Table 3).

IRAM Methodology

1. What is the goal?  Data integrity, confidently, and reliability are at risk from the combination of vulnerabilities and threats.  The goal is to reduce or prevent the likelihood of production server exploitations.  The IRAM goal aligns with the adoption process of diffusion because an innovation has been identified.

2. Who is at risk?  The organization stakeholders are at risk from vulnerabilities and threats.  The stakeholders are the production processes, data, and systems.  Stakeholders are participants in the usage process of diffusion.

3. Why are the production systems at risk?  Production servers are vulnerable from a wide scope of interactions with infrastructure, applications, operations, and people.  Vulnerabilities are risk conditions that source from the implementation process of diffusion.

4. How are the production servers at risk?  Circumstances and events can harm production servers with threats of data changes, data theft, data disruption, and data destruction.  Threats are closely related to vulnerabilities, and both components align with the implementation phase of the diffusion process.

5. Should the risk be mitigated?  The IRAM risk assessment matrix estimates the effects and likelihood for vulnerabilities.  Network operators will use the assessment to determine whether controls are needed to mitigate the potential impact from risks.  Risk assessments align with the diffusion process of effects.
 


Data Analysis

Decision makers can use the IRAM methodology process to help determine if BYOD is appropriate for their organization.  System areas that denote high risk require mitigation.  Medium risk deserves substantial consideration.  Mitigation may be optional for low risk areas.

     This study recommends a detailed qualitative mitigation assessment for systems that require mitigation.  Qualitative mitigation assessments assign monetary values for assets (i.e., production servers) and mitigation processes (i.e., firewalls, anti-virus software, etc…). Ultimately, organizations must decide if the benefits of BYOD is worth the potential risks.



Barnes, N. M. (2013, September 26). BYOD: balancing employee privacy concerns against employer security needs. Retrieved from Association of Corporate Counsel: http://www.lexology.com/library/detail.aspx?g=1109490a-6895-40f0-a7a3-afc714316165
Bouwman, H., Dijk, J. van, Hooff, B. van den, and Wijngaert, L. van de (2005). Information & Communication Technology in Organizations. London:  SAGE Publications.
Brynjolfsson, E. (2003, July). The IT Productivity Gap. Optimize Magazine (21). Retrieved from http://ebusiness.mit.edu/erik/Optimize/pr_roi.html
BusinessKorea. (2013, November 22). Reason for Increasing Recalls. Seoul, Korea. Retrieved from http://www.businesskorea.co.kr/article/2238/reason-increasing-recalls-use-smartphones-during-work-hours-emerging-significant
Carr, N. (2008). The Big Switch. New York: W. W. Norton & Company, Inc.
Chen, B. X. (2013, May 1st). Cellphone Thefts Grow, but the Industry Looks the Other Way. New York Times, p. A1. Retrieved from http://www.nytimes.com/2013/05/02/technology/cellphone-thefts-grow-but-the-industry-looks-the-other-way.html?_r=0
Cisco. (2010). 6.4.3 Wireless Security Solutions. In Cisco, CCNA Security Course Booklet (p. 180). Indianapolis, IN: Cisco Press.
Cisco. (2012). BYOD and Virtualization Survey Report. Indianapolis: Cisco IBSG. Retrieved from http://www.cisco.com/web/about/ac79/docs/BYOD.pdf
Cisco. (2012, October 16). Digital Subscriber Lines. Retrieved from Cisco Systems, Inc.: http://docwiki.cisco.com/wiki/Digital_Subscriber_Line
Craig-Wood, K. (2012, April 26). Energy-efficient cloud computing: Jevons Paradox vs. Moore’s Law. Retrieved from Mesmet Blog: http://www.katescomment.com/
Donohue, D., & Stewart, B. (2010). Campus Network Security. In CCNP Routing and Switching Quick Reference (p. 191). Indianapolis, IN.: Cisco Press.
Feng, W.-c. (2003, October 1). Making a Case for Efficient Supercomputing. Queue - Power Management, 1(7), p. 54. doi:http://dl.acm.org/citation.cfm?doid=957717.957772
File, T. (2013). Computer and Internet Use in the United States. Washington DC: U.S. Census P20-569. Retrieved from http://www.census.gov/prod/2013pubs/p20-569.pdf
Fortinet. (2013, October). Fortinet Internet Security Census 2013. Retrieved from http://www.fortinet.com/sites/default/files/surveyreports/Fortinet-Internet-Security-Census-2013.pdf
Froom, R., Sivaasubramanian, B., & Frahim, E. (2010). Implementing Cisco IP Switched Networks (SWITCH). Indianapolis: Cisco Press.
Gambling, W. A. (2000, Nov-Dec). The Rise and Rise of Optical Fibers. IEEE Journal on Selected Topics in Quantum Electronics, 6(6), 1077-1093. doi: 10.1109/2944.902157
Glanz, J. (2012, September 22). The Cloud Factories: Power, Pollution and the Internet. Retrieved from The New York Times: http://www.nytimes.com/2012/09/23/technology/data-centers-waste-vast-amounts-of-energy-belying-industry-image.html?pagewanted=1&_r=1
Hardesty, L. (2010, January 19). Explained: The Shannon limit. Retrieved from Massachusetts Institute of Technology News: http://web.mit.edu/newsoffice/2010/explained-shannon-0115.html
Herman, J. (2011, September 21). Why is My Phone So Hot? Popular Mechanics. Retrieved from http://www.popularmechanics.com/technology/how-to/tips/why-does-my-phone-get-so-hot
Hof, R. (2011, August 15). Bring Your Own Device. Retrieved from MIT Technology Review: http://www.technologyreview.com/news/425009/bring-your-own-device/
Hughes, R. (2012, August 13). Allowing Bring Your Own Device with Minimal Policy or Legal Implications. Retrieved from The White House: http://www.whitehouse.gov/digitalgov/bring-your-own-device#ttb
IEEE. (2013, December). IEEE Std 802.11. Retrieved from IEEE Standards Association: http://standards.ieee.org/findstds/standard/802.11-2012.html
Intel. (2013, October 5). More's Law and Intel Innovation. Retrieved from Intel: http://www.intel.com/content/www/us/en/history/museum-gordon-moore-law.html
Juniper Networks. (2012, February). 2011 Mobile Threats Report. Retrieved from Juniper Networks: http://www.juniper.net/us/en/local/pdf/additional-resources/jnpr-2011-mobile-threats-report.pdf
Juniper Networks. (2013). Juniper Networks Third Annual Mobile Threats Report. Retrieved from Juniper Networks: http://www.juniper.net/us/en/local/pdf/additional-resources/jnpr-2012-mobile-threats-report.pdf
Koomey, J. (2011, February 13). A fascinating encounter with advocates of large rebound effects. Retrieved from Jonathan G. Koomey, PHD.: http://www.koomey.com/post/3286897788
Koomey, J., Berard, S., & Sanchez, M. (2011, July-September). Implications of Historical Trends in the Electrical Efficiency of Computing. 33(3), pp. 46-53. doi:http://doi.ieeecomputersociety.org/10.1109/MAHC.2010.28
Odom, W. (2006). Networking Basics. Indianapolis: Cisco Press.
Owen, D. (2010, December 20). Annals of Environmentalism the Efficiency Dilemma. The New Yorker, 78-79. Retrieved from http://www.newyorker.com/reporting/2010/12/20/101220fa_fact_owen
Pew Internet. (2013, October 18). Pew Internet and American Life Project. Retrieved from Tablet and E-reader Ownership Update: http://pewinternet.org/Reports/2013/Tablets-and-ereaders/Findings.aspx
Shannon, C. E. (1948, July, October). A Mathematical Theory of Communication. The Bell System Technical Journal, 27, 379-423, 623-656. Retrieved from http://web.mit.edu/persci/classes/papers/Shannon48.pdf
Standage, T. (2004, June 12). A brief history of Wi-Fi. The Economist. Retrieved from http://www.economist.com/node/2724397/print
Troianovski, A. (2012, April 3). Optical Delusion? Fiber Booms Again, Despite Bust. Retrieved from The Wall Street Journal: http://online.wsj.com/news/articles/SB10001424052702303863404577285260615058538
White, G. (2011). Security+ Certification. In G. White, Security+ Certification (pp. 477-4994). Emeryville: McGraw-Hill.

Review:  The Adventures of an IT Leader (2009), written by Robert D. Austin, Richard L. Nolan, and Shannon O’Donnell , is a fictional story of Jim Barton and the challenges he faced as the new CIO of the IVK Corporation.

The story began with Barton’s ascension to the head of the IT department.  IVK Corporation had recently experienced tremendous growth.  Annual sales for IVK Corporation had increased from $41 Million, to $233 Million, over a 3 year period.  Sales however, had leveled off, and growth was flat compared to the previous year.  The board of directors had let go of IVK’s previous CEO, and hired the new CEO, Carl Williams.
Williams decided to shake things up and he reorganized roles within the company.  Williams fired Bill Davies, the IT manager, and offered the new position to Barton.  The news came as shock to Barton because he had no technical background; although he had a great reputation has the head of the Loan Operations department.

Besides Barton’s reputation a good manager, he was chosen because he was vocal in identifying problems with the IT department at executive meetings.  Williams was also looking for leadership qualities that were the exact opposite of Davies.  Davies was very knowledgeable regarding computer networks but he seemed overwhelmed and was a poor communicator.

Because of Barton’s limited IT experience, he began a knowledge quest, to quickly get up to speed on everything related IT.  Barton sought answers from his girlfriend, Maggie Landis, who also happened to be a management consultant.  She suggested that Barton start by meeting with leaders from the other business units, and ask them how their business needs were being met by IT.  Barton also befriended “the kid”, a wise twenty something year old, at a bar near his condo.  The kid’s first advice was to quickly identify the best talent and a cryptic, “know what you don’t know“.   By strange coincidence, Barton also ran into Davies, during a jog.   Davies told Barton that no one could manage the mad house and left him with a parting, “You’ll be gone in under a year”.

When Barton first began his role as CIO he held a 5 minute meeting with the IT managers.  He requested that they formally schedule a management meeting to set direction for the department.  The managers requested additional staff to help with discussions but Barton preferred it be management only.  Barton wondered why they had to lean on their “tech-nerd sidekicks” and worried his management staff was not qualified.

Throughout the story Barton discovered that IT was very complex and that it was nearly impossible to be a specialist in every field.  At one point Barton went to the books store and bought $1,200 worth of IT books to get up to speed.  He read throughout the night and realized that IT was “complicated as hell”.  When he was head of the Loan and Operations he had the skill and knowledge to do the job of any employee that worked in his department.  In contrast, an IT manager could not possibly master every technology at IVK.  The Exchange specialist may not know anything about .Net programming.  The programmers may not know anything about routers and switches, etc…   Barton’s managers would also learn that not every IT meeting involved all things technical.

In the course of Barton’s duties he had been asked to participate in a leadership meeting by the CEO.  Each department was asked about spending and the bottom line.  Barton had to justify the cost of the IT department.  Through the process he discovered the IT department was funded through a complicated charge-back system that subjectively billed the other departments for their IT related services.  In addition IT was generally viewed as an unwelcome expense from the other business units.  Barton also found that because of IVK’s rapid period of growth, they were forced to provide the same services to more and more customers with the same limited resources.   Barton’s goal was to demonstrate the value of IT.

Landis introduced Barton to competing philosophies regarding IT value.  She suggested an article called, “IT Doesn't Matter” by Nicolas Carr.  Carr argued that IT investment did not create value.  IT was a commodity and did not provide a competitive advantage.   However, MIT professor, Erick Brynjolfsson argued IT created value in a number of ways:

• Firms that invested heavily in IT deployed business processes quickly
• Competition was able to copy new innovations quickly.
• Firms that invested heavily in IT had increased market share.

Barton also learned from one of his managers, Bernie Ruben, the concept of “competes” versus “qualifiers”.  If IT was a race, the “qualifier” was something that needed to be done, simply to participate in the event.  The “compete” was an innovation that helped win the race.  Barton thought if he could document each IT service as either a compete or a qualifier, he may be able to demonstrate IT’s value.

Ruben also touched on service-oriented architectures (SOA) and business intelligence (BI) concepts.  SOA is a foundation that is used to combine different application services that can be combined to deliver new functionality.  Web based portals that support business objectives can be considered SOA.

Business Intelligence involves data mining.  BI analyzes all available data, such as customers, sales, completion, and identifies trends.   Landis gave an example of BI from a Spanish company called Zara.  The clothing retailer used its point-of-sale data to identify their hottest selling items.  The process automated the order process and allowed them to re-supply the best-selling inventory before their competition.

Accompanying Barton’s research on the value of IT was the role of project management within the IT department.   Barton had to figure out how to plan for the unexpected.  Barton discovered an article by Jim Highsmith, called “Agile Project Management:  Principles and Tools”.  He learned that APM teams expect the initial plan to be wrong.  Prototypes or quick release of specific features is important with APM.

Barton also learned from “the kid” about the book The Death March, by Ed Yourdon.  A death march is a bad project managers are determined to stick to.  After Barton took charge he discovered a runaway project that IVK had already invested over $3 Million into.  The project was sold and run by an outside consultant.  It was initially pushed from a business unit over the objections of the IT staff.  Rather than waste further company resources Barton decided to kill the project.

Reflections:
I am impressed with the relevance of the content.  I was able to identify real life situations from my work experience in every chapter.  After the first couple chapters I thought the authors had specifically written about the previous company I worked for.  I had been hired at the tail end of their explosive growth.  Just like IVK, they went from a $10 Million company to a $100 Million company in a 3 year period.

When I was first brought on board the IT department was too informal.  The IT manager was “computer” smart and hands on.  I found my manager was similar to the Davies character in the book.  He enjoyed working with every technology, and because of that, he liked to micro manage every project.  As a result IT was always behind on help desk requests and big ticket projects.  We did good work but I don’t think we kept up with the needs of all the business departments.

Similar to the situation in the book, growth had leveled off, and the IT relationship with the other business departments suffered.  Directors looked at IT as very expensive and they did not understand the multitude of services we had supported.  In addition, the IT budget and staffing, had not kept up with the growth of the other business departments.   We were expected to serve 800 additional network users with the same resources as before the growth.

My original IT manager was let go and a new IT “Director” was brought on.  By the time I left the company I had seen a big difference in the level of service we offered.  My new boss had implemented a series of changes, similar to how Barton had.   My new manager was quick to identify our strengths and delegated responsibility; that resulted in quick workflow and turnaround.

The book’s CEO, Williams, also advocated for an IT leader with business experience instead of one with only technical knowledge.  When my boss had first been hired I remember thinking he had an acute lack of technical knowledge.  I wasn't sure what to expect but I didn't think it was a good thing.  After my experience working with him I found my initial reaction was wrong.  His technical skills were stronger than I first suspected; more important was his managerial experience helped the company move forward.

After reading the first half of The Adventures of an IT Leader, I found comfort knowing the situation I experienced was not unique to my previous employer.  The advice and examples from the book are based on first-hand experience of someone that had worked for many IT departments.  It should also be used as a wake-up call to all IT professionals; raw technical skills will not cut it in the modern business environment.   It is just as important to consider other ICT philosophies such as the organization, management, end users, and communication lines.  

The second part to this review can be found at:
http://www.stevenjordan.net/2012/08/the-adventures-of-it-manger-review-part.html

P.S.  This post has been surprisingly popular.  Please leave a comment if you found it helpful.
Thanks!  -SMJ

References:
Robert A., Nolan, A., O’Donnell, S., (2009).  The Adventures of an IT Leader.  Boston Massachusetts: Harvard Business Press.

Last updated  July 16th, 2013 by Steven Jordan