NSF's guidance on Cloud Computing will inform research dollars in the near future

The National Science Foundation released their report on cloud computing. It can be found here. The intent of this report is to provide information that guides funding programs. The NSF used NIST’s guidance on cloud computing to inform their research and decision making. This report will be instrumental in informing Federal decision makers and cloud investment. It is important to pay attention to such documents as they can help businesses align with Federal government priorities.

The NSF has identified the following areas as research areas worthy of financial support from the federal government:

1. Computer Systems
2. Computer Networks
3. Security and Privacy
4. Algorithms and data management
5. Applications and software engineering
6. Computer science education

The report concludes with the following:

“As recognized by both NIST and the America COMPETES Reauthorization Act, cloud computing is an area vital to the economic growth and competitiveness of the nation. The CISE community has responded vigorously to the challenge, as evidenced by the wide range of research efforts underway that are supported by numerous programs throughout the CISE Directorate.”

The NSF’s Computer Information Science and Engineering (CISE) directorate will continue its research into cloud computing (and hopefully will continue to advance cloud computing knowledge and research).

Related articles

• Federal Researchers Push Limits Of Cloud Computing (fedcyber.com)
• Cloud Security, Costs Concern Federal IT Pros (ctolabs.com)
• Cloud Computing: Why Should I Care? (blogs.cisco.com)

My friend Peter Thorp has a way of sensing great technologies and then helping teach others of the relevance of those to enterprise missions. He did that with amazing firms like Netscape and Opsware and has been key in teaching many of us about dozens of other incredible capabilities. For the last year he has been telling a few of us about a story that can now be broadly shared. His latest project is leading all federal activities of a firm called Nicira.

Nicira has just exited “stealth-mode” and is now providing information broadly on what they do and how they do it. One of their press releases is copied below for your information.  The press and analysts in the IT community are now diving deeper into Nicira’s capability and are already concluding what Peter told me long ago. Nicira will deliver powerful capabilities that can transform network operations and economics. We will be writing more about Nicira here in the future and will also be capturing reference information at our companion site CTOlabs.com, so please stay tuned for more.

As you read the press release below, consider how disruptive and virtuous virtualization has been to enterprises that once had to buy a server for every single application they ran. Server Virtualization saved enterprises everywhere and is still disrupting things in a positive way. That same dramatic savings and performance enhancement is now about to sweep the world of routers and switches and networking.

More below and at:

February 6, 2012
Source:
Nicira

Related articles

• Nicira Virtualizes the Network (ctolabs.com)
• Meet Nicira. Yes, people will call it the VMware of networking. (gigaom.com)
• Andreessen Horowitz-Backed Nicira Pulls The Curtains Back On Disruptive Network Virtualization Platform (techcrunch.com)

This is just another in a long string of NASA security breaches

Recently, some news of a NASA hack-and-dump passed my twitter deck.  I decided after watching a few of my friends re-tweet the news that it might be worth checking out.  At least I’d see if I could perform some password analysis on any dumped credentials, or even test out the new Crucialpoint Cloudera Hadoop password cracker on any leftover hashes.  What follows is a step-by-step methodology of how I put together the pieces on the hack, and what I think likely happened based on my experience as a web application hacker/programmer.

First, I followed a re-tweet from someone I follow to this user account on twitter: https://twitter.com/#!/d4op.  The user is a prolific poster about security vulnerabilities and has a long list of tweets linking to pastebin.com drops with account credentials.  The NASA link is but one of many.  I follow the link in the tweet to this pastebin paste: http://pastebin.com/W2K3pTyX, and from there, to a mediafire download: http://www.mediafire.com/?962aq85rgchjs7d.

I unpacked the RAR file to find a .sql dump script, a file typically used to restore the database and it’s contents in the event of data loss.  Literally it’s a backup of the SQL data.  A few quick searches shows that, true to it’s name, it contains data from the Solar and Heliospheric observatory (SOHO) database according to tidbits of data inside of the dump, the filename, and a few other markers.

Within the dump I was unable to find any credentials, mostly it contains instrument data tables, articles, and other data of scientific and academic interest.  It does not appear as though there is any actionable data (from a security standpoint) contained within the dump.  This may mean that either the attacker did not push the attack for more, or that they were confined to accessing a single database from within a vulnerable database application.  In any event, it is clear that this database dump is publicly-accessible information from the SOHO website resources.

If it’s a SQL dump, it’s likely to be a SQL injection (one of the most commonly-exploited vulnerabilities).  Some of the other disclosures mentioned in the twitter account also appeared to be SQL-injection related, so these factors started me searching for user interactions with the NASA database — specifically search functions.  Search functions are great targets for XSS and SQL injections.  Lo and behold, one such search function exists, and it looks to have been written a great deal of time ago: http://seal.nascom.nasa.gov/cgi-bin/bib_ui_seal

I did not attack/test the website in question to confirm the vulnerability of any SQL database application (that’d be illegal without permission), but I’d say there’s a pretty high likelihood that the SQL dump was caused by either an incorrect setup on the database itself or a SQL injection from that page due to the outdated programming methodologies it is apparently using (CGI) and the primitive layout structure of the view (tabular layout, popular in late 1990′s and early 2000′s).

For more information about SQL vulnerabilities or other kinds of web application vulnerabilities, I recommend starting here: https://www.owasp.org/index.php/SQL_injection OWASP is a great resource for developers, managers, and security personnel to get together, compare notes, and build secure websites.

Related articles

• Hacking group releases more Stratfor subscriber data (bobgourley.com)
• Only 18% of Software Apps Pass Security Tests (ctovision.com)
• Romanian Hacker Arrested for NASA Breach (ctolabs.com)

CumuLogic is ready to provide PaaS services for your enterprise

CumuLogic is a cloud computing company founded by Sun Microsystems’ alumni. The company has developed a Java Platform-as-a-Service (PaaS) software that makes it easier and faster to develop and deploy Java applications (apps) in the cloud. By automating the management of the runtime environments for developing and deploying Java apps in the cloud, including automated scaling, CumuLogic’s Java PaaS can reduce the current time these steps take from upwards of multiple weeks to under a day. Cloud computing is not just about Infrastructure-as-a-Service (IaaS). The cloud is about the applications, and getting them to your customers in a timely and effective way.

CumuLogic’s Java PaaS is now in beta with general availability coming soon. Their offering provides a no-lock in PaaS solution for Java apps that works on either public or private clouds. An enterprise can easily move apps between their own private cloud and a public cloud if needed. CumuLogic PaaS supports Amazon EC2, Eucalyptus, Citrix/Cloud.com CloudStack, OpenStack, and VMware private clouds. The architecture is flexible, cloud agnostic, hypervisor agnostic, offers mix-and-match infrastructure components, and has IT integration points. The beta product supports the following open source web servers, app servers, and databases: Ngnix, Apache, Tomcat, JBoss, Jetty, GlassFish, MongoDB and MySQL. The product also supports connections to an Oracle database. CumuLogic PaaS architecture is designed for high availability and failover. Fault tolerance is built in at every tier of the platform to meet the needs of mission critical applications.

Unlike today’s PaaS platforms like Google App Engine or application server-based approaches such as IBM WebSphere or Oracle/BEA WebLogic, Cumulogic recognizes that enterprise applications often exist in a tightly integrated ecosystem of highly varied and version dependent infrastructure components such as databases, web servers, libraries, and the like. Infrastructure component choices and their versions are often dependent on the goals of the executing application. The same is true for different application deployment scenarios where the choice of components is dictated by the specific service goals to be achieved.

CumuLogic is the first and only PaaS offering for application service development and deployment that supports full choice of an application’s infrastructure components regardless of whether they are open source, purchased from ISVs, or built in-house and proprietary. Existing PaaS platforms give limited choice of infrastructure components while application server vendors require significant component knowledge, integration, and testing to guarantee and maintain application functionality and integrity. CumuLogic PaaS provides freedom of choice for a wide selection of infrastructure components automating the otherwise costly integration of those components into a fully functioning application environment. CumuLogic PaaS also allows those applications to function on a CumuLogic platform(s) hosted on one or multiple internal sites and/or external service providers. Additionally, CumuLogic’s PaaS addresses enterprise security and compliance issues. Applications that require isolation can be managed separately to execute in isolation if required. Other applications without this requirement can share infrastructure components.

With the above features, the benefits of CumuLogic are dramatic:

• Enhanced developer productivity,
• A twenty to thirty percent cost savings in application lifecycle management, and
• Increased overall business agility.

Check out CumuLogic’s Java PaaS at www.cumulogic.com for your cloud computing application needs.

Useful Links

• Data sheet
• White paper
• Demos
• Beta registration

Related articles

• What You Need To Know About FedRAMP (ctovision.com)
• CumuLogic PaaS is Verified as Citrix Ready (prweb.com)
• Cloud Security, Costs Concern Federal IT Pros (ctolabs.com)

Aldiko Sync gives your Android "Whispernet" capabilities

For many of you Android fans, Aldiko (the free epub/pdf/ebook reader) is an app that you use daily. One of my favorite things about Aldiko is that it is easy to use. I can find epubs all over the place, send them to my Dropbox and easily open them on any Android device. This is great, if you only use one device, or only read one book per device. But if you’re like me, and have too many devices, this doesn’t work.

That’s why there is Aldiko Sync. Basically, Aldiko Sync allows you to easily save your Aldiko library information to your Dropbox account. It uploads your books, the library information and an md5 hash tag to Dropbox for comparison. The Pro upgrade (only $.99) allows you to auto-sync. The auto-sync does get a little annoying, (every time you unlock your phone it quickly syncs) but the benefits are worth it.

One of the things I was happiest about with my new Galaxy Nexus was the ability to actually use the screen for reading. This has made my old SGT sad and lonely and mostly unused. Aldiko Sync is a program that makes it easy to read across all of your devices. If you’re an avid reader, and an Android user I would definitely recommend checking out Aldiko Sync (and paying the $.99 to a solid developer).

Related articles

• Aldiko Book Reader Gets Huge Update, Shows Love For Tablet Book Fanatics (androidpolice.com)
• Using Dropbox with Aldiko (teleread.com)
• Will the Amazon Kindle Fire further fracture Android? Or do just the opposite? (ctovision.com)

As you watch the video below you can form your own conclusions about this natural evolution of robotics.  But I’ll give you some of my opinions below the video:

http://youtu.be/YQIMGV5vtd4

Now some context:

• As a technologist I would like to remind you all that every future use case for incredibly capable systems like this will involve IT with moving parts, and all IT with moving parts requires IT guys to fix them when they break. So guess what CIOs, increasingly you are going to be the person that is turned to for robot repair.
• Most use cases for devices like this involve sensors. For example, swarms like this could be sent into disaster areas to look for survivors of a disaster, or could be sent into an area to sense the environment. There are so many other use cases involving sensors. Which means, this evolution of robotics will add even more data to overloaded systems. So we are looking at yet another reason enterprise IT professionals need to study Apache Hadoop.
• These things are built with some smarts in the devices themselves and some smarts external and they all communicate with each other via networks. I have not conducted a security assessment on these and don’t know anyone who has, but I can tell you from experience there are ways for bad guys to get into the network. Don’t think f0r a second that you can trust these flying robots to always be under the control of their designer.

VMware helps the NMCI run smoothly

The Navy Marine Corps Intranet is the largest individual network in the world. The only larger network is the Internet. This huge network sprawl requires a great deal of strategy, concern and planning. Over 700,000 users rely on the intranet to receive IT services. This is a huge network, and the NMCI cannot afford to take risks lightly, nor can they afford to be behind the eight-ball.

NMCI uses VMware Infrastructure for a few different reasons. The first is to virtualize Microsoft Exchange Servers. They host over 350k users on VMware servers. NMCI can run five virtualized exchange servers on every single physical server. This enables higher usage of server capabilities. As well, it adds value, and enables instant provisioning of new servers when necessary.

The largest individual network uses VMware - could it help your enterprise?

The second use NMCI has for VMware Infrastructure is server consolidation. Following OMB’s directive to consolidate servers, the NMCI is finding VMware Infrastructure key to these efforts. They have  consolidated 2,000 servers into roughly 300 physical hosts, a ratio of 9:1 (expected to rise to 12:1).

NMCI has extended the lives of their older servers, all the while consolidating their needs. This is huge for them, as their budgets diminish and user needs increase. E-mail is not something that they can waste a large amount of server space on, when there are so many mission critical applications out there.

Find the VMware case study here.

Related articles

• A look at VMware’s vFabric Cloud Application Platform (ctolabs.com)
• Is the Healthcare Industry on Life Support Without the Cloud? (bobgourley.com)
• The Elders of the Internet Have A Message for the U.S. Congress (bobgourley.com)

Team up with Carahsoft and Virtual Instruments to prepare for the FDCCI

Last week I attended a Carahsoft webinar with Virtual Instruments’ Doug Norton and our very own Bob Gourley. The topic was the Federal Data Center Consolidation Initiative, and what Virtual Instruments can do to help prepare your agency for consolidation.

The key capability that Virtual Instruments brings to the table is the ability to identify and create real metrics for your data center and across the SAN. VI uses fibre channel technologies to copy network data in stream and then perform their analytic magic on that data – this allows your network to continue to operate with zero latency introduced by their action.

Consolidation is a huge target for any CIO, let alone those to whom it is mandated. Virtual Instruments helps prepare the network for consolidation by identifying weak points, underutilized assets. One huge hold up for cloud adoption is visibility, which is exactly what VI can offer your agency or firm.

Virtual Instruments has created a six-step plan that directs the consolidation process and optimizes the results.

Step 1: Mitigate Risk and Improve SAN Utilization

Step 2: Speed Resolution Time & Root Cause Analysis

Step 3: Head Off Application Performance Problems

Step 4: De-Risk and Tune Mission Critical Applications

Step 5: Optimize Storage Tiering

Step 6: Increase Use of Virtual Servers

If you’d like to watch the archived webinar, find it on Carahsoft’s website, here.

Find Virtual Instruments and Doug Norton here.

Related articles

• Learn how to get ready for the FDCCI with Bob Gourley and Carahsoft (Webinar) (ctovision.com)
• A Tale of Two FCoEs (datacenteroverlords.com)

Mahout is a machine learning library that will be included in CDH4

At Cloudera Day, Cloudera software engineed Todd Lipcon Delivered a Deep Dive on the Core of Cloudera’s Distribution including Apache Hadoop (CDH), detailing tweaks and planned improvements to the Hadoop core. Just a few days later, some of these planned improvements were implemented when Cloudera released CDH3, Update 3, and more will be made for the upcoming CDH4. Many tweaks need to be configured by the user, so if you want your cluster running optimally be sure to check the documentation provided by Cloudera.

When measuring the efficiency of a cluster, we can look at three different metrics. Speed can mean per-job latency, measured with a stopwatch, or throughput, measured in slot-seconds. Latency and throughput can be at odds. Another metric, perhaps the most important to Hadoop developers, is overhead, which Lipcon defined as effort spent on jobs you don’t care about. All of these metrics can be improved with some simple adjustments. For example, by tweaking the way Linux IO and caching you can decrease latency by roughly 20% while increasing disk utilization and smoothing out CPU usage.

According to Cloudera, these and other improvements are available in CDH3u3, resulting in a 15% to 150% increase in performance depending on the workload. Additions include MapReduce TaskTracker disk failure toleration, HDFS and MapReduce read-ahead and drop-behind for improved performance, HDFS improved block report performance via improved locking and parallel disk scanning, HDFS shortcut local DataNode reads for improved performance, and  HDFS re-use of client-to-DataNode connections for improved performance. Apache HBase has also been updated with Distributed log splitting on RegionServer crash, Atomic bulk load, and HBCK offline META rebuild as well as updates to Apache Oozie and Zookeeper.

CDH4, which will be available in beta shortly, has an even wider array of improvements and additions based on customer demands and industry trends. One of the biggest changes will be the inclusion of a High Availability Namenode so that if the namenode fails you won’t lose the whole cluster or your data. With Hadoop Distributed File System-RAID, HDFS’s data replication factor will drop from 3 to 2.2 times thanks to a Distributed Raid File System. DRFS increases protection against corruption and hence reduces the amount of replication necessary to ensure availability, for significant disk, rack, and power saving when dealing with Big Data.  CDH4 will also include Apache Mahout for machine learning and improved versions of Flume, Sqoop, and Hue. There will also be new HBase diagnostic and repair tools and Kerberos for security.

Lipcon also mentioned the direction of Hadoop R&D at Cloudera. Goals for future distributions include encryption, disaster recovery, metadata storage and management, resource management, and MapReduce alternatives for problems outside the framework.

Related articles

• Cloudera Day in DC (ctovision.com)
• Hadoop Quickstart: Build a Cluster In The Cloud In 20 Minutes Or Less (ctovision.com)
• Big Data Tip For The New Project Manager: Starting With Apache Hadoop (ctolabs.com)

The Galaxy Nexus has raised the bar for all mobile devices

While Apple recorded their best quarter ever, Samsung and Google released the most impressive smartphone to date. Appearing on the Verizon network with LTE radios in the US, as well GSM w/ HSDPA+ radios internationally, the Galaxy Nexus is the most groundbreaking phone available.

The mix of 32GB internal storage, a dual-core TI OMAP processor, Android 4.0, a beautiful 720p 4.65″ screen and high-speed 4G networks make it the phone to measure to. Running the un-distilled version of Google’s Android OS, the Galaxy Nexus has all the first-party support you’d expect from Samsung, and unrivaled support from the Android development community.

The Galaxy Nexus offers great battery life (for a LTE device) and the best user experience Android has had to date. While there is a bit of a learning curve coming from Gingerbread (2.3.x) or Honeycomb (3.x), Android 4.0.x is ready to play. With the right ROM, you can force the “menu” buttons back into play. Android 4.0.x was created to be easier on the average user – but with all the developer support, it can still be a geek powerhouse.

Developer support is part of what makes the Galaxy Nexus the phone to beat. A quick search of XDA Devlopers or Rootzwikiwill show the preponderance of developers out there supporting the Galaxy Nexus (in both GSM and CDMA/LTE forms).

Application support is coming. Google has been rolling out 2 or 3 updates to their core applications ever week, and the top 3rd party developers are joining the party as well. Many of the best Android applications are already updated with ICS versions in mind – so that they take full advantage of the huge screen and capabilities of the Nexus.

Trust in Team Kang for all your GNex ROM needs

I’ve been using the Android Open Kang Project ROM for over a month now. It’s my favorite ROM available, and gives you a great deal of flexibility and customization. Additionally, the creator, Roman, added some key performance options which increase battery life (and thus the usability of the device).

While Cyanogen Mod 9 is not out yet (the one based on Android 4.0.x), installing it on your device is something every user should consider. Part of the fun of Android is Rooting/ROMing/Theming your phone – getting it to exactly the specifications that make you work and play best. The Rooting process can be intimidating, and there will be some issues, but you’ll learn a lot about your device in the process. While you may lose of your data (most of it is backed up to the cloud), the capabilities gained (battery life, Wi-Fi Tether, full Nandroid backups, etc) will more than outweigh that in the future.

Do you have an Android device, if so, is it rooted, if not, what are you waiting for?

Related articles

• Amazon drops price of Galaxy Nexus to $100 (inquisitr.com)
• All Hail the Galaxy Nexus (ctovision.com)
• Now that ICS is here, don’t buy an Android that’s not the Galaxy Nexus (bobgourley.com)