And now for something (not) completely different (old-school Monty Python fans will understand):  

(Please see Pt. I if you haven’t). 

Squarely within the concerns expressed in my prior article regarding my local Starbucks, I read yesterday that U.S. Airways suffered a power loss at a data center.  This loss took their website offline, grounded hundreds of flights nationwide, and consequently stranded thousands of passengers. 

U.S. Airways released the following statement yesterday:

US Airways is experiencing a computer systems outage that has impacted usairways.com and the airline’s airport computer systems.

Early reports indicate that the systems outage is the result of a power outage near one of the airline’s data centers in Phoenix.  Some airport computer systems are coming back online now and we are working to restore operational order.

We strongly encourage our customers to check their flight status before arriving at the airport by calling US Airways Reservations at 1-800-428-4322.

It’s not completely clear from this statement if the power outage involved utility mains – that is, elements of power outside the scope of their control – or something “near” the data center like its own internal power and associated management.  But – what of reciprocal systems?…  redundant data and process, geographically dispersed, and therefore not on the same substation, within the same power grid, nor same data center? 

I’m frankly surprised that a major airline could go offline like this – and I rather suspect the problem was “local” (that is, located within systems and controls of the airline itself).  However, I honestly don’t know – but the redundancy criticism is certainly valid.  My gosh, if an endeavor like an airline can’t maintain its continuity of business in the face of a mundane local power outage – instead suffering a national impact – I think something is seriously lagging.  Recognize:  Local power at one data center had national impact.

But here’s a lesson for everyone, from HelpDesk staff to senior executive class:

Survey your backup equipment, UPS devices, battery statuses, and configurations.  If you manage people who do those things, survey those people, and get them on it.  Take nothing for granted.

June 12^th:  On this day in 1979, Bryan Allen flew a human-powered aircraft over the English Channel, the Gossamer Albatross.  The flight took 2 hours and 49 minutes.

A few days ago my local Starbucks lost power.  The sun was shining and it was around 2 in the afternoon.  Suddenly, all the lights went out, the refrigerated cases went dark, and… yes, internet connectivity was out.

What I learned that day, and the next, was interesting to me, and I hope it can provide a lesson for all of us.  There had been a tremendous rainstorm the day prior to the outage.  As it turns out, upon this next day’s outage, one of the baristas mentioned that they had received a call from the local utility company earlier in the day that the power might “go down” in order to work on a station.  Huh.

Unfortunately, there was not only the one effect:  That is, an afternoon’s loss of power.  Something else occurred:  Next day, the ‘net still wasn’t available  - nor the next.  Apparently, a hard crash had affected some measure of my local Starbucks’ backoffice (if I may deign to call it that – I haven’t seen it).  And, for whatever reason, it was on Day 3 that internet connectivity was restored for customers.

On one of the days during ‘net unavailability, I worked at Starbucks, writing away.  I watched customer after customer walk out of the store upon hearing of the outage.  So, there was a definite business impact.

I’m wondering if Starbucks has a simple UPS with configuration for a graceful shutdown of equipment in the event of outages?  Perhaps it’s a calculated cost – they’d rather suffer a hard crash, with dispatch of a tech to fix whatever server, router, or measure of corruption has occurred.  (A barista also told me that she spent considerable time on the phone with someone from Starbucks who attempted to talk her through various resets and restore points – to no avail).

But – one also has to consider the lost business over the course of days due to the outage.  Even if it was a wash, it’s better to expend a little $$ for some measure of protection to equipment in just securing the environment for business reputation – and the secured environment for customer convenience of internet access and use.

Next:  Part II.

June 11^th:  On this day in 1911 the Tigers, trailing the White Sox 13-1, came back to win 16-15.  Never, never, never give up.

It was so tempting to title this, “Sobering:  Cyber Security and Society”… I do so love alliteration.

But no matter – perhaps as follow-up.  But today’s post is driven by some concerning statistics that are rather bothersome.  The number of cyber security incidents affecting Federal Government information is increasing. 

Consider:

Cyber Security Incidents Affecting Government Information:

-         2006 incidents reported:    5,503

-         2008 incidents reported:  16,843

-         2010 incidents reported:  41,776

Source:  GAO & Office of Management

“Affecting” involves everything and anything:  Exposure, corruption of data, nefarious manipulation of data, introduction of malware, breach, theft, loss, and so forth.  We all face the same sorts of threats and attendant bad outcomes.

It’s been awhile since I’ve done work for the Feds, but interestingly, I had occasion to do a little work for a city agency recently – just within these past weeks.  Obligation of Confidentiality prevents me from naming the city, agency, or specific work – and even absent that, I wouldn’t.  However, a rather illuminating incident does highlight what is likely to be a contributor to Federal, State, County and City governments’ challenges, and provides a lesson to us all.

An administrative person received a warning e-mail from Target regarding the Epsilon breach.  It appeared that the recently-departed, prior, Admin person had ordered from Target at that particular PC workstation, under generic login credentials (“Admin”), and Target was warning that the admin@xyz.org address, and perhaps other information, might be compromised . 

I notified the department’s Director, offering to draft an e-mail of warning regarding the Epsilon breach, and some things to watch for, to avoid, and some general cyber security tips.  A point to the department’s IT Security Policy would have been nice too (if they had one).

The Director declined – and because I was there contracting on other matters, I concentrated on those.  But… my gosh:  In 2011, you miss an opportunity to reinforce security awareness and to propagate best practices in a vulnerable environment?  Who can afford that? 

No  one.

The stats above are hardly surprising.  If you are in a position of influence – whether  government agency or private sector business – anything – never lose an opportunity to reinforce security awareness and best business practices.

Always remember this BTW principle: 

In the realm of risk, unmanaged possibilities become probabilities.

On this day:  In 1921, station KDKA broadcast the first radio sporting event:  a boxing match; Ray vs. Dundee.