:: MIS Insights ::

That’s the tagline from Lenovo 3000 C Series notebooks. I saw it along Edsa’s northbound tunnel intersecting Shaw Boulevard (in Tagalog, the tunnel in front of Edsa Shangri-la).

From the above tagline, I’d say Lenovo was trying to capture an audience that wants to:

• Make history - perform breakthroughs that will be remembered for years to come.
• Make history, Not Backups - have a system that can run forever. Don’t bother with backups, it won’t go down.

I’m all for both types of intended audience, but I don’t think such tagline is a good slogan from an IT security perspective. While such tagline was not meant to be taken literally as it is, it has a subconscious message preparing computer users for a big disaster.

I’ve had many people asking me once in a while, “Do you know how to recover data from a broken computer / hard drive?” To which I honestly reply, “If it’s a broken operating system that won’t let you in to see your files, I can help you with that. If there’s physical damage to the hard drive itself, there’s nothing much that I can do.”

While hard drives today are less prone to bad sectors (a common occurence 10 years ago) and have increased life times (mean time before failure), there is no reason not to make backups - whether we want to make history or not. While it may seem the most crude of IT security solutions in case of a disaster, it is still a basic and fundamental standard operation.

A year ago, I wrote about the same topic. Attached is my entry on the same topic.

(Read on …)

Once upon a time, there were ten employees in a big, bhg, bpg company. These ten employees, hailing from the same department, decided to go out for a noontime feast one day. Among the ten brave souls that dared to eat outside the department premises, five of them brought their magic identification cards. The rest didn’t.

Now these magic identification cards were bestowed upon them by the all-powerful Human Resources department to empower them during their quests - most of which had a minimum 2.5 year fellowship bond. Legend has it that if the magic cards were placed near the correct scanners, doors that led to untold treasures would open for them.



10 value meals and 1 hour later, the ten employees went back to the company to resume their quests. The first five with identification cards easily got in. With a 180-degree, crescent-shaped swiping motion of their magic identification cards over the department door’s scanner, the door unlocked with a loud “bzzzt!”



Then there was the other half that didn’t bring their magic card. They thought that, “Hey, fellow adventurers, you can let us in when you get in right?”

Well, the five cardless dolts were wrong. Their fellow prudent adventurers didn’t let them hitch a ride back inside to the department. They knew that the magic identification cards were there for a reason - to prevent, or at least minimize, unauthorized entry. One cannot even begin to imagine the horrors that would be unleashed if a cracker got inside to mess with the systems or if an intelligence spy got access to the company’s treasured information chest. Such careless behavior should not be tolerated. After all, who better can implement the company’s security program, other than the employees themselves?

The five boy/girl scouts wanted to teach the five rascals a lesson. However, the guard waiting at the lobby proved to be the weak link in the company’s security plan. With a persuasion spell of Pleasus Openus the Doorus Maximus, the guard promptly used his magic card to let the employees in to the department.

End of Story.

Truly, companies could do more with their security measures. This is an example of a security breach that used social engineering (guard) to thwart two of the pillars of IT security - authentication and authorization. In my honest opinion, either companies start implementing what they have on paper or scrap the whole program all together. With roughly US$3 per magic card and a hefty US$1,000 per scanner, the money could have been put to better use for the sake of the stockholders.