First some definitions and news relating to the subject:

Process Mining:

Process mining is a family of techniques relating the fields of data science and process management to support the analysis of operational processes based on event logs. The goal of process mining is to turn event data into insights and actions.

Digital Twin:

A digital twin is a virtual representation that serves as the real-time digital counterpart of a organization or process.

News:

https://newsroom.ibm.com/2021-04-15-IBM-to-Acquire-myInvenio-to-help-Organizations-Use-AI-powered-Automation-to-Better-Streamline-Business-Processes

Background:

myInvenio is a disruptive solution of Process Mining and Digital Twin of an Organization to automatically analyze business processes, monitor and predict the future trends of processes.

Details:

“Addition of myInvenio provides customers with a comprehensive AI-powered automation portfolio for business automation – including process mining, robotic process automation (RPA), document processing, workflow, and decisions”

Notes:

Given the above details regarding Process Mining within an organization and creating a Digital Twin of an organization and then moving towards greater efficiency it is obvious that Network Automation is one piece of the puzzle. Efficiency of the whole organization depends on analyzing the processes and then putting the right kind of automation in place. Reading up on another article I saw that one method of process mining is to conduct interviews across organization to analyze what the staff do and to analyze the human part and the machine doable part. RPAs, Network Automation, Systems automation are one part of the puzzle. Gartner is calling this Hyperautomation.

Details:

Hyperautomation is the application of advanced technologies like RPA, …. and Process Mining to augment workers and automate processes in ways that are significantly more impactful than traditional automation capabilities. Hyperautomation is the combination of automation tools to deliver work.

Gartner’s report notes that this trend was kicked off with robotic process automation (RPA). The report notes that RPA alone is not hyperautomation. Hyperautomation requires a combination of tools to help support replicating pieces of work where a human is involved in a task.

Network transformation from a legacy HQ POP and WAN architecture to a more modern public cloud and secure access architecture is an interesting project. It entails migrating connectivity and security to new solutions. I recently came across a job advertisement for such a transformation project. The Job advertisement had the following list:

  • Build a resilient WAN environment in Megaport with Megaport Cloud Routers,
  • Connect on-prem data centres in Equinix
  • Megaport Cross Connects, migrate Azure ExpressRoute and AWS Direct Connect to Megaport.
  • Migrate on-prem data centre Internet to an ISP peering with Megaport with DDoS protection and migrate zScaler GRE tunnels to new Internet link.

The above is the connectivity addition and migration towards the public clouds.

The job ad continues:

  • Build physical Palo Alto firewalls for office locations and on-prem data centres (all in Sydney),
  • Build Panorama management solution and integrate with all Palo Altos including the ones currently hosted in Azure regions.
  • Redesign and build firewall policies with user-based firewall rules and Zero Trust Model.
  • Build Prisma Cloud and Prisma Access environment and migrate forward proxy from zScaler to Prisma for users and servers.
  • Build new RADIUS/NPS servers with Azure MFA and configure all network appliances to use these servers with RBAC policies and MFA prompt for admin privileges.

The above is the new secure access (SASE) solution work to be done – Secure Access Service Edge.  

And then the job ad lists:

  • Decommission Imperva DDoS, zScaler, legacy Cisco and Juniper firewalls and routers.

There goes the old stuff. After the migration to public cloud and the SASE solution the previous network devices which aren’t needed are being decommissioned.

The skills required are listed as:

Primary Skills Required = Palo Alto (firewalls, Panorama, Prisma and Global Protect), Juniper SRX, Cisco Switching and Routing, Azure Networks, Citrix Netscalers (for load balancing and failover), Python scripting

Ancillary Skills Required = Splunk (syslog integration and queries), Azure automation, CI/CD with Azure DevOps Additional Skills Preferred = Megaport, RADIUS/NPS

These are the skills which the network engineer needs to carry out the transformation. Heaven knows how many will already have those as these transformations are a bit new.

Networking is transforming. This takes the enterprise’s network to the next generation of solutions available. The two key items are Public Cloud and SD-WAN based secure access. So the enterprise transforms to adapt to the new traffic flows and the new traffic patterns. Traffic patterns and flows which are different in terms of sources and sinks. They now include sinks/sources to be hosted in Azure or AWS (in addition to on-prem) and a remote workforce. These new dynamics also require a new security solution as well which is very much different from a simple firewall perimeter in the HQ POP earlier. Therefore and SDWAN based Security layer is added.

Copied:

Secure access service edge (SASE) is a network architecture that combines VPN and SD-WAN capabilities with cloud-native security functions such as secure web gateways, cloud access security brokers, firewalls, and zero-trust network access. These functions are delivered from the cloud and provided as a service by the SASE vendor.

Let’s now dig a bit deeper.

The first part is L3 routing BGP style and all of that related work. Given again here so that we can first divide and conquer the connectivity related items:

  • Build a resilient WAN environment in Megaport with Megaport Cloud Routers,
  • Connect on-prem data centres in Equinix
  • Megaport Cross Connects, migrate Azure ExpressRoute and AWS Direct Connect to Megaport.
  • Migrate on-prem data centre Internet to an ISP peering with Megaport with DDoS protection and migrate zScaler GRE tunnels to new Internet link.

Here is a good picture from Megaport documentation:

Source: https://docs.megaport.com/mcr/route-advertisement/

One thing to note is the BGP ASN numbers. The red are the Megaport Cloud Routers (MCR) and so MCR are a BGP hop with their own ASN. We are looking at BGP peering configurations between on-prem and the MCR and between the MCR and the public cloud. This means 4 BGP configurations. One in the on-prem device facing the MCR (firewall or router), another 2 on the megaport MCR one facing on-prem and one facing the public cloud, another 1 facing the public cloud.

This is in its simplest form. The figure shows more because there could be private subnetworks hosted with the public cloud. These might have separate BGP neighbourships. So for example multiple Azure VNETs. If there are multiple public clouds like both Azure and AWS then each will have separate routing configured at the MCR as well.

The job ad again:

  • Megaport Cross Connects, migrate Azure ExpressRoute and AWS Direct Connect to Megaport.
  • Migrate on-prem data centre Internet to an ISP peering with Megaport with DDoS protection and migrate zScaler GRE tunnels to new Internet link.

So new cross connects, new SFPs, new fibre optic cables and new port configs. Then migration cutover of traffic from ExpressRoute and Direct Connect to the MCR. This would be route changes. With the MCR Megaport all set up the next hops will be cut over for traffic to travel via megaport instead of the old express route etc. Any GRE tunnels will be reconfigured in a cutover change window too.

Now let’s move on to the newer security phenomenon which is securing the remote edge and devices.

For this part the job ad states:

  • Build physical Palo Alto firewalls for office locations and on-prem data centres

This is simply a firewall rollout. Installation and integration into the network. Palo Alto documentation is the best friend. Some vendor help might be required which comes when you buy stuff.

Jod ad again:

  • Build Panorama management solution and integrate with all Palo Altos including the ones currently hosted in Azure regions.

What is Panorama? Here it is:

Panorama is a centralized management system that provides global visibility and control over multiple Palo Alto Networks next generation firewalls through an easy to use web-based interface. Panorama enables administrators to view aggregate or device-specific application, user, and content data and manage multiple Palo Alto Networks firewalls—all from a central location.

So it’s a GUI. A centralized Management Server. Therefore it is a software application which will need to be installed on a VM or a server. It will need to be configured to add all the Palo Alto firewalls rolled out above. The GUI/Server will need to be added to the network and assigned an IP and it will need IP level connectivity to each firewall to administer it.

Moving on another part of the job ad:

  • Redesign and build firewall policies with user-based firewall rules and Zero Trust Model.
  • Build Prisma Cloud and Prisma Access environment and migrate forward proxy from zScaler to Prisma for users and servers.

What is Prisma Access?

Prisma Access provides a network of cloud-based next-generation security gateways that secures traffic. Mobile workforces are distributed around the world, and Prisma Access for mobile users establishes points of presence for them to use.

Prisma Access works together with the GlobalProtect agent/app on laptops and mobile devices. When a remote user has internet connectivity, the GlobalProtect app locates the best gateway available for the user’s location and sets up an IPsec/SSL VPN tunnel. All traffic passes through Prisma Access.

Therefore we can say that it is a secure gateway solution for the remote and mobile workforce. The zscaler for each remote worker.  In essence it appears to be an enforcement point where a client on the devices sends traffic to Prisma Access and then Prisma Access secures it. It will use SD-WAN and application level access policies under the hood.

Prisma Access brings protection closer to users so traffic doesn’t have to back-haul to headquarters to reach the cloud. Prisma Access ensures Zero Trust Network Access (ZTNA) with service and application-specific access controls.

I think practically this will require proxy connectivity configurations to be put in place and for policies to be added and removed via Palo Alto management portal. From looking at the Palo Alto documentation on configuring Prisma Access it appears it has mobile devices onboarding, Panorama connectivity onboarding amongst other things.   

What is Prisma Cloud ?

Prisma Cloud is the industry’s only comprehensive Cloud Native Security Platform (CNSP) that delivers full lifecycle security and full stack protection for multi- and hybrid-cloud environments.

Cloud Security Posture Management (CSPM) Prisma Cloud provides:• Visibility, compliance, and governance» Cloud asset inventory» Configuration assessment (runtime)» Compliance monitoring and reporting » Infrastructure-as-code (IaC) configuration scans (IDE, SCM, and CI/CD)• Threat detection» User and entity behavior analytics (UEBA)» API-based network traffic visibility, analytics, and anomaly detection» Automated investigation and response

Cloud Infrastructure Entitlement Management – Prisma Cloud provides:• Permissions visibility• IAM governance• Automated response• User and entity behavior analytics (UEBA)

Prisma Cloud seems to be a cloud access security point. A developer, development environment and application security checking point. So whereas Prisma Access was securing the remote workforce the Prisma Cloud secures the cloud deployment by checking the users and entities accessing the servers in the public cloud. The Entitlement Management is a high priority thing for the public cloud where it is functioning as an Identity and Access Management permissions checking point.  From the above it is also doing IaC config scans.

I think practically this is also a GUI based users, account, permissions addition and removal. There are accounts and groups and roles and policies to make. It is like the Active Directory or Cisco ISE of the public cloud security.

Job ad again:

  • Build new RADIUS/NPS servers with Azure MFA and configure all network appliances to use these servers with RBAC policies and MFA prompt for admin privileges.

What is this about:

The Network Policy Server (NPS) extension for Azure AD Multi-Factor Authentication adds cloud-based MFA capabilities to your authentication infrastructure using your existing servers. With the NPS extension, you can add phone call, text message, or phone app verification to your existing authentication flow without having to install, configure, and maintain new servers.

The NPS extension acts as an adapter between RADIUS and cloud-based Azure AD Multi-Factor Authentication to provide a second factor of authentication for federated or synced users.

So this is a security 2 factor authentication setup for the network nodes. It uses Radius protocol for the user/permissions exchange. An extension appears to be requiring installation and here again I think users and roles and permissions and accounts will need to be setup or perhaps they will be integrated from AD.  

That’s it. A two part work required to connect to the public cloud and to put in a new security solution. One part needs BGP routing and network configs. Another part needs firewall deployment and policies and users administration. Enterprise Transformation done right.

8 years ago in March 2013 I covered NIST’s definition of Cloud Computing :

https://networkfuel.blog/2013/03/12/breaking-into-the-field-of-cloud-computing-networking/

Now after a while it’s time for NIST’s Cybersecurity Framework. They have done a very good job again with this one. One of the best documents out there to manage your organizations cybersecurity is definitely the NIST framework. It covers the breadth and depth of the requirements from cybersecurity teams.

This is the excel link: https://www.nist.gov/document/2018-04-16frameworkv11core1xlsx

With 108 Titles it seems daunting but trust me its very intuitive. It has been divided into simple and intuitive sections. These are easily understood by anyone who has worked in networks and systems and large to medium scale orgs which practice these.

Identify – Protect – Detect – Respond – Recover

The details are below:

Once you grab this it is easier to understand all the sections of the framework. To implement this in any organization it is necessary to spend time and effort on each of them and carry out the exercise required for each category and sub category.

This is important and not practicing the correct methodology could cause an incident in the organization and would either leak data or cause damage otherwise.

For this blog I have chosen to specify four areas which exist in the globe. There is Research and Development going on in academic knowledge hubs and some large organizations. There are products being made and sold by organizations. There is a service being provided by organizations, There is knowledge being sold by organizations.

Research is mostly being carried out by academia and universities.

Products are being made and sold by organizations based on market demands.

Services are provided by organizations based on market needs.

Knowledge is sold by organizations and individuals.

To do research people dive deep into a problem to solve it and invent a solution. To make a product an exercise in engineering and manufacturing is carried out to make something. To provide a service you have something which you own or can do and other people use it and pay you for the use. For knowledge people or organizations know something and they sell their knowledge and analysis of it.

What is more important. Invent; Make, Serve or Know.

As things stand:

  • Some people are inventing as they have the budget to invest people into researching and inventing.
  • Some people are making because they have the source materials, the manufacturing capability and the people to make that thing.
  • Some people are providing a service because they have the people and equipment available to provide that service.
  • Some people are selling knowledge and analysis because they have that knowledge and are capable of providing an analysis on it.

As IT evolves it appears feasible that pretty soon the majority of people on the planet will soon have a very capable smart device with them. One thing that is lacking still is a consensus global identification app which could be utilised to identify a person across countries. This only requires coordination and enablement. Already a global ID system exists in the form of Passports. Another unique global system which exists is the phone numbers system which have country codes and numbers unique in the world.

Will it ever happen that a smartphone that a person carries will have an epassport and a phone number as an ID which can be used at airports. Here is my smartphone, it has my passport, my base country ID, my base country driving license, my phone number and here is me. In addition to that here is my linkedin, my facebook, my twitter and here is me.

The international credit card system is a very good example of coordination. It has a number, a name, an expiry and a CVC number. It is unique and can be used globally online.

There could be a similar global ID card and a global eID which works. If anyone opts in they will be a known Citizen of the World. If anyone opts out they will a disconnected individual who prefers some privacy.

Cost of SaaS and SaaS Operating Income should always be the main concern when making an investment in SaaS or buying SaaS. Power, People, Vendors, Equipment. That sums up the game pretty much. Power as in Electricity cost per unit, people as in cost of manpower, vendors and equipment as in the manufacturers and organisations providing you the equipment.

Cloud computing was initially coined to serve as Infrastructure as a Service (IaaS) purposes where you will have access to virtual machines running on in offsite cloud providers data center. This gave the advantage to organizations of not taking the pain of managing hardware and Infrastructre like routers, switches, servers, storage boxes etc. Clouds then evolved to include Platform as a Service where you would get containers and kubernetes services. This would essentially be a lighter platform more lightweight than virtual machines and henceforth cheaper. Clouds then further evolved to add on FaaS – function as a Service where very light instructions could be sent and processed and results could be served. This would further minimize cost by having an even lighter ‘booked-reserved’ infrastructure from the pool and being even lighter.

In all cases – IaaS, PaaS or FaaS one thing is common and that is the fact that you will still need to develop an ‘Application Software’. If you want to develop and deploy your application on VMs like Windows Server or Centos/Redhat you can go for Infrastructure as a Service. If you want to develop and deploy on containers you can go for Platform as a Service – PaaS. If you want to use a public clouds Functions as a Service offering then develop and deploy custom code using the APIs exposed by the cloud and make an application. In any case you need to develop a software stack which will be the Application.

The benefit of SaaS is that you will get an end product already developed software ‘Application’ all ready to use.

This is the best the cloud can get to. Click and start running a software application as per your need. Work and pay as you grow on the application. A software which is online and managed by a vendor which is simply hosted on a cloud somewhere and you are using it. What else could be easier. Your main business aim is to have an Application. That is why you buy IaaS, PaaS or FaaS. You will still need to develop and deploy an application on these three. But if you opt for SaaS then you get a service immediately.

To that end it is important to get the Cost model right with your SaaS vendor and make sure you pay them a reasonable profit and get a reasonable cost service. The SaaS vendor should have deployed their service preferably on a FaaS or PaaS from one of the main clouds. Or they should have a stable infrastructure of their own. But their Power Usage Efficiency – PUE should be cost optimised so that their infrastructures power bill is low not high. Their ops costs should be optimised and their Total Cost of Ownership should be cost optimized.

SaaS is the best the cloud can offer and an organization must select a good SaaS provider. I am not aware of a SaaS inter-vendor protocol where you could migrate from on SaaS to another SaaS easily. This would be a strange thing in any case if it existed.

Lets imagine your SaaS providers Costs –

Data Center Power cost (Electricity), UPSs etc, Routers, Servers (CPUs, RAM, HD), Real Estate cost, Network Engineers, Systems Administrators, Operating System (Linux/Redhat etc), Virtualization (VMware/KVM etc), Fibre Optics SFPs, Fibre Optic Cables, CPUs, Data Center Operations Staff, Software Stack Operations Staff, Platform Operations Staff, Network and OS Operations Staff.

List of sample SaaS cost factors above.

On top of all this they are offering you a service online for a cost. At the back-end they are supposedly managing this all for you. Now imagine that this SaaS offering is being offered from a location where the power bill is high, where the operations staff bill is high. Imagine they are using say a costly virtualization platform or imagine they are using costly routers and switches or costly servers. Or imagine even that they are using costly SFPs and cables or even costly UPS battery backups and costly generator backups or costly other things. This would all add to the CoSaaS – Cost of Software as a Service offering. To minimize CoSaaS – Cost of Software as a Service the SaaS vendor needs to be using a highly optimized structure for all of the above list of sample SaaS cost factors. If they arent it’ll all boil down to a costlier SaaS offering for you.

Therefore it is important to weigh your options. Do you have time to develop application software ? do you want to buy an IaaS, PaaS, FaaS offering and have the time to make a software application on top of these ? Do you instead want to just get a service and pay for it via Saas model ? Do you have the resouces to build a date center and house the OS, virtualisation etc on it ?

If you want to just get a service and pay for it via SaaS then it is important to ask pointed questions from your SaaS vendor as to what their Power Bill is like ? What vendor Switches/Routers are they using and where are they sourced from ? What vendor servers are they using and where are they sourced from ? Are their routers and servers cheap or costly ? Where are their operations teams located and is their Ops teams bill costly ? Ask them clearly where are your Data Centers located and are they somewhere where power is very expensive ? Because these things run on power you know. Which virtualisation platform are the SaaS provider using and does it have a costly license ?

Now it is simply a time to compare TCO – Total Cost of Ownership. Simply make a list of your own Cost and Time factor. Do you have the Time and Cost and resources to Make and Build the equivalent of this Software as a Service in-house. Integration is also an engineering effort and so do you want to buy the above list of items from multiple different vendors and integrate them yourself in an in-house fashion and then run an application on it ? How much would all the above list cost you ? How much is the Power Bill in your area, Real estate bill in your area, License cost and routers and servers cost which you would pay for. In the end you can do a cost comparison. If you were to build, make, integrate, source and deploy whatever you want to do in-house then roughly how much would it cost. In comparison how much is the SaaS vendor asking for.

An organization may simply do a project planning cost finding exercise and find out how much engineering and resource costs are needed to do something in house and how much in comparison the SaaS vendor is charging.

I feel slowly organizations small and large will slowly move to SaaS offerings from major providers. Major providers source cheaper equipment, they get better deals from their vendors, they get better power bill locations and power deals, they do 24/7 operations globally from various locations to get cheaper operations staff costs. In the end they will offer a SaaS stack for a cheaper price.

To that end I think privacy dies here and you are out of luck if privacy is a concern. The SaaS vendors data center may be far off in another country where the power is cheaper and your data is therefore at that location. The SaaS vendors teams may be located across the globe they run your application and well your privacy is dead.

If indeed privacy is a concern and you want to seriously do things in house than one good option is to try to use Nextcloud. It is an open source SaaS stack which is a good service and can help in privacy and locality requirements.

I feel SaaS is important as in the end you need a software application and want to use that.

I hope you find this blog post helpful.

Thanks

Habib

In IT there are different types of works. Not everyone realises this and not everyone knows which field of work they are in and which they are not in. For example an operations engineer who has worked in operations for a considerable time of his career might find it difficult to adjust in a deployment role or an architecture position. If you are in one line generally the hiring party knows your line and try to select a person from within that line. There is a difference between running an already built system and setting up a system. There is a difference between setting up a system already designed and designing of a new system. The design of the system is dependant on the requirements from that system and the tools and protocols you have at hand. The requirements of the application dictate the design. This work of requirement analysis and design is different from installing the system. Furthermore design and install are both different from running a system continuosly. These are all different skills and some people know all three and settle in one while some people know only one and work within that one. Generally these are titled Operations which is running a system and Deployment which is installing a system and Architecture which is designing a system.

Installation and Deployment fall under project execution work and Architecture and Design fall under project planning. Running a system and operations is generally considered non-project. It is good for an engineer to know the line of business he is in and choose to either intelligently acquire further skills within his line or acquire the skills of another line and move into that one. An Operations engineer might work in Ops for a few years and learn design skills and try to move into Deployment Project work. He may then move onto Design and Architecture work. Operations work are normally 24/7 all week 365 days of the year and this require weekend shift and night shifts and oncall work. Project and Deployment work are generally day time office hours work but the site installation work is somtimes done after hours in a planned maintenance window. Architecture and Design is mostly 9-5 business hours work. Some operations roles are now done internationally in a follow-the-sun manner across countries and across timezones. This means that in one country when it is daytime their engineers are on call and are running the system and after sunset another country wakes up and engineers in that timezone are handling the operations in their daytime. This is called follow-the-sun operations and in organisations running like this ops work also is in daytime only. Normally these are large organisation spanning the globe with presence in multiple countries.

Habib

I came across a job ad titled Systems Reliability Engineer which turns out to be a sort of a hybrid engineer skillset. Its details are copied below. Bear with me while I break things down.

The hybrid part in this is that it requires a combination of:

   – Linux/Unix/Virtualisation which falls generally under SysAdmin roles.

   – Networking which falls under Network Engineer roles

   – Storage and Server which generally falls under Storage/Backup Engineer

   – Kubernetes which is a container orchestrator and will provide a platform for a distributed application. This is a new field but I think its safe to say that Devops Engineer or Platform Engineer role titles handle this responsibility.

   – AWS/Azure/GCP Cloud which are Public cloud IaaS, PaaS or FaaS services.  This falls under Cloud Engineer or Devops Engineer.

A combination of the above knowledge bank is required to function as a Systems Reliability Engineer here.

And so we can say that a Systems Reliability Engineer is composed of a SysAdmin, Network Engineer, Storage Engineer, Devops Engineer, Platform Engineer and Cloud Engineer.

Can we break this down a bit more?

Starting with the Application workload, suffice to assume that the heavy weight applications which this guy will support require a networked distributed system to run. They are cloud native microservices based applications requiring a networked distributed system to run. The application needs CPU cores, RAM, Storage, IOPS, Bandwidth at such a scale.

Digging in further it can be observed that the individual components require an OS and Virtualisation (Linux/Unix/KVM etc – Sysadmin). Networking these individual components require L2/L3 networks (Routers, Switches – NetEng) and further on what can be called a Distributed System OS is required which will present not individual components but the servers/OS/router/switches/vswitches/ storage combo to the application. Kubernetes can be said to be the Distributed System OS providing orchestration and management of namespaces/containers. A distributed file system and storage servers will also be present. Certain parts of the application may be interacting with public clouds (AWS/Azure/GCP) to run certain workloads on public cloud instead of on the local infrastructure.

Oh dear, what a combination of knowledge bank and skillset this person needs!

In Computer Science we work on the principle of Abstraction Layers where there are layers which have science and phenomenon within themselves and then they provide a function or service to another layer. And so the whole system is composed of multiple Abstraction Layers interacting with each other. In this case this Systems Reliability Engineer requires knowledge spanning multiple Abstraction Layers. Traditional engineers have been functioning within their own Abstraction Layer. Their specific jobs have been complicated enough to require tips and tricks of that same abstraction layer to make things work. An engineer working in the networking abstraction layer knows how to troubleshoot links, routing, SFPs etc and an engineer working the SysAdmin layer knows what to do with the Linux OS, KVM etc etc. Similarly an engineer working on the Public Cloud may actually know the tips and tricks of 1 or 2 public clouds and not all 3. Kubernetes and container management is itself now an Abstraction Layer.

This job advertisement not only lists multiple abstraction layers but even within them it lists multiple tools. For example within Virtualisation it lists KVM, ESXi and HyperV all 3 famous hypervisors and within Public Cloud it lists GCP, Azure and AWS all three. So not only does it span abstraction layers but even within abstraction layers it is asking for familiarity with multiple versions of software.

In IT Operations knowing the right command or the right place to click sometimes matters a lot. Things dont proceed if you dont know the command or dont know where to click or what parameter to enter. Spanning Abstraction Layers and multiple tools within Abstraction Layers is a tricky job for IT Operations. I am guessing they will have a team and will manage the skillset of the team and not individual engineers. Multiple engineers with basic knowledge of the system and specific knowledge of 1 or 2 Abstraction Layers and 2 or 3 tools. The team level skill set management would be an important aspect here.

The rest of the job description suggests this is an operations job as they required full work week availability and troubleshooting skills as well. So this new hybrid engineer will be tasked with on shift troubleshooting work supporting customers and speaking to vendors etc. It is important to note that this is not a Project Deployment or Professional Services job where you are reviewing designs, testing solutions, submitting BOMs, reviewing equiptment lists, counting item, installing systems and configuring systems from scratch. This is an Ops tshooting break-fix role. As such it requires a troubleshooting mindset and will require sufficient knowledge of the systems functions and the individual components to identify which part of the system is causing a bug or service impact. Once you identify which part is broken (eg networking or virtualisation) then you might need to dig a bit deeper and review some logs within that component to a certain level. Thereafter they will make an intelligent decision on either actions to fix the component or whom next to contact to fix the problem. Each individual component will have their own level 3 support structure and vendor and this Systems Reliability Engineer will identify whether networking is broken or virtualisation is broken or storage is broken etc etc. He will then attempt a certain level of fix and if not then consult the right team or vendor.

As such when we look at the multiple skill sets required it looks very very complicated for one person to know all this. From my experience of 13 years IT still ongoing we are still in a siloed world where possibly a network engineer with a ccnp is progressing towards senior network engineer and CCIE or maybe only diversifieng with an AWS or Azure skill. A comprehensive non-siloed cross abstraction layer engineer with kubernetes, storage, public cloud, networking, virtualization, linux knowledge will probably be difficult to find because from what I see a lot of people are comfortable within their abstraction layer and such diversity is not necessary and is a big headache. Within networking which is my field I feel that network engineers are probably proceeding with deeper design knowledge or AWS/Azure diversification or Python Network Automation knowledge as a career path. Same might be true for say engineers within the Virtualization / Sysadmin layer who might be developing inside that abstraction layer. Further tricky is the part that you need this cross abstraction layer engineer to have ops and troubleshooting mindset willing to do shifts on weekends. There will be few people out there. Perhaps some incentives might be required to find the right diverse engineer working weekends. Incentives like permanent work from home or any nearby country accepted working the right timezone etc.

These are the new Hybrid Engineers.

Update: I later came to know that they have mentioned that they require 2 or 3 out of the skill set. So it appears they aee dividing skillset on a team level.

Habib

Privacy Engineering has become a new subject. Recent implementation of the GDPR law by Europe and similar laws following up elsewhere are affecting the internet. The internet is a beast which is difficult to control. There are forums and platforms on it where collaboration is fast and speedy which is difficult to dictate and control. A persons otherwise private information is stored on servers in distant places.

Recent concerns include that of children and their online exposure. Children and youth become members at various platforms on the internet and their online activity is stored on the servers of the service they use. This means that their messages, writings, exchanges, search queries and any and all activity is present in some form on the internet. Whichever service they use will have networks spanning the globe and this data might well be present in a different country. This means that the childrens and youths data of one country is present and stored (and possibly analyzed) in another country. This will be objectionable to the elders of that country who might want to retain the data of their citizens within their country. To this end it appears that Data Centers might need to be established in various countries which enact laws to keep their citizens data in-country.

One more concern is that large corporations of another country might have the data of your citizens. This means that they will have to comply to the laws of the country they belong to. This therefore means that any legal request for Data will have to be complied with and so your countries citizens data could well be legally shared to another country’s state agencies. Its a mixed bag of items. You have access to a free online service which shows you ads and provides free connectivity and free collaboration services but as a result it has your data.

One thought process is ‘Who Cares’. As long as you are a normal peace loving citizen of any country who goes online to express ordinary acceptable views according to acceptable standards then who cares if your Data is here, there or elsewhere? Another thought process is ‘I do care’ and don’t want my Data to be present anywhere at all and don’t want my data to be accessible by any entity of any state.
The fundamental question arises whether one considers the state as a friend or as a foe and whether one trusts the state or doesn’t trust the state. The fundamental question arises whether one consider their own state or the foreign state with their data trust-able or not. These are all valid questions and one persons view will be different from another persons view on this subject.

Do you want to be blackmailed or maligned at any point in your life based on any of your past internet activity ?
Do you want your state to be able to blackmail or malign you based on your internet activity?
Do you want another country to be able to blackmail or malign you based on your internet activity?
Is your online data from your past online activity such that if it goes public it could create problems for you ? Or is it such that you are afraid that if it goes in any enemies hands they could blackmail you ?
Do you want your children to be unknowingly doing stuff online at a young age for which they could be maligned or blackmailed at a later date ?
These are also valid questions and one persons view on this may vary from another persons view.

From these questions arises the field of Privacy Engineering where the technical, societal and legal aspects of privacy are raised. These are indeed difficult but valid questions. If a person with ill intent gains access to your online data this could definitely affect your life.

The internet is a battleground for control and a battleground for civilizations competing as well. One persons acceptable content is another persons evil and unacceptable content. What is evil content and what is good content is not agreed upon between different groups of humans. Therefore they compete on the content on the internet.

The Internet also poses one of the most difficult situations existing on the planet for parents. Parents across the globe who are knowingly or unknowingly defenders of the human spirit in their children find it difficult to put their children on the internet. It is such a challenging exercise to preserve the human spirit of your child if their heart and mind gets exposed to evil inputs from the internet. Parents knowingly or unknowingly care for their childs human spirit and want to raise a good human being. This means that the eyes and ears of their children do not get exposed to evil content and evil inputs. The eyes and ears are direct paths to the mind and the heart and affect the hearts of the children and affect their spirit and affect the childs character. Access to the internet poses a grave risk and allows possible access to otherwise dangerous content.

This poses a difficult situation where an attractable instrument exists in everyones pocket which exposes their childs eyes, ears, heart and mind to content which they consider evil, inappropriate and unacceptable. At a young age if the child starts browsing content on the internet and their immature mind gets exposed to information or content which they are not yet fit to absorb they then begin to think about things which perhaps they cant handle at that age. This is one of the most difficult situations on the planet for parents.

This presents a field which could be named as Internet Morality Engineering. Parents I guess would be interested in Morality Engineering. (Morality: principles concerning the distinction between right and wrong or good and bad behavior)

This is again a mixed bag of items where one mans morality is another mans immorality. Again the Internet here becomes a battleground for a clash of civilizations and a clash of values and a clash of cultures.

It is indeed a sad situation at the moment in the worldwide community that the internet is affecting the children and the youth of the planet in negative ways. It comes as a mixed bag where one could use the internet to gain insight into any subject technical, scientific or social but it could negatively affect childrens thoughts, mindset and character as well.

The internet and technology is possibly or definitely a cause of child and youth mental health problems. Exposure at a young immature age to mature content will most definitely lead to mental health problems. On this issue again the states of the world are inactive and the children and youth are getting exposed to everything on the net.

At what age should a child have a smartphone with internet access ? This is one of the most difficult questions for parents. The Morality and Privacy concerns regarding the internets content put much stress on the parents of the world.

It is an unfortunate state of affairs regarding the internet industry today that there aren’t much good controls present which would control childrens and youths internet exposure. States and governments don’t appear to be doing much to preserve their childrens or even adults minds, hearts, eyes and ears from evil, unacceptable content on the internet.


There seems to be a total lack of understanding of ‘evil and unacceptable’ and its definition and there seems to be no state or government efforts underway to prevent exposure to evil things on the internet. This again becomes a case for Internet Morality Engineering which would debate on evil and evil content and goodness and good content. A contentious issue which would definitely be debated heavily but do you want to not debate it today and have the children of the world
and children of your country or even your own kids to grow up with mental health problems ?

The hearts, minds and the spirits of the children of the world are at stake and Internet Morality should be debated heavily. The Internets governing laws around the globe should address Goodness, Evil, Morality, Good Content, Bad Content, childrens exposure, child mental health and youth mental health problems. This should not just be left to private individuals and small groups. It must be addressed in government forums at a large scale. It is important for the children of the world and the parents of the world and the future of the internet and the future of humanity to have some control exercised on the internets content.

The ears and the eyes are means of reaching the heart and the mind. It should be debated what the ears and the eyes of children, youth and even adults get exposed to on the internet. What is acceptable exposure and what is unacceptable exposure ? It is a difficult debate but is important.

I would advocate that all the content on the internet must be ‘tagged’ like the content on the TV. Content on TV is tagged G (General), PG (Parental Guidance) and M (Mature) etc. and there are tags on content on streaming services, movies and games. I believe the same should be done for everything on the internet. There should be a G switch for the internet where it can be enabled on a smartphone and a browser and access becomes restricted to G rated Internet much like
streaming services parental guidance mechanisms. This will require at source i.e. at server side programmatic enablement.

In addition a home and the community is a controlled exposure by parents for their kids. I would also advocate that much like this there should be a service available on smartphones and all internet platforms where a parent controls exposure to only allowed online acquaintances for their kids.

I would say that as there is IETF – Internet Engineering Task Force there should be an IMETF Internet Morality Engineering Task Force.

This is very very important. Keep in mind that not every parent is fully educated or fully literate or fully tech savvy to control content at user end. There should be at source support for Internet Morality Decisions.

Habib

Shuffling large amounts of data around is the new thing. A cloud there, a cloud here, another third cloud there ; all connected and giving Multi Cloud. But will you ever move a large amount of Data off a cloud ? Or on a cloud ? Or between 2 clouds ?

What is the Data Shuffling Cost between clouds ? Is there Data Shuffle Lock-in ?

Imagine Serverless Lock-in and Data Shuffle Lock-in. Consider this with Data Gravity and Data Sovereignty.

Consider Data creation location, Data transport mediums, Data handover location, Data processing location and results publishing location.

Consider the Stream Processing nature of Data results. Systems handling data at large velocity.

The concept that Data resides on storage places and that Data transfer takes time brings about the concept of Data Gravity. Wherever a GB is created it must be stored and transferred as well. This requires storage space and network bandwidth.  If as in 5G there are mobile phones and other electronics creating a lot of Data then Edge processing should be the way for some applications due to the created Data’s gravity. If all of the created Data needs to be transferred to a Data Center far far away for processing then that will require network throughput which is slow and costly. This would mean that some calculations, inferences and data processing will probably be done at the edge.  In addition if Data Sovereignty laws are present in the country then Data will need to be stored within that countries boundaries at the country edge.

But it is interesting to note that Google search results are Anti Data Gravity where text is entered and a result appears very fast. The data of the search item is small and processing is done at backend data centers that are both near the edge POP and far far away. If search text is small and can be handled without much concern of Data Gravity then can other things be done similarly? At what data size and at what network speed are other similar processing works possible for other applications.

There must be a balance between Edge Processing for some applications and Central Processing of some Data then. 

These concepts don’t seem new. I think in Computer Science Intel’s Multicore CPUs and Oracle’s distributed databases will have dealt with these already. It is only that geographical size has changed and instead of a KB it became an MB and then now it is GB. It is only that instead of a single circuit board and a local area network the network has grown larger. Some of the basic concepts of Storing, Retrieving, Interlocking, Delay, Latency, Queuing, Caching, Paging and Number crunching etc would probably be the same even now. 

Habib

Infrastructure as Code has two main sections to it. The first is running the code itself and executing the change onto the cloud platform. The second is maintaning the version control of the code. i.e multiple changes by multiple people to the code.

For executing the change one could use Ansible or Terraform.

From a high level you simply run an Ansible playbook while having changed the variables files to make changes to the environemnt. One could do this without getting too much into the way Ansible is working. Inside Ansible there are roles and tasks which divide the execution of the playbooks in a structured format so that writing complex playbooks is easier.

The second part regarding version control of the code is required because there are multiple people in a team making multiple changes to the Infra as Code variables. So for example one person could be adding a firewall rule subnet to one firewall and another person could be adding a firewall rule to another firewall. So if you imagine that all the firewall rule subnets are actually present in one variables file for all the firewalls then you need version control to coordinate these two changes to the file. This version control is done by Git and Bitbucket mostly and these are the two famous tools to maintain software code versioning.

This is definitely similar to what any large software system build and maintenance would require where multiple software developers are writing code and changing code in all sorts of code files at the same time so you need a version control system to maintain consistency. These have push and pull mechanism where when you make a change locally and push it onto the main file and at the master file you pull the change. It also has peer review mechanisms where other team members can review your code differences before they allow your code to enter the main repository.

To conclude, imagine you have 30 Azure VNETs (Network VRFs) and 30 Azure Firewalls in your product deployment. As people ask you regularly to make firewall rule changes and add and delete subnets it requires either manually going to the Azure web portal and making changes their or you could use Infrastructure as Code and make the changes via Ansible playbooks and git/bitbucket variable files.

This post will cover multicloud networking integration between multiple public clouds and on prem network. Imagine four clouds three being AWS, Azure and GCP and the fourth being the on prem private cloud which is basically a Data Center network.

All these four clouds will be glued together somehow and that glueing will be the multicloud scenario. The basic requirements would be to have switching, routing, firewalling and load balancing equipment present within the glueing network between the four clouds.

Switching would be present to trunk layer 2 between IP endpoints. Routing and routing protocols like BGP would be there to exchange the IP endpoints reachability information to populate routing tables and get the Nexthops.

IP planning would be involved in the sense that the On Prem and the three public clouds dont have duplicate conflicting IP address spaces and there aren’t two endpoints in the network which are generating packets with the same source IP address.

In essence if there a single routing table present in your environement which has routes for all three Public cloud endpoint subnets and also the routes for the on prem DC network then you have multicloud established.

Wherever this routing table exists from that location there will be Layer 2 swithcing links and trunks into the three clouds and On-Prem until the trunks reach the other routing tables within the clouds, be it Azure VNET routing table, AWS/GCP VPC routing tables or On-Prem DC Routing Tables.

This multi-cloud environment is somewhat similar to large Service Provider public internet networks we are all familiar with where each large SP can be considered a cloud in itself with routes being exchange with the other large SP i.e. similar to cloud routes over BGP.

The SP environment are mostly used for traffic passing through whereas in the multi-cloud enterprise environemnt there are Data Sources and Data Sinks in either the On-Prem or in the Public Clouds. There is also the difference that the glueing network in the middle will have firewalling too.

Lets say there is a new connection required to a VPC subnet in a AWS region. Firstly the layer 2 would be provisioned over the AWS Direct Connect either directly with AWS or with partners like Megaport. For the majority of the cases the on-prem device which connects to the direct connect service will be provisioned with a new VLAN.

Once this is done this layer 2 will be trunked to the on prem device where IP endpoint is provisioned and the routing table exists. This could be a firewall or a router. This is where the packets will decide on the next hops.

On-Prem firewall filtering is in the path where the different DMZ regions, different IP Subnets and L4 Ports are allowed or disallowed to communicate with each other. If the On-Prem device with the routing table containing the multi cloud routes is a firewall things are simpler in the sense that the firewall filters are present on the same device and the different clouds are treated as different DMZ zones.

This multicloud networking scenario is a routing environment which has multiple routing domains as spokes linked via a hub site. This hub site is the on-prem glueing routing table. There would be the addition of firewalling capability within this environment so as to be able to govern and allow/disallow traffic between these environments. Another addition could be a load balancer within the glueing on-prem environment.

This load balancer would spray traffic onto either on-prem DC subnets IP endpoint servers or onto the public cloud subnets housing cloud servers. This would mean that there will be public facing IPs which receive the traffic which is natted onto Private IPs and then it is loadbalanced onto the multiple server endpoints be it in Public clouds or in On-Prem DC.

So the load balancer would have the load balanced front end IP to Server IP bindings going towards either a public cloud endpoint or an on-prem endpoint. This would mean that the load balancer connects to the glueing routing table entity as well to send/receive traffic to server IPs.

This mix of route, switch, firewall, load balancer is an example of a typical multicloud network connecting multiple public clouds.

Habib

As fresh Pakistani engineers start leaving their country on Washington Accord visas one wonders whether back home Digital Policies are being framed which could be sealing their jobless fates.

Let’s check the numbers. If half of Pakistanis generate only 5 MB of Data in one day on government run Digital Pakistan then it would amount to 500 million MB in a Day. This is half petabytes per day. This will only keep growing. All this data, it’s processing and it’s related networking will possibly be run on equipment which will only add to the import bill if Pakistan doesn’t manufacture it’s own servers. It would also traverse imported networking routers and switches which would add to the import bills if Pakistan doesn’t manufacture it’s own network equipment. All of these would also be put in Data centers which could be using Racks and Cabling possibly all imported.

How many jobs will imported servers, imported switches, imported routers, imported racks, imported DC HVAC and imported Data Center cabling produce ? And what will be the import bill of these Digital Pakistan backend items ?

Another aspect of these imported items is their lack of Cybersecurity from a National Security perspective. If it’s imported and all plug and configure only with unknown hardware and unknown software it will be considered a black box and totally insecure in terms of Cybersecurity.

A further aspect of these imported items is that each item comes with support contracts in case they fail and have a problem. These are very expensive support agreements with their manufacturers and will add to running cost and yearly import bills.

Now consider that a while back the aeronautical complex in Risalpur launched its own tablet, the PAC PAD Takhti 7. https://en.m.wikipedia.org/wiki/PAC-PAD_Takhti_7. How did that happen and why can’t we make our own Digital Pakistan equipment. How is it possible that Pakistan can make parts of JF-17 thunder and indigenously manufacture multiple types of missiles and also make a nuclear bomb but not make it’s own servers, routers, switches, DC HVAC and DC Cabling ?

Much of these IT equipments are now open sourced. Servers, Routers and switches under OCP and there is MIPSOpen and multiple open source Network Operating Systems. Positive results are really possible in case solid effort is made for local manufacturing.  At least Cybersecurity mandates that the Hardware assembly and Software assembly and their System Integration is carried out within Pakistan. This will create Jobs and reduce the import bills too.

Let’s hope for the best.

This post seeks to distinguish between the multiple aspects and phases of networking projects. Network Architecture and Network Design are the phases of a networking project carried out first. Then comes the Project Implementation phase along with configurations by Network Engineers.

Some experts have included an Analysis phase as part of, or before, the Network Architecture phase. The concepts being that first an analysis needs to be done on the flows expected from the new network.

Before Network Architecture the Analysis phase consists of gathering the User Requirements, Application Requirements, Application Types, Performance Requirements, Bandwidth Requirements, Delay Requirements etc. After gathering these requirements a Customer Requirements Document (CRD) can be made consisting of all the expectations and requirements from the network. This document will assist with project management throughout the network life cycle and for sufficiently large projects its a good exercise.

Once the requirements are gathered a Flow Analysis can be done to identify the flows required from the network. Data Source and Data Sinks, Critical Flows and per Application flows etc. are analyzed as part of Flow Analysis exercise.

Once the requirements are known and flows are known this can lead to decisions regarding the Network Architecture. The Network Architecture term is generally used with the Network Design term as one but according to one definition it is distinguished from Network Design such that the Architecture consists of the technological architecture while the design consists of specific networking devices selected and vendors selected for the architecture to be implemented on ground. This means, for example, that the Network Architecture will deal with whether to use OSPF or ISIS and how to use them and the Network Design will cover which specific vendor router to use. They are closely linked.

Once the flows are known it can be discussed what the architecture can be. This will consist of primarily deciding the protocols, the addressing and the routing architecture which can be used to facilitate the required flows. Once it is decided which network technologies to use for the flows (such as OSPF, ISIS, MPLS, L2VPN, L3VPN, IPSec, BGP, Public Internet, VXLAN, EVPN, Ethernet etc) a diagram can be made of the architecture. Multiple iterations and permutation of the various architectures will come forward from the discussions over what the architecture could be to facilitate all the flows and provide a resilient network. For each of the protocols listed above, and any other to be used, the clogs available in each can be discussed in detail. It can be discussed and decided regarding how the combinations of multiple protocols will be used to meet all the flows and meet the requirements from the network. If there are cloud connectivity requirements it will be discussed how (which protocol) and where to connect to the cloud. Once an architecture is decided and protocols are selected and the tools within the protocols which are to be used are listed then they can be summed up in a document and in diagrams.

After this phase comes the Design decisions phase. This is close to the architecture phase but this is where the vendor of that OSPF router is selected. This is where the specific router is selected from the multiple router offerings available from the selected vendor. Device vendor selection and specific device selection is a task of its own and is a separate effort in networking projects.

Also as part of the Design it will also be decided which Service Provider to use for Internet and WAN links. It will be decided which service offering will be used from the SP Vendor. If the application and system contain Public Cloud use (including Hybrid On-Prem) than it will be decided which specific connectivity mechanism and location the cloud will connect to. Will it be IPSec over Internet or over Direct Connect and where and how. Will it be the biggest MPLS VPN provider on the market or the smaller one. Will it be the biggest BGP Internet Transit provider or the smaller one.

Once the requirements are known; Once the flows are knows ; Once protocols and architecture is known ; Once the device vendors and device type and SP offerings are known and once all of these are selected than comes the implementation phase.

Engineering is a broad term which can encompass all of the above and more but as things stand here we can say that a Network Engineer as part of the engineering phase will configure and deploy the devices, configure and deploy the WAN links, configure and deploy the Internet links, configure and deploy the cloud connectivity VPNs and configure and deploy the interconnections in the network. This network engineering implementation effort is after the Requirements/Flows/Arch/Design phase as its an effort on ground and on site to implement the network and make things run. Up until this phase all the previous phases were on paper and this one is on ground practical work.

The previous Requirements/Flow/Protocols Architecture/Design and even initial aspects of the engineering phase can be done in office in meeting rooms. Initial aspects of engineering phase consisting of configurations and parameters to be used can be also decided before going out in the field. Once on ground and on site implementation starts than this is an effort of its own and can be considered as Project Deployment and Project Implementation. It entails device delivery, WAN link delivery, device power on, WAN link testing, Internet Link testing, Cloud VPN delivery, configurations and testing etc. This is a phase of its own and is an effort which is more akin to technical project management as well as it is more of an on ground project coordination and project management effort too. This is because of its physical, geographical and on site implementation aspects.

Depending on the type of project the implementation phase can consist of outage windows and maintenance windows and a lot of coordination to implement the new devices and new links.

Hence we can say that a networking project consists of separate requirements gathering, flows analysis, architecture, design and implementation phases. This means that a networking project can be divided into smaller multiple projects each consisting of these above phases. Each phase also requires a skill of its own. For example the Requirements, Flow Analysis, Architecture and Design phases are generally handled by Network Architects, Solution Architects and Network Design Engineers. The configuration and deployments aspect is handled more by Network Engineers and the Project implementation and coordination efforts are handled by Project Managers.

Multiple and simultaneously such large scale projects having all these phases going on at various levels would be run under a Program given the size of the organization is sufficiently large and that there are multiple streams of such projects being carried out.

I hope you enjoyed the good read.

Happy networking.

Habib

In Networking, Cybersecurity should now be Distributed Cybersecurity. Distributed Cybersecurity is where each organization and each home is independently capable of monitoring its traffic and inspecting it on demand.

This paradigm is where the Wifi AP at home is capable of sending its traffic in-out Data to somewhere within home and where the AP’s and Routers in an office setup are capable of sending their in-out information to somewhere within the local office.

This requires Netflow capable Wifi Access Points and Netflow capable CE Edge routers. It also requires a setup of a Netflow receiving station where the information sent by Wifi Access Points and Cisco routers in Netflow language will be received and displayed.

In Segment Routing the concept of source routing is present:


In computer networking, source routing, also called path addressing, allows a sender of a packet to partially or completely specify the route the packet takes through the network. In contrast, in conventional routing, routers in the network determine the path incrementally based on the packet’s destination

Wikipedia

In prevalent IP networks per-hop lookup is performed based on the single primary destination address in the packet. Consider a situation where a stack of IP addresses is present per packet and needs to be processed by the intermediate routers. There would be a requirement from the hardware in the line cards. In this hypothetical situation how deep of a stack of addresses can be processed by the router chipsets and hardware ?

Similarly the SID Depth or the Maximum SID Depth is a parameter in segment routing enabled network devices. To route from a ingress to an egress the path selected by the source should be entirely capable of handling the number of SIDs ( MPLS Labels in SR MPLS) that are pushed onto the packet. Because the path selected by the source is in effect translated into a stack of labels (in SR MPLS) therefore the number of labels that the each device in the path can handle is an important design consideration.

Also, in Segment Routing MPLS the SID i.e. the labels are distributed via the IGP. So an end to end path label stack is supposed to be either in a single IGP area or if multiple routing areas or domains are required then some tricks are required to push and handle a label that is not distributed by the IGP. Lets see now: An external entity will need to program the ingress source node to push a stack of labels which includes a label not distributed by the IGP. This being the source there will be a resultant intermediate destination where at some point on some hop a label will be popped and the next label will be not have been learnt via the IGP.

In some way the burden of end-to-end connectivity over multiple hops is being shifted from the distributed IP routing control plane into a central label stack distribution authority.

I wonder if where we had IP Planning and IP configurations we will have label planning and label configurations.

Shifting a portion of the intelligence present on distributed nodes to a central authority.


Information is present in computing platforms in two forms.

– Bits that are stored
– Bits that are traveling and transitioning

Securing bits that are stored and bits that are traveling and transitioning is a task.

These two forms present their own challenges but the bits that are traveling and transitioning i.e. changing forms within the computing platforms have acquired special attention. This is due to the prevalent pervasive communications using information technology computing platforms within society and businesses. When bits transition and travel they are also stored and retrieved from storage so securing both is important.

The only mystery surrounding the field of security is the presence of the all so many interaction surfaces between hardware layers and software layers through which transitions and traveling of bits occurs. From seeing text on the screen with ones eyes to thinking and considering it to thereafter editing it via hands there exists industries working within the human body which occur without us contemplating over them. There are interaction surfaces with the body as well. With muscular, neural, skeletol, etc working together to name a few.

Within computing platforms as the bits transition back and forth within one component i.e. one isolated CPU, RAM, HardDisk, Operating System and Application Software they present their own security challenge. When instead of isolation the bits travel between 2 such computing systems they present a different set of challenges. When there exists industrial scale, constant, consistent, ongoing back and forth travel and transitioning within milliseconds over large geographies between hundreds and thousands of components of various types it presents a completely different set of challenges.

Interaction surfaces are where bits change hands between subsystems. For example bits changing hands between the operating system and an application running on it or bits changing hands between one PC and another PC over a network. Interaction surface is when one subsystems surface interacts with another subsystems surface within the larger system and bits run. As the field of information technology and computing has evolved and progressed the number and types of subsystems, their surfaces and their interactions has increased a lot. So much so that securing them has become complicated. Wholesome security is therefore achieved when every time bits change hands i.e. transition and travel the interaction is secure. It is secure in the form that the storage at each end of change of hands is secure and the medium of exchange is secure.

Now it is simple to state in general english that when one subsystem interacts with another subsystem and bits change hands the storage points at each end and the medium used for the interaction and travel should be secure. Given timescale and geographical scale when it comes to reality the shear number and types of subsystems, the number and types of storage locations and the number and types of exchange mediums is so large that encompassing all of them becomes difficult.

Another incision into the security domain is cut deep into the system when the human computer interaction surface appears at various locations and in various forms. This increases the complexity of the whole security domain. Bit to Human interaction surface also needs to be kept secure at each interaction, at each geographical location and every time.

Furthermore another aspect is when one secure system under the ownership of one entity interacts with another system owned by another entity. This is therefore a time when bits are changing hands amongst different owners of them. The time and location of such an interaction surface presented between two separate ownerships also increases complexity. As your bits are stored under the ownership of another entity and accessed and retrieved by other people a whole system of management is required for such inter-ownership bit storage and bit travel interaction surfaces.

I guess a chart showing the whole variety of interaction surfaces within computing would demystify security. The reason for this is that each entry in the chart i.e. each interaction surface would be simply mapped to the precaution and action required for securing it. Each type of interaction surface would require a security precaution and actionable item within the security framework.

Be it an interaction surface where bits are:
– stored in hardware
– being processed by one set of software
– within one computer
– on a server
– in an application
– traveling over a network
– interacting with humans
– being exchanged between different humans
– being exchanged between different entities