Information Security is Infrastructure??

Ran across a Slashdot post that says "Information Security Is Becoming Infrastructure". This is interesting...are we actually thinking security is separate from the underlying applications or services that are being implemented?
Security is an element of a solution we provide to our customers or if your an internal IT shop, the end-users. Sure there are components that are purely infrastructure items that IT uses to secure an environment, such as IDS\IPS, Anti-Virus, Firewalls, etc.
Maybe this Slashdot post shows us a symptom of the overall lack security posture technology companies tend to take when developing a solution. DO THEY THINK SECURITY IS A PROBLEM TO BE SOLVED BY SOMEONE ELSE?

Cloud Computing Thoughts

As i work on setting up a new SaaS business I've begun to research non-traditional computing environments that the business can utilize that will minimize capital requirements, maintenance effort and bring piece of mind to customers that the service will be available when they need it and secure. Amazon's EC2 is one of these services along with the storage back-end they provide S3 and now a database server. there are also similar platforms provided by other vendors.

these platforms bring me to question the long-term viability of the traditional IT model of build the infrastructure and host the applications on these platforms. In this model the organization that supports the organization has to support both the infrastructure and applications that support the business potentially distracting company resources (executive talent and capital) away from their core business. Where as cloud computing if done well would allow the business the latitude to control the applications (and potentially focus more resources there) without the burden of supporting the infrastructure (at least minimize it) while maintaining a fair amt of control which many fear the loss of and have experienced in traditional outsourcing agreements. In the cloud computing model the organization can run the apps they want when they want with very little friction (compared to traditional IT models and/or sourcing models). If executed properly it will also minimize the ongoing costs associated with corporate compliance.

Could IT be following the same cycle of manufacturers? If so, would manufacturers be considered to be in a more advanced stage than IT.

Quick Note:

- I ran across an interesting blog post by Robert Bazinet that discussing the problems with the dependence on "the cloud".

- Google has entered the cloud computing space. Lookout Amazon. Where's Microsoft? One of the differences between Amazon and Google appears to have written an additional abstraction layer. You have to utilize their APIs and Development environment. With Amazon you utilize their API for infrastructure access but Linux for the rest. Which one is better? Is lock-in to a development environment what we need\require?

Shipping to China Update...

The barriers that language and distance (& possibly culture) create are interesting and require patience and the right attitude and drive to solve in a timely manner.

So as I stated in my earlier post on this topic we were about to pay ~ $10-15k more in VAT until we stopped the process. At the point the shipper and importer told us we could adjust the invoices to accurately reflect the shippable items and avoid unnecessary VAT. However, there was one little piece of information they left out...1 of the 2 invoices had already been given to Chinese customs so we couldn't change it without going through some serious red tape.

So without being told this additional tidbit i worked with the vendor that is implementing this system (also responsible for procuring and shipping it) to develop an updated set of invoices. The vendor submitted the updated invoices to the shipper and importer thinking all was good and this 9 week shipping ordeal would soon be over. But wait....remember the bit of information I told you they left out. Well we get a little nasty gram note back from them stating: "The invoice is all wrong and we can't use it! The weights make sense compared to the air bill; items are missing from the invoice (my thought - uh wasn't that the point of adjusting the invoice?); Country of Origin is incorrect for one of the devices. When you get this all corrected in a new invoice please send it to us." At this point they still hadn't bothered to tell us they had submitted one of the invoices to customs already. When we try to get clarification via email they didn't offer assistance and attempts to call them late in the evening Friday (their time) was thourthed. So now I wait until Sunday night (my time) to call them and I'm finally able to spend 45 mins with the importer (would have taken 15 mins if we both spoke the same language natively) to drag out of him that one of the invoices had already been submitted and more detail about why he was concerned about the weights on the invoice compared to the air bill. Armed with this information I send an email follow-up to the importer to ensure I understood everything (remember the language barrier thingy I mentioned) and forwarded the same information to the vendor in order to ensure the latest invoices would be correct and accepted by the shipper\importer and customs. Late Monday evening (my time) we get confirmation that the invoices look good and will be submitted to customs for processing. Now we sit and wait yet again. (hopefully for only 3 days)

Things to prepare and do if your going to ship electronics to China:

• prepare invoices that only show the items that are included in the shipment

• ensure the invoice (packing slip) includes the following: name of item; catalog #; vendor; description; qty; net weight; gross weight; unit & total price; country of origin and serial numbers

• ensure that you have CCC certificates (http://www.ccc-us.com/)for each item. if the item is telephony equipment you also need to have NAL (http://ul-asia.com/cma/Network_Access_License/Overview.html) certificates

• ensure total weight on invoice is comparable to weight on the air way bill (or other shipping document)

• if you aren't licensed in China to import goods, establish a relationship with an importer in China prior to shipping the goods and ensure they have all the required information (will likely charge 1 to 2% of shipment value to provide this service)

• be prepared to pay VAT (~17% of value but changes based on country of origin). if your a foreign corporation doing business in China you can apply for a process that allows you to avoid VAT up to a defined $$ amount per year but this should be initiated prior to shipping because as i understand, it is time consuming

• be sure to include a penalty or out clause in your contract with the vendor to ensure they have skin in the game. this should ensure they do everything possible to push the shipment through in a timely manner.

And if you've built a project plan, make sure you use your most conservative duration for the shipping portion. our vendor estimated 2 weeks and we are currently 9 weeks into this 2 week task.

Oh What Fun it is Shipping to China!!

More shipping to China drama today.... Just when I think we finally have everything needed to submit the shipment to Chinese customs we hit another hiccup. This hiccup is the VAT (Value Added Tax) amount.

When VAT was initially calculated it was calculated by checking the invoice for the value of the hardware goods that were actually being shipped to China. The value of the goods are pulled from the invoice\packing slip that must accompany the shipment. It just so happens that included on the packing slip was software license and services (implementation charges). Just as we were being told the shipment was being submitted to customs I asked a clarifying question - "We will only be charged VAT on the hardware that's being shipped, correct?" - low and behold the answer from the importer is "No, everything on the invoice\packing slip will be utilized for the VAT calculation."

VAT for hardware only would be about $10k and VAT for everything would be ~$25k.

Question: Geee what is the best thing to do?
Answer: Delay shipping once again and await an updated (more accurate) invoice\packing slip from the vendor who shipped the equipment.