It is National Cybersecurity Awareness Month (NCSAM) and I am reposting most of what I posted last year around this time which are mostly applicable and I am amazed at the number of people who are still not aware of all different ways you can protect your information. You don’t want your important information compromised or your financial assets stolen. So, better to take precautions early. I have added something about SIM swap, a technique that used to be prevalent in certain foreign countries is becoming common here.

Passwords & Passphrases

I use fairly long and complex passwords. I prefer passphrases wherever they are supported. It is so sad that so many systems still do not support passphrases and are restrictive in terms of the length of the passwords. As a rule, I use different passwords for different systems. I will be very happy to privately share with anyone who is interested in knowing more about how I maintain/remember all of these passwords. I also avoid saving passwords for some of the critical systems and financial institutions in my browser’s password manager. They are safe and continue to be safer, but, if ever someone steals my Google Password AND bypasses two factor authentication, they will have access to all my passwords (paranoia!).

(more…)

I can’t believe that my last blog post was more than 2 months ago! That is how busy I have been, along with all my colleagues. As I have written before, we moved several additional processes to Workday Student this summer and you can imagine how much work this is. I am happy to say that given the enormity of this transition, things went well. Most importantly, the first year students registered without any known technical issues. We now have the ability to analyze the registration process in a way that we can make changes for future registrations to make the experience less stressful for the students.

Of course, no transition of this magnitude is without problems! So, I describe some of what happened during the last couple of months below.

(more…)

I am still an active software developer! I love doing it and I can’t imagine a world or a job where I don’t have the freedom to practice that.  Of course, because of the nature of my job, I have to do it after hours and weekends etc, which I don’t mind because I just love doing it. The title of this blog is related to that and not anything wider than that. There have been so many cautionary articles written on how one should not trust everything on the web and I am not going there. I just want to talk about finding answers on the web as a developer.

I just marvel at how far we have come in the last 30 or so years. In my first job at Wesleyan University, I had to learn assembly language programming for the VAX/VMS system. I had a lot of experience  in higher level languages such as Fortran, PL/I. My PhD thesis was on computationally heavy systems that required a lot of distance calculations between atoms. Our group decided to speed that step up by coding that part in Assembly Language, but that was for an IBM 370. I also taught courses at Hunter College on this subject, so I was familiar with the concepts, but VAX/VMS is a very different system.

And in those days, if you get stuck, it was not easy to get answers! There were a LOT of bound manuals that you could look through, but it took forever to find the right answers. You can also call support, but they were of little help. In order for them to understand and help, they needed to spend a lot of time to look through your code etc. and they just couldn’t afford the time. In several instances, we would just give up and start over in a different direction.

(more…)

Transition from one ERP to another is rare (at least until recently). When it happens, there is a sense of excitement, but a quick realization that it is an arduous task. Such transitions require careful planning as well as the cooperation of many members of the institution. And almost always, even the well laid out plans don’t always work, so, not letting the roadblocks that come in the way affect the morale of the team, but finding workarounds and the willingness to accept some compromises is essential. We experienced all of these during the past three years and I am very happy to say that we have achieved a major milestone and will begin the process of opening up Workday student in a couple of weeks.

It will be a phased approach whereby the students will begin using different features at different times. During the first phase, all students will have the ability to review their personal information and make modifications themselves. We have also moved the checklist for the incoming first years from a custom application to Workday.

(more…)

My wife and I recently traveled in Israel and Jordan and during last couple of days, we rented a car to drive around Northern Israel. The vehicle had this little gadget stuck on the left side of front windshield. I had no idea what it was and as always, I told myself “we will figure it out”. It turned out to be the Mobileye!

I was pleasantly surprised by the various things it did, which I will describe first. Then, when we met up with my wife’s colleagues, I learned a little bit more about it. All of this was fascinating for me, so I thought I would share it with you all.

(more…)

I have been too busy to write blog posts… I will be writing a couple of quick ones during my trip West…

We are being inundated by cleverer phishing attempts. Though our attempts to educate our users are helping, the new phishing attempts are essentially bypassing the safeguards that we have put forth and rely on social engineering.

Imagine getting a very short email from the President of the College or the Provost. Mind you, the hacker is careful to choose who to send it to. If it is coming from the President, the person has researched who are likely to be communicating with her – senior leaders, support staff etc., all of which is publicly available.  (more…)

Amherst College, a premiere residential liberal arts college, lost network connectivity for almost a week. The college supported almost all of the technology services locally, which meant that pretty much everything was inaccessible for that period – Email, Learning Management System, Web site, administrative systems etc. And the faculty could not connect to the web from classrooms and students needed to use their cell phones to connect to the outside world. As one of them tweeted, students who could not afford to have unlimited data plans were limited from doing even this. You can read about the details here.

The IT staff did a remarkable job given the circumstances and had the community support all through, based on what I have heard. And I am so thankful for them coming out and sharing their experiences openly with their colleagues. This is so important for the rest of us to learn from, not just the technology piece, but how to best manage such a crisis.

What really happened? It is a complicated story on a lot of fronts, but the core issue that caused this outage is due to lack of investments in network hardware. Because they are still running on hardware that is pretty old, their network is configured as a “flat” network (Layer 2). Most modern networks are Layer 3 networks where we can segment networks based on a variety of criteria, such as a separate segments based on particular buildings, or connections from classrooms etc.

Amherst suffered what is called a Mac Flap Storm. Each network device has a unique address, called the MAC address and the networks operate under this uniqueness assumption to forward the network data to the appropriate device. Any compromise to that can “flood” the network and it is especially worst in Layer 2 networks. It will basically cripple the entire network. This can happen either because network wires create a short circuit or a misconfiguration either of which can advertise the same Mac address on two or more ports. This is most probably what happened in Amherst case. The worst thing about the MAC flap storm is there is no easy way to detect them!

(more…)

Congratulations to the Patriots on an incredible feat! It was one of the most boring and uninspiring games, but in the end, what matters is the score.

For me, this is Superbowl XL. The first superbowl I saw was in January of 1979, barely 5 months after I arrived in this country. As a young man thousands of miles away from home, deeply homesick, I needed distractions and sports provided that.  Just like the millions of young Indian men, I was a devoted fan of cricket at that time (and continue to be). Only issue was that cricket was not as abundant as it is today. And it was played all around the world in odd timezones. We used to be glued to short wave radios for commentary and read the newspapers for additional details and photographs. I come to the US where cricket was only known as an insect at that time and not as a sport!

I used to go every day to Indian Embassy, some 6 blocks away from Hunter College with the hope that they had “The Hindu” newspaper. This is a regional newspaper that covered Tamil Naddu, where I am from, and I enjoyed their Sports coverage. The Embassy typically had newspapers from approximately a week prior and The Hindu was not their priority because it is a regional newspaper. Imagine getting scores a week later and sometime missing a key day! It was depressing.

So, i gave in to learning about American sports. My apartment mate tried to teach me football by having me watch both College Football and Pro football on the tiny 13 inch black & white TV.  It is enough to say that he was much better at teaching me theoretical chemistry than football. I became friends with another Indian family in the neighborhood and that is where I learned the intricacies of the game.

(more…)