News for December 19

TheRegister: Sun and Micron extend flash life

by Chris Mellor

Sun and flash memory vendor Micron have collaborated to extend the life of enterprise flash memory to one million write/erase cycles, higher than any other NAND technology available.

Enterprise flash is a term used to denote flash memory used in servers as a cache or solid state drives (SSD), and storage arrays as SSD replacement hard drives or as controller cache.

Micron says a new single level cell (SLC) NAND technology is involved in this Enterprise NAND, and that production devices are capable of achieving the million cycle mark. Specific write and read speeds of flash using this new technology aren't revealed but SLC flash is inherently faster than multi-level cell (MLC) flash and Micron has announced fast NAND chips recently.

The company spokesperson said: "Read speed is similar to existing SLC NAND. While there is a write-performance penalty for extended-cycling NAND the penalty varies by product and process technology, so I can't provide an actual number. But keep in mind that the applications that will take advantage of this technology will be less sensitive to write performance, because they either write in the background, which doesn't impact system performance, or they have very large arrays that essentially spreads the write delay out among multiple NAND channels (parallelism)."

Brian Shirley, Micron's memory group VP, said: "We expect this technology to revolutionize the enterprise storage hierarchy and be adopted by a wide range of transaction-intensive including solid state drives and storage disk as well as networking and industrial."

Sun has previously worked with Samsung on a similar flash write/erase cycle extension initiative. The write/erase cycle life was extended tenfold in that one which we thought meant about 50,000 cycles.

CNet: After six years, Homeland Security still without 'cybercrisis' plan

by Declan McCullagh

When the U.S. Department of Homeland Security was created, it was supposed to find a way to respond to serious "cybercrises." "The department will gather and focus all our efforts to face the challenge of cyberterrorism," President Bush said when signing the legislation in November 2002.

More than six years later, and after spending more than $400 million on cybersecurity, DHS still has not accomplished that stated goal. "We need to have a plan tailored for a cybercrisis," DHS Secretary Michael Chertoff said on Thursday.

Chertoff told a conference in Washington, D.C., that creating such a plan first requires "a clear awareness of exactly what the dimension of the threat was," meaning the ability to detect intrusions in real time, and probably means taking some of the existing plans for physical attacks and "adapt them and some of the basic principles" to electronic threats.

"I do think that we have work to do in figuring out how to tailor something specific for cybersecurity in the same way that we've done it for natural disasters or terrorist attacks or things of that sort," he added.

Because only a few weeks are left in the Bush administration, any further work will be left to the administration of President-elect Barack Obama.

InfoWorld: IT ops, security pros at odds over virtualization risks

by Ellen Messmer

IT pros are upbeat about virtualization and the benefit of server consolidation, whereas security experts harbor doubts about the security role the hypervisor can play
Does transitioning to virtualization increase security risks within a company? IT managers appear to be at loggerheads with IT security professionals over that question, even while sharing similar opinions on where risks might lie, according to a new survey.

The 2009 Security Mega Trends Survey from research firm Ponemon Institute - which also looked at attitudes on other topics, such as outsourcing and Web 2.0 technologies - shows roughly two-thirds of IT operations staff who responded said they felt virtualization of computer resources did not increase information-security risks. But about two-thirds of information security professionals surveyed felt the opposite way.

A full three-quarters of the survey's 1,402 respondents, all active in U.S.-based private sector firms or government agencies, said their organizations had already implemented virtualization of their computer resources, with about 90 percent in both the IT and security camps saying they were "familiar" or "very familiar" with virtualization.

The survey reflects the often upbeat attitudes about virtualization expressed by experienced IT pros about how the technology, most commonly that of VMware, Microsoft, and Citrix Xen, is bringing them the benefit of server consolidation.

"We started virtualization in a development and test environment, and now the main applications we have using VMware in production instances are file and print servers," says Rich Wagner, director of IT infrastructure at Columbus, Ohio-based Hexion Specialty Chemicals. Wagner says virtualization hasn't raised red flags as far as security requirements. The main concern, he says, is "from a performance standpoint - the CPU and memory and disk I/O - in sharing a large box," with database servers seen as a resource-intensive application that might not be well-suited for virtualization.

There's a far more skeptical view of virtualization security often expressed by seasoned IT security pros, who harbor doubts that vendors on the virtualization front have really sorted out or addressed the risks associated with the underlying hypervisor transformation.

"The security for the virtualization itself is way, way behind," says Nelson Martinez, systems support manager for the City of Miami Beach, who is responsible for IT security in systems used by the city's 2,000 employees. Martinez says the city does make use of VMware for some Web servers, but "I would never host any kind of database or my e-mail server in that environment." There are performance and maintenance issues in running traditional security applications for each VM host application on each physical machine, while the industry still seems to be sorting out the security role the hypervisor can play, Martinez notes.