Truth About Computer Security Hysteria
Seat belt? Check. Air bag? Check. Computer backup? Duh...Rob Rosenberger, Vmyths co-founder
Sunday, 30 June 1996 THE U.S. DEPARTMENT of Defense builds disaster recovery capabilities into almost everything it buys. You've probably heard stories of $400 hammers, $700 aircraft toilet seats, and $5000 space-shuttle coffee makers. The military often goes to extraordinary lengths to have products custom-built to "milspec" (military specification). Yet all branches of the military ignore the need for disaster recovery in desktop computer contracts. Mind you, they've purchased millions of desktop computers since 1984. Suppose a military mainframe computer crashed tonight. Or, suppose a major local area network server crashed tonight. Then suppose a high-ranking officer said, "do you have backups? No? Oh well." Do you think a general or admiral would just shrug his shoulders? Such a loss would equate to hundreds or perhaps thousands of man-years of effort. Wasted. Down the tubes. Gone for good. All because the mainframe or local area network server had no backups. The Defense Department recognizes the need for disaster recovery in "critical" computers. It purchases every mainframe (and every local area network server) with this in mind. Why, then, does the military ignore the need for disaster recovery in millions of desktop computers?
LET ME TELL you a little story about my stepfather. He asked me to accompany him on a recent computer purchase. He read all the magazines, he consulted other people besides me, he knew his budget limit, and he knew what he wanted to do with his computer. He bought a good system for his needs. I asked him what would happen if the computer crashed and he lost all his data. "What do you recommend?" I mentioned a cheap internal tape backup unit for $125. He practically choked. "I'd have to buy a different computer: the one I want has no spare bays. Forget that." Well, then, consider a cheap external tape backup unit for $175. "Why? I can buy a bunch of floppies for a lot less," my stepfather noted. He added 200 formatted floppies to his computer purchase. We drove home and my stepfather played with his new toy while I tediously labeled all the disks. Eventually I convinced him to take his first backup — so we started an hours-long backup session. My stepfather grew extremely bored with the task... And on disk #97, the backup software aborted. "Dammit!" he screamed at the computer. "I just lost three hours of my time." It didn't matter anyway. His computer needed 450 floppies for a complete backup of all the pre-installed software. We would have stopped after six hours upon reaching disk #200. My stepfather paid $60 for 200 floppies. He'd have to spend $140 for a total of 500 floppies — the cost of a tape drive! So I asked him a question: what will he do when — not if, but when — his computer eventually crashes? "I'll restore everything from the master disks," my stepfather replied. What about your data, the most valuable asset in your computer? "I'll never have data of real importance anyway." My stepfather phoned me a few days ago to say how much he loves his computer. He entered his checkbook into it, he entered my mom's checkbook into it, and he purchased a rental-property package so he can better manage his condo. He'll lose a lot more than three hours of work if & when his computer crashes. But he doesn't care. (At least not yet.)
THIS LITTLE ANECDOTE points to an important reason why the military ignores disaster recovery capabilities in its desktop computers. It has to do with something known as the "desktop computer purchasing paradigm." The Air Force authorized the first major military desktop computer contract in 1984. The basic computer came with two 360k floppy drives, or you could give one up for an optional 10MB hard disk. You could back up an entire 10MB drive with just 29 floppies. Besides, many users didn't trust hard disks back then. They stored all their programs and data on floppies. If your computer broke down, you took your floppies to another computer. Simple. The size of hard disks grew: suddenly you could store 20MB, then 40MB. But high-capacity floppies hit the streets as well — you could still manage a backup even if you did use the hard disk for everything. Hard disk capacity continued its geometric rise: 80MB, then 140MB, then 200MB, then 420MB, then 528MB, then 800MB, then 1GB, then 1.2GB, then 1.6GB. Floppy-disk capacity hasn't kept up. The military follows an outdated paradigm: "the desktop computer user can easily deal with disaster recovery." The Defense Department now buys computers with 400MB or more of pre-installed software. Why pre-installed? Because they don't want people to waste time installing software anymore. Military desktop computer users can no longer easily deal with disaster recovery. The outdated paradigm leaves it to users to maintain backups with inadequate technology. Users now might need two full workdays to back up a computer with a thousand floppy disks. "What's your computer doing, Sergeant?" Creating a backup, sir. "Didn't you do that yesterday?" Yes, I started this backup yesterday morning...
SOME PEOPLE IN the military try to work around this mounting problem — with varied success. They can purchase "detachable tape drives," for example, so multiple users can create backups of their desktop computers. Sadly, these devices prove hard to use because you have to (a) get the tape drive from the guy who controls it, (b) attach the tape drive, (c) back up your computer, (d) disconnect the tape drive, and finally (e) return it. These devices see relatively little use as you might expect. Various other "workarounds" exist — but why must military personnel find workarounds so they can prepare for disasters? You now understand one reason why the military doesn't include disaster recovery devices in its desktop computer contracts. A second reason involves the people who negotiate military computer contracts. Like my stepfather, they read computer magazines and study sales literature. So, pick up any desktop computer ad. Does it include a tape drive or some other disaster recovery device? Desktop computer firms haven't seen a demand for these devices in desktop systems — buyers must specifically ask for (and pay extra for) it. The military sees no trend for disaster recovery devices in desktop computers, so they blindly follow the outdated paradigm.
YOU MIGHT FIND it hard to believe, but the U.S. military wants its new computers to come with CD-ROMs & sound cards & huge video monitors. They want all of the software pre-installed. Disaster recovery devices still have no place in military desktop computer purchases. I honestly can't wait for my stepfather's computer to crash. "Hey, I told you..."
[presumed first edition,