Managing infrastructure, a newbie's guide: Simple stuff you need to know

Dave, interesting article but I think you mean it from a small enterprise point of view, else the following kicks in.

2. Standardise your networking

If you have a mish-mash of network technologies and vendors, bring them together into as few as possible (preferably one).

Fantastic advice, if your a sme and have no choice. If your larger it smells like "put all your eggs in one basket", and involves the company you choose not being bought, sold, going bust or dropping the complete hardware line you have bought into with no second option. It also massively opens you up to a single zero day compromising your entire infrastructure if its a bug in say junos or ios and common to the whole codebase.

Plus if you get very large, the vendors salespeople know this also and its a great way to get bent over the desk during negotiations on price by them. They know it costs to reskill and retool to another compettitor when you have done this, best to have a limited deployment from a second vendor to threaten them with and as a disaster recovery option..

3. Look to the cloud

There is no cloud, its just someone else's computer. Try, just a little bit, to think if that data your about to shove into the latest buzzword would harm your business reputation if it got leaked, and if so, ask yourself if your ok with putting the same on someone else's computers.

5. Virtualize your servers and storage

Great, beancounters and managers will be happy at the buzzword improvement on annual reports, just don't get let whomever suggests it too carried away and eliminate your redundancy by talking away the issue as the redundant hot server is another vm on the same hypervisor. Or when your one of two (or one if accountancy gets their way) cabinets has a backplane fall over or a cab fire takes your monster vm host and virtual core switching router rack for the entire country for example, you'll realize why they were on seperate machines in different dc's to start with.

Call me wizened old warhorse survivor of incidents in large infrastructure works and multinationals. I've been told I'm part of the problem enough times by bright young things so maybe it really is just me.

Forgive me for asking but, what exactly is "Service Pack Zero" slang for......

You had me until..

3. Look to the cloud

...where you pointed out emotional reasons ("can't help liking" "I'm a big believer") for the cloud, but not the actual advantages and -more importantly- the disadvantages. Whether you genuinely think it's a good idea; believe the sales hype; got pressured into it by management; did it because everyone else is doing it; or wanted to collect a couple of cloudy badges for your CV, you really, really need to examine your reasons for moving anything to the cloud. Cost, yes; convenience, yes; new and useful abilities (like being able to have multi-user documents) yes; but "because I feel like it, is a bit suspect. And then there's the downsides. Anything cloudy is going to increase your attack surface. More importantly, anything cloudy is putting that aspect of your operation under the control of someone else. That entity can change the terms; frig about with your stuff; or (as happens frequently enough to be a cause for concern) just fuck off over the horizon with little or no warning.

I always ask myself if that thing *needs* to be out in the cloud. Do the benefits outweigh the costs? My personal litmus test is "would I care if my customers saw every single document I have out in cloudyland?"; because there is a very real chance of that happening.

Then there's email which is both cloudy in nature; and may well contain stuff that you would rather not escape into the public domain. That just has to be lived with; but can be mitigated by applying as much encryption as possible and getting it through the cloud and onto local storage as quickly as possible.

I can't help liking Office 365 and the cloud-based flavour of Websense (or ForcePoint Triton as I'm meant to call it these days), for instance, and in both cases I've historically been known to abandon the standard local-install version for a more usable, flexible cloud-based alternative.

Interesting examples. I don't trust Microsoft. Their behaviour over the past few years has been appaling so -from my POV- it's not unreasonable to assume that anything in Office 365 is compromised. Time will tell; and if I'm right, I've saved my clients from possible disastrous mistakes; and if I'm wrong people are free to call me paranoid...which they do anyway. I'm not a big user of Office suites and have never encountered a situation where Libre Office can't do what I want; but I understand that others' needs are different. However, if something is important enough or me to fire up an Office program; it's also important enough for me to control the choice of how; when; where and to whom it's distributed. Going on Microsoft's current form, there is absolutely no reason to trust their integrity on anything even vaguely important.

Your other example is also an example of the lack of control. They changed the name into a longer and harder to type name. A small example of user inconvenience; but I'm willing to make a small wager that the name change was accompanied by a whole bunch of ToS changes; all to the user's detriment.

I'm a big believer in cloud-based storage, too: I just can't help thinking that virtualising at least your low-performance storage into the cloud (your offline data archives, for instance) is going to grow massively in popularity over the next couple of years.

Unless you are storing locally-encrypted containers, this can be an incredibly dangerous thing to do. Can you ensure that there is not one single byte that will bite you in the arse if leaked? The only way this is safe is if you encrypt the living knackers out of it before it ever sees the cloud (and use two separate providers to cover yourself in the event of a "sodding off over the horizon" scenario). I don't do stuff on faith; and -quite often daily- there is a Reg story that confirms the need for caution. Everyone else's mileage may vary, of course.

5 of 7 ain't bad I guess

1. Draw a hardware obsolence timeline

Agreed. Know your hardware and support status (and cost of the support/maintenance contracts as the hardware ages.

2. Standardise your networking

Bringin it down to one might not be the best choice. Never have your eggs in one basket. Also with more than one vendor you have a safety net if anything happens to the vendor (or its products), you are in stronger negotiation position with the vendors if they know they have competition and tendering does not in any way guarantee a sale. Also often there is difference in vendors' offerings and one vendor's products might be better choice for a particular situation.

I do, however, agree that you should try to limit number of vendors.

3. Look to the cloud

Can't agree with that. Yes, it can be the correct solution to some applications/situations but in most cases it just isn't. Simple lithmus test is: "Can you survive without it?" No? Well why would you then trust a third party that may or may not be there tomorrow. And this is without going to the obvious security implications. Also, don't understimate the cost of reliable and fast enough connectivity to the cloud provider.

4. Integrate your applications

This sounds like a biggie, but actually what I'm getting at is that you should integrate the authentication for as many of your applications as you possibly can.

You assume that they lend themselves to easy modification of authentication. Legacy applications tend to be cans of worms and changing things (if even possible in the first place) can be extremely costly. In many cases you will not get any ROI (real or imagined).

4. Centralised Authentication

If you're in the UNIX world then learn this now - it's a skill that's missing in so many companies. Some places do this integration very well, but many others haven't got a clue, and as time moves on the requirement to use a Directory Service for authentication not just at OS but at application level is going to become much more fundamental.

Don't reinvent the wheel. Integrate with a proven directory service, and if your company already has Windows AD then leverage Windows AD as that directory - the Windows world has been doing this for 16 years now, and while it's far from perfect, it's extremely pervasive.

"Running a single operating system on a physical server is incredibly last year"

On the contrary, for some applications, VM multi-tenancy is last year. Containerisation seems to have reached the mainstream - particularly Docker (https://www.thoughtworks.com/radar/a-z)

Virtualise

Yay. I've fitted my 4 separate web front ends into one server running all virtualised!

I've saved 3 hosts!

My business, which runs exclusively as a web-shop, is now cheaper. Yay!

Virtualisation is a good idea if you understand why you're doing it and where the performance log-jams are. Just doing it cos its 2016 needs careful thinking....