Diverted

 

Image from Pixabay

On board flight KL1540 from Alicante to Amsterdam, a call was made for a medical doctor. Moments later, the captain announced that the plane had to divert to Paris due to a medical emergency.

And then things suddenly go differently than you're used to. The tone shifts from friendly-businesslike to measured-strict. The descent feels noticeably steeper than usual. The cabin crew is instructed to check seatbelts and tray tables "if time allows." There's no time left to collect trash with a cart. Once on the ground, you're quickly parked and emergency services arrive.

After everything around the patient is taken care of, you want to return to normal as quickly as possible: onward to Amsterdam. For that, the captain had to "make the necessary calls," for example to refuel and to arrange a new landing slot at Schiphol. He also mentioned choosing not to order extra catering, as that would take additional time. He did take a moment to walk through the cabin to answer any questions.

In IT, you sometimes have to divert too. Something stops working in one data center but still works in another; it's redundantly designed, as we like to say. Failover comes in different flavors. In some systems, it happens automatically and users don’t notice a thing. The system detects something is wrong and switches to "the other side." In other cases, administrators must detect the issue and manually switch things over. And unfortunately, not every situation allows for failover, and users must wait until the problem is resolved.

Just like in aviation, in IT you want to return to normal as quickly as possible after a diversion. You need to plan ahead, because there are often many dependencies that require a specific order. You document the procedures in plans and – very importantly – you regularly practice those plans. Partly to get familiar with them, and partly to catch errors in the plans. Better to encounter those errors during practice than in real life.

Sometimes there's no time to practice – or rather, no time is made. Imagine if pilots weren’t given time to train emergency procedures. And then during takeoff – a fairly critical moment – an engine fails. You don’t want the pilots looking at each other in confusion. No, they should routinely (on autopilot, so to speak) perform the correct actions. Those actions have been thought out, documented, and thoroughly practiced. So that things end well when something goes wrong.

But it can get worse: when no attention is paid at all to the continuity of a process. Sure, you can make the deliberate decision that it isn’t necessary, but in the cases I’m referring to, the topic isn’t considered at all. Out of ignorance, helplessness, lack of time – who knows. Maybe you're thinking of the recent massive AWS outage (Amazon’s cloud service), but feel free to look around your own organization too.

Flight KL1540 arrived two hours later than planned at Schiphol. Not a big issue for passengers whose final destination was Amsterdam. But there were also people on board who had a connecting flight to Kristiansand, in southern Norway. Not many flights go there from Amsterdam. I fear those passengers had to divert to a hotel.

 

And in the big bad world…

• AWS was down for a while and it had a major impact.
• Some people ended up sleeping upright in overheated smart beds due to the AWS outage.
• We could use a few more IT nerds in Parliament. [DUTCH]
• The UK government urges companies to make cybersecurity a top priority.
• You shouldn't rely too much on AI for your news coverage.
• Hackers breached a nuclear weapons facility.
• Law enforcement is increasingly interested in video doorbells.
• Microsoft secretly installs Gaming Copilot on your PC.
• You can also hack a card shuffling machine, of course.

 

Water distress

 

Image generated by ChatGPT

Apeldoorn (the Netherlands), Friday 4 October 2024, 18:22 – 70 thousand households receive a mail bomb: the tap water is contaminated with the e.coli bacteria (lovingly referred to in the newspaper as the 'poo bacteria'). We need to boil the water for three minutes before drinking it. We should also use boiled water for brushing our teeth and washing vegetables. [For some context to strangers: tap water is delicious in this country.]

People are rushing to the supermarket en masse to stock up on bottled water. The need is great – in one supermarket people are even fighting over the last few bottles. We see images that we know from faraway countries, with people pushing shopping carts that are filled to the brim. By the end of the evening there are no more bottles for sale anywhere. The next step would be looting. A shopkeeper tells the newspaper how quickly the water was sold out, and that he has ordered not the usual thousand litres (264 US gal), but ten times as much for the next day. The local press photographer captures a car with a boot completely filled with water bottles. I counted them: there are around 140 litres (37 gal) of water in that car.

And us? We stayed home quietly. Because on the one hand we trust that the water company when they say that boiling for a few minutes is sufficient, and on the other hand we have had an emergency supply of drinking water for years, precisely for these kinds of occasions. And we pay attention to the expiration date, so that the water is swapped in time (nevertheless it tastes a bit stale). And there are more things that you better have in the house in case something strange happens. A supply of food is of course obvious; remember that you may not have gas or electricity to prepare it and that you must be able to eat it cold. Rechargeable lamps are only of service as long as there is power - lamps that (also) work on batteries are better, provided you have enough fully charged batteries in the house. A battery-powered radio is handy to stay informed about the progress of the misery.

In IT, this is the field of Business Continuity Management. BCM professionals ensure, among other things, that if something goes terribly wrong, if our IT is hit by a disaster, the impact is limited and we return to normal as quickly as possible. They do this by ensuring that teams responsible for keeping IT services up and running are optimally prepared for eventualities. Plans are ready and these plans are tested. And for major, far-reaching events, they train the crisis management team, so that these people also know what to do if things go completely off track.

As the example of the water distress in Apeldoorn and the surrounding villages indicates, it is also useful to do something about BCM at home (although I would perhaps rather call it HCM: Home Continuity Management). Above I already gave an idea of a shopping list; on the government website denkvooruit.nl you can find even more information. There you can read, for example, that it is also useful to have some cash at home. Because in the event of a massive power failure or network failure, you will no longer be able to shop cashless, and the ATM will also show its sorry screen. Then you are happy if you have emergency cash at home and can still go shopping. [For you strangers: the Netherlands is rapidly transforming into a cashless society, where paying with your phone or debit card is common and where people often don’t have any cash on them.]

But don't start hoarding right away, okay? Here in our city, the mayor had to intervene to call on the population not to grab what you can grab and to take each other into account – let others have some water too, he begged. I had to think back to that video from the covid period, in which a forklift driver, roaring with laughter, drove through an immense warehouse that was filled to the brim with toilet paper. That was the product that we then feared to run out of. The run on water in Apeldoorn is even more remarkable because it is a local problem. Incidentally, many people have already moved to surrounding cities to get water.

Meanwhile, boiling tap water is a great alternative. Admittedly, it is a bit tricky. I am so used to tapping my tea water from the boiling water tap that this morning I looked right past the filled thermos and filled my mug under the tap and only when the tea was ready did I realize that I was wrong. For brushing our teeth, we have a bottle of water in the bathroom, simply because it is more convenient. Boiled water has to cool down before you can use it for such applications.

In the meantime, the water company is busy inspecting four water reservoirs, each containing three million litres of water (792.516 gal). They have to be emptied for this, but it has to be done one by one because else our taps would run dry. That’s why it’s taking so long – at least until the 14th, we have to be suspicious of our tap water. Today (Friday) we’ll get another update. Hopefully with good news. And I’m also curious about the cause. In the meantime, I just wiped my daily apple with a paper towel instead of washing it with water. Oh well, those minor inconveniences.

 

And in the big bad world…

• An American water company has been hacked.
• Dutch police have arrested a dark web drug market administrator.
• of course air-gapped computers can also be hacked.
• Australia has a reporting requirement for paying a ransom in the event of a ransomware attack. [DUTCH]
• Private data and photos of several police officers were also stolen in the major police hack. [DUTCH]
• cybercriminals are trying to steal athletes' loyalty points. [DUTCH]
• The data of 31 million users of The Internet Archive have been stolen.
• The Chinese have hacked the wiretaps of American telecom companies.
• Most Dutch civil servants think they understand cybersecurity. [DUTCH]

 

Wet laptop

 

Picture from author's collection

Last night my daughter (14) came to me: "Dad, my screen is not working." She has a separate screen in her room for her laptop. According to the old adage check cables first I checked that both ends of the cable were in place. I then grabbed another HDMI cable to find out if her cable might be the culprit. No result.

She came home just before the end of the world yesterday (it's been quite stormy here), so I asked if her things had gotten wet. Well, not really, only the cap had come off her water bottle in the bag. But luckily that water bottle was empty. She thought.

I opened the laptop and immediately saw that something was wrong: it was damp in several places. First I took out the battery and patted the damp spots dry with tissues, and I gave the HDMI port the same treatment. The speakers also had to be dried, because no sound came out of the laptop, as my daughter reported reluctantly. I loosened quite a few screws in order to reach several spots. That I dare to do so, I owe largely to a colleague, with whom I once went to a computer fair a long time ago, where we bought individual parts and then put together a PC ourselves.

It’s been said one should put a telephone that has fallen into the toilet or into the sea in a bag of rice, because the rice absorbs the moisture. I hesitated for a moment whether I would give the laptop such a treatment, but decided against it because I was afraid that the rice grains would get stuck in various places and that didn't seem like a good addition to the hardware. Instead, I grabbed the hair dryer and worked the guts of the laptop on a low setting—for both heat and blowing power.

“Never use a hair dryer”, I just read in two different articles, which looked up because I really wanted to know more about that rice advice (no one is talking about that, by the way). Ouch, that hair dryer wasn't such a good idea, because the heat can damage the sensitive parts and the wind can blow the moisture in the direction of extra moisture-sensitive parts. Fortunately, the hair dryer was on low; I'm pretty sure the laptop itself produces more heat than it endured from my action. And the laptop wasn’t like soaking wet, so I don’t think that a lot of moisture could have been moved. But I didn't unscrew enough components to see everything.

In the event of a disaster, you have to act quickly, but if you have to think about what exactly to do at that very moment, you may end up doing things you shouldn't have done. A wet laptop must be switched off completely as soon as possible, all plugs must be removed and then you dry it as well as possible inside and out. So far I've done the right things. At that point I should have done what I only did this morning: get information about the next steps. And of course it would have been even better if all this had been ready knowledge.

I pointed out to my daughter that she should have come to me as soon as she noticed that the laptop was damp – because she certainly had. She looked taken aback when I told her that her laptop would be left open to dry for at least a day. “But then I can't do anything for school!” she exclaimed indignantly. Yes that's right. And this event also reminds us that she should not store her files on the laptop, but on the NAS (hard drive in our home network). I told her this long ago, but after that I never checked whether she actually acts upon my directive, and whether she understands how to do it at all.

Moral of the story: as soon as you know or suspect that something is wrong, you must report it to a competent authority. My daughter should have brought the damp laptop to me right away. And if you come across something in your work that could harm security, report this to the service desk and/or the security officer. And of course informing your manager is always a good thing – they are supposed to be able to tell you what to do (see previous sentence). Don't try anything yourself, except of course pull the plug from a smoking device and things like that.

The laptop is now sunbathing on the windowsill. Hopefully it will recover.

There will be no new Security (b)logs for the next two weeks.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

 

• you preferably don’t save your passwords in the browser; use a password manager instead. [DUTCH]
• working from home leads to more data breaches and security incidents. [DUTCH]
• Bluetooth was never intended to unlock cars; now it can be used to steal cars.
• you should watch out for (among other things) digital scams when booking your holiday. [DUTCH]
• the Apeldoorn City Pass leaked login data of citizens. [DUTCH]
• a man faces court for trading in the personal data of a quarter of a billion people. [DUTCH]
• privacy and law enforcement sometimes clash. [DUTCH]
• you can try to hack a song festival, of course. [DUTCH]
• more Linux malware has been observed. [DUTCH]
• a Swiss bank account is no longer a safe haven for cyber criminals. [DUTCH]
• the NCSCs of various countries jointly give tips to organizations about frequently made security errors.
• the Tax and Customs Administration should take a closer look at the GDPR. [DUTCH]