Letters to the Editor.

Standard Fare

I normally agree with Hal Glatzer on most of the columns he co-authors with Mark Brownstein but in the May issue ("Standards Vs. `Standards'", page 3) I tend to agree with Brownstein. First, we need to separate the storage technology where a prime function of the device/media is portability, i.e. using storage media to transfer files and data between systems such as home to office. In that case, the existence of a standard is of prime importance. Where would we be if there were five different 3.5-inch floppy format standards? The relative success of the CD-R/CD-R/W is due to promulgated and agreed-upon CD-ROM standards. Surely, the CD-R and CD-R/W are the new "floppies." You couldn't give me a HiFD or a Zip drive because none of those extended capacity floppies are interchangeable with each other.

On the other hand, since tape has been relegated to back-up duty for the last 10 years or so, the drive and media are essentially captive to the system (I'm referring to small LANs with 25 terminals or less). I'm not going to take my server backup tape home to use on my home office workstation. In this case, a standard tape format is much less of a concern. My primary concerns in this case are reliability, capacity, and speed of backup. Use of a standard format is next in line.

The primary advantages to using a standard tape format are cost and availability. When the format becomes a defacto standard, the costs of both the drives and media come down and the media becomes available from multiple sources.

Al Kruhm

The Phoenix Group

Viruses Reaching Epidemic Proportions

After 10 years of working with CERFnet to establish and promote the Western leg of the original NSFNet and most recently the company's IP infrastructure and web hosting activities within AT&T, I don't think I can be classified as a net newbie. In this period, I've become rather ambivalent to viruses, Trojan horses, hacking, and worms as stupid prankish efforts of malicious individuals who had no real lives.

That was before ExploreZip tore through the agency's network, destroying files on every drive . . . including the backup. Fortunately, we had a full backup from a week before and much of the most recent work had been forwarded to clients for review, approval, or posting. The destruction wasn't as bad as it could have been. But it still took over 50 manhours to bring the system back to a near-normal condition.

I couldn't even blame anyone else in the agency for unleashing the worm into the agency early in the week, since I had received the attachment and opened it myself. After all, the message came from a responsible technical editor we've been working with for several years. I didn't even think twice about the message I'd received as I attempted to open the attachment and unleashed the disaster.

We stopped all work when it hit and focused on restoring the systems and files. At one a.m., I checked my email before going home. Four more copies of ExploreZip came in from "people I knew." Obviously, they were discarded without being opened. . . I'm dumb, not stupid.

After getting past the urge to call her every name in the book and wanting to go to her publisher and have her fired, we focused on reconstructing more than 20 years of client and agency work. I fully understood the massive cleansing and recovery work that was going on at AT&T and in the thousands of other firms around the globe. The individual who developed and unleashed ExploreZip didn't simply create a nuisance. He or she had actually broken into our offices, destroying property just as certainly as though they had walked in the front door, wantonly smashing furniture and burning records.

I am no longer ambivalent. Should he or she be prosecuted? You bet. They cost us--and other firms similarly infected--hundreds of millions of dollars in lost time and lost intellectual property. But how can they be brought to justice? The FBI is "investigating" but, even when the individual is identified, who will have legal jurisdiction? The Internet is a global network of networks. ExploreZip may have first appeared in Israel but how do companies and individuals in Japan, Germany, Canada, the U.S., and elsewhere press charges?

In the borderless world of the Internet, there is no global court to deal with this destructive individual. ExploreZip wasn't an isolated instance. Similar destruction occurred with Melissa and the CIH virus. According to anti-virus experts, ExploreZip was a hybrid of the two. You can be certain that somewhere another "brilliant" wacko is busy developing an even better, more insidious, and more destructive virus to unleash on the Net.

Somehow, we will have to develop a means of dealing with these individuals because, if we don't, their activities will only increase, dramatically impacting individual companies and countries as well as our global economy.

With more than 200 viruses pushed onto the Internet, there is no way anti-virus software producers can stay ahead of the situation to ensure we can protect our files and data BEFORE we receive a virus.

* Be suspicious of every attachment.

* Constantly check your anti-virus suppliers site for updates.

* Constantly check your system for infection.

* Continuosly check major online information sites for alerts.

Since the disaster, I've received tons of sympathy and tons of advice: * Be suspicious of every attachment. * Constantly check your anti-virus suppliers site for updates. * Constantly check your system for infection. * Continuosly check major online information sites for alerts.

Good advice. But if we religiously followed these steps, clients and editors would never receive anything. There has to be a balance struck between disaster protection and productivity.

But there is one procedure that has been put in place that will be strictly followed by everyone in the organization: workstation and network backup. From now on, we'll burn through as much storage media as necessary to protect our information. In our case, we're using tape but any removable media will work. Tape is cheap . . . data isn't!

Every afternoon, our systems administrator checks our anti-virus supplier's site for updates. Every evening before staff members leave, he or she MUST check their systems to ensure they aren't infected with any "known" virus.

Then, our backup policies and procedures kick in. Our organization is no different from the millions of firms around the world . . . including yours. Our most vital and critical resource is information. From now on, we intend to protect and manage that resource.

Ideally, we'd do a complete backup of every station and the server every evening but that would take too long. So we've chosen to do a complete backup weekly and an incremental backup every evening.

There is plenty of outstanding automated backup software packages available today. All we have to do is remove the tape when we come in every morning and install a fresh tape immediately. Ultimately, we'll have three weeks of backup--full and incremental--to fall back on. The latest week of backups will

sit in a fireproof safe and I'll keep the prior week's at home.

Perhaps it's a little paranoid. But somewhere another sick individual is working on a virus that will combine all the "best" features of Chernobyl, Melissa, and Worm.ExploreZip.

There's little chance we'll ever develop a foolproof means of stopping him, her, or them from showing the Internet community how "creative" they are as they destroy hours, days, and weeks of people's work. Because of the global reach of the Internet, bringing them to justice and prosecuting them for destroying corporate and personal property will probably never happen. And I doubt if they will ever develop a social conscience.

But for less than $50 for a 30GB tape there is a way to limit their destructive activities. That's an investment I'm willing to make.

Andy Marken

Marken Communications Inc.

Clarifying SCSI Cabling

In the response to the second question in the June "Ask The SCSI Expert" column (page 50) it says, "For single ended, it is possible to run 20 meters and add an expander for the remaining distance." This should actually be 20 feet (6 meters) and it should be noted that 20 feet is for slow SCSI.

Jim Stein

Paralan Corporation