FIGure It Out: An Interview with Cliff Hunter of LionHeart

Details

Created: Friday, 21 December 2018 19:39

This year, we will be taking time each month to interview professionals from various fields of work that relate to the data center. Through these interviews, we will be asking questions that directly relate to decisions you would make for your own business so you don't have to. This month we spoke to Cliff Hunter of LionHeart Critical Power Specialists about generators and gen service, and how to keep your equipment running efficiently and safely.

What is an ATS and how does it function?

Cliff Hunter: An ATS (Automatic Transfer Switch) is a piece of electrical equipment that functions as the “brain” of the generator.  It is what detects the power outage and tells the generator to start and power whatever loads are connected to the ATS.

How often should the generator and ATS be inspected?

CH: The ATS is one of the most important and often the most neglected part of the generator system. The frequency for which they should be tested depends largely on the code requirements for that facility.

For health care facilities that are inspected by IDPH (Illinois Dept of Public Health) and TJC (The Joint Commission), the ATS’s need to be tested monthly by transferring all ATS's to the emergency position. The ATS's also need to be maintained by a professional once per year.  

LionHeart services hundreds of data centers in the Chicagoland area. There aren’t any code testing requirements for the generators or ATS's that are backing up a non-life safety (IT) loads.  With that said, we still highly recommend testing the transfer switches by transferring them to the emergency position at least once per month as well as having them maintained once per year by a professional.

Can you explain why it is important to test the ATS during a generator PM?

CH: It is extremely important to test the ATS during a generator PM because that is the only way to truly test the entire system.  A lot of our customers have their generators set to run automatically every week on a timer, which is good. However, we highly recommend that someone physically goes to a transfer switch every month and tests the switch manually by hitting the test button on the outside of the ATS.  

By doing this, it will make sure that the ATS is communicating properly with the generator and that the transfer process goes smoothly.  The theory behind testing it regularly is that if there is an issue with the transferring from utility to emergency, it is better to find that issue during a controlled test rather than during an actual outage which can happen extremely late at night or on a weekend.

How often should a generator be load bank tested? And how loaded should a generator be (50%, 75%, 100%)?

CH: NFPA-110, which is followed by IDPH and The Joint Commission (health care facilities), states that a diesel generator should be load banked every year for 1.5 hours.  The load bank levels are 30 minutes at not less than 50% of the generators rated capacity for 30 minutes, and 60 minutes at not less than 75% of the rated capacity.  The City of Chicago also now follows these same guidelines for life safety generators.

For generators that do not power life safety loads (IT), it is still highly recommended to load bank those generators every year as well.  When diesel generators run weekly with no load on them, a lot of unused fuel can get stuck inside the engine.  Over time, that unburnt fuel can cause an issue known as “wet stacking”.  It causes the generator to run sluggish and smoke a lot at start up.  Running the generator under heavy load during a load bank test can prevent wet stacking.  

The load bank test is also very important for natural gas generators as it can help ensure that there is adequate gas pressure getting to the engine.  When generators run every week with no load, they may run fine, but the ultimate test is running them with heavy load to ensure that, during a power outage, your generator will handle a load similar and higher that of the building load.  Again, it is better to find an issue in a controlled setting with a technician onsite than to find an issue during an outage at 3am on a Sunday when no one is onsite.

When is it better to use natural gas vs. diesel?

CH: The debate of natural gas versus diesel usually comes down to cost.  Generators that are smaller than 150 kW (or so) are less expensive to get in natural gas.  This is because a diesel generator at that same size requires a fuel tank which costs extra money.

When you get over 150 kW, diesels become less expensive.  The reason is because a diesel generator produces higher horsepower than a natural gas generator.  To make up for the deficiency in horsepower, a natural gas generator will require a much larger engine in order to produce the same amount of output as a diesel generator.  The upsizing of engine is what makes a natural gas generator cost much more at larger sizes.

What are the most common repairs you make on equipment, and how can a customer be better prepared to help prevent emergency maintenance?

CH: The most common repairs that we see are to the engine block heater, and batteries.  The engine block heater, which warms and circulates the coolant and keeps the engine warm, can go bad every 3-5 years.  The hoses on either end of the heater wear frequently because of the heat which can cause cracking of the hoses.  When this happens, leaks can occur.  Batteries are recommended to be replaced every 3-years.

What is the biggest aspect of working with generators that customers tend to overlook?

CH: The testing of the generator and transfer switches are probably the most neglected part.  Many people think that as long as they have a professional service company maintaining their equipment yearly or semiannually that there is all there is to owning a generator.  Unfortunately, especially with outdoor generators, there is a lot that can go wrong with these pieces of equipment in between the 6-months that they are inspected by a professional.

LionHeart is a strong proponent of training and we offer to all of our customers free, onsite generator and ATS training to ensure that all of our customers are comfortable with running their equipment weekly to ensure that everything is working as things can change very quickly.

About LionHeart Critical Power Specialists

LionHeart is the nation's most sought after Critical Power Specialists, focused on serving clients throughout Illinois, Indiana and Wisconsin - while, also solving the most difficult critical power issues all across the US. Our operation and maintenance strategies are designed to ensure year-round business continuity while providing optimum performance and longevity from your critical power systems. LionHeart provides our specialized services to more than 2,500 clients who trust us with their critical assets because we continually demonstrate technical competency and focus on their best interest.

www.powerassured.com

FIGure It Out: An Interview with Karl Koshy of StratoZone

Details

Created: Friday, 02 November 2018 16:14

This year, we will be taking time each month to interview professionals from various fields of work that relate to the data center. Through these interviews, we will be asking questions that directly relate to decisions you would make for your own business so you don't have to. This month we spoke to Karl Koshy of StratoZone® about how customers can analyze their migration needs, and what it takes to transition from in-house IT operations to the cloud.

Can you tell us a little bit of your background in the IT and cloud space?

Karl Koshy: I have had over 25 years of experience in the IT space ranging from ERP solutions and Procurement Automation to IT Infrastructure.  As innovators in the infrastructure space we delivered early solutions to accelerate virtualization when this concept was still new to legacy IT environments.  The transition to innovation in the public-cloud space was a natural transition in the evolution of next generation IT.

What are the most important things for a customer to consider when analyzing their migration options, either to colocation or cloud?  

KK: With public cloud, customers need to understand (i) what they have in their IT environment, (ii) how it’s all tied together via dependency maps, (iii) the risks and compatibility levels of their assets and applications with cloud platforms, and (iv) the true costs of consuming public cloud.  The key considerations for colo are primarily cost and capabilities of the colo environment.

Are there disadvantages of going to the cloud?

KK: The benefits of public cloud generally outweigh the disadvantages which are primarily centered around the requirement for updated skillsets, keeping up with fast-moving technology options, and the need to re-think security requirements.

What is the hardest part of the transition from in-house IT operations to the cloud?

KK: The primary challenges relate to creating a repeatable, prescriptive framework to evaluate applications for cloud fit, deciding on the level of modernization that can be tolerated by budgets and timelines, and obtaining business-unit or app-owner buy-in for cloud-adoption.  Customers fundamentally underestimate the transformational change that is required with a cloud-transition as well as the level of operational readiness that must exist prior to embarking on the cloud journey. Customers who prepare for day-2 operations prior to a migration are far more capable of succeeding than those who do not consider this a critical dependency.

Is it possible/suitable to move a company entirely to the cloud?

KK: If a customer’s infrastructure is based on the x86 platform (both Windows and Linux), then the entire footprint can be moved to a cloud environment.  On the other hand, if a customer is not operationally ready to re-deploy mission critical, high-performance compute, or applications that have dependencies on non-x86 platforms (such as mid-frames or mainframes), then these applications generally require a longer period of time before being ready for the cloud transition.  Ultimately the feasibility of moving an entire IT footprint to the cloud depends on the available budget to re-platform assets that are not cloud-ready either technically, or operationally.

What are the possible dangers if an end user goes straight to the cloud without formally assessing their cloud readiness first?

KK: Without an assessment and appropriate planning, customers generally run into overspending in the cloud environment, a lack of governance, security risks, operational support challenges, and most importantly a significant risk to the availability and performance of production applications.

How does the process of the StratoProbe® work? Are the results always clear?

KK: StratoProbe is a part of the StratoZone SaaS platform that is responsible for delivering automated discovery, optimization, pricing, and technical outputs like cloud-fit scoring and dependency mapping. The solution works with agent-less data collectors that are deployed within customer environments to analyze the IT footprint including capacity, performance, dependencies, and configurations. This critical first step provides for a data-driven assessment and cloud-consumption plan which in turn reduces risk on multiple fronts related to a cloud adoption initiative.

What is your opinion on smaller companies offering private cloud offerings and competing against the likes of AWS, Azure, etc.?

KK: We generally see customers considering one or more of the big-3 players, namely AWS, Azure, and GCP.  This is primarily due to the completeness of their offerings, scalability and ability to offer production-level features that are not as mature within the smaller cloud-providers.

About StratoZone®

StratoZone® delivers a powerful cloud services automation suite for ITaaS and multi-cloud adoption. Encompassing all of the necessary automation functionality, the suite consists of seven primary platforms, all seamlessly integrated into a single SaaS platform. StratoZone® arms customers with powerful features to help control and harness their cloud adoption and migration process.

www.stratozone.com

FIGure It Out: An Interview with David Carlson of Sirius Computer Solutions

Details

Created: Monday, 17 September 2018 18:19

This year, we will be taking time each month to interview professionals from various fields of work that relate to the data center. Through these interviews, we will be asking questions that directly relate to decisions you would make for your own business so you don't have to. This month we spoke to David Carlson of Sirius Computer Solutions about the benefits of using colocation for your business IT operations and questions to keep in mind when evaluating your move into the colocation space.

Can you give us a little bit of your background in the IT and data center space?

David Carlson: I’ve been in the data center and managed service space for over 20 years and joined Forsythe (now Sirius) 3+ years ago to lead the sales efforts to market and sell our new state of the art facility in Elk Grove Village, IL. My team also currently runs and operates the facility.

What are the most important things to consider when evaluating colocation facilities?  

DC: It really depends on the client requirements which the primary drivers are: power/cooling requirements on per cabinet basis (this could filter out low-density providers); connectivity requirements including specific providers and low latency access to the hyperscale cloud providers; compliance, regulation or certification requirements (e.g. SSAE16, ISO-27001, Uptime Institute Certification by Tier); generator and diesel capacity; and probably historical view of any outages over previous 2-3 years.

Can you explain the differences between the different tier levels a colocation facility can achieve?  Why is that important?

DC: There are different organizations that certify data centers based on design and constructed facility.  Uptime Institute is probably the best know entity in the industry that many data center companies use for certifications.  The different tiers focus on design criteria for power, cooling, and security.  The higher the tiering will add redundancy on many of the key components which leads to increased uptime SLAs for power and cooling and physical security into the facility. It is important to understand that many data centers design to different tier standards but choose not to go through the certification process.  Sirius Data Center is Tier III certified by Uptime Institute for both design and construction. The benefit to the client is that the facility is certified for continuous availability which means we offer 100% SLA for both power and cooling.

When considering colocation, what should one look for relating to both physical and cyber security?

DC: Clients should at minimum make sure the provider is SSAE16 certified which means they have standard operating procedures that are audited bi-annually and they have multiple layers and different types (badging, biometric, etc.) of security checkpoints to get into the actual colocation space.  Regarding cyber security, any data center with connectivity into the building should also have different security technologies protecting the data center’s internal network from external threats.  This could include various technologies such as firewalls, DNS proxies, IDS, DDOS services.  If a client is buying internet services from the colocation provider, they should ask to meet with the network team to understand the architecture and what types of security services have been implemented.

What are the main reasons why someone would choose colocation over a hosted cloud solution?

DC: Clients that may want to still own and run their own infrastructure but don’t want to operate/maintain their own data center.  Clients that move to hosted or cloud based services are typically looking to exit the infrastructure business and buy it as a service in OPEX model.  There are also different types of cloud services (e.g. IaaS, PaaS, SaaS) which have their pros and cons depending on the application workload and client’s IT strategy.

Who is the ideal colocation candidate? 

DC: The ideal client depends but we look for clients that have the following compelling events occurring: Current colocation contract is expiring and unhappy with the incumbent (outage/service issues), technology refresh is occurring, data center consolidation project underway; need direct connectivity to the public cloud providers, making acquisition or spinning out of another company; client needs remediation on their own data center and thus may have large capital expense; client that needs to implement a DR site as part of their business continuity plan. 

If a data center manager is unsure whether colocation is the right choice, how can they feel more confident in exploring the option?

DC: I’d recommend that they schedule data center tours with leading colocation providers to get better perspective of how they run their facilities and the investments they make to operate and maintain a facility.  Running data centers typically is not core competency for most Enterprise clients. Thus, making the capital investment to own and operate a data center just doesn’t make financial sense nor enable IT to drive greater value back to the business.   There is a better way to buy data center space which is colocation.  This industry may be consolidating but the need for hybrid models and direct access to public clouds will only continue to increase demand for colocation for the next few years.

About Sirius Computer Solutions, Inc.

Sirius is a national integrator of technology-based business solutions that span the enterprise, including the data center and lines of business. Since its founding in 1980, Sirius has grown to be one of the largest IT solutions integrator in the U.S. Today, Sirius offers integrated, multivendor technology solutions that meet the requirements of the full range of organizations, from small businesses with fewer than 500 employees to large enterprises with thousands of employees and hundreds of locations.

www.siriuscom.com

FIGure It Out: An Interview with Andy Soodek of Secure Compliance Solutions

Details

Created: Thursday, 26 April 2018 21:23

This year, we will be taking time each month to interview professionals from various fields of work that relate to the data center. Through these interviews, we will be asking questions that directly relate to decisions you would make for your own business so you don't have to. This month we spoke to Andy Soodek of Secure Compliance Solutions about the risks of cloud security breaches and what can be done to help prevent them.

Can you explain Managed Security as a Service?

Andy Soodek: Managed Security is basically outsourced management of systems and network security.  Good security requires constant watch,  recognizing that today’s interconnected computer systems come with a wide variety of threats, both internal and external.  Security frameworks (NIST, ISO, PCI DSS) recommend, and data privacy laws (HIPAA, GLBA, GDPR) require continuous security monitoring.  We employ dedicated software and hardware tools that monitor systems environments for security violations (“events”).  A managed security service depends on skilled Security Engineers and Analysts, who apply their contextual understanding to: a) determine whether an event is real, and to: b) choose the best response to an Incident that will most quickly restore systems to a “normal” operating state.  Over time, and with careful system observation, security personnel tune security systems to strengthen defenses and make risk mitigation recommendations, in accordance with the client’s security strategy and business objectives.

When should a company look for an outside resource to help in matters of security and compliance?

AS: Some clients come to us after they have been attacked or breached.  We investigate what happened and make recommendations to prevent a repeat occurrence of the Incident.  However, if the company hasn’t prepared for security Incidents (backups, system logs), we may be limited in what we can do. 

Other clients request our services, because they acknowledge they don’t possess the appropriate in-house skill sets to: a) properly define their cyber risks, b) establish appropriate cybersecurity strategy, c) raise organizational awareness of cyber risks, or d) implement and manage technical security solutions.  The clients that use our managed services acknowledge that the cost associated with maintaining a 24x7 security team is cost prohibitive and inefficient.  Those clients understand that we can deliver the necessary security expertise and attention to their networks, systems and emerging laws that may affect their operations at a fraction of the cost of employing a small army of security and compliance personnel.

What are the biggest risks customers will face with security in the cloud?

AS: The cloud represents tremendous opportunities for small and medium businesses to take advantage of systems that would have been priced out of their range if hosted onsite.  Certainly, cost savings, rapid deployment, scalability and availability are significant benefits to businesses of all sizes.  However, there are a number of risks.

1. Widening Attack Surface – Migration to the cloud may mean additional locations where confidential data may be stored, transmitted or processed.  On shared platforms, your organization’s systems or data may not be a target of attack, but if an attacker targets the cloud service provider, or one of its clients, your operations may be impacted. 
2. Release of Responsibilities - Many purchasers of cloud services rely too heavily on the cloud service providers to handle all management aspects of their systems.  In Infrastructure-as-a-Service (IaaS) arrangements, cloud administrators may support security elements of the infrastructure, but they won’t necessarily patch Operating System software or applications.

Which types of companies are mostly at risk for a security breach?

AS: Every company is at risk for security breaches.  We believe there are two types of company: 1) Those companies that have been attacked, and 2) those companies that haven’t been attacked yet. 

That being said, some industries that use personal data more than others may be the initial attack targets.  These include healthcare companies, social media sites, governments, etc.  If those organizations have a reputation for lax data privacy practices, Hacktivists (Hackers driven by causes) may target them more rigorously.  Critical Service Providers (power plants, water reclamation, mass transportation) may be attack targets, because of the potential mayhem to society that an attack could cause. 

We expect an increase in small business attacks, because attackers know that small business doesn’t have the resources to defend themselves like their larger counterparts.  What your readers should know is that hackers continuously scan internetworked environments for openings and vulnerabilities they can exploit.  Whether you think you are a target or not, you need to diligently maintain the systems in your environment.  Your systems may not prevent an attack, but if the systems are configured properly, they may help minimize the impact of attack and will definitely help you get back in business faster. 

Are there any security and compliance details that most companies overlook or neglect?

AS: Unfortunately, many company managers believe they are not particularly lucrative targets for attackers, so they don’t worry about security like they should.  Big media news covers big corporations that get attacked, because they are highly visible, and so many people are impacted by each breach. Small business doesn’t receive as much news coverage following breaches, so many small business managers don’t think they are targets.  The reality is that 40% of all cyber attacks are perpetrated against small and medium businesses. 

We see companies who have been breached, but they haven’t adequately prepared their environments to withstand attacks, or accidents.  Many well-meaning companies build controls and implement technical solutions, but then they don’t test them.  Waiting until after an attack or data breach to find out your backups aren’t working is the fastest way to end your employment, and maybe the organization. 

What is the most important aspect of security and compliance that every company should have covered at a minimum and why?

AS: Understand that security is not a “set it and forget it” exercise.  Cyber threats continually evolve.  Laws and regulations evolve.  Many companies throw lots of money at tactical point solutions that don’t cover the entire spectrum of threats.  Security requires a strategic mindset that includes cyber and privacy risks as critical components of overall business Risk.  Remember, it isn’t just the systems we are trying to secure.  We are trying to protect your business operation. 

If you don’t do anything else, at least make sure you have an Incident Response Plan.  60% of small-medium businesses cease operations within 6 months of a cyber-attack.  Not only is Incident Response planning a requirement of every security regulation and framework, the common understanding of how to respond to a security Incident may just save your company. 

About Secure Compliance Solutions

Secure Compliance Solutions is the trusted security advisor for Chicagoland’s small-to-medium businesses. We offer a variety of services that promote a strengthened security posture and a culture of compliance. Our solutions include: risk advisory services, strategic cybersecurity planning, security and privacy awareness, regulatory guidance, penetration testing, and managed security services.  We tailor our engagements and solutions to align with your cultural needs and business objectives; not the other way around. We keep your appetite for risk, budget constraints, and timeline in mind to define strategy and operational tactics that maximize your return on investment. At SCS, we champion a Strategy of Readiness and Resilience.

www.securecompliance.co