Field Notes and Research

Software Licensing – Mitigating the risk of paying too much

No Comments 25 March 2008

There are many ways to mitigate the risk of paying too much for software licenses—but you can't expect vendors to help you much on this front. Even as many software offerings have drifted towards commodity status, it seems that many vendors are working hard to bolster license revenue by making fee structures ever more complex and non-standard. Many of these license structures heavily favor the vendor interests and tend to inflate costs beyond what is necessary and reasonable. For example:

  1. Some use-based licenses add a premium for peak periods, complicating cost calculations and potentially producing unexpectedly high fees
  2. Enterprise licenses base pricing on tiered or target numbers of users, rather than the actual install base. In such scenarios, companies can end up paying for unused seats.
  3. Vendors offer discounts for prepaying years of maintenance fees (e.g., three years) at today’s “lower” prices and usually based on projected levels of use. In reality, software fees generally fall over time, due to competitive pressures and increasingly cheap base technologies. As a result, locking in fee rates can commit companies to paying fees that are, over time, higher than rack rate.

The worst part about these structures is that customers feel they have no choice and must accept disadvantageous license and use-auditing structures in order to continue using software products.

Continue Reading

Field Notes and Research

Blah blah don’t blah blah blah security

No Comments 25 March 2008

"As he said 'Blah blah blah blah blah blah blah blah
Them crazy hippies blah blah blah blah no effect on me
Blah blah blah blah blah blah blah blah
The Great Depression blah blah blah'
And he would not leave me be"

Old Blevin, Austin Lounge Lizards 

Is there something in Texas water that causes otherwise rational people to find epiphanies in country music? It must be so, because after the Brightfly Risk Management Clinic last Tuesday I found myself en route to the Houston airport, marveling at how the Austin Lounge Lizards had nailed a key problem in information security.

Continue Reading

Field Notes and Research

Communication Channels for Security Awareness

No Comments 13 March 2008

Here is a list (far from complete), of communication vehicles for driving security awareness. This list has been developed with our clients through our Security Awareness Workshops and is still growing as we continue to do more. What I have found most striking is the sheer number of methods you have for communicating with your users.

Continue Reading

Field Notes and Research

Writing Effective Policies

No Comments 02 December 2007

As we have previously stated, information security policies are extensions of the directive portion of the total controls environment within an organization. Therefore, like guardrails on the highway, they should be designed to manage the behavior of the users in performing their duties within the boundaries set by the organization. Policies should not be solely about what the users cannot do, as it quickly becomes untenable for the practitioner to outguess the users in determining the limits of acceptable behavior. Instead, the policies should guide the user in the proper means of accomplishing their goals, showing instead the right way of doing things, as opposed to enumerating a limited subset of bad ways.

Continue Reading

© 2008 Brightfly, Inc.

Powered by You, the Community.