From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

A semiconductor icon depicting IT hardware

Hardware

Brianna Monsanto

itbrew.com

Jobs you may not know that exist: ice cream taste tester, professional bridesmaid, snake milker…and USB warrior?

The latter is more of a working title to describe what members of the USB Implementers Forum (USB-IF), the nonprofit organization responsible for improving USB technology, do. If you have a pile of tangled USB cords in the corner of your office, chances are you have encountered the 30-year-old organization, whose members include Intel, HP, and Apple, in one shape or form.

Jeff Ravencraft, USB-IF president and COO, told IT Brew that he has practically dedicated most of his life to advancing these connectors.

“USB is the most successful [input/output] interface in the history of personal computing, and it has migrated now into all types of consumer electronics product segments,” Ravencraft said. “Airplanes, automobiles, cell phones, desk lamps, displays, electronic toothbrushes, medical electronics, power tools, wall sockets. It’s literally everywhere.”

IT Brew caught up with Ravencraft and USB-IF Chairman and CTO Abdul R. Ismail to break down the certification process and what’s ahead for USB connections.

Responses below have been edited for length and clarity.

What does the USB-IF certification process look like? Is it just you sitting in a room, plugging in connectors all day, making sure they adhere to your guidelines?

 We test for 10,000 insertions, but that’s not a person sitting at a desk plugging a connector into a receptacle 10,000 times. Some of it’s done with automation. Some of it’s done through math and parameters of insertions. We also certify silicon that goes in the devices and the host. We certify cables. We cut the cable open, look at the material. We do poisonous gas testing. It’s quite in depth.

 For the poisonous gas test, what we’re actually talking about is aging. We’re aging the cable, five years, 10 years. Those tests are not just to check the poisonous gas effect, but to cause aging of the cable to make sure that it can still work after five years, after 10 years, for example. And for the 10,000 extractions, there’s extraction force and insertion force. We have all these things to make sure it behaves the same way.

How far away are we from ditching port connectors altogether and just going all in on wireless connections?

 Today, there’s not really wireless charging. There’s no such thing. It’s a pad that you lay your phone on, and coming out of that pad is a USB Type-C connector…The issue with true wireless charging is they have not figured out how to actually send wireless signals through the air without killing someone. What if you have a pacemaker? What if you have some other device? How high is the charge going to be? There’s no such thing as wireless charging. I’m not saying they won’t solve it, but they’ve got to solve how to send power waves over the air without killing someone.

Any tips for IT professionals and organizations when shopping around for connectors?

Today, every manufacturer wants to be the lowest cost provider. Now, I’m not saying that’s good. Just because it’s low cost doesn’t mean it’s a good product, but that’s the nature of the beast today…I would caution them to not focus strictly on cost to the company or for their organization.

Always look for certified components. If a consumer buys a certified connector with the USB-IF logo on it, you will be assured that you will get quality products, something that will work every time.

USB-IF goes under the hood on the USB standards process

USB-IF president tells IT Brew that the certification process for connectors and cables involves 10,000 insertions and poisonous gas testing.

Eoin Higgins

As if IT pros didn’t have enough on their plate, decommissioning hardware is another responsibility with the potential for security breaches.

How and when you dispose of old and obsolete hardware infrastructure—whether you’re closing down your business or upgrading your tech—could have serious ramifications. Tim Rawlins, NCC Group director of security and senior advisor, told IT Brew that the sensitivity of data you have written on your hardware can often determine to what extent you’ll need to go to ensure it’s protected before you throw it away.

“At a low level, just rewriting it over, three times is enough. If it’s more sensitive data you might look at fully encrypting the hard drive so that there really is nothing in there that can be obtained,” Rawlins said. “And at the highest level, if it’s got sensitive data, then you would go for physical destruction.”

This kind of data cleanup is often referred to as sanitization. Rawlins said that the need for protection varies depending on how valuable the information is and whether or not there’s a viable threat. Organizations often hold onto their assets for longer than needed, meaning that the hardware gets used past what it’s made for, leading to further attrition when it comes to data on devices and hard drives. And on top of that, there are many boxes to check, according to Rawlins.

“You need to identify the data, you need to figure out how you’re going to destroy it, whether it’s just that sort of digital destruction or physical destruction,” Rawlins said. “You’re going to record that you did it so that you’ve got a record that you can use as part of any evidence that you might need to be able to demonstrate that you’ve done that process.”

The threat is real enough that agencies on both sides of the Atlantic are raising the alarm. 

 from the FBI detailed the risk of attackers exploiting remote access management on old routers to infiltrate systems. These attacks are a way for threat actors to go after internal information and show the threat that old hardware can pose.

In the UK, the National Cyber Security Centre has 

 for decommissioning hardware to avoid the security threat posed by stored data. It also lays out the steps companies should take for sanitization. “Some forms of sanitization will allow you to re-use the media,” the Centre explains, “while others are destructive in nature and render the media unusable.”

David Redekop, founder of DNS and security firm ADAMnetworks, told IT Brew that sanitization has, roughly, two main paths. First, and perhaps easiest, is to hand the work over to a trusted third-party vendor who can manage the sanitization. Second is to do it yourself. Which way you do it should rely on your risk posture, Redekop said.

“Whatever data you have, absolutely none of it should ever leave the premises, or the possession of a trusted employee, or trusted company premises,” Redekop said. “That’s the bottom line.”

Where the risk level is depends on a number of factors, but the primary concern is how much of a target your organization is to attackers. As Redekop explained, high-value targets tend to be those that have highly sensitive data or currency on their hardware; attackers getting their hands on hardware with that data could spell disaster.

“We’re talking about an attack surface that today is still growing,” Redekop said.

Data on old hardware requires sanitization—here’s how to do it

Agencies on both sides of the Atlantic are raising the alarm over the need for data cleanup.

You’ve been tasked to look for new hardware, and cost is a priority. There’s the potential for buying recycled equipment, but you’re wary—who knows if the previous owner properly wiped the device, or, more worryingly, if it’s still accessible from the outside?

Those concerns are part of the calculation IT teams need to make when looking for replacement hardware. As Rapid7 Principal Security Research of IoT Deral Heiland told IT Brew, it comes down to firmware: how it’s managed on the devices and whether the hardware has been sufficiently cleaned of prior data.

“If you’re buying network infrastructure gear, you can usually come in, purchase it, flush everything, factory reset, put all new firmware on, all new passwords, accounts, everything, and you got a perfectly safe device,” Heiland said. “If there is a cloud or internet component to that, then you need to consider, ‘Can I properly flush that disconnect and ensure the device can’t be registered by somebody else after I’ve purchased it that would give them some level of access?’”

The possibility that something can slip is enough to bother security professionals who are 

. For David Redekop, founder of DNS and security firm ADAMnetworks, the concern isn’t just how the device has been decommissioned and cleaned, it’s whether it can actually do the job.

“You need a little bit more horsepower or maybe a little bit more storage, because the drives weren’t as big back then,” Redekop said. “But what you can do with that now is practically the same thing you can do with the brand new one, and so there’s huge economic value in buying used equipment for those that want to run a sustainable business and would like to go on-prem versus on the cloud. Huge, huge value.”

Replacing the firmware on used devices allows for removing data the purchaser doesn’t want; removing embedded data is a chance to ensure the hardware is safe, no matter where you get it from. You don’t want another user, maybe half the country away, being able to access your “new” device, in other words. But for most branded tech, even when it’s used, that’s not an issue—nonetheless, the risk isn’t zero.

Doing a risk assessment is what anyone buying used hardware needs to keep in mind. There’s always the possibility that recycled devices could be used by malicious actors to infiltrate the systems of the buyer, but the likelihood of that happening is minimal unless you’re the specific target.

“If you’re really, really paranoid about security, then obviously buying new stuff is the way to go,” Heiland said. “If you’re fine with a little bit of risk, even if it’s very minimal, then buying on the secondary market may have some real value.”

Cost is often a motivating concern, and that gives the chance to compare and contrast new and used devices. While the newer hardware may have a higher upfront cost, used devices often need the aforementioned extensive patching and wiping, making it a wash. But supply chain uncertainty could change the calculation, offering attackers another way in by alteration between the factory and the user.

Redekop called it “buyer dependent, buyer beware.” It comes down to making the right decision for the specific user, much like a used car.

“If you know what you’re doing, buy it used, because you’re going to get tremendous value,” Redekop said. “If you are a buyer that just needs to go through a tremendous amount of checks and validations, new is going to be the way to go. So, it really is going to vary quite broadly on when I would make a recommendation one or the other. There is no simple answer.”

Aerial view of trucks unloading trash into a landfill

Buying recycled hardware has ups and downs—here’s what to look for

“If you’re really, really paranoid about security, then obviously buying new stuff is the way to go,” IoT researcher tells IT Brew. 

Hacks are a pain, and that’s the truth.

 on a train vulnerability based on remote-control linking got the railway industry to work on resolving a problem that had existed for years. Attackers could, hypothetically, infiltrate a packet that links the head and end of the train, and then control the brakes.

While the Association of American Railroads (AAR) was made aware of the vulnerability as early as 2012, the organization more or less ignored the danger for years, researcher Neil Smith 

 on X on July 11. According to Smith, who was working closely with the federal government’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) at the time, AAR declined to take action because the danger of the exploit had not been sufficiently proven.

Sounds bad. But hold on, said Hussain Virani, Dragos response command lead and principal incident responder. The danger might not be quite as dire as it sounds.

“Is this something which we can kind of put off to the side and not pay attention to? Certainly not,” Virani said. “It is important. After all, it involves the safety system. Does it deserve full-out panic? No, it doesn’t.”

In an emailed comment, AAR spokesperson Jessica Kahanek said that “every operational strategy, safety protocol, and piece of equipment is viewed as an opportunity to enhance performance and safety.”

“Accordingly, railroads have, and will continue to, put concerted effort into advancing next-generation end-of-train devices and the technical standards that govern them,” Kahanek wrote. “Next generation devices and standards have the potential to significantly improve communication between lead locomotives and the end of the train, securely enhance reliability, and streamline operations.”

Any unexpected braking would be noticed and acted upon by the conductor, Virani continued, so while there is a danger the actual effects are unlikely to be life-threatening. The human element is helpful, putting people in the process. Plus trains have a system called Positive Train Control, a technology that prevents accidents.

“There’s this overarching safety system in place to mitigate against a system like an end-of-train device failing,” Virani said.

Impacts of the potential exploit go further than the trains and the AAR. Houbing Herbert Song, an Institute of Electrical and Electronics Engineers fellow, told IT Brew that he sees the AAR’s inaction as symptomatic of the way the transportation industry as a whole addresses security concerns.

“The infrastructure is very old, so a lot of people don’t care about the cybersecurity issues here,” Song said. “This problem, this issue, is one vulnerability that has existed for many years.”

A patch for the problem is expected in 2027, 

. That’s a slow fix that could appear to indicate the flaw isn’t a major priority—but, Fortinet Head of Cyber Policy and Global Field CISO Jim Richberg said, the reality is more that in the OT space, security is often a distant third, after safety and reliability. IT security considerations and processes are simply not the first priority for this space, and transportation is no different.

“We’re always going to be playing catch-up,” Richberg said.

In order to manage the threat going forward, Song said, defenders will need to adjust how they approach security as a whole. Transportation isn’t fundamentally different from other sectors of the tech space, though it’s often treated as such; understanding it as a part of the IT security framework—something that experts have called on IoT to do 

“The perspective is to treat transportation infrastructure as a cyber, physical, human system—a social, technical ecosystem,” Song said.

Like most OT-capable infrastructure, the transportation industry moves slowly and solutions are cost-dependent. Virani said that the hard realities of specific maintenance windows and mitigated controls allow for repair, but not on an accelerated schedule.

“If we know this system is prone to a certain vulnerability, then we can put additional measures in place in order to prevent anything from happening, or at least to reduce the consequences,” Virani said.

The fix might not come for a few years, and it’s unlikely that security will become one of the top two priorities for the OT space. But for the train vulnerability, the fact there’s a patch at all is a sign of a positive change that Richberg hopes continues.

“At this point, something like 95% of organizations have got OT reporting up to the corporate CISO,” Richberg said. “They’re starting to say OT affects more than just the OT operating environment, it’s part of the whole business.”

a train with computer error messages overlaid

OT moves slow to handle threats, and transportation is no exception

“We’re always going to be playing catch-up,” longtime OT exec tells IT Brew.

Billy Hurley

As a fungal researcher, the University of Wisconsin–Madison PhD candidate analyzes the DNA of the microorganism’s 500 different strains, or genomes, preferably all at once. A program outputs a file that tells Pratt every single gene and its location.

A fungal genome has thousands of genes. The high-computational task, on her machine, would take 12 hours…per genome.

A management tool called HTCondor helps researchers like Pratt connect to powerful computers on campus to do hardware-heavy jobs. The open-source software, developed at UW–Madison’s Center for High Throughput Computing (CHTC), has also received funding from orgs like the National Science Foundation.

University pros—and one software engineer who has worked with the computing scheduler for almost 20 years—shared with us why HTCondor helps with research needs.

“I can run analyses in parallel, and I don’t have to sit with my computer open for hours on end. I can just submit something, close my computer, go do whatever else I need to do, and then come back later when it’s done,” Pratt told us.

HTCondor, first installed as a production system in the UW–Madison Computer Sciences department in the 1990s, has now been put to work by almost 200 academic, government, and private-sector groups, according to 

 containing volunteered info. (There are even users in Antarctica. The “IceCube” experiment researchers use HTCondor as they search for subatomic particles in the South Pole.)

The map also cites 22 private-sector partners. According to Greg Thain, senior software engineer at the CHTC, the private sector “absolutely” uses high-throughput computing in production and not just for research. DreamWorks Animation, he wrote, uses the system to render the frames of their movies. (DreamWorks did not immediately respond to a request for comment regarding if and how the company uses the tool.)

Institutions can limit computing capacity to their own campus hardware, as well as pull from an “

,” composed of thousands of cores contributed by sites all over the country.

It disappoints Thain when researchers prematurely limit the scope of their inquiry to what can be done on a laptop.

“Computers are cheap. They’re not free; they’re cheap. They’re widely available. We don’t ever want lack of access to computation when there are so many computers, in your office, in your building, in the world,” he said.

To run the fungi analysis, Pratt logs into the CHTC.

A “condor_q” line command allows Pratt to see jobs completed and jobs running. A “condor_submit” command points to the relevant submit file.

A submit file contains, essentially, the program that Pratt wants to run: components like GPU requirements, the executable (

), and text files that the executable requires. (Some command-line expertise is required, Pratt notes; she attended trainings and learned from the HTCondor team.)

Hardware is a precious commodity when dealing with the latest technologies, like large language models. OpenAI CEO Sam Altman this year shared on X how his company’s latest GenAI tool was “

” available GPUs, and Big Tech companies like 

 have dedicated major investments to provide data-center support to train and run their LLMs.

Institutions like the Grainger College of Engineering at the University of Illinois Urbana–Champaign 

, too, and that means plenty of computers and a tool like HTCondor to schedule the jobs.

Users submit their tasks to HTCondor, and the management system queues them up based on scheduling policy and priority scheme, runs them, and informs the user of the result.

The tool tries to run a “fair share” of resources, Thain said; if you’ve used 5,000 CPU hours, you’ll move to the back of the line after your job is done. The resource providers, however, can influence the setup substantially, he added—maybe a physics department that’s paid for the machines gets primary access, or an astronomy team gets the computing at night.

The setup came in handy during Covid-19 lockdowns, according to Gianni Pezzarossi, computational system analyst for the Grainger College, given HTCondor’s handling of workloads across unused computers, like abandoned Linux lab machines after students left campus.

“We were able to utilize all these idle computers that were sitting in the computer labs,” he said.

A primary benefit of HTCondor is to help with resource contention within research groups, Pezzarossi told us. Before HTCondor, there wouldn’t be enough CPU to go around, he said, and jobs would be halted by the Linux Out of Memory Killer.

Following the campus-wide usage during Covid, Grainger began to offer individual research groups their own smaller clusters made up of only their research-group nodes. The school currently runs six of these smaller clusters.

Pratt, on June 20, had one project completed in the HTCondor queue and one currently running.

Five-hundred strains is still a big job, no matter who or what is handling it.

Credit: Brittany Holloway-Brown, Photos: Adobe Stock

For high-compute jobs, HTCondor matches hardware with researchers

University pros share how the tool saves them time and takes advantage of unused resources.

If there’s one thing people in the tech industry are talking about—other than AI—it’s data centers. The critical infrastructure is becoming even more important in an era where computing technology relies on information and developers are rapidly building out capacity.

Despite that increase in production, however, data centers are also 

 at a rapid rate. In large part, this is due to an increased reliance on the usage of offsite hyperscale data centers, which has resulted in the closure of on-premises sites. But with the rise of larger off-prem centers comes 

 could lead to a spate of decommissioning in the future.

Decommissioning involves migration of system data and workloads and wiping, or sanitizing, data on older hardware. Migration is a relatively simple process, F5 CTO of Government Solutions Bill Church said, because the risk involved 

“It’s almost inconceivable that we would design an application today that would not have some sort of fallback or backup capacity,” Church told IT Brew.

But overall, decommissioning is a procedure that carries with it no small amount of security risk, as NCC Group Senior Advisor and Director of Security Tim Rawlins told IT Brew. Hardware that’s been cleared of data often retains information.

“Time and time again, it’s been shown that if you go out onto eBay and buy second-hand computing equipment, there’s a very good chance that it hasn’t been properly wiped, that there is still data on that system,” Rawlins said.

It’s not cheap. Kiersten Todt, former CISA chief of staff and current president of communications firm Wondros, noted that the cost of decommissioning often starts with moving assets and data to the cloud. Transitioning to a new facility is frequently the reason for decommissioning; managing, minimizing, and mitigating costs are the priorities for organizations.

“As this data center boom continues, and as we’re seeing more of this—both from an energy perspective, but also physical—cloud first are easy to scale, and it helps to sync and create the efficiencies across them,” Todt said.

The process of decommissioning comes with other concerns. Energy and infrastructural hook-ups to the grid are frequently important, whether you’re seeing strict decommissioning or augmentation, Energy Exemplar CEO David Wilson told IT Brew. Scaling up existing sites that are operating on older generation technology is more frequently seen, meaning that when these sites are closed by one organization, another is only too happy to pick up the slack. That’s not unique.

“Typically, what we’re seeing in the US is…whenever a large load is disconnected from the grid, whether that’s a data center or an aluminum smelter or some other industrial process, there’s a list of candidates who are quite happy to pick up that load,” Wilson said.

Disconnecting the center from the grid is easier than connecting it. Energy research firm Rystad Energy found in February that in excess of 2 terawatts of potential projects are 

, but “historically, the approval rate for queued projects has hovered around 15%.”

Even if the centers are augmented, rather than being decommissioned outright, the infrastructure has a finite lifespan. Eventually the assets in the centers will become obsolete, and with the technology moving forward rapidly, the capacity and scale of existing facilities is often already behind the times.

“They just become uncompetitive because they’re sub-scale, and they will retire,” Wilson said.

Technician working on a large LED screen, connecting and adjusting cables for optimal performance and troubleshooting any issues

Decommissioning data centers is often necessary, but carries risk

“Time and time again, it’s been shown that if you go out onto eBay and buy second-hand computing equipment, there’s a very good chance that it hasn’t been properly wiped,” NCC Group exec says.

 whip out your backup redundancy strategy.

 or storage methods for data that allow for systems to remain operational in the event of a failure, are essential in an industry where data breaches, 

, and ransomware incidents remain a threat to business continuity. Jon Kuhn, SVP of products at Delinea, told IT Brew that recent disruptions such as the 

 have highlighted the importance of having redundancies in such events.

“That really caused a tremendous amount of damage due to the fact that it didn’t allow computers to reboot and I think there were very few people that saw that one coming, as wide-scale [as] it was,” Kuhn said.

Kuhn added that having adequate backup systems will remain “critical” for organizations as they continue to increase the amount of data in their systems.

“With video and audio content on the rise…you have a lot more to store and therefore, that’s going to continually be a problem as we get further on into the next 10 years,” he said.

IT Brew asked Kuhn and Kirkham IronTech CEO and founder Tom Kirkham how to craft a well-rounded redundancy strategy. Kirkham told IT Brew that businesses should have three components in their redundancy strategy: data restoration, disaster recovery, and business continuity.

Kirkham said there are different redundancies to consider for different purposes. Hard drives, for example, are an example of a fault-tolerant redundancy strategy for servers, he said.

“They can be configured in such a manner that if one disk fails…the data is still recoverable,” Kirkham said. “And in fact, if it’s done properly, the user won’t even know.”

At the data center level, Kirkham said redundancy should be considered for the power, heat, cooling, and internet service providers of a facility. He said cloned data centers, which he described as facilities with duplicated data centers, are an example of this type of redundancy strategy.

“The entire data center on one side is cloned over to the other one and they’re designed to be…hot swappable,” he said.

Kuhn said redundancy for account access is an overlooked area among businesses, a factor that some companies struggled with during the CrowdStrike incident.

“An approach for that might be to allow personal computers, then, access on a temporary basis. That might be what we call a break-glass account to get access to a specialized system in a time of need,” Kuhn said. “That’s really only used for emergencies.”

Kirkham said it is essential that businesses periodically test their different backup systems to ensure that they will work as needed in any given event.

“If you’re not testing it and improving it and looking at all your different backup time frames, and thinking about business continuity, you really don’t have a backup or redundancy,” Kirkham said. “You kind of have a wing and a prayer.”

Making the business case for pricier backup options. 

For IT leaders who need to plead their case for more premium backup equipment or services to stakeholders, Kuhn suggests that professionals showcase the impact downtime can have on their organization. Kirkham said downtime can be quantified as monetary productivity loss.

“How much downtime would be [for] one hour of your call center being offline, or your employees not being able to work?” Kuhn said. “And with that ROI in mind, you start to see where the cost of downtime actually far exceeds what protections you could put in place.”

Kuhn compared the need for enterprises to have 

“Would you drive without a spare tire to save a few dollars?” Kuhn said. “What would be the impact if you were on a lonely road in the middle of the desert when you don’t have a tire there?”

Five blue servers with arrows pointing to one another.

Why redundancy is required now more than ever

“With video and audio content on the rise…you have a lot more to store and therefore, that’s going to continually be a problem as we get further on into the next 10 years,” one expert says.