The 10 most demanding jobs in IT

Emerson survey cites roles requiring 'Always-On' availability

What are the 10 most demanding jobs in IT?

Well, according to a survey by Emerson Network Power, a provider of high-availability data center infrastructure management products, they are:

1. Executive director/administrator
2. IT procurement
3. CIO
4. IT manager/director
5. IT operations
6. Data center manager
7. Engineering
8. IT security
9. Applications/software development
10. Database management

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

LOOKING: Want a new IT Job? Now's your chance

Emerson surveyed 800 IT professionals from four regions -- the U.S., Asia, Europe and Latin America -- representing 17 work roles and 18 industries, at businesses ranging from 50 to more than 10,000 employees. Most questions were designed to gauge who and what role in IT was "Always-On" -- a reference to Emerson's business in power supplies -- and used an agreement scale ranging from strongly disagree to strongly agree.

There we three open-ended questions:

• How many hours per week do you work at your IT job? Include paid and unpaid hours.

• What are the most demanding aspects of your IT job?

• Please describe one or two situations that best illustrate how your IT job requires you to be Always-On: always available, always working at peak capacity and always accurate.

Respondents at the executive director/administrator level -- including administrator, leader, department head and director -- have hands-on involvement in every aspect of IT: strategic, operational and tactical. All say they work on many projects at once, and that their work requires a high level of intelligence. Only 25% agree or strongly agree that success depends on things out of their control; that they are accountable for success, and that translates into high job demands, the Emerson survey found.

IT procurement officials identified themselves as analysts, buyers, representatives, supervisors, consultants, directors and other leaders. More than half of respondents say they don't have control over their schedules and don't have time to do quality work. They indicate multiple pressures: urgency, demanding clients often in different international time zones, staying up on the latest equipment and filling pressing staffing needs.

CIO scores highest on "dependencies and multi-tasking," according to the Emerson survey. Responses show particularly high requirements to work on many projects at once and make important decisions quickly, and those decisions can be required any time. Other respondents say they have to be available to take emergency calls and have been tracked down even on vacation.

Demands of the job also include motivating and orchestrating the work of others. CIOs also indicate more than did any other IT role that they are responsible for a large part of the company's budget.

IT manager/director might be called on to put out fires or do routine work at any time, including nights and weekends, the survey found. Respondents say demands include juggling several projects at once, solving problems quickly and working at peak capacity at all times.

Respondents also say they have responsibility for a large portion of the company's budget and for leading the meetings they are in.

IT operations personnel include technician, manager, analyst, operator and specialist. They report working on high-stress projects with constant time pressure and responding to after-hours incidents, the Emerson survey found.

Data center managers were in the top three for "dependencies/multi-tasking," the top four for "availability" and the top five for "quick response." They also scored more than 30% higher than average in agreeing they don't control their own schedule -- 70% for data center managers compared to 45% on average.

Job demands and responsibilities include working fast, handling confidential information, troubleshooting, managing budgets, hardware maintenance and "everything," the Emerson survey found.

Engineers scored high in "dependencies, "multi-tasking" and "quick response." More than 80% agree or strongly agree that others depend on their work a great deal, 91% say they immediately read all messages received and 86% quickly respond to all inquiries. Thirty percent of the respondents work for consulting engineering companies, and "perfection" was cited as one of the job demands.

Making emergency decisions is noted as a typical demand of the IT security group. Eighty-nine percent of the security respondents agree or strongly agree they make important decisions quickly -- the highest score of all the IT roles.

But this group also scores lowest on quick response, the Emerson survey found. Sixty-one percent agree or strongly agree they quickly respond to all inquiries, but the average across the top 10 Always-On jobs is 76%. More than half of IT security respondents say that success depends on things out of their control.

Application and software developers are apparently able to concentrate on their work more than others. One-third or less report having no time for quality work and no time to think things through.

This group scores highest in quick response, though, the Emerson survey found. Eighty-seven percent of respondents say that others depend on their work a great deal; and job demands include developing new applications for the workplace or industry, some involving highly complex issues.

Database managers have a similar profile to application/software developers: 87% say others depend on their work a great deal, but 58% say they have no time for quality work and 47% say they have no time to think things through.

Those responses are consistent with the demands of the job, the Emerson survey concludes, which include working under pressure while troubleshooting various issues on a daily basis, often under tight project deadlines.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

The two most feared attacks and how to avoid them

Large organizations with ample resources quake in their boots over two common security threats. Here's your best defense

These days when I'm consulting with big businesses, governments, and other organizations, two main topics come up over and over: pass-the-hash attacks and hacktivism. One government client put it thusly: "Our department considers pass-the-hash attacks our No. 1 threat, above all other computer threats." A lot of things are broken in the security world, so to pick out one and call it the greatest threat is saying something, especially since the customer has what most readers would consider nearly unlimited funds, a multitude of competing vendor partners, senior management support, and a horde of experts with whom to discuss the problem.

Defending against pass-the-hash atttacks
The reason pass-the-hash attacks are so feared is that once the password hashes have been obtained, the attackers can move around the compromised environment with ease. Hashes can be used to access any protected resource within the same forest. Worse, if a domain admin has logged on to a computer, a local attacker with Administrator credentials can harvest the domain admin authentication hashes right out of memory.

[ Prevent corporate data leaks with Roger Grimes' "Data Loss Prevention Deep Dive" PDF expert guide, only from InfoWorld. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]

I think it is the latter attack, the ability for an attacker to elevate themselves to domain administrator -- just because a domain admin had logged on to a box -- that scares defenders the most. Essentially, the trustworthiness of your domain admin credentials are now an exponential factor of every computer they have ever been used on.

How to fix it? The best way is to not have any domain admins. Even if attackers compromise elevated accounts, their access is less than elevated domain admin. And if they add themselves to the domain admins group, an alert will be generated quickly because your monitoring software will know that should be an empty group. Here are other actions you can take:

Never log on to a normal end-user workstation as a domain administrator. Limit your domain administrator logons to domain controllers or special file servers. By never logging onto regular workstations, you significantly reduce risk.
If you have to log on using domain admin (or other elevated credentials), always do so from a trusted computer. These are known as "jump" boxes. These jump boxes can be unique per user, virtual machined, and flashed cleaned after every use. The idea is to always log on to boxes that you know are clean.
Do as many administration tasks and fixes as possible using remote console tools, which are less likely to leave password credentials in memory on the remote computers. Most pass-the-hash attacks take interactive log-ons (unfortunately Remote Desktop and Terminal Services are interactive log-ons), so the less of them you do, the better.
If you have to interactively log on to a computer, after you are through, reboot the computer (if possible). Rebooting removes the credential temporarily stored in memory.
Frequently update elevated account passwords. I have many clients who change passwords after every use, often with the help of third-party software. That way, if an attacker grabs the credentials out of memory, so what? They aren't any good anymore.

The No. 1 way to prevent pass-the-hash attacks is to keep the bad guy from getting domain admin or local admin in the first place. After doing your best to achieve that, see how far you can get using the other recommendations above.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

The looming hacktivist threat
Another growing fear involves hacktivism-style attacks. Most companies point to the malicious success of the Anonymous group. Each CIO I've spoken with is increasingly worried that determined adversaries will get access to data if they want it.

You might ask why they don't fear APT (advanced persistent threats) as much. They do, but most have already been through that pain and are living with the outcome and response. And unlike APT, which usually steals data silently, hackivists steal data or cause DoS attacks, and they publicize the fact to embarrass the entity and cause it to lose customers, trust, and money. In many circles, the publicity factor is worse than some city-state threat looking to steal intellectual property.

How do you defend against hackivist threats? Most attacks of this ilk begin with a compromised Internet-facing host or social engineering of credentials from a trusted employee. If you're worried about hackivists, start here.

First, conduct a penetration test on your outward-facing assets. Why let random attackers be the first to test your new Internet-facing application, server, database, or defense? Use your own testers and/or hire "red teams" to fill the role of the rogue hackivist.

Make sure all custom application code has undergone security development lifecycle creation and review. Make sure all your software is created from the ground up with security built in from the start and not as an afterthought.

Engage in strong antisocial engineering education for all end-users who are in a position to release credentials or protected information. Recently, I was asked to assess how well a large company's antisocial engineering education and policies were working to prevent hackers, calling in over the phone, from obtaining credential information or other employee-related data from administrative assistants.

At this company, the assistants are part of the first-tier support for such information, and they're all trained to ask for specific information and/or to check for confirmation with superiors before releasing such data. I was amazed with the results. Although the company has thousands of administrative assistants, often changing, each with varying levels of computer skills and malware awareness, the education program has been highly successful.

After hundreds of over-the-phone hacking attempts each year, as far as I know, only one hacker was successful in the course of the last decade in obtaining a password reset and none were in obtaining personally identifiable information. No one knows if every attempt (successful or not) was noted, but when going back and auditing accesses and password resets, we were able to verify that nearly 100 percent of them were legitimate and valid requests when reported as such, and vice versa.

I got to listen (or read transcripts) to many of the recorded phone calls of hackers trying to obtain protected information from administrative assistants. The calls went something like this: The hacker would always start by being as friendly as possible, while asking for access to confidential information or a password reset. When challenged to produce the verifying information, the hackers always became more hostile. The more the assistants resisted, the more the hackers challenged. Many times, by the end of the call, the hacker would explode in anger and threaten the assistant's job security. I wondered how well I would have handled such a call early in my career. It showed me that a well-run education program could work.

Of course, you can't rely on end-user education alone. I prefer systematic DLP (data loss prevention) solutions. DLP software monitors your content and traffic flows to prevent unauthorized access. False positives are still a problem, but recent improvements have helped.

Best Microsoft MCTS Certification, Microsoft MCITP Training
at certkingdom.com

Microsoft, Google, IBM and Salesforce.com heat up PaaS

IBM, Microsoft, Google and Salesforce share their strategies regarding one of the hottest emerging areas of the cloud: Platform as a Service.

What do you get when you get four of the biggest cloud vendors in a room to talk about one of the hottest emerging trends in the industry? Not a whole lot of agreement for one thing.

At last week's Cloud Leadership Forum, which was sponsored by IDC Research and IDG Enterprise, officials from IBM, Google, Microsoft and Salesforce.com came together to discuss their platform as a service (PaaS) offerings. PaaS is a way to develop and deliver applications in the cloud, but it's the least mature of the three major cloud delivery models compared to infrastructure as a service (IaaS) and software as a service (SaaS). And pretty much one of the only things all four companies agree on is that PaaS is still in its early days.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

While PaaS is still a developing market, some experts predict that PaaS could become the most important cloud model. PaaS lets companies build customized applications and designed from the start to run in the cloud. In the near term companies that embrace PaaS have a market differentiator compared to competitors, says Steven Hendrick, an IDC analyst tracking the PaaS market. As the IaaS and SaaS offerings continue to gain widespread adoption, the real differentiators for companies will be applications they have tuned to the specifications of their business needs, he says.

PaaS has some technology advantages as well, he adds. A PaaS environment sits between the software and infrastructure layers, which gives applications designed in a PaaS space insight into the supply and demand of the cloud environment. "That uniquely positions them to understand the workload demands of the applications and the system resources of the infrastructure," Hendrick says.

There's a growing marketplace of vendors attempting to stake a foothold in the PaaS arena. In addition to some of the big-name players like Microsoft, Google and Salesforce, emerging players such as Engine Yard, CloudBees and AppFog are also in the market. VMware has an open-source PaaS offering named Cloud Foundry, while Red Hat has its own PaaS offering named OpenShift, which is expected to be brought out of developer preview later this year. Amazon Web Services, the dominant public cloud IaaS provider, Hendrick says, could even be classified as a PaaS offering because it offers tools for developers to build and deploy applications in the AWS cloud.

But the four big-name tech stalwarts are making sure they're not left out of the cloud conversation moving forward.

Microsoft

Microsoft may have one of the most recognizable PaaS products in the market with its Azure platform, but Tim O'Brien, general manager and platform evangelist at Microsoft, says cloud is still mostly seen today through the lens of IaaS. "The PaaS question we get today is, 'How is that different from IaaS?'" In a simplified form, IaaS is nothing more than virtualized machines or storage, he says, whereas PaaS is a development fabric. The idea is that developers deploy the software and the application automatically provisions virtual machines to its specifications. To allow for easier connections between the PaaS and IaaS layer, Microsoft recently extended an IaaS offering to Azure, which O'Brien says makes it the most comprehensive cloud offering on the market. "No other provider has that kind of breadth," he says. The other major differentiator is the company's 25-year experience working with enterprise IT, which he says newer tech companies just don't have the experience of. "There are no shortcuts to truly understanding what keeps CIOs up at night," he says.