sultanbouhamdan

What I learned the most from Sweden was Perfection: the concept of perfection in designing and building products. In this article, I will share what I learned from IKEA and how we can bring these concepts to the software world while designing products that not only adding real value but also cost effective. Leading by design inspired me to develop a new concept of quantifying the cost/need ratio of any product we are building, and constructing the circle of feedback early on in the design process before prototyping.

I for Ingvar, K for Kamprad, E for Elmtaryd, A for Aggunaryd – IKEA

Leading by design by Bertil Torekull is one of the best read I had in 2022.

The philosophy started from a trip to Milan where Ingvar saw the difference between the exhibited luxury and the furnishings that ordinary people could afford in their homes. He asked himself:

• Why do poor people have to put up with such ugly things?
• Was it necessary that what was beautiful could be bought only by the elite for large sums?

He went back home with those questions ringing on his head. They were to go on demanding an answer from me all my life. Democracy as an instrument for evolution can lead to remarkable inertia.

• Solving the question of How in the simplest and cheapest way to convey goods from the factory to the customers
• Giving names to furniture instead of serial numbers
• Mail order and furniture store at one
• Only those who are asleep make no mistakes
• An even greater joy is having business ideas and convincing others that they are possible to achieve
• A kind of keenness not to miss a chance
• Companies are People, Ideas, Cultures and History
• Cost Awareness, The majority of people, the dream of a good capitalist, hard work raised to the highest morality.
• Taking responsibility is a privilege: The fear of making mistakes is the root of bureaucracy and the enemy of development. 

Democratic Design

• Swedish Design: Bright, Light and Functional
• All designs learn from other designs
• The innovation of self assembly, saving a great deal of money in the factories and in the transport
• Gillis: What a lot of space it takes up, let’s take the legs off and put them under the tabletop. The one fine day, they had the first flat parcel and thus they started a revolution. Max was the name of the first assembled table.
• Reality forced the innovation upon us. We had begun to experience a worrisomely high percentage of damaged furniture in transport (Breaking table legs, etc)
• Then it was another revolution – the way of treating the surface of the wood

The concept

We are a concept company – Ingvar said:

The spirit primary stands for the concept.

• Just inside the entrance, there should be the living room, and in the living room, they begin by deciding on the most important piece of furniture of all, the sofa 
• After the sofa, they usually go for the carpet, the table, then they buy the chair, then a bookcase of shelving
• After that, the kitchen, bedroom and so on

Product Names

Computer people wanted numbers; Ingvar fought for names which he usually thought up with the designer.

• Suites, Sofas and Chairs were to have city names
• Bookcases were to have boy’s names
• Curtains girl’s names
• Duvets bridge names
• An armchair was called Stabil and its certainly was stable

Products like Aveny, Billy, Morot, Moppe and Sultan were hits.

The same names are used all over the world using the Swedish names.

The Business model

• The hugging management – Hug each other, if you like each other you work well together. Hugging is both free and cost effective.
• The ideological Think Tank of the empire. Each store, each concept purchaser and franchise pays 3% of Turnover to Inter Ikea systems BV
• The sacred concept: Waste is a deadly sin, Simplicity is a virtue, Doing it a different way, concentration is important to our success, we can’t do everything, everywhere, all at the same time.
• Selling hotdogs for 5 SK.
• Down to earth democracy
• To manage all of it, you have to know the details, that’s my philosophy
• Tax is a cost, corporate tax is 28%
• 1% in reduced sales produces 10% in reduced profit.
• The Head-To-Foot company

IKEA has meant more for the process of democratization than many political measures put together. Part of creating a better everyday life for the many also consists of breaking free from status and convention – becoming freer as human being. We must, however, always bear in mind that freedom implies responsibility, meaning that we must demand much of ourselves. No method is more effective than the good example.

Einstein once said that “we can’t solve problems by using the same kind of thinking we used when we created them”. This quote works for many cases in life but it doesn’t really work if you want to solve the security threat behind cloud computing. So you have to think first of how would you attack what you have and use a reversal techniques to protect yourself.

So how the bad guys think? The criminals may be looking for a memory corruption bugs in the web server for instance, tries to figure out what IP addresses are used and looks for a service that is unpatched to break in. Once they break in to the web server, they can easily find their way to the Database and Application servers. Criminals can also send a file in a hope that someone could open this file, if this happens they can take-over the machine, establish interactive control, scan the network, escalate the user privilege in the active directory to become admin users, take over the machine and get the data they want. The question that asks itself here, how can they connect to the servers with all the firewalls and protection in place? They use Divert sockets to match traffic with the firewall rules and divert it into a piece of code, and then they look for SYN packets going to a server and alter the traffic using the generated code. They do the reverse coding on the remote site so that the hack is not captured by the security log files. Attacker also tries to create a huge amount of connections in the SYN received state until the backlog queue is overflowed so that the host kernel memory becomes exhausted. Moreover, the attacker can spoof their source IP addresses make it harder to trace the source of the attack. To add complexity, the attacker can use a distributed attack taking advantage of many drone machines in the internet. It is very important as well to know when you are under the attack, who is attacking you, what is the target and how can you stop it. Now we know the different ways of attacks, let’s design the best 5 lockers to close all the borders of our cloud architecture.

Lock#1 – Physical: Starting by the physical layer, there is a big demand in the market to use COTS hardware. From security perspective, although we are abstracting the software from the hardware, we do need to protect our hardware to better protect the software layers on top. The basic tip here, use built-in security in the infrastructure layer with hardware based root of trust and policy engines that checks hypervisor integrity and allow/deny work load migration from one host to another based on trust security profiles.

Lock#2 – Virtual Machines: On the virtualization layer, there are many cybersecurity attacks where malware creators inject viruses into the Virtual machines; these viruses are mainly written in open source programming language such as python and others. So if they manage to get into the VM, they can eavesdrop on all the traffic running within a specific tenant. VM environment is not static, VMs can be moved from one host to another, and when you move a VM from one host to another the network policies will go with them, so we need to protect the VMs during this transition. The virtual firewalls will prevent your virtual environment from external attacks but if the criminals manage to pass the Firewall, then the anti-malware Intrusion detection software should signal an alarm while the Intrusion prevention software should try to prevent or block it. From capacity dimensioning perspective, we don’t need anti-malware software and signature database on each VM as this will reduce the host performance and accordingly the number of VMs supported in a host.

Lock#3 – Hypervisor: In addition to tenant isolation where the hypervisor isolate guests so that each guest has only access to its own resources, we need to have a software firewall that protects the host itself and here we need to follow the attacker’s logic. So mainly the attacker would be looking into your operating system backlog size, how long are the TCBs kept in SYN-Received before timing out. The attacker can send a number of SYNs exactly equal to the backlog, and repeat this process again and again. The Solution for such “SYN DOS” attacks is proper filtering (Ingress/Egress) of traffic through firewalls and automatically dropping packets that are not explicitly allowed by policy, using IPSec to defend against the distributed spoofed packets, plus tuning the TCP/IP stack in the operating system. We also want to secure the interaction with the hypervisor by creating local users with admin rights other than the Root credentials. Moreover, when you move your compute, storage and networking services into the cloud, you want to centralize and secure the user authentication of these services. Attackers might bridge in and replace your LDAP or Radius server that you are using for authentication, so to mitigate the risk, review carefully your authentication process and make sure you have TLS and SSL in place and they are working properly.

Lock#4 – Domain Name System: Without DNS, there is no IP to domain mapping and accordingly there is no access to the outside world, so protecting your DNS is a key for deploying network security. Consider deploying multi-layer defense to protect against DDOS, DNS stateful firewall to protect against poison pill and DNSSEC for Cache poisoning. From design perspective, make sure to have geographical redundancy of your DNS servers, enable load balancing between your DNS servers, dimension for the future capacity for both throughput and response time and have your system ready to scale up in case of unexpected load increase.

Lock#5 – Application Programming Interface: We are moving into an open environment where any application (Telco or IT) would run on any virtual layer, any hardware and integrated with any other existing cloud based or legacy based applications, and here the API security comes into the picture. Every API is fundamentally different; whatever the protocol we are using, whether it’s REST/http, SOAP/XML or other, we need a trusted environment from the service layer up to the abstraction and orchestration layer. From API security design perspective, use SSL to protect the API end points, implement gateways that enforces security policies in front of these service APIs to protect them from DOS attacks, apply rate limiting, enforce federation relationships, and use service authentication & authorization based on orchestrated just-on-time data which would inform about who is accessing these APIs and under what conditions.

Finally, with all the above security lockers, we still need to have some kind of virtual robots or honeypots to know the frequency of attacks and how they vary geographically. The algorithm in the honeypots provides detail on the IP addresses of the source location, determine attack vectors, identify malwares and do reverse engineering. To provide early warning for new malwares, it’s very critical to design the right integration points between these honeypots and analytics and between your analytics platform and the cloud management system.

When we started building 2.5G and 3G Networks, the aim was to provide voice, sms and some data services with accepted user experience and quality of service; The blended ARPU for Telcos was mainly generated from voice services. The technology shift in the last 3 years opened the door for new business opportunities and set a new challenge for Telcos to capture some of the revenues taken by OTT players. The voice ARPU is declining year over year and new services such as video streaming, mobile TV, mobile payment, E-commerce, E-health, connected cars, smart metering and cloud services are expected to take over 40% of the Telcos revenue streams. To provide these services, the end to end latency need to be reduced and the network reliability need to be improved in order to support the multi-Gbps data rates. An evolved version of LTE and HSPA is required to satisfy the requirements of new types of connections, it is the 5G that relies on smart antennas together with new or evolved RAT where the end users can benefit from the unlimited data rates and low latency.