Molouk Y. Ba-Isa Saudi Gazette Finding spare parts for repairs, be it for a refrigerator or a clothes dryer, has long been an issue in Saudi Arabia. Saudi Gazette recently discovered that the spare parts problem now extends to the appliances used for network security in the Kingdom. When most people think of appliances, items such as washing machines come to mind. But start talking about appliances to a computer engineer and the conversation turns to equipment – possibly email gateways or network attached storage. A few years back, software applications were deployed in networks to handle tasks which are now being taken over by computer appliances. One of the reasons for the popularity of computer appliances is the idea pushed by the appliance vendors that such equipment reduces complexity in technology deployment and support. This is particularly attractive in the Kingdom where we have a shortage of IT staff with experience handling larger networks. In Saudi Arabia, computer appliances are being installed extensively in medium to large-sized organizations. Industrial, financial, commercial and government entities are purchasing email gateways, content filtering devices, firewalls, intrusion protection systems and unified threat management devices – among others. At their most basic, these security appliances are servers with hardware and software preconfigured by the manufacturer. Their hardware consists of typical server components such as a power supply, motherboard and hard drive. These components can fail just as they do in any server. The security appliances aren't cheap – many cost over $10,000. When they go down, tossing them in the trash isn't an option. And anyway, since they aren't stocked in the Kingdom, getting a new one can take three to six weeks or more. The good news, according to Marcus Ranum, CSO of Tenable Network Security is that security appliances “tend to fail soft. When the appliance fails, the network remains secure for a while." The simple reason for that is because the functionality is no longer available. For instance, if an email gateway appliance goes down, that's the end of corporate email until the appliance gets repaired or some sort of workaround is activated. “It doesn't make any sense that an inventory of spares for these appliances isn't stocked in Saudi Arabia," said Ranum. “I would think that any company that has spares would have a competitive advantage and they would advertise that advantage. What's the cost of keeping a case of hard drives on hand, compared to the fury of a customer who can't get a replacement when he needs one? This is especially important because the appliance warranty is usually void if non-vendor supplied spares are used in the repair." Ranum added, “There were any number of times that years ago when I was a system support engineer at Digital that I was able to positively influence a future sale by reaching into my briefcase and pulling out a hard drive and reconstructing someone's server on the fly. Customers like that." Customers need to be aware of the current situation and start to fight back. Saudi Gazette saw that in a recent bid document from one Western Region petrochemical company, there was a requirement that a spare for the email gateway had to be available in Saudi Arabia. How the company would have enforced this provision over the three years of the contract is unclear and the penalty in the contract for not having a spare appliance available wasn't large enough to ensure compliance with this provision from the local integrator. “Perhaps the regulatory authority in the financial sector for instance can mandate that spare parts and spare appliances must be proven to be in the Kingdom or those appliances can't be installed," advised Ranum. “Maybe then the vendors will pay attention because it will impact their sales."
