It's a safe to say that the Worldwide Reseller Agreement for the emulator could be a benefit to HP's own operations. Such systems are usually scheduled for migration. But as Stromasys GM Bill Driest said at this month's Training Day, "I'm a quota-carrying salesman, and the phrase we use is "Liars are buyers.' "

In other words, a customer who says they'll migrate has a chance of being on the server longer than they expect. Does that make them liars when they say they'll be off the 3000? Maybe, but more likely it's a matter of timing and degree -- the same things that tamped down my panic when I heard in a phone booth in Lausanne's train station my distraught partner Abby telling me, "HP says the 3000 is going away. They're not going to make it anymore. They need to talk to you, before they announce."

I ponder the afterlife that's emerged because that's where I think my mom is today. We sent her off in a memorial service on Sunday, when three of us eulogized her with imaginations of her dancing in heaven, catching up my dad in the afterlife, or asserting, like I did (at 12:00 in the YouTube video), "They say nothing dies if it lives on in the hearts and minds of those who love it."

The MPE/iX OS, apps and IMAGE are going more than living in hearts and minds. They live in companies like HP. The ecosystem was supposed to be the death of the 3000, according to the HP speaking in 2001. Instead, it's becoming a place where the customers who need help are getting supported. Even if they need an interim emulator to buy, so applications can remain where they lie.

The afterlife has a way of entrancing us all. I knew that HP's five-year time-frame for getting customers off the 3000 was outlandish, knew it even before I hung up the phone in that train station. But HP was writing the song that could've been presicent lyrics for the Squirrel Nut Zippers' song "Hell."

In the afterlife
You could be headed for the serious strife
Now you make the scene all day
But tomorrow there'll be Hell to pay

On that tomorrow in 2001, I bought a new notebook and rode the train back to Paris. I began to write 50 questions for my briefing with HP. At the top of the first page I wrote the seminal query, the one that fueled 49 more:

Tell me why it's going away.

Some of those 50 questions I wrote in a fever of inquiry, roaring onward to London on the under-the-Channel Eurostar train. Things like open source or sharing of MPE code with third parties, or a delivery channel of HP-driven 3000 services beyond 2008 — those got resolved. An emulator -- pretty much unheard of in HP's business line of computers -- was still four years away from being licensed and more that 11 years away from having a sales kickoff in Mountain View. The third parties didn't get much of HP's direct help for a homesteading customer -- unless you count the limited-use release of MPE source, and the concessions like that emulator license, wrenched from HP by OpenMPE.

Let's review how some of the 49 have shaken out, six years after I passed that phone booth where the afterlife started to emerge for 3000 owners.

Will the customers and development community get access to HP's internal compilers, to make changes to MPE/iX? Absolutely not, and they probably never will. MPE is as polished as it will ever be. However, seven companies do have source code to MPE/iX. They write patches and workarounds for the OS and the database. It's a compromise, but that source code is something to keep MPE/iX from having Hell to pay.

What are HP's plans for its own 600 internal HP 3000 systems? Five more years into the afterlife, there are still some 3000 systems running HP company functions.

Are the PA-RISC customers in the HP 9000 customer base being given an obsolescence date as well? Not only is PA-RISC obsolete now, but HP's own expert witness in the Oracle lawsuit said the HP-UX processor's successor, Itanium, has about seven more years of life.

In 1998 HP committed to Itanium for the 3000. What has happened in the market to change that commitment? We heard of a decline of "the 3000's ecosystem." What declined was sales from HP and its resellers, working on a 2003 sales cutoff. But replacing hardware is not the name of the game anymore in 2013. Sustaining applications is the essence of the ecosystem. Virtualization is the end state of every hardware system.

Will there be a planned reduction in Response Center staff trained in MPE?  There certainly was, but how planned is a matter of persepctive. HP offered two Enhanced Early Retirement programs, plus moved its MPE staff onto concurrent support duties for other operating environments. Then sent most of the remaining support team away. Today, even 16-year vets like Bob Chase of the 3000 Escalation Center are out working for SMS Systems Maintenance Services as a Senior Technical Support Engineer. If you issue the magic transfer code 798 on an HP call, it gets 3000 sites to Response Center folks who know the 3000 is not a printer. You call for free patches. That's about all.

What are the possibilities of having solution providers take over some parts of MPE source, like the spooler or ODBC? Nobody is going to take over development of these parts of source, unless HP gets picked clean for parts in a takeover. Highly unlikely.

Is there any possibility of reviewing this decision? Customers still wish this was possible. Fewer all the time, though. Of those who wished for a reprieve, the ones who need a long-term MPE engine will look at the Stromasys emulator. The others have bitter memories and no hunger for anything HP-centric. Windows or Linux will do. 

Is this decision in the best interest of the 3000 owner, and if so, how? HP said back then that ending its 3000 operations was in the customers' best interest, because HP felt it was risky to remain a 3000 customer. the ownership of a 3000 was influenced by the vendor's leadership and plans, however, so HP's decision started the clock on the afterlife. 

The Squirrel Nut Zippers' song does croon some hope for the afterlife, though. The truth and a clear picture emerges there -- like my mom dancing circles around my dad, scolding him for leaving too soon to see the great stuff to come.

Beauty, talent, fame, money, refinement , job skill and brain
And all the things you try to hide
Will be revealed on the other side.

Tomorrow afternoon HP will release its financials for its second quarter of 2013, a year when its CEO said "The patient is showing signs of recovering." People who wrote off HP as a split up company, PCs and enterprise IT, might turn out to have an outlook as hazy as HP's about the 2013 ecosystem of the 3000. Of Luke Skywalker's friends's future in The Empire Strikes Back, he asked, "Will they die?"

"Difficult to tell," Yoga replied. "Always in motion is the future." As is the afterlife, from the way I see it in my seat this week, beyond the eulogy.

Yes, this new software product that runs on industry-standard Intel hardware qualifies for HP resale status, unlike the server which it emulates. Go figure; nobody wants to be bothered with building hardware anymore.

But the lack of a supported OS as a keystone to a Stromasys emulator -- well, that seems novel. However, at the recent Training Day for the product, GM Bill Driest said selling a product with a vendor-curtailed OS is not all that unique, in his view.

"We don't see this market as fundamentally different from what we've done for a number of years now, to get 5,000 customers in 50 countries," Driest said on May 10 at the Training. "From a sales and marketing perspective, this is our US launch. I have a handful of customers in the US, so we are just embarking on this new market for us, worldwide. There are existing references and customers in Australia, New Zealand."

But from a tactical perspective, he said, those Digital system successes have taken place with an OS that's not available: the apps use versions of VMS that are locked in and not qualified for any extra engineering HP adds to that OS. This is, he believes, essentially the same situation as an MPE/iX market that can go no further than the 7.5 release.

While the replacement of aging hardware used to be the concern just five years ago, now the prospects for Charon in the 3000 world "are looking for partners, ISVs and consultants to take over more of the application administrator role. There's a revitalization of the important of the app to be done here. They'll be saving the hundreds of thousand to millions of dollars to rewrite that application." 

It's a conscious decision to not let an app retire, Driest added. It's a choice so common up to now that the Digital customers start with a plan to emulate temporarily. Then the reality of replacing an app sets in.

"Customers say they just need their systems a couple more years, and they have a plan to migrate," he said. "But once the monkey's off their back, they realize they have other higher priorities for their IT resources. Rarely do you see them reinvesting in a multimillion dollar project once they realize they can run their application successly in an emulation on industry standard technology.

"They're not coming to us anymore and saying 'Can you fix my HP 3000 hardware?' That's what we thought they were saying five to 10 years ago. We understand that the value is in that application layer. We're just a new hardware refresh. And our average deal size has not been about onesy-twosy sale in testing or development. There's organic growth in legacy systems, new opportunities out there. I wouldn't have predicted that five years ago."

Kent Wallace, a 3000 manager for Idaho-Oregon healthcare delivery system Primary Health, needed to move his 3000 console:

I was asked to move the console another 10 feet (more) from the rack (it's an N-Class HP 3000/N4000-100-22). What are the 3 pin positions on the wire that I need to extend this RS-232 cable?

Reid Baxter of JP Chase offered the most direct answer, for those willing to modify cables. "Pins 2, 3 and 7."

Tracy Johnson of Measurement Specialties added:

In addition to what Reid said, you can also get a 3-pin mini-din extension cord and extend the other end.

Our blog contributing editor Gilles Schipper chipped in with a solution offering even farther movement:

If you want to extend the range of the console to anywhere on the planet (at least where there’s Internet access) you could consider the HP Secure Web Console to replace the physical console.

Depending upon the condition of your physical console, this solution may also save a bit of wear and tear on your eyeballs.

(Schipper wrote us a great article on setting up such a web console.)

Former HP support engineer Lars Appel offered another take on Schipper's strategy:

While Gilles is right about the possibility of using the web console, it would probably be easier to use the already built-in dedicated LAN port of the N-Class systems that gives access to the GSP by telnet.

I prefer the “telnet console” over the “web console” because it gives more freedom in the choice of terminal emulator — whereas the web console typically lacks features like “easy cut and paste” or special key mappings (e.g. German language ;-) or something similar.

This prompted Schipper to clarify his suggestion:

Lars is absolutely right about the built-in “secure-web-console” that comes with all N-Class and all but the earliest A-Class e3000s.

And, yes, the built-in is definitely more functional, allowing cut-and-paste as well as telnet access, whereas the external variety has only Java access to it via a web browser and no cut-and-paste.

So, if one has a choice, the built-in is definitely superior and available with only proper configuration.
However, the external secure web console is available for all HP 3000s, and would still be most useful where is internal secure web console is not an option.

Jeff Kell, curator of the 3000 newsgroup where the advice appeared, added the last word and a little joke:

The internal one isn't really "secure" — it's plaintext telnet. The GSP "documents" some secure access mode (ssh? https?) but I could never get it to work on our A-Class.  Maybe it's an HP-UX thing. 

The external web console was the really insecure "secure" web console.  It used a secret decoder ring :-)

One week before my latest birthday I was sharing hope about an aging icon. “She’s a tank,” I said to my sister Tina. We said this often to one another about my mom, who was 87 when she passed away late last month. Death and perhaps the  afterlife comes to everything that is vital, endearing and revered. Ginny Seybold, born in the era before radio was king, died peacefully in her bed. She was vital in heart and mind until nearly the end. All of us – brother Bob, Tina, older brother John, my bride and partner Abby — we all desired more years from mom.

But in a few hours from now I will board a jet to fly to Toledo, the place she gave birth to us, and put on the black suit I reserve for occasions of joy (my kids’ weddings) and of sad times. I will give a eulogy and certainly cry through it, just as I am at this very moment I’m creating these words. My mom taught me to read, gave me the first words of countless ones that I would learn to ride like fresh breeze throughout my life and hers. For more than a decade I would work and tinker at a novel, while she was devouring everything her Irish favorite Maeve Binchy wrote, until I could finally finish mine and send it to her, just like the hardbacks I’d buy because she wasn’t getting out to the library as easily. But when a novel would arrive, she’d scamper through the book like she would dance across floors from the 1930s up to her 80th birthday. My mom outlasted expectations of her vivacity.

Since I am her boy, I can use a comparison with a bold stroke. In that outlasting, the push of the tank of her heart, she resembled the computer I have written about for more than half my life. People expected the 3000’s demise many years ago. Now with an emulated version selling and shipping, for the 3000’s relations and disciples, Charon has become the kind of tank that Tina and I marveled at when we visited mom in the Franciscan Care Center.

Tina found that resting place for our mom, relentless and persistent in locating a spot where Ginny could receive the attention to both her heart and her body. The former was strong in spirit, the latter holding out as well as anything created before FDR became President.

I think we all have someone older in our lives who we wish would last forever. For some, this might not be a person they love as a friend or a member of their birth family. People who die like Roger Ebert of the film world, or Steve Jobs of our own industry, or Dr. Suess of everyone’s childhood, they all leave holes in our hearts too. This is the first way I reply when everyone, so kind even if we don’t know one another well, tells me they’re sorry for my loss. “I have a hole in my heart now,” I say. I tap my chest and I can say no more at that moment. Loss is like that, a fog that seeps in and whiles away time as you remember why you loved whatever or whoever you did, their perfection and the parts that were very human, very imperfect.

Like you and your community, I owe my mom a lot. She believed in beginnings and taught me to question and debate and express my imagination. Not always with the best of examples. But as my counselor and friend Jim Hoadley says, “She was a teacher, you know — she taught you how to show compassion.”

I know it’s not the same thing to love a computer’s ideals and elegance, to revere the struggle of years when our community had to learn compassion about the imperfections of the 3000’s creator. Even still, we had our memories that remain beyond the death of the Bill & Dave HP. The times that Marc Hoff of HP, taken by cancer, would give out his home phone number on the back of business cards, or swear to eat a new MPE release tape if it came out with a bug in it. The times that Bruce Toback or Wirt Atmar would make us chortle or fume, and then become richer and smarter through the miracle of the newsgroup, before they were claimed by heart disease. For me, the quiet confidence and spark of revival from Danny Compton in Texas, who took a discarded Maestro software tool and created ROC Software – so many years after he got a death sentence at age 8, and then outlasted the forecast by more than 30 years to build a family, products, and then a company.

For my own family in this sad week, I try to think of the joy that I saw in mom’s face, especially on the night of her 80th birthday party, one my bride created for a pip of a mother in law. Ginny was vivacious, at her very best. She was lively in her later chapters, like the night I saw her dance on roller skates at age 52 with us grown kids, or that night she banged a tambourine onstage in her new home in Vegas, 80 years old and smiling through way too many choruses of the Beatles’ “They Say It’s Your Birthday.” My mom, turning around to look at the cover band playing in that faux Irish pub inside a casino. Turning as if to ask, “Surely you must be done?” And the band looking back at this marvel of a pip, maybe saying, “Wow, I hope I can do that at 80.”

There is so much more to write about endings and the afterlife, a life where I’m sure mom now dances on the legs that she lost in her final years. I only know that words fall short of feelings about long relationships of love. There is one word I will invoke at her service this Sunday, the first Sunday after everybody’s Mother’s Day. The word is pip, and my mom was one. A word with more than one definition, just like my mom. Pip, an excellent person or thing. Pip, a crack of a baby bird’s shell. Pip, a small, hard seed in a fruit. They say that a person never dies if they live in our hearts and minds forever. So I’ve got her in there, and deep inside my heart, too. Here’s to anything old that has become grand. As the British say in salute, pip-pip.

"We know some customers who have bought a perpetual license are running it in a private cloud environment," Driest said at the recent HP 3000 Training and Social Event. "How we're going to monetize that market is something I think the people in this room can help us with."

The company was represented at last year's VM World virtualization conference. "Cloud is a growing part of our business," Driest said. "We had a full cloud demonstration, live, and up and running. We're able to provision a machine on the fly. We had two different sized VAXes, two different sized Alphas. We're trying to assess the market for this. How big is that subset?"

For manufacturing applications, "You need to be close to the wire, and you're not close to being in the cloud. For certain HIPAA data [in healthcare], it would need to be a private cloud without a public cloud. We've tested, we've sized, we've done some of the cost models.  Today, if we want to sell a perpetual unlimited license we get the money up front. In a cloud model it might be a 3-year, $1,000 a month kind of thing."

Stromasys is looking at how cloud implementations of its product change the dynamics of how the company goes to market. "We are very interested in the conversation, but not from the technology perspective. It works and the customers are starting to ask questions about the cloud for certain sets of apps. They say 'I don't want an emulator, I want you to take the whole thing.' But we're not sure from a business side where we divert some of our resources -- on how we market it, how we price it, and how we sell it."

Is an HP 3000 customer more applicable to this kind of virtualization, where a customer only wants to run an application, without datacenter investment or on-site IT management? "I don't think we have a clear understanding of that yet," Driest said. "From the technology side we're there. But is the world ready for emulation and the cloud on legacy systems all at once?"

Today, Stromasys sales are 40 percent direct to customers, and 60 percent through a reseller channel that includes HP. Some "boutique VARs" know niche products. "Someone's in the MANMAN market with a 3000, and these VARs focus on that," Driest said. "The emulator comes as part of their normal work."

An HP 3000 support provider asked about how that channel could help him help his customers, 135 sites running HP 3000s. "So they don't keep dropping off every July fiscal cycle."

"Well, we could start with my card," Driest said, drawing a gust of laughter from the support company as well as the room full of the 3000 ecosystem players.

I worked on external communications for MOST for Hewlett-Packard in the spring of 1995. It was one of the biggest assignments I took on during the months that led up to creating the 3000 NewsWire. The audacity of putting a venerated OS in as a bootstrap system for HP-UX apps led me to believe HP was exploring every prospect to win any customer who was veering toward the market's magnetic pull of Unix.

HP showed off external specifications for MOST to key partners in '95. The product was scheduled to emerge in the fall of that year on Series 9x9 and 99X PA-RISC systems. These were the highest horsepower 3000s in the HP stable. MOST was to begin with two partitions, one for MPE/iX and the other for HP-UX. Or, a customer could run two separate instances of MPE on a single server. MPE was to be the primary partition, controlling the uptime of the hardware.

In one sense, this product wouldn't have been a 3000 -- because half of it would be dedicated to running Unix apps and processes. Independence, a white paper on the product stated, "is especially important, as the co-dependencies between the different OS should be as small as possible."

MOST might have been ahead of its time in hardware requirements, but it reminds me of the virtualization that nearly every operating system enjoys today. The Stromasys Charon lineup, the VMware partitions which run Windows, Linux, and Mac OS all at once -- all of these flow from the concept that drove MOST. Well, there's a major difference. HP didn't release MOST, even after a beta test period and surveys that showed most of the customers saw it as an evolutionary path to heterogenous computing.

"The future path is almost impossible to foresee," HP's briefing stated. "Windows or OS/2? WARP? Unix or NT? Once proprietary, but now open systems?"

The software would have realized the founding principle of PA-RISC engineering: "Eventually, any PA-RISC operating system will be able to operate concurrently and independently on the same hardware platform."

HP delivered on some of these promises many years later, employing its Superdome designs for high-end servers with flexible partitions. This was not strictly emulation, because the native hardware remained the same. It's a sad piece of history that by the time Superdome was rolled into the markets, MPE/iX was not an environment supported on the high-priced server.

The OS came closest to its rightful place as keystone of HP's business computing strategy with MOST, however. HP said that it "is a natural complement to the four strategic directions of the HP 3000:

• Reinforce HP 3000's strengths in mission critical OLTP environments
• Superior integration in a multi-platform environment
• Provide an evolution to client/sever computing
• Deliver innovative applications and services

The Hewlett-Packard of 1995 was looking for a way to "let customers add, test and develop new applications without purchasing a new Unix box." That might have been the downfall for MOST. A successful server, steered by MPE but also able to run Unix apps, would surely have been a roadblock to more HP 9000 server sales. HP bet hard on Unix in that era, a play that now seems to have run out of step with the Windows and Linux choices of today.

But the good news is that an HP licensing mechanism still exists for MPE/iX to operate under the Charon emulator -- pretty much on any good-sized Intel system that can run VMware and Linux. However, you need to know how to ask HP for the required license.

Charon HPA product manager Paul Taffel uncorked the phrase that permits a customer to switch their MPE/iX from HP iron to PC or Mac hardware. It's called "an intra-company license transfer." If you don't ask for it by name, the standard HP transfer forms won't pass muster. Most SLTs happen between two companies. Who'd sell themselves their own hardware, after all?

In short HP's using its existing and proven Software License Transfer (SLT) mechanism to license emulated 3000s. It's doing this because of that delay which ran out the clock on a hard-earned path to the future. HP called it the Emulator License back in 2005. It just happened to need an emulator on sale in order for a customer to buy this license.

The Emulator License isn't quite like the mythical griffin of ancient lore. It made more sense than a jackalope. But the process to earn one of these licenses is not well known yet, which was one of the reasons Stromasys held its training and social event.

Perhaps HP's lawyers -- who certainly had to be convinced by the 3000 division at the time -- insisted on the "existing emulator" clause in the license. The license was supposed to cost $500, but HP could never collect that money without a working emulator for a 3000 on the market. Then HP stopped issuing MPE/iX licenses because its Right To Use program ran out at the end of 2008. No RTU, no emulator license: this was a moment when the 3000s in the world were limited to whatever HP iron was on hand.

However, this was not the first time HP had ever tried to make it legal to run one of its OS products on non-HP gear. By the time OpenMPE wore HP down and got that Emulator License, the Stromasys product line was running hundreds of instances of VAX and PDP emulated systems, all using VMS. Digital, even after it became part of HP, didn't care if you were emulating its "end-of-lifed" PDP and VAX systems. What Digital-HP cared about was the ongoing support revenue, and the good will, of keeping older systems running where they remain the best solution.

This time around, for the 3000, HP intended to cut off all of its business by 2006. Er, 2008. Well, certainly by 2010, even though some 3000 owners still could call on HP for MPE and hardware support during 2011. No matter. Customers are the ones who determine the life of a computer environment, and software never dies. At the Stromasys training event, general manager Bill Driest said that the natural end state for every computer is virtualization -- or what the classic 3000 customer would call emulation.

"We're here to help preserve the software investments that you've all made," Driest said. "We've always believed that the value of the system is in the uniqueness of the application. For 14 years we've had this tagline that keeps coming back: preserving the investments we've all made across these hardware generations."

So to recap, you contact HP's Software License Transfer department. You tell them you want to do an intra-company transfer. And instead of the $500 that HP said this emulator license would cost eight years ago, it's $400 -- the same fee HP wants to collect on any MPE/iX system transfer. You need to have a 3000 license to begin with, of course.

You don't get to create MPE/iX licenses for Charon systems. Stromasys cannot sell you one. But a copy of MPE/iX does exist in the freeware download, model A202. It's just not licensed, because you attest you won't use this freeware for commercial use when you run through configuration. The licensed copy of MPE/iX in freeware -- the holy grail of open source pursued by OpenMPE for more than nine years -- is as much a mythical creature as an emulator license. This isn't the first time Hewlett-Packard built an item for 3000 customers that it never did sell. But at least the previous one got into testing before it was killed off. More on that tomorrow.

But what's more special is the range of 3000 sites who'd be Charon HPA/3000 prospects, if only they knew how to focus on fitting into a new server paradigm. One site that Scott visited out in Union City, Calif. was discussing available IT datacenter floor space. "How are you fixed for that?" says Scott.

"Well, we've got this big system in the back of the datacenter we have to keep running," the IT manager says, explaining the server keeps significant parts of the company running. Even though Scott is out there in Union City to help the manager with Dell solutions, he's curious about what this box is.

"We're pretty sure it's an old HP 3000," the manager says. Scott's invited him tonight for some beverages and heavy appetizers, but there's been no RSVP yet from Union City. If you're in the area, come by tonight, or tomorrow at the Computer History Museum. You might find a way to free up floor space while you don't have to throw your critical MPE applications overboard.

Hope to see you tonight over a pint. You never know what opportunity might bloom, like those curbside flowers growing out of a beer cask on Villa Street at the Tied House.

By Steven Hardwick
Oxygen Finance

Why do we need security regulations which relate to IT anyway? Many IT professionals believe compliance is way too complicated. and costs a lot of time and money that could be better spent. For example, the HP 3000 might have better security for credit card processing that flows through MPE servers.

If only the data would back up that IT pro's desire. The latest Verizon Data Breach Investigations report should dispel the myth that security is simply a function of the IT department getting firewall configurations up to date. The 2013 report shows attacks varied from hacking, to social engineering and physical attacks. Physical, technological and administrative security controls were breached to make the attacks possible. In many cases, multiple controls were compromised to breach the organizations infrastructure. But a third of IT pros say security is too hard to implement (click on graphic for details.)

Why do we need regulations? It boils down to the two distinct challenges with security: a legal definition of malicious behavior, and a difficult to quantify return on investment. First, to address the legal position of defining a malicious act may not be that simple.

Theft in the information world can involve merely taking a copy of the data. The original data may still be in the possession of the owner. To be able to prove theft in this case, a new definition of “illegal copying” has to be defined. In the information world, the copy or the operation that created it has to be detected. It is now a lot more difficult to define information theft as the concept of copying now has to be legally defined.

To illustrate the legal difficulties, consider this challenge. If a neighbor sees a unprotected wireless network router and is given an IP address by the DHCP server, does it constitute the owner's permission to have Internet access?

Compliance standards establish a set of security controls that are not concerned with legal definitions of malicious activity. This allows an organization to stem the threat of breaches without relying on a legal framework to enforce it. A good example is the Payment Creditcard Industry Data Security Standards (PCI-DSS or just PCI). This compliance standard is solely enforced by the credit card community. As such it can quickly adapt to define requirements that meet mitigating new threats.

I was once involved in a HIPAA audit. After the presenting the audit results to the CIO, the next question was remediation. The CIO’s response was, “After consulting with legal council, we are taking no action to mitigate the deficiencies found in the audit. They have informed us it would be cheaper to litigate than spend funds on security changes.”

That was in the early days of HIPAA. in those days, that regulation lacked teeth. To rectify this, the US government passed the Health Information Technology for Economic and Clinical Health (HITECH) Act for enforcement. It defines what's a breach of information. plus the responses that organizations must take after a breach. Very quickly, the cost of not putting security controls in place changed, especially due to the enforcement defined by the act.

Why are there so many regulations and laws?

With PCI and HITECH, why are even two needed? Well, the two standards were developed by different specialists, and so the laws are different. PCI's goal is to prevent the misuse of Credit Card information. HITECH/HIPAA is focused on medical information. 

To additionally diversify standards, the groups focused only on the threats and impact of breaches in their particular industry. For example, compromised credit card data can be used globally, whereas medical data tends to be country specific. PCI is a global standard, whereas HITECH is only US based.

Standards tend to be focused on the type of information they protect. For example, although a credit card number may be used in conjunction with a medical record for payment of services, HITECH does not define the card as part of the information that needs to be protected. 

Organizations that have multiple data sets will fall under multiple regulations and standards. A public Insurance company that uses credit card payments for medical services would, at a minimum, have to comply to PCI (Credit Card data), HITECH (Medical data) and Sarbanes Oxley Act, or SOX, (Public Financial data).

What other challenges are there?

There is hope. In many cases the standard or regulation will give a list of compliance goals. Applying the goal will depend on how the controlled information is used in within the business. Some standards will give guidance on how to implement security controls to comply with the goals.

For exaple, PCI has requirements around penetration testing for network interfaces. Other standards rely on an existing security framework. (This security framework is a definition of security controls for an environment.) They framework is designed for general protection of information  -- and not focused on a specific data set.

A good example is that the Sarbanes Oxley Act (SOX) which mandates security controls. Control Objectives for Information and Related Technology (COBIT) is a security framework that is commonly used to assess SOX compliance.

Next Time: More detail on how to use security frameworks to address compliance.

On the same day I got notice from Doug Smith -- a 3000 consultant and developer and support provider -- that he'll be at the Stromasys event, HP tried again to wrap up the lifespan of Windows XP. The company that gave up on MPE and the HP 3000 might be just as misguided about XP's future as MPE's. It seems so simple to HP.

Let’s face it—reminiscing about old software programs 20 or so years from now won’t bring about nearly half as many warm memories as that 1967 Pontiac Firebird of your youth. 

You could say that updating business software is akin to changing your toothbrush after it’s seen better days. Can you imagine running Windows 98 on your home PC? Then why would you fight tooth and nail, stubbornly looking into a variety of contingency plans and options to hold onto Windows XP?

The why of holding on is obvious. Smaller companies -- and some surprising large ones -- cannot make a good business case for putting their Firebird of a business server up on blocks. The math on an emulator solution, supplied in good stead with support for MPE and indie software tools -- holds up against projects that start in six figures and take at least a year to deploy.

The Tied House and the Computer History Museum will be places to learn why that toothbrush (the HP hardware) might be old, but the fresh toothpaste (MPE) is still worthy of plenty of extra years. Doug Smith thinks so. So does Walter Murray, who developed HP's COBOL products for the 3000 before exiting Hewlett-Packard to manage 3000s for the state of California. Then there's the contract programmers, and more, simply off our heads-up emails.

Bruce Hobbs and Mike Watson are making the trip to the Training on Friday, flying up from Southern California and Colorado, respectively. Just for the day, to see the software in action. There's an opportunity to help out a customer or two, one who's got their own software, no license hurdles and little desire or budget to buy that disruptive toothbrush.

Tom McNeal will be at the Tied House tomorrow evening. He's a veteran of the kernel project when the first 3000 multiprocessor platform was released, in 1991. Tom's adding the brew pub visit to a busy night. You might be similarly inclined. "I thought I'd send this, which is signed by all the folks that worked in that lab."

We also had a dinner party commemorating our kernel product, and that was a lot of fun. Frank Ho was the project manager, and I worked on the memory manager, which was primarily developed by Marcia McConnell. The other, going clockwise from Marcia, were Simon Cutting, Peggy Chen, Craig Hada, Hung Nguyen, Kim Rogers, Vijay Bajaj, Dave Rubin, and Satya Mylavarabhatla.  As far as I know, Marcia is the only one still working at HP.

Martin Gorfinkel, creator of 3000 software Fantasia for printing and an advocate for the community, says "I still get support calls for Fantasia. "Mostly I would like to have my editor and Fantasia for my own use. All that should work nicely within the limitations they place on the freeware emulation." He added that he needed to get a new PC to load it. The newest PC he had was about five years old. Gorfinkel will be at Friday's training session.

It's not tough to imagine that between a free pub evening and free lunch at the History Museum -- places where you can meet with 3000 legend Stan Sieler, who says "I'm hoping to be at the Thursday social, and present for most of some or most of Friday -- a 3000 user could network with people who've had firsthand experience with emulation, or are ready to share stories about how they hope Charon HPA/3000 will help them in an interim for migration, or as a hot archival system for MPE data.

I hope to see you there. I'm brining a fresh toothbrush, just to commemorate another run of years with something built as well as the toothpaste that's MPE.