Daily Tech Digest by Kannan Subbiah

June 20, 2013

The GRC maturity model and value proposition
Not surprisingly, organizations evolve with respect to GRC capabilities in different ways and timeframes and, at any given point, achieve varying levels of proficiency and benefit commonly described by stages of maturity. ... The Global Association of Risk Professionals provides us with an effective way to organize our thinking and facilitate conversations regarding the anticipated benefits of enacting integrated GRC programs.

Scaling Storage Is Hard To Do
No more monoliths or clusters. The new wave of startups recognize this, with companies and projects as diverse as Amazon S3, Cleversafe, Ceph, Exablox, Gridstore, and Convergent.io moving rapidly to offer object-based storage. Object storage is nothing new (hello Centera, HCP, Caringo, etc) but perhaps it has finally found its place at the center of the enterprise storage universe!

BSIMM4 measures and advances secure application development
The Building Security In Maturity Model (BSIMM, pronounced "bee simm") is an observation-based scientific model ... The most important use of the BSIMM is as a measuring stick to determine where your firm's software security initiative currently stands relative to other firms. Do this by noting which activities you already have in place, and useg "activity coverage" to determine the level and build a scorecard.

Evolution of search in big data as told by LucidWorks
The key challenge today is moving from rigid systems that gathered, organized, and analyzed data based upon previously known questions to dynamic systems that can immediately look at streams of rapidly changing data coming from many sources. Their hope is that today's systems can help analysts discover the right questions to ask, rather than just providing the answers to previously known questions.

Promoting yourself as a thought leader
You’ve spent time thinking about leadership. You’ve practiced its principles. You’ve come to understand what works and what doesn’t work. The next step for you may be articulating your leadership style in a way others can reproduce. Regardless of how you decide to disseminate your information, once you come to an executive position, sharing your leadership skills by living your truths and writing about them can benefit you and your organization.

Spy-proof enterprise encryption is possible, but daunting
"While all reputable companies will want to comply with the laws of the states in which they do business, encryption can give them full visibility into what is being monitored so that they can be a willing and active partner in government investigations," said Mark Bower, vice president of product management at data protection vendor Voltage Security, via email.

Do You Really Think for Yourself?
We are more susceptible to the influence of others than we might think. Get in touch with your beliefs. Don’t assume them to be true. But then again, don’t assume that others are right either. Use critical thinking. Ask why you believe what you believe. Groups can be quite influential at a subconscious level, causing us to change our minds without thinking.

Dimensions of Data Quality Under the Microscope
When discussing the level of agreement on the dimensions of quality, consensus of definition should be measured within its intended scope. Dimensions of quality are most often implemented as a part of a broader data quality/governance effort and, as such, are determined and maintained within a given unit of authority, like the data governance board of an organization. There is authority given to them by the leadership of that organization and consensus is only required within that group (or within the data management roles across the company).

Develop a compliance culture to implement anti-money laundering guidelines
Know your customer (KYC), an essential prescribed precaution, must be coupled with know your employees (KYE). There are a host of instances that highlight the involvement of employees in fraudulent transactions and in most cases in league with customers as the Cobrapost sting operation indicated. The sting operation captured employees advising the customers how they could convert their black money by opening multiple accounts, engaging mules, and many other such methods.

Stratos 2.0 Supports Any Runtime and 30 IaaS
Cartridges are a way of packaging a runtime making it available to be run on Stratos. There are two types of cartridges: Carbon and non-Carbon. Carbon or Product Cartridges are wrappers around WSO2 middleware products, including ESB, API Manager, Application Server, Governance Registry, Business Process Manager, Identity Server, WSO2 Message Broker, etc.. These cartridge are provided by WSO2.

Quote for the day:

"Unclear expectations lead to inefficient processes and subpar performance." -- Christine Lotze

June 19, 2013

Java Garbage Collection Distilled
Garbage collection algorithms are often optimized with the expectation that most objects live for a very short period of time, while relatively few live for very long. In most applications, objects that live for a significant period of time tend to constitute a very small percentage of objects allocated over time. In garbage collection theory this observed behavior is often know as “infant mortality” or the “weak generational hypothesis”.

Intel bets on heterogeneous future for supercomputing
"We believe the right answer is to use the best of what heterogeneity provides, which is the performance per energy spent and the customisation benefit," said Dr Rajeeb Hazra, Intel's VP of datacenter and connected systems group and general manager of the technical computing group. One drawback of the heterogeneous computing is the added complexity of writing programs that can run on different instruction set architectures.

What Are You Using?
You’ll find here the answers the best and brightest developers in web development gave to the four questions, which include 'Which editor or IDE do you use?' and 'What software can you not live without on a daily basis?'. Hopefully you will discover some tools that could make your development much easier. You’ll definitely find common themes (Sublime) and a few nuggets that are new.

Our Backbone Stack
Backbone is a base to build on top of. It gives you a framework for separating your data and your presentation into models and views, but there is a lot that it doesn't give you. It's up to you to figure out what else your unique app needs, and how much of that you'll get from open-source libraries or decide to write yourselves. Here is how backbone.js stacks up at coursera

Twelve essential questions to help improve your project's AIM statement
When teams are unable to focus on the real issue, they lose valuable problem solving time, and become discouraged about the value of QI. Team members become disengaged from the process since they seem to be going in circles without making any progress. Below are twelve questions to facilitate the process of developing AIM statements that are clear, specific, and focused.

Data De-identification Dilemma
In today’s context, a vast amount of personal information is becoming available from various public and private sources all around the world, which include public records like, telephone directories, property records, voters register and even the social networking sites. The chances of using these data to link against de-identified data and there by being able to re-identify the individual is high.

Following Dell acquisitions, users find platform integration enticing
"For the most part, the things they said they would deliver in the unified system have made it in there," Bumgardner continued. "I know there's talk of them providing more standardization of product lines. But when we talked to them two years ago, it was a five- or six-year timeline, so I'm surprised some of that already made it in."

ECRI: 10 ways to cut health IT risks
Health IT is on nearly every healthcare organization’s radar screen. And it will continue to be for the next few years as organizations move to electronic health records," Cindy Wallace, senior risk management analyst, said in a news release. "We recognize that bringing these systems online is a massive team effort. Risk management input is essential."

Yes, you really can make complex webapps responsive
Information consumption is the focus for the designers of these websites. Visitors need to be able to digest content with low friction on any device they own. While responsive techniques are popular for brochure type sites, the question remains; How achievable are they for interaction rich web apps?

Don't let your Governance program derail
The success of your governance program may be jeopardized by many factors, including complexity of the initiative, lack of executive support and / or internal resources, organizational culuture, data integrity issues, etc. Those issues can be addressed with careful planning and recruitment efforts, but for your efforts to have the most impact they must be considered within the context of yur organizational environment.

Quote for the day:

“Courage is what it takes to stand up and speak; courage is also what it takes to sit down and listen.” -- Winston Churchill

June 18, 2013

How To Analyze Performance, Capacity with Foglight
With Dell acquiring Quest, Quest Foglight and vKernel vOPS are now all Dell products. With these changes, all products have been rebranded with the Foglight for Virtualization name and is available in three editions; Free, Standard and Enterprise. The Free Edition is based on the same virtual appliance as the Standard Edition and allows you try the Standard version (with a single click) as you need more advanced functionality with no loss of historical performance statistics.

Samsung mass produces 1.4GBps PCIe flash cards for notebooks
"This allows the drive to read 500GB of data or 100 HD movies as large as 5GB in only six minutes, or 10 HD movies at 5GB in 36 seconds," the company claimed in a news release. "That is approximately seven times faster than a hard disk drive (which would need over 40 minutes for the same task), and more than 2.5 times faster than the fastest SATA SSD."

Making OUTER and CROSS APPLY work for you
This article will explain OUTER and CROSS APPLY and show you how to use them by means of sample code. OUTER and CROSS APPLY are unique to SQL Server so this article is intended for anybody using SQL in a SQL Server environment. It will also cover many examples of where you can use OUTER and CROSS APPLY and their pro's and con's.

NIST Cloud Computing - Security Reference Architecture
The purpose of this document is to define a NIST Cloud Computing Security Reference Architecture (NCC-SRA) – a framework that: identifies a core set of Security Componentsthat can be implemented in a Cloud Ecosystem to secure the environment, the operations, and the data migrated to the cloud; provides, for each Cloud Actor, the core set of Security Componentsthat fall under their responsibilities depending on the deployment and service models; ...

Microsoft Building Up Hyper-V Management Support for Linux and Unix Servers
The improvements that Microsoft is bringing with the new Hyper-V in Windows Server 2012 R2 also apply to managing Linux and Unix systems. Examples offered by Kelley included faster live migrations and network virtualization benefits. He also described dynamic memory support, the ability to dynamically resize VHDs and VHDXs, a new two-dimensional synthetic video driver and the ability to use replicas of Linux-based virtual machines (VMs) for disaster recovery.

Prism doesn't have CIOs in a panic -- yet
Many enterprises may be more concerned about industrial espionage than government spy agencies cracking their communications. But Prism should nonetheless serve as a clear wake-up call to CIOs and other IT executives, said Nick Selby, CEO of StreetCred Software and a risk management consultant who advises large organizations on industrial espionage and data breaches.

How to Comply with Security Standards for Health Care Applications
This article demonstrates how Visual Guard has been able to help meet the strict criteria of health regulations in the United States. It will look at why two major health care actors have integrated Visual Guard into their applications. Visual Guard combines authentication, permissions and auditing features in the same tool. A number of Visual Guard clients are public and private health care actors.

Chris Matts on BDD, Feature Injection and Commitment
The idea is that most of the time when business domain experts come and ask for something they very rarely tell you and express it in terms of the value they want, they often come up with a half-baked solution. What we actually want though is something which is a set of examples that can drive the Agile development process but driven by value. Feature injection has three very simple steps, first step is find the value, second step is inject the features, as we call it, and the third step is break the model.

Why Hadoop and Solr in DataStax Enterprise?
Today’s modern LOB applications have new data requirements that have proven to exceed the capabilities offered by legacy RDBMS’s. ... because the data requirements of modern applications are different today, the types of technology and data management vendors have also changed, both on the LOB and data warehouse sides. With this change has also come a change in technology regarding how analytics and search are handled in modern LOB and data warehouse systems.

U.S. and Russia sign pact to create communication link on cyber security
“We recognize that threats to or in the use of [computer technologies] include political-military and criminal threats, as well as threats of a terrorist nature, and are some of the most serious national and international security challenges we face in the 21st century,” President Obama and President Vladimir Putin said in the joint statement, issued by the White House.

Quote for the day:

"Fear will keep you alive in a war. Fear will keep you alive in business. There's nothing wrong with fear" -- Norman Schwarzkopf

June 17, 2013

Guide for Applying the Risk Management Framework to Federal Information Systems

The intent of this common framework is to improve information security, strengthen risk management processes, and encourage reciprocity among federal agencies. This publication, developed by the Joint Task Force Transformation Initiative Working Group, transforms the traditional Certification and Accreditation (C&A) process into the six-step Risk Management Framework (RMF).

Redefining Hot and Cold Data
Data warehouses that could accomplish the feat of defining and managing data aging policies then had to script, code, automate, schedule, verify and monitor that the entire process was working correctly in production. Most of the time, data architects would take a simplified approach of identifying data classes (or use fewer storage tiers) to make this process achievable.

Meet Google's 'Project Loon': Balloon-powered Net access
In addition to providing access to the two out of every three people on earth ... another goal of the Google[x] team behind Project Loon is to help with maintaining communications following natural disasters. The solar-powered, remote-controlled balloons would navigate stratospheric winds 20 kilometers above the surface of the earth, well above the altitude where most planes travel. Similar to the way satellite internet works, the balloons would communicate with special antennas and receiver stations on the ground.

Why Strategies Fail
After all, a lot of smart, educated, motivated people try hard to make them succeed. In this 30-minute speech, delivered at a conference (sponsored by The IE Group) of Chief Strategy Officers in New York City on December 9, 2011, you will learn some surprising, thought-provoking answers. The speaker is Mark Chussil, Founder and CEO of Advanced Competitive Strategies, Inc.

Don’t Just Cut “IT” Costs, Optimise…….
Round two of IT cost optimization is a story of big changes, strategic shifts, improved IT management practices, rightsizing IT service levels, “doing less with less,” better IT demand management and taking advantage of what new IT services the marketplace has to offer. Gartner sees four areas of opportunity for cost optimisation, ranked by level of difficulty as well as their potential to deliver valu

Federal Cloud Computing Strategy
Cloud computing offers the government an opportunity to be more efficient, agile, and innovative through more effective use of IT investments, and by applying innovations developed in the private sector If an agency wants to launch a new innovative program, it can quickly do so by leveraging cloud infrastructure without having to acquire significant hardware, lowering both time and cost barriers to deployment

IT Heads have been given a mandate of influencing the non-IT functions and business groups
The clear road map for future CIOs is to be the change and bring about change within their organisations. The new arena of technology includes data deluge, big data, agility, security, cloud etc., which are providing the necessary impetus to the IT leaders in making a transformation and driving innovation.

How to prevent code rot
A system that needs periodic attention indicates poorly designed automation, ... if the systems are neglected for too long, they fall apart. In software development, we call that code rot. When nobody pays attention to a section of working code, it suddenly doesn’t work any more. ... This happens so frequently that it almost doesn’t surprise us any more. The code didn’t change itself (at least, most code can’t do that), so how did this happen?

Has the CIO lost Big Data?
Should CIOs cede the Big Data battle and let CMOs take charge of these types of initiatives? After all, there is an abundance of recent precedents for Marketing taking over technically oriented initiatives, from the early days of the web, to marketing automation, to social media. While it may be tempting to let Big Data slip from IT’s fingertips, Big Data will be a cornerstone of future enterprise technology, and is an area where the CIO can add demonstrable value.

There is a Cowboy in my Domain! - Implementing Domain Driven Design Review and Interview
Many more people want to do Domain Driven Design (DDD) than understand how to use it. Vernon tackles this issue by guiding his readers through DDD’s principles, illustrating the importance and correct execution for each one. By providing a myriad of teaching techniques such as code samples, rules of thumb, a case study that progresses throughout the book, and ‘good ole cowboy logic’, IDDD reaches a level of accessibility that enables even the uninitiated to achieve an excellent understanding of DDD.

Quote for the day:

"Determination gives you the resolve to keep going in spite of the roadblocks that lay before you." -- Denis Waitley

June 16, 2013

Parallel Keynote: 8 Lines of Code
Greg Young is an independent consultant and entrepreneur. He is always involved with many concurrent projects, currently these include building out a distributed event store and mighty moose (a continuous test runner). In this InfoQ presentation, he discusses eight lines of very common code finding in them massive numbers of dependencies and difficulties, looking for ways to get rid of them.

Big Data: Rethinking the Platform
IT infrastructure teams will need to work with a wide range of other IT professionals in order to build big data platforms. This multidiscipline approach must also include a careful focus on the economics of the projects. Costs to consider include hardware, software, implementation, the risk of delays and problems, and the opportunity cost of not being able to run with other IT projects.

What You Need to Know about IT Asset Disposition
At the completion of the IT asset disposition process, assets are usually either resold or recycled. How they reach this final disposition, however, is rife with risk, if the process is not planned properly. The following are three risks associated with IT asset disposition that enterprises should account for in their risk management planning.

Why Google fears the totalitarian connotations of the buzzword big data.
Yet digging around a little, it looks to me like Google has all but banned “big data” from its communication with consumers. So far as I can determine, neither Google’s founders, Page and Sergey Brin, nor its chairman Eric Schmidt, have ever uttered the words big data in public (please correct me in the comments section if I’m wrong). A search of Google’s press releases also turns up exactly zero occurrences of the term.

ITSM Software is not a Silver Bullet
Our IT organization must define all the service management processes and procedures to meet the organization and business needs, but in many cases we do not know what they are, and we don’t have the time and/or expertise to do it. Of course, the consultants end up working in a vacuum with no access to in-house expertise, but still need to produce something quickly, so we end up with ‘stock’ generic processes that don’t match the way our IT is setup.

Expectations of Risk Management Outpacing Capabilities – It’s Time For Action
The Risk Management challenges are growing faster than most organizations' abilities to respond: today's complex environment requires an even stronger capability to master and optimize risk management. This is the main finding of a large-scale study of risk conducted by KPMG International, based on a global survey of 1,092 C-level respondents that was deployed by the Economist Intelligence Unit in December 2012.

Here’s Why Strategy Is So Misunderstood
Tactics, often mistaken for strategy, are the last piece of the puzzle that includes goals/objectives and strategies. Tactics are the ever-important short term decisions and activities that win battles and contribute to winning the war. In traditional manufacturing companies, sales departments know tactics better than most other functions because sales people work with tactics every day.

Inside the mind of a successful Android developer
As the founder of Cloud.tv, Christoff created the popular HD Widgets utility for Android, which is currently the 13th most popular paid app on the platform. His two-man startup has grown into a seven-person company now focused solely on Android development. JR Raphael had the chance to chat with Christoff about his experiences working with Android, both positive and negative, and the revelation that helped him turn a once-small side project into a booming full-time business.

New Categories for Data Center Best Practices (Part 3)
In this final installment, the focus shifts to high temperature ambient (HTA) data center operation. Once again, the advancements inenergy management are accelerating the momentum of an exciting trend by giving IT and facilities teams the oversight and controls necessary to minimize the associated risks.

An overview of High Availability and Disaster Recovery solutions available for SQL Server
With the more recent releases of SQL 2012 and Windows 2012, we are seeing the landscape of available options for SQL HA/DR specific architectures is improving significantly. Below is a summary of the high availability and disaster recovery solutions available for a SQL environment.

Quote for the day:

"Instead of looking for reasons to complain, look for ways to laugh." -- Ralph Marston