February 18, 2014

Why a great networking engineer is like an application whisperer
The hard-to-swallow truth is that applications have always run the show when it comes to networks. This reality can be extra difficult to accept in organizations where the systems team is fronted by a less senior and often frazzled sys admin who -- if not wearing a red fire helmet and rubber boots -- at least always carries the faint scent of smoke and ash. Nonetheless, it is a truth we must come to terms with.


Getting your features out
Now we are at a point where we actually branch. Feature Branches evolve around the idea that each functional implementation is done in its own branch. The branches are pushed to the central repository, so each feature branch is available for each developer. Once the implementation is done, the developer starts a pull-request, and the changes are discussed in the team and merged to the master.


SDN in action: Pertino service lets users turn up a network without buying hardware
Pertino’s SDN is made up of two parts: A control plane that houses all of the information about the users, security credentials and network topology; and a data plane running on top of cloud-based virtual machines that can scale horizontally and are fault tolerant. This architecture allows for massively large scaling, segmentation among users’ networks and insulation from downtime from service providers Pertino works with, such as Amazon Web Services, Rackspace and others.


3 Leadership Tips for a Particular Kind of Entrepreneur: the Successor
The challenges of taking over a business from a father (or any powerful executive) are not insignificant. The transition at one client of mine was so unsuccessful that the father had to return from retirement to salvage the business from the son's ineptitude. I've seen companies succeed under a second generation's leadership, and I've watched others fall into bankruptcy only a few years after the change occurred.


Diebold's Mattes believes company can succeed by re-igniting its innovation
In a move to drive home the need to re-ignite innovation, Mattes and his management team brought 140 key employees from operations in 17 countries to Canton in late January. They spent three days at Kent State University at Stark studying new products and hearing about the need to work more with customers. "Diebold is not short of great people," Mattes said, while being interviewed during a break in the meeting. The company is filled with employees who have brilliant ideas, he said.


Data Profiling – Four Steps to Knowing Your Big Data
“Know thy data” is one of the fundamental principles of sound data science.1 Another name for this is data profiling. The article “Big Data – Naughty or Nice?” listed six foundational concepts of data science.2 Along with #2 “Know thy data,” the article listed five other data science “commandments” ... We expand on data profiling here by elucidating the following four steps toward knowing your data: data preview and selection; data cleansing and preparation; feature selection; and data typing for normalization and transformation.


SDN security issues: How secure is the SDN stack?
The SDN controller is a prime target for hackers because it is both a central point of influence in a network and a potential central point of failure. "If somebody is not paying attention to [the controller], it becomes an extraordinarily high-profit target for an attacker, who could very easily compromise [it], modify some of your code base and rescript control of your traffic in such a way that it's ex-filtrating data or stashing data somewhere where an attacker can sniff it," said Dave Shackleford, security consultant with Voodoo Security and lead faculty member at IANS.


PseudoCQRS, a Framework for Developing MVC Applications
With CQRS, the state of the customer object is held in memory, and the things that you persist to the data store are the actual events that occurred in the system that affected that customer. As you have a record of all those events, if you shut the application down and then start it up again, you can just run through all the events to restore the state of the Customer object, and the rest of the system. PseudoCQRS was created because we wanted to apply the CQRS pattern to an existing application - one that already has all the state information stored on a database


Whatever happened to the IPv4 address crisis?
The day of reckoning still looms -- it's just been pushed out as the major Internet players have developed ingenious ways to stretch those available numbers. But these conservation efforts can only work for so long. ARIN currently has "approximately 24 million IPv4 addresses in the available pool for the region," according to President and CEO John Curran. They're available to ISPs large and small, but Curran predicts they will all likely be handed out by "sometime in 2014."


A Chromebook offers Defensive Computing when traveling
Even using a Chromebook normally, with a Google account, still provides safety because Chrome OS encrypts all your files. There is no way another person using the same Chromebook can see anything of yours (assuming you don't give out your Google password). If you are going to lose a computing device, you want it to be a Chromebook. Your files are protected even if someone removes the solid state hard drive. And, unlike other operating systems, the encryption is stress free. That is, a Chromebook user does not have to enable anything, run anything or even remember anything, to have their files encrypted.



Quote for the day:

"Success in life comes not from holding a good hand, but in playing a poor hand well. " -- Kenneth Hildebrand

February 17, 2014

App delivery techniques: Virtualization and Web-based apps
Browsers are also delivering more native-like capabilities within their interfaces. In the iOS version of Safari, for example, you can make interface elements disappear as you scroll through the page content. But Web-based apps still pose many hurdles for IT. For instance, whenever application-state data -- the data stored in memory during a session -- must be updated, a screen refresh is required. If the user's connection is less than optimal, this refresh can affect performance.


Collect Your SQL Server Auditing and Troubleshooting Information Automatically
The idea is that since we do not know how often the default trace files are changing for each server, and since the files have a maximum size of 20Mb each (but they may be much smaller), it is actually more efficient to import them and merge them than to write custom logic to check which file was imported and which has not. (The performance overhead of importing 20Mb trace files and using the MERGE script is minimal. I performed a test by populating 1 million rows in each table by using Redgate’s Data Generator and even in such case the import was fast.)


Update: Third of Internet Explorer users at risk from attacks
The extension of the vulnerability to IE9 followed confirmation earlier yesterday that active attacks are compromising the newer IE10 and hijacking PCs running the browser. "Microsoft is aware of limited, targeted attacks against Internet Explorer 10. Our initial investigation has revealed that Internet Explorer 9 and Internet Explorer 10 are affected," a Microsoft spokesperson said via email today. With both IE9 and IE10 vulnerable, it means that about a third of all those using Internet Explorer are at risk.


Report: EU to push to reduce US role in Internet governance
The European policy paper seems to reject a U.N. takeover of Internet governance functions, by rejecting calls for a new international legal regime. The paper calls for a multistakeholder process that ICANN trumpets as its current model. An ICANN spokesman didn't have an immediate comment on the proposal. "The Internet should remain a single, open, free, unfragmented network of networks, subject to the same laws and norms that apply in other areas of our day-to-day lives," the E.U. document said, according to the Journal.


An Introduction to UX Design
UX is considered a discipline these days, which incorporates many aspects and will always include good UI design. The problem that many have wrapping their heads around UX is that there is a lot of conflicting information online and even many designers will give you a different definition than their peer might. It’s a little ‘fractured’ as a discipline because of this and simply because at its heart, UX incorporates a lot of ideas, research and theory, as well as practical application in the real world.


Linux Deepin is a fringe Linux distribution that could steal your heart
With a new desktop (DDE – Deepin Desktop Environment), Linux Deepin takes nods from nearly every desktop environment available and rolls it into one, elegant solution. Part Windows 7, part Ubuntu Unity, part KDE, part GNOME 3 (which DDE gets its base), this desktop brings to mind exactly what Microsoft should have done for Windows 8. You take a deeply embedded desktop metaphor and give it a modern twist, a flush app store, and make it scream on nearly any hardware. That’s what Linux Deepin did.


Is it Really Possible to Achieve a Single Version of Truth?
The road to SVOT is paved with very good intentions. SVOT has provided the major justification over the past 20 years for building enterprise data warehouses, and billions of dollars have been spent on relational databases, ETL tools and BI technologies. Millions of resource hours have been expended in construction and maintenance of these platforms, yet no organization is able to achieve SVOT on a sustained basis. Why? Because new data sources, either sanctioned or rogue, are continually being introduced, and existing data is subject to decay of quality over time.


Understanding atomic and composite patterns for big data solutions
Atomic patterns help identify the how the data is consumed, processed, stored, and accessed for recurring problems in a big data context. They can also help identify the required components. Accessing, storing, and processing a variety of data from different data sources requires different approaches. Each pattern addresses specific requirements — visualization, historical data analysis, social media data, and unstructured data storage, for example. Atomic patterns can work together to form a composite pattern. There is no layering or sequence to these atomic patterns.


Exploring the complexity of modern cyber attacks
Justifying ROI for information security can be a challenge. Information security is, in fact, a business problem, not an IT problem. The information security team should develop an information security strategy aligned with the company’s business imperatives and the various IT programs designed to support those business imperatives. A well-executed information security program should also deploy a security architecture that enables business focused outcomes (i.e. enabling the company to research and develop new products, to expand in existing markets or enter new ones, or to attract new customers) in secure ways.


Taking the first step towards better enterprise information management
Banks are under increasing pressure to meet regulatory demands and manage their business challenges. This could potentially create another wave of siloed data projects, if not carefully ‘governed’. While addressing tactical urgencies are important, there must be a strategic focus on having a coherent strategy for banks to leverage ‘data’ for growing, saving costs and staying compliant. The intent of this article is to convey the importance of having a good framework and the right guidelines to help banks make the right choices to be effective and efficient.



Quote for the day:

"I am reminded how hollow the label of leadership sometimes is and how heroic followership can be." -- Warren Bennis

February 16, 2014

NIST Framework Released to Widespread Praise, But What Happens Next?
The framework was widely praised at a high-profile release event in Washington, preceded by a statement from President Obama. The framework "is a great example of how the private sector and government can, and should, work together to meet this shared challenge," Obama said, adding that much more work needs to be done on cybersecurity, particularly the need for Congress to pass legislation that provides greater legal protection to spur greater cybersecurity information sharing.


The Case Against Wearables, Or Why We Won't All Look Like The Borg This Year
The problem: The hype is years ahead of the market. Big and unresolved questions remain about pricing (too high), battery life (too short), utility (too limited), looks (too ugly) and privacy (too scary). “We’re a ways away from the Borgification of the consumer,” says Bill Briggs, chief technology officer of Deloitte Consulting, which is predicting that 10 million wearable devices will be sold this year in a market valued at about $3 billion. (Compare that with 1 billion smartphones sold in 2013.) “We’re going to need to see new categories emerge and existing categories evolve.”


World’s Deadliest DDoS Attack Against A Company Which Was Fighting It
The new attack used the NTP reflection technique, involving the sending requests with spoofed source IP addresses to NTP servers with the intention of forcing those servers to return large responses to the spoofed addresses instead of those of the real senders. ... CloudFlare wrote in the blogpost that this had two effects: the actual source of the attack is hidden and is very hard to trace, and, if many Internet servers are used, an attack can consist of an overwhelming number of packets hitting a victim from all over the world.


New Data Center Design Drives Efficiency Gains for Dupont Fabros
“We recognize that in this industry, things change and evolve,” said Scott Davis, Senior Vice President of Operations for DuPont Fabros Technology (DFT). “We sat down with the design group and looked at the trends (n data center design). We took all those trends and came up with goals. The end result is (a data center that’s ) cheaper to build, requires lower maintenance, and has an industry leading PUE. We never save at the cost of reliability or resiliency.” The company expects annualized Power Usage Efficiency (PUE) UE to be below 1.14 at 75 percent capacity, and below 1.13 at 100 percent utilization.


Innovation is Inspiration: Lead in your Surroundings
Think “Smaller.” Not every innovation will produce a world of change today. A happy life, a well-done project, or a successful business is just the sum of their parts. Break down any problem into workable smaller parts. Take some simple action to quantify or identify just one part of a problem or activity, no matter how small or seemingly unimportant, and innovate a small change to that portion. You will see–it will move the process forward.


DataKind: Data Science for the Common Good
DataKind’s goal is to connect expert data scientists with social change organizations who are seeking to better manage, visualize and understand their data. Porway was most recently the data scientist in the New York Times R&D lab and remains an active member of the data science community. Scott Laningham, IBM Digital Journalist, spoke with him at the IBM Information on Demand 2013 conference in Las Vegas.


Modern Enterprise Performance Analysis Antipatterns
The specific examples that led to the distillates below are drawn from the Java ecosystem, but similar remarks apply to many other types of enterprise system. Each basic cause corresponds to some common cognitive bias. For example, Boredom andResume Padding both stem from a desire to escape the existing tech that a developer uses in his or her day job, and their aspirational desire for a better tomorrow. The antipatterns are presented below, in a style and format that should be reminiscent of the Gang of Four, as well, of course, as the antipattern format pioneered by Brown et al.


Secure Networks: How To Develop An Information Security Policy
While security methods provide protection for access and infrastructure, these methods should be the result of a carefully defined security policy. An effective security policy integrates well-known protection methods into a network in a way that meets both security standards and the goals of the entity being secured. An information security policy builds the foundation for a secure network, but it must be seen as valuable to an entity.


Australian standard published for IT governance
“The standard has been prepared to set out how significant IT projects can benefit through the use of appropriate governance frameworks and principles,” said Bronwyn Evans, Chief Executive Officer, Standards Australia, in a statement (PDF). “As the world we live in continues to change rapidly, organisations need to consider how they can deliver effectively today, while investing in technology for the future.” Evans said guiding successful projects, driving change within organisations, and achieving desired business outcomes, requires clear engagement between governing bodies and their senior executive.


Ramp Up Your IT Governance Model for IoT
Effective IT governance help converting the enterprise goals to IT goals and selection of appropriate enablers like policies, frameworks, organization structure, services, infrastructure etc. It will also help in selecting the rights processes that help in achieving the IT goals thereby helping achieving the enterprise goals and meeting governance objectives of meeting stakeholders needs and expectations.



Quote for the day:

"The best strategy for building a competitive organization is to help individuals become more of who they are." -- Marcus Buckingham

February 15, 2014

SD Elements--A Solution To The Web App Security Conundrum
It’s an interesting approach – instead of using either a pre-configured software security requirement list, or an after-the-fact automated scanning tool, SD Elements works alongside and at the same time as the development process, it’s also a dynamic tool, taking into account new found vulnerabilities and approaches to security. It’s also compatible with existing scanning products so sits nicely in the web app security lifecycle process.


Study Shows Those Responsible for Security Face Mounting Pressures
"When we speak to CIOs, CISOs, IT Managers/Directors, we almost always hear that their Board of Directors has asked them what they are doing to protect the companys valuable information. When the Board asks questions, there is more pressure. However, security has been a board-level issue for some time," Cole explained. Today, the difference is in the type of questions being asked by the board. It used to be a matter of answering the question, 'what are we doing to prevent data loss?"


US seeks information on industry ability to hold bulk phone data
The RFI has been posted to the Federal Business Opportunities site that lists federal government procurement opportunities. The government is looking for information on whether commercially available services can, among other things, provide secure storage and high availability to U.S. telephone metadata records for a sufficient period of time, and ensure that there are no unauthorized queries of the database and no data is provided to the government without proper authorization.


10 Scientific Insights That Could Make You A Better Designe
As designers, we can take advantage of findings from fields like behavioral economics and cognitive psychology, and become more mindful about exactly how we’re influencing people through our designs. Insights from these fields can help us better understand why people behave the way they do, design more effective products and services that positively influence behavior, and make more informed predictions about how our designs will ultimately impact people when we let them loose in the real world.


Intel wants to be the 'operating system' for big data
Fedder declined to share how many customers Intel has for its Hadoop distribution. A lot of the work for it began as a lab project in China. To date, most customers are in China although there are users in Europe and the U.S. as well, he said. Those looking to pinpoint Intel's intentions for Hadoop should know one thing, according to Fedder. "Where we differ from other players is we're not trying to build an end-to-end solution," he said. Instead, Intel wants to be the "operating system" for big data, letting third-party vendors and customers themselves create the application layer on top, he added.


Can You Keep a Secret, App?
That’s where Secret comes in. Like a more established app called Whisper, Secret is free and lets users post an image along with several lines of text. Yet while Whisper posts can be seen, searched for, and commented on by all users, Secret shows you posts from your contacts who are also using the app, and, under certain conditions, secrets from friends of those contacts and beyond. If your contacts tap a heart icon to indicate they love one of your secrets, it’s sent on to their contacts, and continuous “loving” spreads secrets throughout the app’s user group. While this means you will see secrets from beyond your initial group of contacts, you can only comment on secrets posted by your friends and friends of friends.


'The Moon' worm infects Linksys routers
The worm, which has been dubbed TheMoon because it contains the logo of Lunar Industries, a fictitious company from the 2009 movie "The Moon," begins by requesting a /HNAP1/ URL from devices behind the scanned IP addresses. HNAP -- the Home Network Administration Protocol -- was developed by Cisco and allows identification, configuration and management of networking devices. The worm sends the HNAP request in order to identify the router's model and firmware version. If it determines that a device is vulnerable, it sends another request to a particular CGI script that allows the execution of local commands on the device.


The Problems measuring Innovation
There are several difficulties when measuring innovation. The first is in the definition of innovation. After all, innovation is a relatively generic umbrella term that contains a lot of different activities and outcomes. Incremental product innovation is more definable and predictable than disruptive business model innovation, more familiar and probably easier to measure. Given the range of activities, processes, definitions and outcomes, talking about measuring innovation is a bit difficult, especially when the range of outcomes is so broad.


Big Data Analytics: Descriptive Vs. Predictive Vs. Prescriptive
With data in hand, you can begin doing analytics. But where do you begin? And which type of analytics is most appropriate for your big data environment? In a phone interview with InformationWeek, Wu explained how descriptive, predictive, and prescriptive analytics differ, and how they provide value to organizations. "Once you have enough data, you start to see patterns," he said. "You can build a model of how these data work. Once you build a model, you can predict."


No More Technical Debt - Invest in Quality
But if you neglect the Technical Debt of the project, that might backfire at one point: If you need to change code with a lot of Technical Debt, the changes might be prohibitively expensive and therefore not feasible. Developers usually know and fear these kinds of situations - working with code that has a lot of Technical Debt is not just little fun - it is also very risky because bugs might sneak in and estimates might be easily proven wrong. So while software quality might be very important for the success of a software project, the Technical Debt metaphor is just not enough.



Quote for the day:

"Take your life in your own hands, and what happens? A terrible thing: no one to blame." -- Erica Jong

February 14, 2014

Erasing SSDs: Security is an issue
The bright spot was encrypted SSDs, effectively deleting the encryption key makes the stored data useless. The one concern forwarded by the researchers is that there is no way to verify that the memory locations storing the encryption key data were sufficiently sanitized. The research team did not come out and say it, but reading between the lines has one believing there is no reliable way to sanitize SSDs other than physically destroying the device.


How to Optimize Your Enterprise Storage Solution
For enterprises that want their own internal data storage, it is best to start with network attached storage (NAS). A NAS filer is basically an extra server that connects to a network and rapidly adds extra storage to that network. However, at a certain point, too many NAS filers can overwork the local area network (LAN), affecting performance. When a NAS starts becoming too slow, creating a storage area network (SAN) is the next best step. A SAN is a collection of connected computers that are used solely for storing data.


Dozens of rogue self-signed SSL certificates used to impersonate high-profile sites
Such attacks involve intercepting the connections between targeted users and SSL-enabled services and re-encrypting the traffic with fake or forged certificates. Unless victims manually check the certificate details, which is not easy to do in mobile apps, they would have no idea that they're not communicating directly with the intended site. In order to pull-off man-in-the-middle attacks, hackers need to gain a position that would allow them to intercept traffic.


Cyberthreats: Know thy enemy in 2014
Defending a large network has never been harder. Expensive perimeter protection systems, complex host-based malware detection and even whitelisting systems have crumbled as attackers perfect an almost unbeatable pair of attacks: spear phishing and watering holes. Both attacks apply an age-old strategy: If a defense is too complex to beat head-on, bypass it. At the same time, social engineering, the Internet of Thingsand the combination of traditional Web applications, embedded applications and networked devices often with "versions" of Microsoft or Linux operating systems, present untold security challenges.


The Rise and Fall of Western Innovation
The main cause of this decline, according to Phelps, is corporatism—the inevitable tendency of businesses, workers, and other interests to band together to protect what they have. In modern economies, he says, corporations, unions, and other interests turn government into an agency for forestalling change and preserving the status quo. This problem has been worse in Europe than in the U.S., which is why productivity and per capita incomes in Europe have persistently lagged.


Workday: Linking technology design and user experience
We can hardly overstate the importance of software that users can easily adapt over time to changing business needs. Historically, it was difficult for users to change software rules and functionality in response to conditions such as a merger or new regulations. The software was inflexible, so these changes often required programmers to code customizations so the software could meet specific business requirements. A recent Gartner report explains the negative long-term impact of these customizations:


Mid-Level Leaders: Key Stakeholders, Agents of Change or Both?
It has come to my attention that a heightened focus on mid-level, or emerging, leaders has taken the industry by storm. However, I’m not just talking about the leadership development industry. This focus is being seen across many industries, pharmaceuticals and energy, in particular. Upon further reflection, it became clear why this is the case: both industries are facing major change initiatives, and mid-level leaders have been proven to be the most effective at managing change and ambiguity in the workplace.


Measuring the effectiveness of your security awareness program
Granted, measuring security effectiveness is not as straightforward as measuring a manufacturing process. There are many variables that are simply outside of one's direct control. In fact, a recent ISACA report conceded, "...security is contextual and not an isolated discipline; it depends on the organization and its operations. Furthermore, effective security must take into account the dynamically changing risk environment within which most organizations are expected to survive and thrive." All the more reason that improvements be addressed wherever possible!


Solving the Gordian Knot of Chronic Overcommittment in Development Organizations
There is no debate that the end result of these changes will be good for MegaRetail, but Claes already has hundreds of projects in various states of progress and the question remains whether there are enough people to staff these additional projects? There was no understanding or acceptance in the meeting that the IT department teams are already busy. In addition, the Marketing Director somewhat heavy handedly reminded Claes that business drives the company forward and IT is to be a supporting function and not a roadblock.


CEO Need-to-Know: Enterprise Cloud needs the SDDC
The vast majority of global enterprises today have in one way or another raised the prospect of a move to the Cloud. Yet fewer than 29 percent expect to be running the majority of their IT operations in the Cloud within the next 5 years[1]. Fact is that everyone’s talking about the Cloud, but few have defined it, much less created a strategy around it . Why? Because you can’t very well migrate well if you don’t know what to pack. Yet the promise of the Cloud is very real; the opportunities that a Cloud model presents can be significant for the enterprise that gets it right.



Quote for the day:

"I am not discouraged, because every wrong attempt discarded is another step forward." -- Thomas A. Edison