11 Tuesday Mar 2014
Posted in General, mindmap, Technology, TOGAF
Following yesterday’s post, I thought I’d share a mindmap that was useful with the TOGAF stuff …
To use a friendly readable & navigable version of the mind map click on the image or here.
This is one of a number of mind maps I have made available through a SaaS mindmapping tool now.
10 Monday Mar 2014
Posted in General, Technology, TOGAF
Tags
books, certification, exam, study, TOGAF
Having successfully become certified with TOGAF 9. I thought it would be good to share some hints, tips and observations that have helped me along the way. So as you may know the exam is conducted through multiple choice – but that simple examination approach should not give a false sense of ease – because a lot of the options will sound right (until you understand the exact technical meanings).
manual is a desk reference for whilst practicing TOGAF. To get the exam under your belt read TOGAF® 9 Foundation Study Guide
you will need to pretty much need to know this stuff cover to cover. Although the guide is Foundation stage – it will get you a long way and you can add additional knowledge from the TOGAF® Version 9.1 A Pocket Guide
Aside all of this there are classic exam suggestions – give yourself time to get to the exam location – a calm composed mind is crucial for this. Try and rush through this and you’re potentially facing a disaster. Make sure you have all the information the test centre requires (id’s etc) – one less stress. Travel light as you wont be able to take anything into the test room. Finally, try and get into ‘the zone’ and roll with the blows dont let the process of taking the exams stress you. I thought I’d scrapped through stage 1, and flunked stage 2 – but discovered I came through with reasonably good scores.
26 Wednesday Feb 2014
Tags
"Mike Oldfield", audiophile, cd, Hifi, MP3, Music
I recently changed my car, and in the process of sorting all the various things out (removing CDs etc from my previous car) lead me to a thinking about a question I have seen often mentioned in music blogs, biographies and other books. That simple question ‘When you get a new bit of audio kit, do you have a specific album that’s at be played first?’ That audio kit could be simply a car stereo or iPod through to some audiophile exotica (go look at marvels such as http://www.michell-engineering.co.uk/turntables/gyrodec/ or http://www.bowers-wilkins.co.uk/Speakers/Home_Audio/Nautilus/Overview.html and these are still relatively tame).
By know you’re either reading this going – what planet are you on, or mug you can’t tell the difference between £100 and £1000 piece of stereo, or perhaps a knowing response of yes it’s xyz album. If you’re response is the later, then you’re probably at least a self confessed audiophile. So, you have the question, and I’m sure if you ask it unless you’re a known audiophile basher (middle response above) you’ll probably get the appropriate response every time.
The fascinating thing is that the album concerned doesn’t necessarily reflect a persons’ taste; it might even be a recording that particularly exercises a HiFi in a manner that shows off its strengths or reveal audio weaknesses (every audiophile will have a few albums they like to use to test a bit of kit with) but most likely something like the first album played on the first bit of proper HiFi. So for me, it is a rather uncool Mike Oldfield QEII. It was one of the first CDs I purchased and played on my 1st vaguely ok HiFi. I still love the album for the swooping guitar work, diverse musical styling. But I’d not suggest it is reflective of my musical taste which which is very wide, but with a strong deference to Alt Rock/Americana these days.
Before I risk getting flamed out by audiophiles about associating CD with quality – yes I do have vinyl and a well respected turntable. For those at the other end, I’m not audiophile zealot – I do have an iPod (a 80GB classic as it happens which is perpetually full) & the name MP3Monster is not without reason. Right playback for the right conditions – MP3 on the move, CD for day to day and those rare quiet moments just occasionally the vinyl gets out. But always music.
05 Wednesday Feb 2014
Tags
applications, books, extensibility, fusion, handbook, Oracle, Vladimir Ajvaz
The next book up for review is going to be Oracle Fusion Applications Development and Extensibility Handbook (Oracle Press)
I have to declare a slight interest in my reviewing as I have had the good fortune to work with one of the authors- Vladimir Ajvaz; and extremely knowledgeable and talented Application Architect.
Oracle Fusion Applications
05 Wednesday Feb 2014
Posted in Books, General, Technology
Tags
Aaron Woody, book, data, datasec, enterprise, Packt, review, Security
So I have previously blogged a series of largely chapter by chapter reviews of Aaron Woody’s book Enterprise Security – A Data Centric Approach. This post tries to provide a brief summarised view pulling my thoughts of the book overall together.
As an Enterprise Architect I took an interest in this book as an opportunity to validate my understanding of security and ensure in the design and guidance work that I do I am providing good insights and directions so that the application architects and developers are both ensuring good security practices and also asking the helpful information available to other teams such as IT Security, operational support and so on.
The book has been overall very well written and extremely accessible to even those not versed in the dark arts of IT Security. Anyone in my position, or fulfilling a role as an application designer or product development manager would really benefit from this book. Even those on the business end of IT would probably benefit in terms of garnering an insight into what IT Security should be seeking to achieve and why they often appear to make lives more difficult (I.e. putting restrictions in, perhaps blocking your favourite websites).
So why so helpful, well Aaron has explained the issues and challenges that need to be confronted in terms of Security from the perspective of the organisations key assets – mainly its data (certainly the asset that is likely to cause most visible problems if compromised). Not only that the book presents a framework to help qualify and quantify the risks as a result device a justifiable approach to securing the data and most importantly make defensible cases for budget spend.
I have to admit that the 1st chapter that that introduces the initial step in the strategy was a bit of a struggle as it seemed to adopt and try to define a view of the world that felt a little too simplistic. The truth is that this the 1st step in a journey, and in hindsight important – so stick with it.
Once the basic framework is in place we start looking at tooling strategies and technologies to start facilitating security. The book addresses categories of product rather than specific solutions so the book isn’t going to date too quickly. The solution examination includes the pros and cons of their use (e.g wifi lock down) which is very helpful.
Finally to really help the book comes with a rich set of appendices providing a raft of references to additional material that will help people translate principles into practice.
To conclude, a little effort maybe needed to get you started but ultimately a well written, informative, information rich book on security.
Previous blog entries:
There is also a supporting website for the book athttp://www.datacentricsec.com/
05 Wednesday Feb 2014
Posted in Books, General, Technology
Tags
Aaron Woody, book, data, enterprise, Packt, review, Security
so I have reached the final chapter of the book which covers the handling of security events and security incidents (the differentiation of the two being the consequences of the event – a piece of malware being detected on a desktop can an event as the consequences are relatively trivial compared to the defacing of an e’tailer’s website).
I have to admit I glossed through this chapter as my role within an organisation doesn’t demand the operational management of issues. That said, the book provides some clear guidance on how to develop a process to support the handling of a security issue – important as you don’t want be figuring these things out when something happens, you want to get on and focus on execution. s with previous chapters, this well written and doesn’t demand knowledge of security dark arts to get to grips with.
The book finishes with a series of appendices which provides some illustrative information for chapters in the book, plus a series of appendices of really useful additional reference information sites cover a spectrum of information from security education resources to security tools.
This series of blogs on this book will wrapped up with a short review of the whole book. But I would like to congratulate Aaron Woody on a fine book rich with helpful additional information.
Previous blog entries:
There is also a supporting website for the book athttp://www.datacentricsec.com/
04 Tuesday Feb 2014
Posted in General
We got to see the excellent boxer Rebellion last night at the Brook venue in Southampton.
Both the venue (which we’d never been to before) and the band where excellent.
28 Tuesday Jan 2014
Tags
Aaron Woody, engineering, enterprise, Kevin Mitnick, networks, review, Security, social, social engineering, wireless
Chapters 7 and 8 of the book in many respects are the polar opposites in their nature, with Chapter 7 looking at Wireless networks in the Enterprise and technicalities of different encryption frameworks, authentication and authorization. Then at the other end is chapter 8 facing into the difficulties of social engineering – the approach of using people’s own nature to divulge sensitive information. Probably one of the most famous people for this sort of thing is Kevin Mitnick and to acts of social engineering are will illustrated in the influential book Bruce Stirling’s Hacker Crackdown.
Although Chapter 7 is addressing an area many would view as the dark art of wireless network setup; it is well explained and actually worth reading by anyone who would like to better understand their own home wireless network as lot of the information (not all) is relevant even in that context. For example the benefit of supressing the visibility of the Network ID (SSID) doesn’t make the network invisible – it simply makes it harder to spot as any device such as smart phone will call out yo the network to see if it is present and this information can be picked up just as easily if you know what you’re doing.
Drilling into the social engineering aspect, the book looks at the more obvious and perhaps brute force models such as spam to increasingly subtle takes such using social media communications through the likes of linkedin to send emails loaded with malware and see the end user open them. For example pretending to be an agent with a job offer who has found you via LinkedIn. But beyond that, the amount of information being made available via social sites as it can be a means to establish a organisations’ IT fingerprint and therefore suggest the best routes to attacking IT. The chapter addresses training, and the pros and cons of different approaches, plus mitigation strategies for the different attack strategies.
Previous blog entries:
There is also a supporting website for the book athttp://www.datacentricsec.com/
20 Monday Jan 2014
Tags
AWS, Cloud, connector, development, integration, Oracle, Salesforce, SOA Suite
As an Enterprise Integration Architect I need to get my hands dirty with products such as Oracle’s SOA suite and AIA Foundation Pack. In the past, I’ve dealt with this by talking with our infrastructure team – obtaining a VM or a laptop with sufficient guts to host SOA Suite (and it doesn’t have a small footprint). This is all well and fine, but means I have to lug a big old laptop (our current standard laptop spec’s are lovely light machines with SSD’s but just don’t pack the punch for SOA Suite when it comes to memory) or have to leap through a series of security steps to get remote access – again not a problem unless I want to share my skunk works with someone outside the organisation. Nor, do I really want to invest chunks of time building a SOA Suite environment to work with – I don’t do it enough to be able to throw these things together quickly. Even Oracle recognise that with the support for a prebuilt VirtualBox with SOA Suite and BPM. The only problem with VirtualBox is I’ve saved on the build time, but still need that heavy laptop or remote access.
Oracle Cloud Java
With the rise of the cloud, particularly Oracle’s big push (announcements at Open World 2013), Amazon offering small footprint dev platforms more or less for free I thought we’d be able to get a PaaS deployment of SOA Suite – after all Oracle offer a range of Fusion Apps in the cloud (built on top of SOA Suite technologies), have launched development of Java and ADF solutions in their cloud and even offer Weblogic on Microsoft’s Azure. How I wrong could I have been. So I started looking around, perhaps someone has an AMI ready to go – well sort of if I want 10g. So I’ve dug around, and found the odd provider who could deliver what was needed (e.g. Titan GS) but we’re talking big bucks – not a low cost dev/skunk works environment.
This is very surprising really, and sort of ironic, given Oracle’s recent announcement for SaaS Adapters for the likes of SalesForce and WorkDay along with convenience tooling to connect to Oracle Cloud solutions such as HCM. I say ironic, because to use the cloud adapters you can’t have a SaaS middleware; in fact the whitepaper Oracle published on Simplifying Cloud Integration infers/assumes that you’d be hosting your own middleware. So if a midsized business has Has HCM, Taleo etc for their staffing management, SalesForce for the Sales/CRM operations and perhaps EBis or JD Edwards to move your business into the cloud you have to either go IaaS and carry the labour of maintaining the middleware platform or self host (one of the things the adoption of SaaS is trying to free you from).
All of this seems to be a really missed opportunity for Oracle. If the oracle wants to host the world (and I think Larry Ellison would like that) and definitely get into that midmarket sector that JDEwards particularly tries to inhabit they need to make it easy for businesses to cloud all aspects of their IT solution, that includes orchestrating specialist solutions that will be hosted by someone other than Oracle (shock, horror). All of which means SOA Suite (and ideally AIA) need to be in the cloud.
As for my problem, its either the pain of building something on Amazon or setting up several copies of the VirtualBox deployment linked to a common GIT repository, and hope those I would like to collaborate with can also get their hands on the virtualbox and connect to GIT.
17 Friday Jan 2014
Posted in Books, General, Technology
Continuing with Enterprise Security: A Data-Centric Approach to Securing the Enterprise by Aaron Woody Chapter 5 gest into some of the security processes and technologies to securing you compute platforms covering topics such as:
But more importantly the chapter links these kinds of activities to the analysis of risk and previously developed trust models. So that you can understand how much security is suitable and justifiable. The ideas along with the pros and cons of each activity are well explained and clearly presented.
Chapter 6 takes us back to central theme of the book – data. With our policies and models identified we need to locate the data – this is harder than it may sound, not everything is in a database (the amount of business operation that runs on spreadsheets on people’s desktops, is endlessly amazing and then compounded by how we make the data collaborative – emailing, moving with personal USB storage, cloud services and on and on). To help find, track and potentially constrain it (prevent undue leakage) the book walks through the ideas of classification and ownership/accountability and then really starts to tie together the earlier chapters, as well as introduce some additional technology concepts such as the encryption of data when in transit and at rest. Like chapter 5, you don’t need a PhD to understand where to apply security and why – the doing maybe a different kettle of fish of course.
Previous blog entries:
There is also a supporting website for the book athttp://www.datacentricsec.com/
