04 Tuesday Feb 2014
Posted in General
We got to see the excellent boxer Rebellion last night at the Brook venue in Southampton.
Both the venue (which we’d never been to before) and the band where excellent.
28 Tuesday Jan 2014
Tags
Aaron Woody, engineering, enterprise, Kevin Mitnick, networks, review, Security, social, social engineering, wireless
Chapters 7 and 8 of the book in many respects are the polar opposites in their nature, with Chapter 7 looking at Wireless networks in the Enterprise and technicalities of different encryption frameworks, authentication and authorization. Then at the other end is chapter 8 facing into the difficulties of social engineering – the approach of using people’s own nature to divulge sensitive information. Probably one of the most famous people for this sort of thing is Kevin Mitnick and to acts of social engineering are will illustrated in the influential book Bruce Stirling’s Hacker Crackdown.
Although Chapter 7 is addressing an area many would view as the dark art of wireless network setup; it is well explained and actually worth reading by anyone who would like to better understand their own home wireless network as lot of the information (not all) is relevant even in that context. For example the benefit of supressing the visibility of the Network ID (SSID) doesn’t make the network invisible – it simply makes it harder to spot as any device such as smart phone will call out yo the network to see if it is present and this information can be picked up just as easily if you know what you’re doing.
Drilling into the social engineering aspect, the book looks at the more obvious and perhaps brute force models such as spam to increasingly subtle takes such using social media communications through the likes of linkedin to send emails loaded with malware and see the end user open them. For example pretending to be an agent with a job offer who has found you via LinkedIn. But beyond that, the amount of information being made available via social sites as it can be a means to establish a organisations’ IT fingerprint and therefore suggest the best routes to attacking IT. The chapter addresses training, and the pros and cons of different approaches, plus mitigation strategies for the different attack strategies.
Previous blog entries:
There is also a supporting website for the book athttp://www.datacentricsec.com/
20 Monday Jan 2014
Tags
AWS, Cloud, connector, development, integration, Oracle, Salesforce, SOA Suite
As an Enterprise Integration Architect I need to get my hands dirty with products such as Oracle’s SOA suite and AIA Foundation Pack. In the past, I’ve dealt with this by talking with our infrastructure team – obtaining a VM or a laptop with sufficient guts to host SOA Suite (and it doesn’t have a small footprint). This is all well and fine, but means I have to lug a big old laptop (our current standard laptop spec’s are lovely light machines with SSD’s but just don’t pack the punch for SOA Suite when it comes to memory) or have to leap through a series of security steps to get remote access – again not a problem unless I want to share my skunk works with someone outside the organisation. Nor, do I really want to invest chunks of time building a SOA Suite environment to work with – I don’t do it enough to be able to throw these things together quickly. Even Oracle recognise that with the support for a prebuilt VirtualBox with SOA Suite and BPM. The only problem with VirtualBox is I’ve saved on the build time, but still need that heavy laptop or remote access.
Oracle Cloud Java
With the rise of the cloud, particularly Oracle’s big push (announcements at Open World 2013), Amazon offering small footprint dev platforms more or less for free I thought we’d be able to get a PaaS deployment of SOA Suite – after all Oracle offer a range of Fusion Apps in the cloud (built on top of SOA Suite technologies), have launched development of Java and ADF solutions in their cloud and even offer Weblogic on Microsoft’s Azure. How I wrong could I have been. So I started looking around, perhaps someone has an AMI ready to go – well sort of if I want 10g. So I’ve dug around, and found the odd provider who could deliver what was needed (e.g. Titan GS) but we’re talking big bucks – not a low cost dev/skunk works environment.
This is very surprising really, and sort of ironic, given Oracle’s recent announcement for SaaS Adapters for the likes of SalesForce and WorkDay along with convenience tooling to connect to Oracle Cloud solutions such as HCM. I say ironic, because to use the cloud adapters you can’t have a SaaS middleware; in fact the whitepaper Oracle published on Simplifying Cloud Integration infers/assumes that you’d be hosting your own middleware. So if a midsized business has Has HCM, Taleo etc for their staffing management, SalesForce for the Sales/CRM operations and perhaps EBis or JD Edwards to move your business into the cloud you have to either go IaaS and carry the labour of maintaining the middleware platform or self host (one of the things the adoption of SaaS is trying to free you from).
All of this seems to be a really missed opportunity for Oracle. If the oracle wants to host the world (and I think Larry Ellison would like that) and definitely get into that midmarket sector that JDEwards particularly tries to inhabit they need to make it easy for businesses to cloud all aspects of their IT solution, that includes orchestrating specialist solutions that will be hosted by someone other than Oracle (shock, horror). All of which means SOA Suite (and ideally AIA) need to be in the cloud.
As for my problem, its either the pain of building something on Amazon or setting up several copies of the VirtualBox deployment linked to a common GIT repository, and hope those I would like to collaborate with can also get their hands on the virtualbox and connect to GIT.
17 Friday Jan 2014
Posted in Books, General, Technology
Continuing with Enterprise Security: A Data-Centric Approach to Securing the Enterprise by Aaron Woody Chapter 5 gest into some of the security processes and technologies to securing you compute platforms covering topics such as:
But more importantly the chapter links these kinds of activities to the analysis of risk and previously developed trust models. So that you can understand how much security is suitable and justifiable. The ideas along with the pros and cons of each activity are well explained and clearly presented.
Chapter 6 takes us back to central theme of the book – data. With our policies and models identified we need to locate the data – this is harder than it may sound, not everything is in a database (the amount of business operation that runs on spreadsheets on people’s desktops, is endlessly amazing and then compounded by how we make the data collaborative – emailing, moving with personal USB storage, cloud services and on and on). To help find, track and potentially constrain it (prevent undue leakage) the book walks through the ideas of classification and ownership/accountability and then really starts to tie together the earlier chapters, as well as introduce some additional technology concepts such as the encryption of data when in transit and at rest. Like chapter 5, you don’t need a PhD to understand where to apply security and why – the doing maybe a different kettle of fish of course.
Previous blog entries:
There is also a supporting website for the book athttp://www.datacentricsec.com/
01 Wednesday Jan 2014
Posted in Books, General, Technology
Tags
Aaron Woody, book, data, Data-Centric Approach, enterprise, Enterprise Security, network security, Security
Continuing into a chapter 4 of
Enterprise Security: A Data-Centric Approach to Securing the Enterprise by Aaron Woody we start to look at some technical aspects of security and technology covering things like the capabilities of new generation of firewalls, DNS security and so on. The information is presented in a very readable manner.
As an Enterprise Technology Architect, and having security specialist friends I thought I was reasonably well informed in this aspect of IT, but the book still taught me me things. Interestingly, perhaps not intended but the chapter left me with a number of things that could be incorporated into development governance that would make the work of network security a lot easier.
The chapter continues with lots of really helpful references many, maybe all are incorporated into a series of appendices that are full of helpful information references and links. If these are made available on the book’s website (see below) it would likely become a must go to site for security resources.
It does leave me asking one question how does this all fit in when using a PaaS solution such as those offered by the likes of Amazon and Rackspace?
Previous blog entries:
The book has been published by Packt (who at the time of writing are running a promotion – more here)
There is also a supporting website for the book at http://www.datacentricsec.com/
29 Sunday Dec 2013
Posted in Books, General, Technology
Tags
Aaron Woody, book, Data-Centric Approach, review, risk, Security
So I’m back to reading Enterprise Security: A Data-Centric Approach to Securing the Enterprise by Aaron Woody. I’ve not finished reading the book yet but as I’m reviewing one or two chapters at a time, I thought I’d blog about Chapter 3 – particularly given its value (previous blog entry here and here).
Chapter 3 goes by the name of Security As A Process, which addresses the processes to determining security risk, the analysis of cost benefit of implementing security features to address those risks. The chapter then goes on to provide guidance on defining good policies and standards.
In hindsight the process for determining and analyzing the security risks and classifying them is fairly obvious – it took the reading to to draw the points and the mechanisms into focus. But the fact it makes sense in hindsight suggests that the approach the workability and the chance for the business to understand the risks and challenges being taken on.
The chapter also provides some really good information sources for people to use to support the adotion of the processes described. Some I’ve known about such as the SANS Institute others I hadn’t.
I have to say that based on the strength of this chapter alone I’d recommend the book to any architect who is seeking to develop practical appreciation of addressing security considerations or understand what they should be looking for what to ask for in a new organisation. Those trying to drive up the quality of processes or get across the need for a more proactive security strategy that is also pragmatic – reading this chapter alone should help provide some serious points to get a handle on things.
The book has been published by Packt (who at the time of writing are running a promotion – more here)
There is also a supporting website for the book at http://www.datacentricsec.com/
29 Sunday Dec 2013
With the holiday break, I’ve had a bit of time to get through some reading, including finishing Appetite for Self-Destruction: The Spectacular Crash of the Record Industry in the Digital Age
Thw book feels well researched (certainly references hold testimony to this), but at the same time it doesn’t read like a dry academic read that you would associate with such a well researched text. But given the attitudes and behaviours of some of the individuals in the big labels their egos run riot far more than most of the ‘rock gods’ that they’re trying to sell.
Steve Knopper has done a great job with the book and I’d recommend it to anyone interested in music or how technology such as peer-to-peer has impacted the media industry. You dont need to be a music fiend or geek to find this a satisfying read.
Steve’s website is http://knopps.com/
25 Monday Nov 2013
Tags
I came across a series of YouTube videos that give the history of different instruments used in a rock band (well perhaps except for the accordion), we are assuming that the series is yet to do the treatment for the synth. Each video is between 5 and 10 minutes long. Each video is opened with the cheesiest music ever. But then things get better, a lot better. Each video has the band with the instrument featured up front, with someone who has to stand like a complete plank whilst MTV like facts are layed onto the board hung over their shoulders.
The band then play the instruments, changing as necessary playing snippets of great music to illustrate evolution of the way the instrument is used, and it great fun to try name the snippets used. But if you’re not sure the pieces are credited if you look carefully near the bottom left of the screen.
Part 1 – Guitar:
Part 2 – Drums:
Part 3 – Accordian:
Part 4 – Bass:
Part 5
25 Monday Nov 2013
Posted in Books, General, Technology
Just as I wrap up the tech reviewing of one book, Packt invite me to start another. This time a book has the working title of SOA Patterns on the Oracle Platform (no link yet – too early). This is certainly going to be a substantial book with about 12 chapters running to about 50 pages per chapter (certainly for the first 4 chapters). Unlike a lot of the more functional Oracle books I’ve seen from Oracle this is low on graphics and screen shots and high on textual content.
So far the book has given me cause to stop and think hard about the points the author is trying to make and then demonstrate. In some respects like the definitive texts by Thomas Erl, however where Erl is solution agnostic, this book is trying to bring the patterns to life through placing them into a scenario and describing the challenges and implementation approaches in terms of the Oracle platform, particularly BPEL, Mediators, rules engines and SCA (i.e. Oracle SOA Suite). I have laughed, as I found the book referencing back to Apache Camel.
All of this does mean that the review process is more time consuming than I had anticipated, if the review feedback is taken then I think it will have been a very worthwhile experience. Watch this space, and I’ll blog on this one once we see the final copy, if not before.
22 Sunday Sep 2013
Posted in General
I am fortunate enough to work for a company who is prepared to fly its staff across the Atlantic to attend a conference – which means I’m at one of the biggest (maybe the biggest) IT conference in the world – Oracle Open World.
Day 1 is a bit of a precursor with all the sessions being driven by various user groups. With about 30 sessions running at anyone time today it’s a job just to work out which sessions to attend.
This gives me my 1st observation of the day – if session is a panel based then say in the title. I attended one session that was meant to cover the development ecosystem, with the expectation of either getting a better handle on tooling around development of things like PL/SQL or perhaps the adoption of more contemporary tooling such as Maven or Git. What happened we heard was a conversation between a couple of panelists which really left me thinking that a lot of Oracle development is still in the dark ages technically, didn’t really appreciate what Agile says about documentation and the world was either agile or waterfall – the fact that Oracle Unified Methodology (OUM) is a derivative of the iterative RUP model.
The second observation is, tell me something don’t just throw facts at me with just slides full of bullets, you won’t hold people’s attention. In fact one session resulted in people walking out in droves.
That said, we also saw some very good presentations, and in fact these tended to keep amount amount of slide content down, but there is a narrative, building and emphasising key points. The presenter spoke with an intonation that showed that they where presenting because it was a subject they cared about and wanted to share their understanding, not because they want kudos for appearing.
The last lesson, is declare whether slides etc will be made available, so you have people’s full attention, rather than them bashing at their mobile devices making unnecessary notes. Although this sounds counter intuitive to the previous point you can enrich the slides with notes, to support later slide review.
