This post may shock you... the Java Rocker is going to talk about legacy iSeries and AS/400! Before you panic, and call it the end of the world, let me continue. This post is about running all of the cool new Web 2.0 things on your IBM hardware. Really! Even in Cincinnati! Many people, (myself included) thought the old IBM hardware was only for RPG and COBOL (shudders). It turns out that IBM has been adding functionality to run Linux on the box. That means Wikis, Ecommerce, blogs, and web applications are now there for iSeries-AS/400 people. The catch is that your iSeries needs to be up to date, which sadly for most organizations is not. My IT consulting colleagues at STAR BASE are good with taking your tired old hardware and doing the maintenance necessary for the modernization piece. They get your hardware and software cleaned up and ready, so I can help you with all of the cool new application development projects that I have been talking about.
But you are sitting there saying we are a small to medium size business (SMB), my entire IT staff is 10 or less, I do not have a Business Process Orgranization (BPO) or Project Management Office (PMO); where should the BA fit into my organization?
SMBs need to utilize the BA role within their project delivery methodology. If the role is not being fulfilled then there is higher risk of failure of the project in that it does not meet the needs of the business. I have worked on many small-to-medium IT staffs and can attest to the fact that when resources are few that people wear many hats. There were projects where I served as the project manager, business analyst, developer and trainer. On smaller staffs, where only one or two of the people will be doing the duties of the BA, it is even more important to make sure that those people are easily accessible by the business units that they support. Have them sit in the vicinity of those business units instead of in the IT Department. I still feel that the BA is an IT function and should report to IT management as opposed to business management, but making the BA readily available and accessible to the business adds value to their role and gains buy-in from the business people to assist the BA with their duties.
So when making the organizational chart keep the BA in the IT Department; but when divvying up office space, make room for the BA near the business unit(s) that they are to support.
1. Think TCO, not ROI
To the CFO, return on investment is how much money you’re going to give back to the company. Let’s face it. Most IT projects — no matter how compelling — don’t bring “return” to the organization like an additional sales person, a new marketing campaign, or a new product launch. Preach total cost of ownership (TCO); repeat it until you are blue in the face. Whether business application development, web application development, IT infrastructure investment; you can demonstrate “fiscal stewardship” through cost reduction or increasing customer satisfaction and loyalty.
2. Cloud Computing
CFOs like what they hear about cloud computing as a cost saver. Don’t fight them on it.
3. Green IT
Are you surprised when the CFO is not willing to pay a premium to keep the environment cleaner? The reality is that no green projects exist unless they have a better TCO. So whether to upgrade your IT infrastructure, better IT infrastructure cooling, or saving space for your IT infrastructure you can build a strong business case of the decreased TCO and community relations intangibles of being an “environmentally conscious” firm.
4, 5 and 6. Virtualize, Virtualize and VIRTUALIZE
“This subject takes up three spots because there are three key virtualization targets -- servers, desktop and storage. But again, the key here is how to justify and how now NOT to justify.” Again build your TCO case for virtualization, but be realistic in your cost savings estimates. Many times virtualization projects are viewed as unsuccessful because they did not meet the upfront cost estimates. Be sure to include high traffic times such as end-of-month close periods.
7. Adopt IT-Centric Business Continuity
Over the years responsibility for business continuity have been put on IT management. This needs to change. Organizations need to understand that there are three phases to a business continuity plan; event response, disaster recovery and business continuity. With the financial impact on the organization of disaster recovery and business continuity, business management must be involved and responsible for these areas. It should not be IT management’s responsibility to determine which business units are most important.
8. Align with the Big Picture
Along with TCO, build your requests showing how the request aligns with the business objectives and goals of the organization.
9. Proactive Cost Reduction
Boy does that sound like another way to say TCO to you? Take a proactive stance on reducing cost. The article showed how to reduce cost of document retention.
10. Reduce Data Center Costs
The organization’s data center is usually the center of the IT infrastructure, both in physical space and cost. Just as in application software development, modular building of a data center can cut cost of the IT infrastructure through avoiding construction cost, reduced cooling cost and reduced capital expenditures.
“While the relationship between CFO and CIO can sometimes have more debits than credits, it is definitely worth the investment in time and effort to highlight IT projects in terms the CFO will understand.”
What is not reported on the evening news is how an army of geek volunteers from the private sector is supporting that relief effort. Leading the way are organizations like CrisisCommons, Ushaahidi, the International Community of Crisis Mappers and InSTEDD, according to an InformationWeek artical. Application software development gets into the mix, undertaking such tasks as developing ways to help locate U.S. citizens and provide information online about Haiti and how to donate money, developing a timeline of events and a wiki of information online, a GPS-compatible street map of Haiti, an English to Creole dictionary for IPhones and Android mobile devices, and a system to use Twitter messages to ask for or offer assistance to those in need. "We've been working a lot at Sunlight Labs to get application software developers to organize and work together in volunteer communities. Developers may not be competent with a saw, but are starting to realize they have a skill they can contribute," says Clay Johnston, director of Sunlight Labs. "The tools are available, and methodologies like agile project management have been popularized that can facilitate this."
In light of the reports of the failings of the coordination of relief efforts following Hurricane Katrina and the reports of the relief effort in Haiti, it is clear that it is IT solutions that have been put into place to better support humanitarian relief efforts worldwide and that technological advances has clearly moved into the 21st century in support of those efforts.
First, sorry for the tardiness of my posts. Between the holidays, coming back from the holidays, a cold, and a secret project (for now), I haven't had time to blog.. until now. My current focus has been a Facebook game application. Well it's still in the alpha phase, but I wanted to get the architecture up and running. There's nothing worse for an application development person than to finish your application, then find out you need to rewrite it (or worse) because of the architecture doesn't support it. Even without Zembly, setting up a Facebook application is pretty easy. Since I had most of the defaults already in, the only thing I need to do is to tell Facebook where my application resides. Since I don't have Zembly anymore, I have to put on my application development and network administrator hats on set up an application server.
My first test was to deploy the application into my local Tomcat. NetBeans does a great job of having the files available to you, but the thing you learn quickly is that there isn't a simple deployment piece. Tomcat needs a WAR file, so I tried to use the JAR command to WAR up the files in the dist folder. No dice. The war file needs a proper web.xml file to work properly. Rather than use workarounds on workarounds, I created a web application project in NetBeans, linked the jar file from my JavaFX project, and copied the JNLP and HTML files to my new project. I now have a WAR to deploy. Tomcat loves this file. I run and... “FILE NOT FOUND?” was heard all throughout Cincinnati. Your JNLP file that was created points to a servlet called internally by NetBeans. Make sure change the following lines:
<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec="1.0+" codebase="http://your server.com/app path/" href="SBWarsTest_browser.jnlp">
<information>
<title>SBWarsTest</title>
<vendor>STAR BASE </vendor>
<homepage href="http://your server.com/app path/"/>
Once I made the change to localhost, everything was fine. Now I wanted a real application server, so I downloaded and installed Glassfish V.2.1 on one of our servers, changed the JNLP file and we are in business. I tried to hit it from my machine, and no dice. After some extensive research, I found out the the Java 7 EA JRE does not play well with JavaFX. I uninstalled it (which reverted to JRE 1.6.18), and it works. In Facebook, you need to set the canvas callback URL to your host application path. The result is the pretty picture you see at the top of my post.
According to ComputerWorld, web application development remains top dog by far in the top IT skills to have in 2010. Specifically, companies will look for developers with knowledge of .Net, Java, Web development, open source and portal technologies. The article goes on to suggest that combining web application development skills with business analysis or project management skills is a big plus. ComputerWorld lists the remaining skills to have for 2010 in its top six as: Help Desk/Technical Support, Networking, Project Management, Security and Business Intelligence.
I feel ComputerWorld did not put enough emphasis on Security; this without doubt will be the biggest challenge for IT executives in the coming years. Open-source software may be an innovative money saver, but IT professionals still have concerns that networks could be vulnerable to viruses, cyberattacks and other intrusions.
According to InfoWorld, a new survey from Forrester Research found that 58 percent of large companies have security concerns about open source. In addition, 57 percent of small and mid-sized businesses expressed concern that open-source software would be "complex and hard to adopt".
With the advent and increasing usage of open-source in the business world, expect to see demand for IT security related skills to grow. According to the FLOSS 2020 roadmap presented at the Open World Forum in Paris, 40 percent of jobs will be related in some way to open source by 2020. You can expect application development and security to comprise a great majority of these jobs.
People outside of Cincinnati may be shocked to know that I work with languages OUTSIDE of Java! I don't know any application development person, especially one who does web application development who doesn't use several languages. I have recently been working on Magento. What is that you say? Magento is an Open Source PHP ECommerce application based on the Zend Framework. You don't need to download Zend, just the Magento PHP files. We actually have Magento internally setup with a LAMP package, but I already have MySQL and Apache on my local machine, so I thought I'd tackle and individual install. The verdict? Well after a couple of small hiccups (don't use the Windows install for PHP, just unzip, and localhost needs to be a virtual host), setup was a breeze! Fortunately, STAR BASE, Inc. has enough experience to over come these issues. Magento is easy to customize products and catalogs, and would be a good choice for organizations to create their own ECommerce site. Magento is easy enough to implement without an IT Consultant, but an experienced consultant can save you time and frustration.
I have been and continue to be a strong proponent for IT certifications. Even since I obtained my CBAP® certification last year the application process has changed. The exam itself is now based on version 2.0 of the Business Analysis Body of Knowledge (BABOK)®.
I have heard that CBAP® applicants are rejected due to the IIBA® reducing their documented hours for tasks or deliverables that do not qualify as business analysis work. Such reduction of hours left them short of the 7,500 hour requirement. Some applicants are unaware of the new 900 hour requirement in four of the six knowledge hours, again leaving them short of the requirement.
First of all I believe that the application process itself is more rigorous than the exam. It is part of the whole process of obtaining the certification. The IIBA® , by putting all applicants through a rigorous review process, protects the value of the certification. A couple of tips I can give you in applying for the CBAP® certification:
- Document more than the minimum 7,500 hours of business analysis work. This ensures that if your hours are reduced in the review process that you will still have enough hours to qualify to sit for the exam. This goes for total hours as well as hours in each of the knowledge areas. I personally documented 9,000 hours on my application.
- Put the language on your application in the wording of the BABOK®. By putting your work tasks and deliverables in the language of the profession it is less likely that the hours will be discounted in review.
My client in Cincinnati is having issues with one of their Java based web applications. The application is throwing an out of memory error. One of the vendor's application development personnel traced it back to a local byte array object. He said "it can’t be the problem because it is created in a method. I don't have to null the object because it is garbage collected". In Java, you are taught that any variables created in a method call persist only for the life of that method call. When the method has completed, all objects are out of scope, so they are to be garbage collected. Java uses implicit object creation and destruction, so the application developer can focus on the problem. Like any rule though, there are exceptions. If your local variable is referencing an external object, and that reference is still live, your local object still persists in memory. Since the method has been garbage collected, the object will stay in memory and not be freed until you restart the server. The best example of this is creating a database connection object. If you don’t call the close method and null it, the object will persist until the JVM is shut down. This called a stale connection. Even though you may have created the connection in a method, the object doesn’t get collected. Look at the following code:
package test;
public class MemTest
{
private final int dataSize = (int) (Runtime.getRuntime().maxMemory() * 0.9);
public byte[] func()
{
byte[] data = new byte[dataSize];
System.out.println("func: byte array created in func");
System.out.println("func: Total Mem=" + Runtime.getRuntime().totalMemory()
+ " Free Mem=" + Runtime.getRuntime().freeMemory());
return data;
}
public static void test()
{
MemTest jmp = new MemTest();
System.out.println("Max Mem=" + Runtime.getRuntime().maxMemory()
+ " dataSize=" + jmp.dataSize);
System.out.println("Total Mem=" + Runtime.getRuntime().totalMemory()
+ " Free Mem=" + Runtime.getRuntime().freeMemory());
byte[] data1 = jmp.func();
System.out.println("byte array returned in jmp.func, size=" + data1.length);
System.out.println("Total Mem=" + Runtime.getRuntime().totalMemory()
+ " Free Mem=" + Runtime.getRuntime().freeMemory());
jmp = null; // this does not do anything as data1 still has a reference to the byte[] returned from jump.func()
// data1 = null; // if data1 is not set to null here to remove to the reference to the byte[], data2=jump2.func() will hit OutOfMemory exception
MemTest jmp2 = new MemTest();
byte[] data2 = jmp2.func();
System.out.println("byte array returned in jmp2.func, size=" + data2.length);
System.out.println("Total Mem=" + Runtime.getRuntime().totalMemory()
+ " Free Mem=" + Runtime.getRuntime().freeMemory());
}
public static void main(String[] args)
{
System.out.println("--test1--");
test();
System.out.println("--test2--");
test();
System.out.println("--test3--");
test();
System.out.println("--test4--");
test();
}
}
If you run this code, it will throw an out of memory exception. Uncomment the data1= null statement and run again. This application is the 1.4 JDK, and the newer JDKs are doing a better job at handling this situation. I also know that there are 2 things to remember in application development, don’t assume anything, and rules were meant to broken. I still have some testing to do, but I am sure my Cincinnati client will be happy.
This is the last of a three part series; part one is here and part two is here. Many application development guys are wondering, what is the Cloud, and what is the Sun Cloud? Think of Cloud computing as a virtualized data center. In part one I talked about VirtualBox, which allows you to virtualize network components and resources. Think of VirtualBox working on the atomic level, taking small resources to create a virtualized network. Now Cloud computing takes all of the virtualized networks and utilizes them as resources in a virtualized data center. The Sun Cloud is a set of APIs to let you manage networks and storage areas as resources. You can cluster or categorize networks in any way you wish. You can manage user access to the resources, not unlike application development teams utilize in web applications.
What does all this mean to application development and management? It means that you can create a single network and copy or clone it. For example, you can create a single network instance with servers, storage areas databases, and clone the entire network for each region you manage. That means all networks are managed in one spot, and all regions are setup exactly the same. No application compatibility issues. You can, of course, add or remove components, but they are all have the same infrastructure. You can upgrade the virtual network, and pass the changes to the other regions. The electricity saved by running virtualized datacenters would be significant. You can connect to your partners’ virtualized networks to access their data. For application development teams, that would change how we design applications if we have access to external data and applications.
This was my fifth JavaOne conference. Since it is always at the Moscone center, I know pretty much every nook and cranny of JavaOne. Although smaller this year, I thought this was the best one yet. The people there were truly happy to be there, and combined with takeover news and a bad global economy, a bigger sense of cooperation. I would highly recommend coming to one if they still have one. Nobody, not even James Gosling (I was in a group of 20 who had a 45 minute meeting with him) knows if there will be one next year. The reason you come to JavaOne is not the presentations (they are great!), but the people. Meeting and befriending people who created your favorite blog, book, or technology is the reason to come. I remember meeting Craig McClanahan (co-creator of struts) in 2004, and saying "that’s Craig freaking McClanahan!" Last year, I was honored a share a picture of beer with him, Jarda Tulach (inventor of NetBeans), and Geertjan Wielenga (JavaLobby blogger extraordinaire). Application development people get to "network" with the best and brightest architects, technical press, and business owners. This year I got hang with the JUG leaders, NetBeans Dream Teamers, and the JavaFX guys. I wrote, and helped edit a YouTube video "pushing Java", and met more of my fellow Java music software developers. I literally have friends from all over the world (yes Cincinnati too), and I am considered an honorary Brazilian because of JavaOne. Larry Ellison, if you are reading this, please don’t stop JavaOne!
Web application development is a must for Cincinnati and Dayton companies. We at STAR BASE, Inc. have written much lately about open source IT solutions. Since we have been on a roll with that, why stop now?
Another open source IT solution we have worked with is Sugar CRM. Sugar CRM falls in to a relatively new software category that I’m going to call Commercial Open Source or COS for short. (Remember you saw the TLA (three letter acronym) COS here first!) COS applications have a free version that you can download and implement and they also have a commercial version that can be licensed and supported like any other software application.
What we have found to be very effective; is to use the open source version and customize and tailor it to meet specific business needs. No need to re-invent the wheel. Swweeet!
Just when I thought the browser wars were pretty much a thing of the past, they are heating up again. Web application development is difficult enough without having to worry about what version of what browser a client may be using.
We just upgraded a couple of machines to IE 8 and guess what? IE 8 is not compatable with our web based CRM! IE 7 and FireFox 3 work fine, but in IE 8 the search fields are not input capable. IE 8 provides for a “compatablity mode”, but hey that doesn’t work either. I was wondering if Google Chrome would work, but in Chrome, the search fields don’t show up at all; the field labels are repeated.
I was thinking about trying Opera, but stopped because how many web browsers do I really need on my machine any way?
In order for web applications to continue to flourish and expand, there has got to be adherence to standards by both application developers and software companies. There are so many other applications that could be developed and expanded. But what do we do with IT solutions? Both vendors and developers shoot themselves in the foot by delivering applications and software that “stops working”.
What's the business impact?
- Increased support costs.
- Increased applications development and testing time
- Less confidence by the user community of “IT not being able to do anything right”.
- Less time and money to develop new applications.
As a reformed, application developer, maybe I should retitle this post “The Return of the Angry White Guy.” I think instead, I’m going outside and shouting, “I’m mad as hell and I’m not going to take it anymore”.
Business application development needs to accelerate faster. Some are still talking about getting IT solutions to the web. We should be talking about how to get IT business applications WAP enabled. As voice and data networks continue to converge, consumers are going to want new and different way to access IT solutions. Some have struggled with web application development and WAP is going to be a little trickier because the user interface is small and will probably need to be re-worked for the smaller display.
In part-one I shared that on this trip, the coverage on my new phone was very acceptable. In this post I will share some of the features I have used. One of my requirements was to have a handset that supported navigation. On the old phone I used Navigator that has a female voice, so I named her Suzy. My new phone has Nokia maps and has a male voice, so I will call him Coleman. Suzy has helped me many times and I have confidence in her, so it was up to Coleman to prove himself. While we were still in the mountains of Maryland, I programmed the final destination into both phones. It took a few minutes for the Nokia to find our location, but once it did, Coleman gave me turn by turn instructions, ETA and other things I expected. Even though I had cell coverage, Suzy was not able to connect at all until we were out of the mountains. I have had this problem before with Suzy before and it’s really quite annoying when you really need directions. The conference is at National Harbor which is been open less than a year. As we got close, I could see the Gaylord resort, but Coleman kept insisting we make a legal U turn. Nokia downloads map data to the phone and navigator send information through a data network. If there is no data network, no maps. The downside of the Nokia is it takes up phone memory. Right now I’m call this even. There are pros and cons to both.
My new phone is a smart phone, so there are two other options that I am aware of. Telenav is subscription service that is very similar to Navigator. I can also download a Google maps application as well.
Another requirement that I have is my contacts and calendar be synced to our server. The Nokia software does a great job at this. Another option that I need is to be able to tether the phone to my notebook for broadband internet connectivity. I have not been able to test this on my new phone yet.
One of the goals of the switch was to save some money. Because our new phones are smart phones, they need full data service and so I’m ending up at about the same cost. So the bottom line is we ended up with more capabilities for the same price. From what I see so far, integrating voice and data applications and having them work well together will be the next application development challenge.
I have written several posts that have talked about various IT strategies. More often than not, we practice what we preach. Star Base, Inc has been around for almost 18 years, so we would fall into what I would call a “mature company” category.
I have always been determined not to be the cobbler’s children with no shoes, so we have invested in systems over the years. Our CRM system was starting to show its age and even though business is down, I decided to invest in a new system. Our new system is actually more than a CRM; it’s a fully integrated HRM (Human Resource Management) and accounting system as well.
We are still learning about all the capabilities, but a couple that I think are really powerful are resume parsing and email capture. Part of our business is IT staffing and that requires us to track a lot of resumes. Our new system automatically parses IT skills out and creates a profile for the person. It also monitors our email; any message received from someone in our system is automatically logged for that contact.
Cincinnati and Dayton tend to be more conservative than other parts of the country. Because of this, a lot of companies tend to have older IT solutions. Could new web application development give you a competitive advantage that would allow you to leapfrog?
If you are long term Java application development person, you are probably familiar with Enterprise Java Bean (EJB) 2.0 . They have been notoriously difficult to use, so the popularity of Object relational mapping tools like hibernate became the standard use for enterprise application development. Sun had JDO, but it was little improvement. The key functionality of Hibernate was the use of Plain Old Java Objects (POJO) to handle the heavy lifting. The big issue with hibernate was that it was resource intensive, which left non-enterprise projects without this useful technology.
Sun worked with the ORM teams and the community to create Java Persistence Objects (JPA) to replace EJB, and to create single standard technology. The big advantage of JPA is application development teams can use it for both EE and SE projects. I have many database driven projects written in Swing. It is time consuming and boring to write boiler plate code to handle moving data to/from the database. JPA removes the plumbing part of my project, so I can focus on problem to solve. My IDE of choice is NetBeans, and has complete integration with JPA, so I can use tools to make my basic connections. Typically in Swing I would create a POJO that represents a row in the JTable. I would then create a custom table model object that uses an array list of row objects to populate the table. I wrote a method that reads from the database, creates rows objects, store the row objects in an array list, move the array list to model, and set the model to the table. With JPA and NetBeans I can bind the JTable to a database table, select which fields to display, and JPA entity classes are created for me. I just save 1 – 4 hours of design and implementation time! JPA uses annotations to specify the database, table and relationships (if connecting to multiple tables). I have a single object to do all of my connection, display, and CRUD functions. JPA uses Oracles toplink to help with the heavy lifting. For those of you application development guys who like to do it yourself, there are tutorials on the sun site.
The best part is that JPA is used in my JSF projects, so I use the same patterns for web application development and desktop application development. There is a learning curve, and Java 6 is needed, but it is well worth you time to learn JPA!
Time and IT solutions march forward. Most of you I’m sure have used or heard of the new generation of self-service web applications collectively known as WEB 2.0 apps. I have jumped in the water with both feet. Follow me on Twitter, Check me out on Facebook, Linked in or Plaxo. If all goes well this post should end up on all of them in some form courteous of Ping.fm.A good framework relies on well researched design patterns like Model-View-Controller (MVC) to make it easier to apply coding techniques like Don't Repeat Yourself (DRY). While this can appear to make applications more complex, in practice a modular application based on an MVC framework will help maintain consistency of the application. If there is only one piece of code that calculates item prices, then wherever those prices are needed, they will always be calculated the same way. This may seem totally intuitive, but you would be surprised the number of applications I have seen where the same task is coded separately in each place it is needed. In fact that is how the monolithic programming style worked. Each program contained all of its code, and it was, usually, easy to see where that program needed to be changed to fix the pricing rule. Unfortunately, it was much harder to find all the programs that the pricing rule needed to be changed in.
A good framework will contain an abstraction layer to shield you from the nuances of your specific database. When the time comes to change database engines you won't be stuck with a major rewrite. Yea, I know you have used the XXX database forever, and will never change. And in Cincinnati, pigs can fly! Acquisitions, mergers, changing business requirements, and other things can cause your simple IT Infrastructure to become complicated beyond your ability to effectively manage it. Consolidation frequently involves choosing a database and porting everything else over to it.
A good framework has a thriving developer community behind it. This makes it easier to retain application developers, get training, and get questions answered. This also means that security threats are quickly addressed to keep your data safe in the brave world of the internet.
As a good IT strategy, choosing and using the right framework can boost the productivity of you application development staff, and make your applications more consistent and more secure.
According to an international survey of senior business executives by global
consultancy, McKinney Rogers, business leaders believe that putting their faith in developing the skills and abilities of their workforce is the best way to reduce an organization’s exposure to the risk of recession.
With recent media attention focusing on the impact of sub-prime lending and the current global economic downturn turning into a full-blown recession, the survey, which encompassed Europe, Africa, Asia Pacific, and the US, was designed to gauge awareness, perceptions and trends on the issue and what can be done to minimize the risk of a recession’s impact on global business.
I would suggest that the same holds true for independent developers as well. If you want to ensure employability you need to be a life long learner with multiple skill-sets to assure yourself that you always have skills to offer regardless of the development platform.
I am a person who makes his living assisting firms to reach their technological and operational goals while the discover the real value of IT. One of the challenges that I face is trying to place the right IT talent into these organizations. As you read this blog you do not need me to tell you that the job market is extremely tight and companies are being very selective in who they hire and who they do not hire.
Not too long ago, application developers and technology consulting firms could concentrate on a given skill-set or set of tools and find plenty of opportunities to meet their offerings. That appears not to be the case any longer. Organizations of all sizes have multiple needs and they have learned that this world waits for no one. That means they must continually re-access technology, work processes and skill-sets to meet the demands of their marketplace.
These are the reasons why any Internet application developer or web application developer must learn multiple skill-sets to make sure they continually improve their value in the marketplace. It is no longer enough to have just RPG skills. Clients are looking for individuals that know RPG, J.D. Edwards and possibly some Java skills. For web develops we are finding that knowing Dreamweaver, Photoshop and ColdFusion are not enough. Depending on the firm that we are recruiting for they also want the people they hire to know PHP, MSQl, AJAX, .Net, Java and Javascript.
Want to make sure you’re always employable during these trying economic times? Increase your skill-set and make yourself more valuable to those organizations that are hiring.
1. Network security technology is not keeping pace with new types of attacks
2. Some security measures interfere with other security measures effectiveness
3. Businesses concentrate on securing traffic coming in through their firewall but put little effort in securing their employee’s traffic, both in and out.
Hackers are working daily to find new ways of hacking into networks and websites and the technology to prevent them from getting in is not keeping pace. They take tools, such as network scanners and snoopers, which Network Security Specialists use to secure their network and scan remote servers for vulnerabilities or ports that should not be open. Once found, they exploit those points of vulnerability. Using tools like eVade O’ Matic Module (VOMM), they create thousands of variants of a virus or malware, requiring an equal number of Anti-virus or IPS signatures for your scanning software to pick them up. They use obfuscating tools to break up the communication packets to help prevent detection of the malware contained within. These are the kinds of tools and methods that are being used to render your IT infrastructure vulnerable.
Many companies use SSL technology, especially those that have ecommerce websites. This is great for traffic as it passes over the internet. SSL encrypts the packets so that they can not be picked off the internet and read. However, the encryption occurs at the origination of the communication and decryption occurs at the destination, after it passes through the firewall. So the firewall reads what part of the communication it can read and sees it is destined for your website, has a rule that allows that and passes it through. It is unable to decrypt the encrypted part of the packet, which may contain a virus or malware.
Companies focus their efforts on traffic to and from their website, but don’t put a lot of effort in securing their employees as they surf the web, for business purposes of course. Google reports that on any given day 1 in 10 websites is infected with malware. Today’s attacks are aimed at getting you to an infected website where the malware is hidden on the webpage and downloads to your computer as soon as you hit the website. Even once trusted websites, such as Wikipedia and Expedia, have encountered recent attacks. Blogs have become popular in recent years and are usually considered to be from an expert authority on the subject. But anyone can post a comment to the blog and encourage the readers to go to a URL. When the reader clicks on the URL link they become unknowingly infected.
So what is the answer?
Technology solutions to be effective against the multitude of the types of attacks that are out there today and tomorrow have to have a layered approach. Stop the attacks at different points, so that if an attack gets past the first security point, it is stopped by the second or third.
Proxy server
Proxy servers remove the hacker’s view of your servers and applications. Cost constraints keep a lot of companies from deploying proxy servers, but they more than pay for themselves by allowing your IT Infrastructure Management staff to concentrate on other issues besides security breaches. 80% of Internet attacks are aimed at a specific application, Oracle, MS-SQL or VoIP. Remove the hacker’s ability to see what is running on your servers and they will be less effective in their attack.
Positive Secure Model
This model states that everything is bad except what is explicitly stated as good. So rules are put into place for every piece of allowed internet traffic, everything else is disallowed. This requires in-depth knowledge of your employees and applications. This model is very effective in stopping the “zero-hour” attacks. These are very newly created attacks that have been in existence for zero hours.
Deep inspection firewalls
New firewall applications are coming out and will be readily available soon that have the ability to decrypt the SSL packet and inspect it for unwanted traffic. This gives them the visibility to fully enforce their policy rules on the entire communication packet.
Reputation and Geo-Location policies
Just as every individual and business has a credit rating that indicates to a company or lending institution whether they should do business with this individual or business, serves are coming out that gives a reputation score to websites. Appliances are put into place to retrieve the reputation score of the website being visited or attempting to get into your website and it is determined whether it will be allowed, or if certain functions, ActiveX, exe or pdf file downloads, JavaScript shall be disallowed.
McAfee reports that Hong Kong, China and Russia are the most dangerous countries for internet traffic. If you’re a local or regional American business that has no interaction with these countries, why would you have internet traffic from these countries.
Conclusion
Even though security technology is not keeping pace with the number and changing types of threats being developed out there, there are several technologies being developed to render these attacks less effective. The best approach to securing your network is to put into place as many of these technologies as possible, but in all cases more than one model is needed to make your IT infrastructure secure.
Powered by Compendium Blogware