IT Infrastructure Management

What makes a good BA?

Friday, February 26, 2010 by Aaron Whittenberger

I have spent a lot of time talking about the duties of the Business Analyst (BA); now let’s talk about the characteristics that make up a good BA. I find it interesting that Kupe wrote on this very subject this week, I guess great minds do think alike. As Kupe notes, the IIBA call these underlying competencies and define these as “the skills, knowledge and personal characteristics that support the effective performance of business analysis”.

The BA performs an important role in the application development process and is tasked with the duty of ensuring that the IT business solution meets the needs of the business. The BA develops and maintains the business and functional requirements that the IT business solution must contain in order to be deemed successful.

So we know the role and duties of the BA during a business application development project, so what “skills, knowledge and personal characteristics” does a person need to have to perform these duties. As the duties of the BA entail eliciting requirements from stakeholders and working with an application development team, you can imagine that communication is at the heart of the competencies of a BA. Good written and oral communication is necessary in order to be able to perform these duties. Good communication is not only departing information, but taking in information, or listening. This is often the skill that is over looked when we talk about skills or create a competency model.

Notice that when discussing competencies, that we not only are talking about “skills”, like Decision Making, Creative Thinking, Learning and Problem Solving; but we are also considering “knowledge” and “personal characteristics”. As the BA has to work with both the business and information technology staff, they need knowledge of the organization, industry and technology. What kind of personal characteristics would you want in a person that serves such an important role? I am sure ethics and trustworthiness would make the top that list.

So if you’re a BA looking to advance your career, there are some competencies to work on. If you’re an organization or manager looking to hire a BA, look not only at their skills and past performance, but develop some probing questions that will give you a look into their “underlying competencies”.

Where Does the BA Fit into My Small Organization?

Monday, February 22, 2010 by Aaron Whittenberger

In my previous two-part posts I discussed where the BA fits into the organizational structure. Even Jeff Welsh notes how application software development has changed over the years and requires a team approach for successful implementation of IT business solutions.

But you are sitting there saying we are a small to medium size business (SMB), my entire IT staff is 10 or less, I do not have a Business Process Orgranization (BPO) or Project Management Office (PMO); where should the BA fit into my organization?

SMBs need to utilize the BA role within their project delivery methodology. If the role is not being fulfilled then there is higher risk of failure of the project in that it does not meet the needs of the business. I have worked on many small-to-medium IT staffs and can attest to the fact that when resources are few that people wear many hats. There were projects where I served as the project manager, business analyst, developer and trainer. On smaller staffs, where only one or two of the people will be doing the duties of the BA, it is even more important to make sure that those people are easily accessible by the business units that they support. Have them sit in the vicinity of those business units instead of in the IT Department. I still feel that the BA is an IT function and should report to IT management as opposed to business management, but making the BA readily available and accessible to the business adds value to their role and gains buy-in from the business people to assist the BA with their duties.

So when making the organizational chart keep the BA in the IT Department; but when divvying up office space, make room for the BA near the business unit(s) that they are to support.

Testquerade Part Two.

Monday, February 22, 2010 by Jeff Welsh

In Part one, I introduced the idea of Test Data Management or TDM. TDM is not something unique to IT Applications in Cincinnati, Dayton or to Ohio. It’s something that will need to be addressed nationwide. With more and more government regulations and data privacy concerns, it will be more and more important to not only manage production data, but also test data used for quality assurance as well.

One of the aspects of good TDM is for the obfuscation (sometimes referred to as de-identification or masking) of data values from a production database in order to make the test instances “safe”. One of the challenges is preserving data distributions and referential integrity–even across distributed database systems. This is particularly important in the healthcare and financial industries where PHI (Personal Health Information), social security numbers or banking information could get exposed.

Another aspect is the challenge of maintaining security around the test databases themselves. Many companies have tight security around production data, but next to none around test and developer data. Often this data is just a copy of production data that is not masked in any way. According to a Ponemon Institute study, data breach incidents cost U.S. companies $202 per compromised customer record in 2008, that is compared to $197 in 2007. With the cases studied a range of 4,200 to 113,000 records that were affected.

Do any of you reading this have a little twinge in your stomach? Can’t anything be easy anymore? Maybe some RX is in order. That was EASY!!!!

Where Does the BA Fit into Your Organization? Part two

Friday, February 19, 2010 by Aaron Whittenberger

In my last post, I joined the discussion of “where does the BA fit into the organization?” I concentrated on the first line BA that should develop the enterprise architecture and help cultivate the business requirements for business process improvements. This BA would be part of a combined Business and IT staffed Business Process Organization (BPO). The purpose of the BPO is to analyze business issues and make the business case as to which IT business solutions projects should be undertaken.

Once a project is approved by the governance body it is turned over to the Project Management Office (PMO) to guide the project to completion. The PMO will be staffed with project managers (PMs) and business analysts (BAs) that will guide the project the rest of the way through the project life cycle. You may be asking why you would need BAs as part of the PMO, or project leadership team; after all the PM is responsible to see the project is completed on-time, on-budget and on-schedule. Yes, but the BA would be responsible to see that the project is completed and the IT business solution meets the business requirements. A business application development project will need functional and technical specifications that the BA should help develop.

The third role of the BA, I alluded to in my first post on this subject, is that of the Test or Quality Assurance Analyst. One role of the BA is to support the system, quality assurance and/or user acceptance testing phase of the project life cycle.

So the answer to the question ‘where does the BA fit …?” is in many positions within the organization. It depends on which BA role you wish to discuss, and whether the organization is large enough to have a BPO and/or PMO.

Any thoughts on the subject?

Testquerade Part One.

Thursday, February 18, 2010 by Jeff Welsh

I had lunch today with one of our Cincinnati customers and he made the comment that his company had eliminated a lot of costs via their IT applications. He also said there was no more low hanging fruit in their IT applications. Everything is integrated and there are no easy changes. I laughed and said there is nothing easy any more; even my easy button quit talking!

In today’s world some IT applications have grown quite complex. It was not that long ago an application developer that knew business could do the business analysis, the technical design, program the application, test and implement it.
Enterprise IT applications today require a team of dedicated professional working together and a good process methodology. Many members of the team are specialized in a particular skill or a part in the development process.

One of the things that is sometimes overlooked or gets glossed over is testing and quality assurance. I have even heard developers say “why should I test, that’s what we have users for”. Because systems have become so integrated and complex, quality assurance is not something to be taken lightly. As a matter of fact, it is quickly becoming a specialty in and of its self. There are many aspects to quality assurance, but one that I think we will be seeing a lot more of in the coming months and years is the notion of Test Data Management. To be continued……….

Where Does the BA Fit into Your Organization?

Monday, February 15, 2010 by Aaron Whittenberger

I attended the CIO Speaker series sponsored by the Cincinnati Chapter of the IIBA^®. The January meeting showcased the CIO and Deputy CIO of FirstGroup America. It was not part of their presentation, but a question was asked of them “should the BA report to IT or to the Business?” This alludes to the bigger question “where does the BA fit into the organization?”

This is the question that many organizations are still trying to answer today. Many organizations are just realizing the benefits of the BA role. One thing to realize, is those of us in the BA arena today are in the forefront of an infantile and growing profession. The International Institute of Business Analysis (IIBA)^®, the professions governing body, was formed in 2004; incorporated in 2006. There are 827 certified professionals (CBAP)^® in the world. Compared to the Project Management Institute (PMI)^®, which was incorporated in 1969, offer five certification programs and has nearly 300,000 certified professionals. You may say that your company has had BAs for the last 5 or 10 years. Then I say your company is one of the forward-thinking organizations that has recognized the benefits that the BA role provides in developing IT business solutions.

Now I believe this discussion will go on for years; but as this is my blog, here I get to put my two cents in. First, let’s define the role of the BA in which we discuss. Many organizations have a quality assurance team, department or processes within the IT application development team. As these people support system or user acceptance testing procedures, these people are Business Analyst. For this discussion, I refer to the Business Analyst that works on the front end of the project life cycle. Who develops the Enterprise Architecture, gathers business requirements for business process improvements and makes the business case for IT business solutions projects to make those improvements.

As the role of the BA is to develop requirements and make the business case for IT application development projects, this is an IT function; therefore the BA is an IT position and should report to the IT management as opposed to the Business management. Although the duties that the BA performs may put him/her in front of external customers of the company, their goal is not to perform the business of the company but to recommend IT business solution projects to improve business processes within organization; this is an IT function.

If your organization is large enough to use terms such as Business Process Organization (BPO) and Project Management Office (PMO); then you should find the BA at the heart of the BPO. The purpose of the BPO is to analyze and recommend improvements to business processes. So now you say that in most organizations the BPO is a business team; I would reply that it should be a combination business and IT team. The improvement to business processes may require a business solution, such as upgrade or replace business machinery or training; or an IT solution, such as application enhancement, system training or system upgrade. Therefore, the BPO should be made up of business positions and IT positions working together to determine the best solution to business issues.

One thing that I would change in many organizations is that I believe the BA should sit more in the vicinity of the business unit(s) that they support as opposed to sit in the IT Department. BAs will be much more effective when they fully understand the business processes in place, issues that business workers face and the daily going-ons within the business unit(s). Also, easy approachability to the BA for the business gains buy-in to the duties and recommendations of the BA.

So there is my opinion on the subject, what is yours?

How to Get the Financing You Need

Monday, February 8, 2010 by Aaron Whittenberger

Any good Business Analyst will tell you that IT and business speak in different languages. Good CIOs and IT Infrastructure Management know that CFOs have a language all their own. “That being said, it is the money people who generally stand in the way of engineers and technologists and the spending required to accomplish great things with IT.”, according to an CTOEdge article. CIOs generally don’t speak in the language of the CFO when making spending requests, so we walk away feeling that they “just don’t get it”. Here are 10 areas where we, as the promoters of IT, can begin to communicate better with the CFO.

1. Think TCO, not ROI

To the CFO, return on investment is how much money you’re going to give back to the company. Let’s face it. Most IT projects — no matter how compelling — don’t bring “return” to the organization like an additional sales person, a new marketing campaign, or a new product launch. Preach total cost of ownership (TCO); repeat it until you are blue in the face. Whether business application development, web application development, IT infrastructure investment; you can demonstrate “fiscal stewardship” through cost reduction or increasing customer satisfaction and loyalty.

2. Cloud Computing

CFOs like what they hear about cloud computing as a cost saver. Don’t fight them on it.

3. Green IT

Are you surprised when the CFO is not willing to pay a premium to keep the environment cleaner? The reality is that no green projects exist unless they have a better TCO. So whether to upgrade your IT infrastructure, better IT infrastructure cooling, or saving space for your IT infrastructure you can build a strong business case of the decreased TCO and community relations intangibles of being an “environmentally conscious” firm.

4, 5 and 6. Virtualize, Virtualize and VIRTUALIZE

“This subject takes up three spots because there are three key virtualization targets -- servers, desktop and storage. But again, the key here is how to justify and how now NOT to justify.” Again build your TCO case for virtualization, but be realistic in your cost savings estimates. Many times virtualization projects are viewed as unsuccessful because they did not meet the upfront cost estimates. Be sure to include high traffic times such as end-of-month close periods.

7. Adopt IT-Centric Business Continuity

Over the years responsibility for business continuity have been put on IT management. This needs to change. Organizations need to understand that there are three phases to a business continuity plan; event response, disaster recovery and business continuity. With the financial impact on the organization of disaster recovery and business continuity, business management must be involved and responsible for these areas. It should not be IT management’s responsibility to determine which business units are most important.

8. Align with the Big Picture

Along with TCO, build your requests showing how the request aligns with the business objectives and goals of the organization.

9. Proactive Cost Reduction

Boy does that sound like another way to say TCO to you? Take a proactive stance on reducing cost. The article showed how to reduce cost of document retention.

10. Reduce Data Center Costs

The organization’s data center is usually the center of the IT infrastructure, both in physical space and cost. Just as in application software development, modular building of a data center can cut cost of the IT infrastructure through avoiding construction cost, reduced cooling cost and reduced capital expenditures.

“While the relationship between CFO and CIO can sometimes have more debits than credits, it is definitely worth the investment in time and effort to highlight IT projects in terms the CFO will understand.”

JavaFX + JPA = Awesome

Friday, January 29, 2010 by Matt Warman

Yes, this is another of my continuing series of JavaFX posts. I hope you are enjoying the posts, and hopefully you will take a look at JavaFX, because it's really going to be a great platform. One of the key complaints from some application development folks is “yea it does cool animations, but where's the non-trivial uses?”. True there has been a lot of “toy” applications, some touted as “Enterprise”, but I want to give you a key usage for your business application development.
First off a brief primer on JPA, or Java Persistent API. The technology grew out of the complexity and (loathing) of the EJB 2.0 spec. Hibernate came up with way to use POJOs to persist data. The brains behind JPA were the driving force behind JPA. Now is the time to learn JPA, because it's a big part of the EE 6 spec.
Some notices here first; I am using NetBeans as my IDE. You should be able to use the general theme with Eclipse though. JavaFX can use Java classes in the script. The key part for me was how to integrate them. The easiest thing to is create a new Desktop application project (New Project → Java → Desktop Application). Pick the database application, so the JPA wizard displays. Select your table, and the wizard creates the JPA controller, and all of the Entity classes for you. Run the Build project, and now you have a JAR file. If you don't have NetBeans, or want to do this by hand, create the Controller and Entity classes and put them in a JAR file. Add the JAR file to your JavaFX project path, and your ready to go! The following Code can be put in your script to access:

 var db =  new YourTableJPAController(); //Creates a new instance of your controller 
 var list = db.findYouTableEntities();  // find all of the entities of your table.

To display all of the values, you can run a for loop like this:

 Vbox {  for(y in new YourTableJpaController().findWineEntities()) 
     Text {  	    content: y.getField() }	
 }

The code above iterates through the List object created by findYourTableEntites, and puts it in a Vertical Box (Vbox). Each item in the Box is a Text object whose display value is one of your fields from your table.

You can now dynamically populate your fields from a database, but more importantly, you are using JPA to handle all of the heavy lifting. Notice I didn't mention anything JDBC. I let JPA do all of the communicating with the database. This is a layer abstraction that let's be an application development guy, not a DBA or Network Admin (not that there's anything wrong with that). If you are using an application server that handles JPA like Glassfish, then you can make your JavaFX application available on the browser and desktop. Now you can have that awesome looking application that actually does something. You are happy to start doing something cool, and your boss is happy because it does something he wants.

Technology at the forefront in Haiti

Friday, January 22, 2010 by Aaron Whittenberger

As you watch the enormous humanitarian relief effort going on in Haiti on the evening news this week, following the devastating 7.0 earthquake that hit that country on January 12th, you can probably imagine the technology and IT infrastructure that the U.S. Department of Defense and other agencies has put into place to assist in that relief effort. Read more about it here. The Haiti government turned over the operation of the one runway airport at Port-au-Prince, the nation’s capital, to the U.S. military. An acknowledgement of the U.S. military’s prowess in logistics and technology. For a few days as the relief effort ramped up news reports of delays at the airport were heard, but as that relief effort got organized those reports of delays ceased even with the amount of aide and volunteers flowing into the country were increasing.

What is not reported on the evening news is how an army of geek volunteers from the private sector is supporting that relief effort. Leading the way are organizations like CrisisCommons, Ushaahidi, the International Community of Crisis Mappers and InSTEDD, according to an InformationWeek artical. Application software development gets into the mix, undertaking such tasks as developing ways to help locate U.S. citizens and provide information online about Haiti and how to donate money, developing a timeline of events and a wiki of information online, a GPS-compatible street map of Haiti, an English to Creole dictionary for IPhones and Android mobile devices, and a system to use Twitter messages to ask for or offer assistance to those in need. "We've been working a lot at Sunlight Labs to get application software developers to organize and work together in volunteer communities. Developers may not be competent with a saw, but are starting to realize they have a skill they can contribute," says Clay Johnston, director of Sunlight Labs. "The tools are available, and methodologies like agile project management have been popularized that can facilitate this."

In light of the reports of the failings of the coordination of relief efforts following Hurricane Katrina and the reports of the relief effort in Haiti, it is clear that it is IT solutions that have been put into place to better support humanitarian relief efforts worldwide and that technological advances has clearly moved into the 21st century in support of those efforts.

ROI, Do we have to?

Tuesday, January 19, 2010 by Jeff Welsh

Happy New Year!!! Welcome to a new year, new decade and a new beginning.

As the recession recedes and recovery takes hold, IT executives are looking at their project lists and trying to decide what their priorities are. Should we do application development in house or bring in an IT consulting company? Should we consider an open source application? What is the ROI? What’s a company to do? It doesn’t matter if your company is in Cincinnati, Dayton or Katmandu, the questions are the same.

Last month we did a pulse survey to see how IT leaders are managing ROI measurement. The results were surprising and sparked a lot of conversation here at STAR BASE, Inc. The thing that surprised us the most was the number of companies that did NOT look at ROI before doing a project. Most of our respondents (58%) do not.

Some of conversations we have had revolved around the idea of doing a project or installing an application just to stay in the game. Could you imagine a company of any size today functioning without email? I could argue that there is negative ROI with amount of time managing my email in box takes!

For those that measure ROI, only about half see the actual ROI align with the projected ROI most of the time. The other half report that they see the actual ROI align with the projected ROI less than half the time and most said seldom or never. I have often said that if management knew how much it was really going to cost to install that new ERP system before they started, they probably wouldn’t.

Since most of our respondents don’t look at ROI and of those that did, half said the ROI did not align, my question is this: How do you decide what projects to do? Are most companies spending money on IT because they need to “keep up with the Jones’ “? Is it because installing that new ERP will look good on everyone’s resume?

Get your copy of our ROI Survey results by going here.

Open-source Security A Major Concern for 2010

Friday, January 15, 2010 by Aaron Whittenberger

According to ComputerWorld, web application development remains top dog by far in the top IT skills to have in 2010. Specifically, companies will look for developers with knowledge of .Net, Java, Web development, open source and portal technologies. The article goes on to suggest that combining web application development skills with business analysis or project management skills is a big plus. ComputerWorld lists the remaining skills to have for 2010 in its top six as: Help Desk/Technical Support, Networking, Project Management, Security and Business Intelligence.

I feel ComputerWorld did not put enough emphasis on Security; this without doubt will be the biggest challenge for IT executives in the coming years. Open-source software may be an innovative money saver, but IT professionals still have concerns that networks could be vulnerable to viruses, cyberattacks and other intrusions.

According to InfoWorld, a new survey from Forrester Research found that 58 percent of large companies have security concerns about open source. In addition, 57 percent of small and mid-sized businesses expressed concern that open-source software would be "complex and hard to adopt".

With the advent and increasing usage of open-source in the business world, expect to see demand for IT security related skills to grow. According to the FLOSS 2020 roadmap presented at the Open World Forum in Paris, 40 percent of jobs will be related in some way to open source by 2020. You can expect application development and security to comprise a great majority of these jobs.

Riding the Wave

Thursday, December 10, 2009 by Matt Warman

When I went to JavaOne this year, I had some friends who went to the Google I/O conference a few days before. Besides getting a new G2 phone (lucky), they were raving about Google Wave. Google recently released Wave into beta, and I have had a chance to play with it.
For those who do not know, Google Wave is a new type of communication software that allows real time collaboration. I know, it sounds all buzzwordy, but it is real cool. Think of Wave as email, SMS, and a working SharePoint all in one. To start a Wave you select new and a text area displays. Select from your contacts to add people, write some text and press send. Sounds like email right? Well, what if after some correspondence, you need to bring other people into the loop? And those late comers are now asking new questions? I don't know about you, but I get confused trying to read emails with lot's of history, and getting new emails based off of some of that history. Google Wave fixes this because everyone is updating a single thread in real time. If you are added late, there is a play button to show the order of the messages. Since it is in real time, all response are shown when entered. You could follow a meeting while listening to a conference call, and ask questions during the meeting, instead of having a second meeting to discuss the first meeting.
Collaboration is the key aspect of Wave. I am using Wave to let some people in Brazil help me test my JavaFX application. As a Cincinnati based application development person, this already saves me time and money. I added a zip file, and instructions on how to use it. I can get their feedback, and update the zip file. I think all application development people can see how useful this is. I can update my code to my users, and have a history of feedback. This will work well for those “confused” management types who “forgot” their feedback.

Google Wave is also a development platform. You can create your own widgets to run on Google Wave. The widgets provided by Google are a poll widget, collaborative Sudoku, and emoticons. I have used the poll widget, and works nicely. If you have a yes/no/maybe question to ask, it really is useful. I have an idea of using TTS to create “talking” Waves.

The one thing I would like to point out is that you will be able to run the Google Wave engine on your boxes. That means you can have a “private” Wave and a “public” Wave. You can set access restrictions on Wave, so you can have control of who uses Wave. Now that it is in beta, look for an invite and get riding!

Is IT Qualified To Satisfy The Business?

Monday, November 9, 2009 by Aaron Whittenberger

“IT executives increasingly implement marketing initiatives to improve the communications with their business customers. But these efforts often focus solely on the brand aspects of the services under the IT’s control without understanding the business’ perception of IT. To maximize the success, IT must add business satisfaction assessments to its tool kit. Understanding business satisfaction requires qualitative and quantitative data that capture customer expectations and perceptions through different types of interactions such as interviews, panels, focus groups, complaint systems, and surveys. This report provides best-practice recommendations, survey templates, and questions to guide IT executives through the deployment of a business satisfaction assessment. It applies Forrester’s deep expertise in external customer satisfaction to the interface between business customers and their internal IT suppliers.” says a new Forrester report.

I have served on countless business application development teams within several organizations in the Southwest Ohio and Cincinnati Information Technology community, one thing I can say is that most IT organizations do not gauge business satisfaction with IT business solutions. I have served in only a couple of organizations where the business serves on the IT governance committee. An organization does not have to be “big” to have an IT governance committee. No matter what the size of the organization decisions are made as to priorities in IT work. IT governance does not have to be a long drawn out process or take great time commitment from the business or IT executives, but business involvement in IT governance goes a long way in gaining business buy-in as you roll out the IT business solutions to the business.

Involvement in IT governance is just one way that many organizations in the Greater Cincinnati area can improve the IT-business relationship. The Forrester report goes into ways to solicit and gauge business satisfaction with IT business solutions. Doing so should affect decisions concerning not only IT business solution delivery but also IT Infrastructure and IT outsourcing initiatives.

Kenai Me!

Friday, September 11, 2009 by Matt Warman

I have not one, but two JavaFX Kenai projects found here and here. First, I have to say Kenai is very useful. It is integrated into NetBeans (my IDE of choice), which means that all I have to do is create a new a project and call the “share it on Kenai” link. The process allows you to change the name of your project, and set the licensing (CDDL, GPL etc). Kenai itself is pretty cool too. It’s not your father’s forge. First off, anytime anyone commits a change a message gets sent out. That may not be earth shattering to you, but if there is more than one person in the code that is huge. I don’t have to guess who changed what. Since my email is tied to my phone, I find out almost immediately! You can do things other places offer like a forum, and mailing list, but the clean execution is nice. It is easy to find on the main page, and any responses in the forum go to my phone! The social networking aspect is something that I want to use. I live in Cincinnati, but I have friends all over the world. If someone helps me out on a project, I can chat with them through Kenai. The price is the best part my application development friends, free. When you sign up to Kenai, you get five free projects slots. I don’t know what happens after five though. I encourage all application development people to put their passion projects on Kenai.

Take a Team Approach to IT attacks

Tuesday, September 8, 2009 by Aaron Whittenberger

You more than likely already know you need the best security possible to prevent an attack. You also need IT infrastructure and IT staffing in place to respond to an attack if one happens.

Incidence response should be one of the most important items on your IT security agenda. Your company must be prepared to respond to an incident once it occurs and quite possibly to stop the next one.

As of late, disgruntled employees violate internal policies or misuse system access for their own monetary gain or for revenge on employers due to mergers, outsourcing of business or IT jobs or employee lay offs. Internal threats are as real as external threats.

IT experts say that security professionals with the right skills can help lower the number of and potential for incidents at any organization with their responses.

An article in this week's GovInfoSecurity.com outlines the experts you will need:

Network security specialist: A person familiar with intrusion detection systems.
Penetration testers: Someone who can assess a system's potential vulnerabilities.
Incident handlers: People who understand attack methodology and can apply critical thinking skills to respond to incidents.
Forensics Analyst: The person who looks for evidence after an attack.
Research Analyst: The person to keep abreast technological advances in incident response activities.
Team Leader: Leads the team through crises and communicates to the business incident activities and cost to the business.

The article also outlines a typical methodology the team should follow to respond to all types of attacks:

Preparation and Training: for both prevention and incident response.
Identification: fast identification of an occurring attack and its impact on the IT infrastructure can help in minimizing the duration and cost of clean-up.
Containment: Once an attack has been identified, steps must be taken to minimize the effects of the attack.
Recovery and Analysis: The recovery period allows analysis and lessons learned of What happened? Why did it happened? Was the response effective?

Is your IT infrastructure safe from internal and external attacks? The proper IT infrastructure safeguards and IT staffing with proper security skills can help ensure your organization's security.

Teaching Old Dogs New Tricks

Wednesday, September 2, 2009 by Mark Murphy

Sometimes the solution to a problem is staring you right in the face. Sometimes you already know the answer but can't see it because the pieces are labeled in a way that is outside the scope of the solution. Sometimes you can just use an old tool to provide a piece of functionality you thought you needed to code a home grown solution for. Recently, such a time occurred for me.

I was in a meeting discussing the logistics of transferring multiple gigs of text data across the internet. The source computer was an iSeries, the target was something else. Much of the discussion centered on network latency and the time it was going to take to transfer that much data, and how processes were going to have to be pushed back a day because the window was too short. Well I said why don't we just zip up the file and send it that way. Data files tend to be highly compressible, up to 90%. "Can you do that on an iSeries." That was the infrastructure guy. Why not, I can run Java on it. I shouldn't be too hard to find something, even if I have to write a simple Java program. "Don't do anything we won't be able to understand." That was one of the RPG programmers. IMHO, the legacy tag belongs with those who use the technology, and the technologies they choose to use rather than with the hardware and operating system. For me it was a challenge.

A day later I had a working command using a tool that is bundled with every Java Development Kit. I knew this, but it took a slight memory jog from a college to remind me. A JAR file is a ZIP file with a different extension. IBM explicitly provides a tool to convert a database file to a CSV file, or a flat text file, but to compress that file into a ZIP file you need to use the JAR utility and give the file a .ZIP extension. Works like a champ. IBM even provides an alternate JAR utility that acts more like a command line compression utility to create zip files, but instead of calling it zip, or izip or something like that they call it ajar.

Well, a short CL later and I have a full featured program that takes a database file name, a zip file name and path (in the integrated file system or IFS), and a format selector (*DLM or *FIXED). It probably would have made more sense to name that format *CSV instead of *DLM, but IBM's conversion utility calls it *DLM. The output is a zip file with the name and path as specified in the input parameters.

And Here it is:

             PGM        PARM(&DBF &ZIPFILE &FORMAT)


             DCL        VAR(&DBF) TYPE(*CHAR) LEN(32)
             DCL        VAR(&ZIPFILE) TYPE(*CHAR) LEN(255)
             DCL        VAR(&FORMAT) TYPE(*CHAR) LEN(6)
             DCL        VAR(&FILE) TYPE(*CHAR) LEN(10)
             DCL        VAR(&LIB) TYPE(*CHAR) LEN(10)
             DCL        VAR(&MBR) TYPE(*CHAR) LEN(10)
             DCL        VAR(&CMD) TYPE(*CHAR) LEN(255)
             DCL        VAR(&TEXTFILE) TYPE(*CHAR) LEN(15)
             DCL        VAR(&TEMPFILE) TYPE(*CHAR) LEN(40)
             DCL        VAR(&ERRLOOP) TYPE(*CHAR) LEN(1) VALUE(N)
             DCL        VAR(&INTER) TYPE(*CHAR) LEN(1)

             MONMSG     MSGID(CPF0000 QSH0000) EXEC(GOTO CMDLBL(ERROR))

             RTVJOBA    TYPE(&INTER)

             CHGVAR     VAR(&FILE) VALUE(%SST(&DBF 3 10))
             CHGVAR     VAR(&LIB) VALUE(%SST(&DBF 13 10))
             CHGVAR     VAR(&MBR) VALUE(%SST(&DBF 23 10))

             /* Ensure ZIP directory exists for error logging */
             MKDIR      DIR('/zip')
             MONMSG     MSGID(CPFA0A0)

             /* Delete &zipfile if it exists */
             RMVLNK     OBJLNK(&ZIPFILE)
             MONMSG     MSGID(CPFA0A9)

             /* build text file name */
             IF         COND(&FORMAT *EQ *DLM) THEN(DO)
                CHGVAR     VAR(&TEXTFILE) VALUE(&FILE *TCAT '.csv')
             ENDDO
             ELSE       CMD(DO)
                CHGVAR     VAR(&TEXTFILE) VALUE(&FILE *TCAT '.txt')
             ENDDO

             /* generate temporary file name */
             RTVTMPIFSN NAME(&TEMPFILE)
             IF         COND(&TEMPFILE *EQ ' ') THEN(CHGVAR VAR(&TEMPFILE) +
                          VALUE('/tmp/$$__tempfile'))

             /* export DBF to temporary file */
             CPYTOIMPF  FROMFILE(&LIB/&FILE &MBR) TOSTMF(&TEMPFILE) +
                          MBROPT(*REPLACE) STMFCODPAG(*STDASCII) +
                          RCDDLM(*CRLF) DTAFMT(&FORMAT) RMVBLANK(*TRAILING)
             MONMSG     MSGID(CPF2817) EXEC(DO)
                SNDPGMMSG  MSGID(CPF9898) MSGF(QCPFMSG) MSGDTA('Error +
                             converting Database File to Interface File') +
                             MSGTYPE(*DIAG)
                GOTO       CMDLBL(ERROR)
             ENDDO

             /* Send 'compressing' status message */
             IF         COND(&INTER *EQ '1') THEN(SNDPGMMSG MSGID(CPF9897) +
                          MSGF(QCPFMSG) MSGDTA('Compressing file ' *CAT +
                          &FILE) TOPGMQ(*EXT) MSGTYPE(*STATUS))

             /*---------------------------------------------------------------*/
             /* This command is using the unix environment to zip up the file */
             /* extracted above.  All errors are logged to a text file        */
             /* named error.txt.  The 2>> operator redirects stderr to the    */
             /* file following it, and adds any messages to the end of the    */
             /* file.                                                         */
             /*                                                               */
             /* The following unix utilities are used here:                   */
             /*  ajar - create an archive                                     */
             /*                                                               */
             /* The following environment variables are used here:            */
             /*  QIBM_QSH_CMD_ESCAPE_MSG - Sends QSH0005 as an escape message */
             /*        if the exit status is not 0 (Qshell error condition)   */
             /*---------------------------------------------------------------*/
             /* Send an escape message if the command fails */
             ADDENVVAR  ENVVAR(QIBM_QSH_CMD_ESCAPE_MSG) VALUE(Y) +
                          REPLACE(*YES)

             /* Create &zipfile from temporary file */
             CHGVAR     VAR(&CMD) VALUE('ajar -c -M' *BCAT &ZIPFILE *BCAT +
                          '''' *CAT &TEMPFILE *TCAT ''' :' *BCAT &TEXTFILE +
                          *BCAT '2>>' *BCAT '/zip/error.txt')
             QSH        CMD(&CMD)
             MONMSG     MSGID(QSH0005) EXEC(DO)
                SNDPGMMSG  MSGID(CPF9898) MSGF(QCPFMSG) MSGDTA('Error +
                             creating ZIP file') MSGTYPE(*DIAG)
                GOTO       CMDLBL(ERROR)
             ENDDO

             /* Delete temporaty file */
             RMVLNK     OBJLNK(&TEMPFILE)
             MONMSG     MSGID(CPFA0A9)

             /* Exit Normally */
             GOTO       CMDLBL(OUT)


             /* Process Errors */
 ERROR:      IF         COND(&ERRLOOP *EQ Y) THEN(GOTO CMDLBL(OUT))
             CHGVAR     VAR(&ERRLOOP) VALUE(Y)

             /* Delete temporaty file */
             RMVLNK     OBJLNK(&TEMPFILE)
             MONMSG     MSGID(CPFA0A9)

             /* Send Escape message */
             SNDPGMMSG  MSGID(CPF9898) MSGF(QCPFMSG) MSGDTA('Error +
                          Processing File') MSGTYPE(*ESCAPE)

 OUT:        ENDPGM

Check it out. Create a ZIP file using the Java Archive utility. A Rose by any other name would smell as sweet!

FUD Factor

Tuesday, September 1, 2009 by Jeff Welsh

A couple of weeks ago, I made the trek to Columbus and attended the Ohio chapter meeting of TechServe Alliance of which STAR BASE, Inc. is a member. In talking with other owners and corporate executives, everyone is pretty much saying the same thing: “We are seeing more sales activity, just no commitments.” Seems like everyone involved with Ohio Information Technology firms is in the same boat. In Cincinnati, things might not be quite as bad as Columbus because there is less state government work.

So why is there a lack of commitment? There could be many reasons, but it all boils down to what I call the FUD Factor. Never heard of the FUD Factor? We would not be a real IT Consulting firm if we couldn’t use a TLA (three letter acronym) and it’s not what you’re thinking! FUD is short for Fear, Uncertainty and Doubt.

When the FUD factor is high, people tend not to make commitments, changes or decisions. Doing nothing seems like the safest choice. A high FUD factor equals RISK and as a society, we have become very risk adverse. When the FUD factor is low, decisions are much easier to make, less risky.

With the economy down and so much uncertainty, the FUD factor is definitely high. So is doing nothing really a good choice? Things tend to move in cycles or patterns, it is the way of the world... Losers become winners. Winners become losers. Day yields to night; nights divide the days; summer gives way to winter. Life goes on...always as it always was...but never the same.

Will you be ready?

Chuck Norris IS The Ultimate Developer

Wednesday, August 12, 2009 by Matt Warman

I am just getting back to the swing of things in Cincinnati after a week of vacation in Florida. Instead of really difficult tech stuff, I am treating you application development folk (and others too) with a great link of Chuck Norris "programmer" jokes. This will give me a week of getting unburied from work stuff, and I promise I write something techie next week.
for those who don't do links, here is a small list of "hacker" jokes that was in one of the comments:

Reasons hacking is easy for Chuck Norris
1. Chuck Norris can overflow your stack just by looking at it.
2. To Chuck Norris, everything contains a vulnerability.
3. Malicious File Execution. Nuff said.
4. Chuck Norris doesn’t need sudo, he just types “Chuck Norris” before his commands.
5. Two words: Brute Force.

Is the IIBA Buckling Down Too Hard?

Tuesday, August 4, 2009 by Aaron Whittenberger

I have return.....from my eight month siesta. No, I have not been in Mexico; so I can guarantee that I do not have the swine flu. Although Mexico is on my bucket list, I don't believe now is a great time to visit. I am back and still on my soap box. What has gotten me back on my soap box are some recent articles and blogs I have read complaining that the International Institute for Business Analysis ® has made the application and recertification process for their Certified Business Analyst Professional (CBAP)® certification too stringent.

I have been and continue to be a strong proponent for IT certifications. Even since I obtained my CBAP® certification last year the application process has changed. The exam itself is now based on version 2.0 of the Business Analysis Body of Knowledge (BABOK)®.

I have heard that CBAP® applicants are rejected due to the IIBA® reducing their documented hours for tasks or deliverables that do not qualify as business analysis work. Such reduction of hours left them short of the 7,500 hour requirement. Some applicants are unaware of the new 900 hour requirement in four of the six knowledge hours, again leaving them short of the requirement.

First of all I believe that the application process itself is more rigorous than the exam. It is part of the whole process of obtaining the certification. The IIBA® , by putting all applicants through a rigorous review process, protects the value of the certification. A couple of tips I can give you in applying for the CBAP® certification:

Document more than the minimum 7,500 hours of business analysis work. This ensures that if your hours are reduced in the review process that you will still have enough hours to qualify to sit for the exam. This goes for total hours as well as hours in each of the knowledge areas. I personally documented 9,000 hours on my application.
Put the language on your application in the wording of the BABOK®. By putting your work tasks and deliverables in the language of the profession it is less likely that the hours will be discounted in review.

Remember that any certification worth getting will not be a give-me. You will have to work for it. Any certification worth getting will have a re-certification process, usually just as rigorous as the original application process itself. In my opinion, the CBAP ® certification and the business analysis profession is what turns IT solutions into IT business solutions. When it comes to web application development or any business application development projects, the business analyst is as much a valued resource as the project manager. Business analysis done right can help ensure the success of your IT business solutions projects.

What’s new at JavaOne Part 3 - The Sun Cloud and The End?

Tuesday, July 14, 2009 by Matt Warman

This is the last of a three part series; part one is here and part two is here. Many application development guys are wondering, what is the Cloud, and what is the Sun Cloud? Think of Cloud computing as a virtualized data center. In part one I talked about VirtualBox, which allows you to virtualize network components and resources. Think of VirtualBox working on the atomic level, taking small resources to create a virtualized network. Now Cloud computing takes all of the virtualized networks and utilizes them as resources in a virtualized data center. The Sun Cloud is a set of APIs to let you manage networks and storage areas as resources. You can cluster or categorize networks in any way you wish. You can manage user access to the resources, not unlike application development teams utilize in web applications.
What does all this mean to application development and management? It means that you can create a single network and copy or clone it. For example, you can create a single network instance with servers, storage areas databases, and clone the entire network for each region you manage. That means all networks are managed in one spot, and all regions are setup exactly the same. No application compatibility issues. You can, of course, add or remove components, but they are all have the same infrastructure. You can upgrade the virtual network, and pass the changes to the other regions. The electricity saved by running virtualized datacenters would be significant. You can connect to your partners’ virtualized networks to access their data. For application development teams, that would change how we design applications if we have access to external data and applications.

This was my fifth JavaOne conference. Since it is always at the Moscone center, I know pretty much every nook and cranny of JavaOne. Although smaller this year, I thought this was the best one yet. The people there were truly happy to be there, and combined with takeover news and a bad global economy, a bigger sense of cooperation. I would highly recommend coming to one if they still have one. Nobody, not even James Gosling (I was in a group of 20 who had a 45 minute meeting with him) knows if there will be one next year. The reason you come to JavaOne is not the presentations (they are great!), but the people. Meeting and befriending people who created your favorite blog, book, or technology is the reason to come. I remember meeting Craig McClanahan (co-creator of struts) in 2004, and saying "that’s Craig freaking McClanahan!" Last year, I was honored a share a picture of beer with him, Jarda Tulach (inventor of NetBeans), and Geertjan Wielenga (JavaLobby blogger extraordinaire). Application development people get to "network" with the best and brightest architects, technical press, and business owners. This year I got hang with the JUG leaders, NetBeans Dream Teamers, and the JavaFX guys. I wrote, and helped edit a YouTube video "pushing Java", and met more of my fellow Java music software developers. I literally have friends from all over the world (yes Cincinnati too), and I am considered an honorary Brazilian because of JavaOne. Larry Ellison, if you are reading this, please don’t stop JavaOne!