OWASP Hartford November 2008

On November 11th, The Hartford Chapter of OWASP will be holding its next meeting and will have two great speakers.

We will have Matthew Barach, ESQ of the Boston Privacy Group discussing legal aspects of web application security and Terence Spies, CTO of Voltage discussing identity-based encryption.

All OWASP meetings are 100% free to attend. This will be the last meeting for 2008. We will also be making the meeting available via audio conference call, so that others can also listen in. To learn of upcoming events, subscribe to our mailing list here.

Do your part to help make application security visible by forwarding this information to others...

Technorati Sucks!

I used to read the blogs of many of the people on my blogroll via Technorati but lately both favorites and keywords have been busted. I hope that they fix it soon as visiting each blog manually is painful...

Links for 2008-10-29

Security Professionals and Software
I have yet to come across a "security professional" I can't send packing after speaking 3, simple words: "Show me code."

10 ways for India to help Pakistan in time of need
Pakistan has no money, no energy, no government but has neighbors that are more prosperous than them. The character of a nation is demonstrated by the urgency of action to help their brothers.

Is reverse offshoring a trend?
Increase in the labor salary in offshore places which was decreasing the difference with U.S. salaries says that folks in other parts of the planet are benefiting from short term games but otherwise committing long-term slow suicide.

Questions and Perceptions = Architect Role
Being sensitive and kind doesn't move us forward, but it makes the journey more pleasant.

Hartford Ruby Brigade
A good event ran by a great person. I how well received it would be if I did a presentation entitled: Ruby Derailed: Security Worst Practices.

The fine game of Tennis
I never really liked the game but find it fascinating to watch others play it. In many ways, it is more gentlemanly than Golf

More Links for 2008-10-29

It's 2008, are you still using Smalltalk?
The marketplace has declared Smalltalk a dead language! Someone better tell James Robertson...

It's True: There's Fraud in the H1-B Visa Program
I suspect that employees of Wipro, Infosys and Cognizant who are bloggers will exercise their right to remain silent on this topic.

IBM to offer NOTES in SAAS model
While we need to acknowledge the hoops that some poor slob within IBM had to go through to get this mental shift to happen, we also have to acknowledge that staying on notes is generally a bad idea. The marketplace has chosen Exchange and IBM is late to the game...

Ten Reasons We Plant Trees
Consider the benefits to IT in being eco-friendly. Global warming is reality in the same way that perception is reality.

Enterprise Architecture and Cloud Computing

Jeff Schneider and James Governor trade jabs on cloud computing. Maybe they need an enterprise architect to bring insight to the conversation...



James Governor published research through the eyes of a vendor, while Jeff looks at things through the eyes of customers. In order for industry analysts to not have daggers thrown at them, they have to understand the distinction between who pays them to create research vs those who consume research.

Cloud computing has several characteristics that industry analysts continue to ignore. Consider that if an enterprise wants to move compute power to the cloud that they may also need access to data which goes above and beyond simply poking a hole in the firewall and/or applying encryption. How about talking about what industry standards that should exist prior to deployment to prove that data is not only encrypted while in the cloud but is certified as destroyed when no longer required?

Do clouds need to participate in federated identity? What about the authorization model used to secure services within the cloud? Is XACML the right specification? Instead of worrying about what operating system the cloud runs, how about talking about the methods in which enterprises can build applications that are operating system agnostic?

40 page requirements are still needed because the industry hasn't figured out a complete yet concise way of describing the notion of a service-level agreement. I wonder if James and Jeff believe that instead of throwing daggers at each other, whether they have some duty to actually help get this type of industry standard off the ground to enable proper cloud computing ecosystems...

How many enterprises train their developers on how to write secure code?

Before we get started, it is important to first acknowledge that training is not the same thing as awareness and that Awareness is an enterprise architecture antipattern...



On Friday, I had a conversation with Derek Slater, Editor in Chief of CSO Magazine. One of the things that I would have loved to suggest for him to explore is that one of the reasons the blackhats are beating out the whitehats is because enterprises aren't actually training their developers to write secure code. What would happen if their sister publication, CIO magazine asked Esther Schindler to write an article on why CIOs are missing out on important opportunities to actually secure the enterprise by simply encouraging their staff to attend local OWASP chapter meetings.

There is a huge disconnect between software development and security in most shops. I bet it wouldn't be difficult to find a CSO who can use the word holistic in a sentence but otherwise hasn't yet figured out the security includes software development. Wouldn't it be fascinating if CSO did a simple survey to see how many enterprises are teaching secure coding practices to their development staff?

Anyway, security awareness efforts prepare employees for more detailed assurance training. Awareness, a general understanding about the importance of information security, makes them more receptive to the targeted training that helps remove vulnerabilities associated with employee behavior. Chad Perrin of TechRepublic talks about the process but doesn't ever talk about the depth required in order to be truly sustainable or secure. For example, it is noble to talk about concepts around encryption, but there are lots of ways that it can be developed insecurely and cause bigger problems....

Links for 2008-10-26

Important Questions for Successful Governance
Todd Biske comments on what is required for successful Governance and keys in on the word behavior. I think it missed an opportunity to explain that governance is not about financial controls.

Is ReactOS a reliable replacement for Windows
As I understand Nick Gall of Gartner will be encouraging his analyst peers to dive deeper into Windows alternatives as part of upcoming research. I also understand that Gartner will be publishing some of its 2009 research under Creative Commons. This is a positive step forward by Gartner and I congratudate them for their forward, innovative thinking.

How Oracle can help you write more secure code
I haven't heard back from Mark Wilcox of Oracle. I wonder if my latest response to his questions where a little too painful.

Open Source Enterprise Portal: Liferay
Forrester has agreed to do the right thing and put open source projects in the same wave as commercial offerings. They have acknowledged that customers don't delineate across vendors as much as they care about solutions to the business challenge that can be implemented in a cost effective manner. Now only if Gartner were to take the same stance.

Scalable ECM
Alan Pelz-Sharpe provides insight into which ECM platforms scale but I wish he went a little deeper. He didn't talk about scalability of management though. For example, can an ECM system be considered scalable if you have to provision individual users to it vs it being able to dynamically bind and consume identity elsewhere. Another missing attribute to scalability is how it behaves in a transactional context. Maybe, he will provide deeper insight in a future update.

Where in the world is pie
I don't care where he is, but I do care that he is doing well. I recently saw him kick off and publish ECM patterns on the Documentum site. I really hope that Craig Randall and others will step up and also contribute.

Things I am so tired off
If you work in a large enterprise, this list will be very familiar to you...

Does James McGovern have something to hide?

I received an interesting comment in my blog based on my frequent usage of the phrase: significant other. They noted that I never say spouse nor do I say partner and have read into my take that I am neither normal or afraid to come out of the closet.

To set the record straight, I am happily married to a female and plan on keeping it that way for a long time...

I am the recipient of the Blogs that Rock Award...

Click here to see the award...

Enterprise Architecture Confusion regarding Buy vs Build...

There are several ways that folks get it twisted when discussing buy vs build...



Much of the waste within IT is attributable to worst practices and indoctrination coming from process weenies who love CMMi and outsourcing yet avoid discussing when is it stupid for us to buy things.

Let's start by acknowledging that an enterprise should only buy a product only when it decreases risk. If you don't understand how the product works, or if you don't believe claims about its capabilities, then don't buy it until those issues are settled.

Likewise, buy the simplest, cheapest product that meets your needs. Don't buy expensive products with lots of features you don't need, even if you think those features might be useful someday. We sometimes get excited by Gartner Magic Quadrants and spend more money than we should. In fact, an enterprise may want to consider avoiding Gartner top quadrant products as they have a higher TCO than ones that aren't leaders.

More importantly, you need to remix your thinking and acknowledge that open source belongs in the buy side mentality. While you can avoid the arduous mind numbing negotiations around seat-based licensing, you can focus on getting something deployed in production that meets the business need a lot faster. Of course, you should consider buying support not just from the vendor itself but also in terms of contributing back to the community...

It's 2008, are you still using Smalltalk?

The marketplace has spoken and declared that Smalltalk is a dead language. Why are you not porting to Java, Ruby or a modern language?



While there are still some holdouts, I wonder if anyone in IT has starting writing a new Smalltalk application from scratch within the last two years? Of course, there are folks who have used it to write quick utility applications, but I haven't ran across any that would be enterprise in nature.

Smalltalk seems to be second class when it comes to modern approaches to security. Notice that Smalltalk doesn't support many of the WS* specifications for web services? From what I can tell, Smalltalk also doesn't support CardSpace, OpenID, XACML or even some of the latest approaches to cryptography such as identity-based encryption.

So, if you still develop in this language, I would love for you to trackback and share why you have migrated elsewhere?

Do the majority of folks in India realize they are the reference implementation for worst practices?

Anecdotal evidence suggest that One out of twenty programmers... produces twenty times the software compared to an average programmer...



If you acknowledge that India has lots of programmers but few developers and that in a couple of years the masses of programming will occur in India, then you could also conclude that they have more than their fair share of average folks who pound out average delivery. There are approximately 2,000,000 working software managers and developers in America. Currently, there are 200,000 additional job openings. These figures indicate a negative 10 percent unemployment rate.

When you apply the same thinking to the American economy, we could jumpstart it by simply acknowledging that half of these programmers could be terminated without any software projects missing any deadlines. Skilled programmers are essential to the success of a software project. So-called "heroic programmers" are exceptionally productive. As few as one out of twenty programmers have this talent. They produce an order of magnitude more working software than an average programmer.

Studies have shown that the size of a project team is optimized when there are no more than four developers. Imagine what would happen if American companies insisted that there be a reduction in headcount from their offshore team until this target was reached. Would quality improve if India eliminated the average? Is there enough integrity to do the right thing for clients?

What is your definition of marriage?

Words mean things. My personality has always attacked those who twist the meaning of words...



Today's blog isn't going to touch the issue of whether a man forming a union with another man is morally right or wrong. We will however look at some questions that deserve answers.

If the traditional commonly accepted definition of marriage is between a man and a woman and now others want to hijack this definition, who is busy working on a word replacement? Can we agree that the dictionary should have different words to describe the distinction between a man and a man vs a man and a woman?

What I find really confusing is how others are stupid enough to belief that the argument is all about bigotry. As a minority, I want to kidnap and hand out beatdowns for folks who equate their struggle with those of other minorities. I am a big believer in one's freedom of speech. Likewise, I also believe that many need to exercise their right to remain silent. I can't simply wakeup tomorrow and declare that I am Chinese and folks won't truly know my ethnic origin but others can simply shutup and others won't know.

Shouldn't the definition of bigotry include a financial measure of those who from a measurable perspective have had financial arm at the macro level done to them in the past and even current state? I am equally curious why folks are ignoring the biological aspects of the argument. The first commandment whether you are believer in Judaism, Islam or Christianity is to be fruitful and multiply. Besides, society as a whole is built on this principle. If you need proof, simply noodle the Ponzi scheme known as Social Security and note that reproduction is required for our country to sustain itself.

I guess as a society we have managed to allow others to hijack many terms. I was watching the news the other day and noticed how the word Semite has also gotten twisted. It used to describe a person from a region of Africa. Nowadays, I have no clue as to what it really means. On the news, there was a guy of European origin calling a dark-skinned Muslim from Africa anti-semetic.

Maybe, I need to get with the program and get my significant other to call me anti-James McGovern...

Enterprise Architecture and Why you are an idiot for voting for John McCain

The fallacy of assuming that people (other than oneself, of course) are unable to make a valid judgement on a topic because they "only vote for the candidate who advertised more", or "do what society pressures them to do" is neglecting the fine concept of free will...



Kennedy, if I recall correctly. Anyway, the first presidential race with television as a factor. One candidate had good hair (and to an extent, makeup). The other claimed that looks were irrelevant to doing a good job as president. You can guess which one won. Presidential elections in general show a strong tendency to elect the taller candidate as well. nearly all of them since 1900. One exception was George W. Bush - and he lost the popular vote.

IT Security Professionals, PMP and the Process Olympics

Why didn't America clean up during the Olympics? Imagine if we all wandered around blindfolded with our hands tied behind our back applying for jobs that we weren't qualified for and upon running across a non-technical IT executive who doesn't know the difference between management and leadership, but did perception management well and we put him in charge of the Olympics.

Of course, we would seize the opportunity and ask him the following:

Please hire me as a member of the US Olympic Cycling team... I have a certification in bicycling... ...see here? It's all embossed and everything...

Sadly, what works in Indian outsourcing is starting to work in America (process as a substitute for competence)....

Enterprise Architecture and Another Disturbing India Outsourcing Trend...

I am curious why magazines such as CIO haven't studied this pattern...



Americans send their work to India. Indian companies hire Indian developers. The Indian developer is given a job and then jumps onto an American forum and asks them to help him write his code.

Frequently the questions are not 'I've tried doing "x" and I'm having a problem with this, how do I make this work?'

Instead they are ' I need code that does "x" who can give me the code?'

My fellow Americans are a lot more cordial than I when it comes to responding to these types of requests. The typical answer from many in the open source community is that we are there to support people, not write their code for them. But it is an indicator of the lack of knowledge and experience that exists in India and how stupid American corporations are thinking that they are getting a "deal"...

How Oracle can help you write more secure code...

It is fascinating to see how others such as Mark Wilcox views customer assistance...



Let's analyze his response to see if additional insights will emerge...

First - make sure to read and check-back with Oracle Secure Technology Center.This is basically one-stop place for all of our security information. Oracle covers everything from OS to applications. And this location covers that breadth with links to deeper-dives.

Coverage of products doesn't equate to writing secure code. Security software does NOT equal software security. If you want to assist customers in writing secure code then Oracle would need to publish something similar to the 19 Deadly Sins of Software Security by Michael Howard or Threat Modeling by Window Synder.

Second - our Chief Security Officer Mary Ann Davidson has been trying to get developer education ecosystem (e.g. CS programs and their cousins) to do a better job of teaching secure coding. I believe she articulated the problem very well in her post - "The Supply Chain Problem".

I like the transparency of thought that Mary Ann articulated, but also felt that Oracle needed to eat some humble pie. Shouldn't the question have been how to rally the entire industry since this problem isn't unique to Oracle alone? What would have happened if she also got industry analysts from Gartner, Forrester, Burton Group and so on along with say a listing of CIOs from Fortune enterprises to be a signatory? Imagine the possibilities if Oracle were to think more open and pursue something larger such as the open security manifesto, kinda like the Agile Manifesto or the Cluetrain Manifesto. It takes a community to write secure code and Oracle isn't big enough to do it alone...

Fourth - if you do anything with the database- David Knox's Effective Oracle Database 10g Security by Design is still the go-to resource. It's book #2 on my tech shelf- after my own (me being first is mostly a vanity thing :)).

I have this book on my shelf and it is good if you want to configure products securely, but it still doesn't teach you how to write secure code. I know that Oracle internally uses products from Ounce Labs and Coverity and therefore has some knowledge of PL-SQL specific coding threats. What if the DB team were to blog exploit tips in this regard?

As an addendum - if you are writing code in ADF you should check out the new tutorial based on the new demo application - "Fusion Order Demo" . Besides learning all of the cool things ADF/JDev bring to the table

My significant other is currently working on a security application for a startup who hasn't used one iota of Microsoft technology. She will be attending a free seminar on security hosted by Microsoft in their local office. She didn't need to be a customer nor even RSVP for that matter. The topic will be on security development lifecycles for software companies. What is the Oracle equivalent to free, technology agnostic and local?

Celebrating India's currency decline

The rupee is now trading lower against the US dollar and there are many ways Americans can exploit this...



Several years ago, I decided to use my blog to counter the conspiracy of Indian outsourcing while focusing on something that employees of Indian outsourcing firms themselves have outsourced which is the global support for making poverty history. In India, you can feed 100 school children for only $25.

Imagine what would happen if every person from India reading my blog figured out a way to personally donate to a charity I endorse: Undavum Karangal which I was turned onto by several employees of Cognizant. Sadly, employees of Wipro and Infosys remain disturbly silent when it comes to encouraging individuals of their firms to help end hunger not only in India but other parts of the planet.

Anyway, I already sent my check to sponsor both Eid celebrations for 2009 in India...