1 Raindrop

Ivar Jacobson: ...all that jazz...

Saw a very good presentation by Ivar Jacobson called "all that jazz", he did an overview of Use Cases, Iterative development, architecture, and AOP. One of the continually interesting things about Dr. Jacobson's work is that he not only breaks down "how" things work, but also how they fit together.

AOP is particularly interesting from two angles:

1) Infrastructure code: security, exception handling and management, and logging

2) Ability to build and deploy an enterprise class app w/o the overhead of a full on J2EE app server

LDA: Lunch Driven Architecture

My colleague, Pat Christiansen, has "discovered" a new and powerful type of IT architecture, LDA!

http://www.arctecgroup.net/0502.htm.

LDA integrates well with other popular methodologies such as Resume Driven Design.

Rapid Cognition in Software Development: Use Cases and Blink

Why have Use Cases become the de facto standard for structuring requirements and goals? I had always thought the inherent simplicity in the Use Case format was the secret to how successful Use Cases became. Simplicity to be sure is a part of the reason, but a more careful answer might be: thin slicing. Malcom Gladwell's latest book "Blink" looks at rapid cognition in a large cross section of real world examples from sculpture, code breaking, emergency rooms, just to name a few. Thin slicing occurs when people form decisions based on a limited set artifacts and their associations.

What does this have to do with Use Cases? Many artifacts in the software development lifecycle are geared at decomposing analysis and design concerns. Whereas a standard functional requirements break down step by step how the different nodes of the application function,  Use Case models construct a conceptual model of the components (use cases), the users and systems involved, and the nature of the relationships between the entities. The Use Case model is itself a thin slice of the software system. In complex software systems, the ability to see a thin slice, gather concerns, and actionable data about the way forward is a major advantage.

Risk Transfer Instruments

John S. Quarterman's slides from his joint presentation at RSA on Designing Risk Transfer Instruments are now available. I liked how they give specific concerns from the CIO, CFO, and CEO viewpoint.

Usability & Security

As security shifts focus from the perimeter and closer to the application and data, the relationship of security and usability is of increased importance. This article drills down on some of the core issues at work in the balance of factors. While these security and usability are typically seen as opposing forces, it is not always so.

Cyprus Infosec 2005 CFP

The deadline is fast approaching,  CFP is below...

CYPRUS INFOSEC 2005 - Conference & Workshops

3rd - 7th October 2005, Limassol, Cyprus - www.cyprusinfosec.org

Organised by Cyprus Computer Society and Information Security Bulletin

CALL FOR PAPERS, WORKSHOPS AND MASTER CLASSES

The 5th international conference, workshops and master classes, Cyprus Infosec 2005, gives information assurance practitioners, academics, consultants and legal experts from Europe and elsewhere involved in this field an opportunity to come together to exchange ideas and to present a holistic approach to all aspects of corporate, national and international information assurance.

The organisers of this event invite the submission of papers, workshops and master classes on both the theory and practice of the field, with emphasis on usefulness.

Suggested subjects for papers include but are not limited to:

- Designing and Managing Enterprise Architectures (SABSA, ‘Software Fortresses’, Common Criteria, other enterprise architecture models)

- Compliance Issues (data protection, email, spam, data life cycle control)

- Multinational Use of Cryptography (Wassenaar, EU, US, other, legislation, dealing with authorities in different jurisdictions)

- Information Assurance Management (CoBIT, auditing in the management cycle, baseline security and beyond)

- Law (EU trends and initiatives, solving the problem of conflicting national and international legislation, money laundering and anti-terror countermeasures)

- Wireless Technologies (new standards and their implications for security, protecting the RF side)

- Web Security (programming web sites securely, securing web services)

- Software Security (code auditing and testing, writing secure code, object code auditing, patch management)

- Authentication and Authorisation (SAML 2, developments and convergence trends in standards, practical implementation of smart card based systems, combining physical and logical access control)

- Secure Operating Systems (SELinux, now a viable option in practice)

Potential subjects for workshops and master classes include:

- Basic and advanced vulnerability and penetration testing

- Advanced intrusion detection and prevention

- Wireless network security in practice

- Email filtering and employee relations (policies and methods)

- Designing and maintaining secure enterprise architectures

- Building compliance into multinational enterprise structures

Extended abstracts of 800-1600 words (1 - 2 pages) must be submitted to the organising committee by email to [email protected]. The deadline is March 1st 2005 1200 noon GMT. Accepted contributors will be required to submit full papers by August 15th 2005. Papers must not have been published previously.

Cyprus Infosec 2005 is organised in a collaboration between the Cyprus Computer Society and Information Security Bulletin. The event is independent of vendors and other organisations.

Emergent Evidence

Adam has posted his Shmoocon 05 slides on Evidence based security showing the current realities and some future directions in that space.

Grid Wars

You have got to love Jonathan Schwartz calling out IBM on their grid strategy. One of the great things about technology is that you frequently get "real" CEOs with real personalities (with all the good and bad that comes with that) as opposed to empty grey suits that we see in other sectors.

Anyhow, the Sun grid strategy along with the deal with Archipelago to build the first exchange for computing is very innovative on both technology and business fronts.

Interview with Security Architect

NewsForge has an interview with Dan Razzell. He raises points around developing a dialog between the client and the security consultant, and developing security architecture through design principles and understanding system constraints.

Design for Failure

ACM has a great article: Bruce Lindsay interviewed by Steve Bourne (of Bourne shell fame) on the topic of designing for failure. This interview contains a metric ton of in the trecnhes wisdom of what can go wrong and what your program can do about it. Topics include: error detection, reporting, recovery, and heisenbugs. While much of the discussion is database-centric, the principles are relevant to any application.