itsecurityideas

The value of Shifting Left

2025-08-27T07:56:00.000-07:00

Determining the Business Value of SAST (Coverity) & DAST (SonarQube) - A Combined Approach Both Static Application Security Testing (SAST) with Coverity and Dynamic Application Security Testing (DAST) with SonarQubes are crucial for a robust application security program. They offer distinct, yet complementary, business value. Let review a breakdown, focusing on how they work together:

Understanding the Core Difference:

SAST (Coverity):

Analyzes source code without actually running the application. Think of it as a meticulous code review performed by an automated tool. It identifies vulnerabilities like buffer overflows, SQL injection flaws, and coding standard violations early in the development lifecycle.

DAST (SonarQube):

Analyzes a running application from the outside, simulating real-world attacks. It tests for vulnerabilities that only manifest when the application is live, such as authentication issues, session management problems, and cross-site scripting (XSS).

I. Coverity - SAST: Business Value & Benefits

Reduced Remediation Costs:

Finding vulnerabilities early in development (during coding) is significantly cheaper to fix than finding them in production. Estimates suggest fixing a vulnerability in the design phase can be 10-100x less expensive than fixing it after deployment.

Improved Code Quality & Reduced Technical Debt:

Coverity doesn't just find security flaws; it also identifies coding standard violations and potential bugs, leading to cleaner, more maintainable code. This reduces technical debt over time.

Faster Time-to-Market:

By identifying issues early, developers can fix them quickly without delaying release cycles. Automated analysis speeds up the review process.

Compliance & Audit Readiness: Coverity helps organizations meet regulatory requirements (e.g., PCI DSS, HIPAA) and provides detailed reports for audits. It demonstrates a proactive approach to security.

Developer Education:

Coverity's findings provide developers with immediate feedback on their coding practices, helping them learn and improve their skills.

Supply Chain Security:

Coverity can analyze third-party components (libraries, frameworks) used in your application, identifying vulnerabilities within those dependencies before they impact your system.

Key Business Impact of Coverity:

Lower development costs, faster release cycles, reduced risk of security breaches, improved software quality, and stronger compliance posture.

II. SonarQube - DAST: Business Value & Benefits

Real-World Vulnerability Detection:

DAST finds vulnerabilities that SAST might miss – those only exposed when the application is running and interacting with its environment (e.g., database, web server).

Comprehensive Coverage:

SonarQube can test a wider range of attack vectors than SAST alone, including authentication flaws, session management issues, and injection attacks.

Continuous Monitoring:

SonarQube can be integrated into CI/CD pipelines to continuously scan applications for vulnerabilities as they are deployed. This provides ongoing security assurance.

Performance & Reliability Insights:

SonarQube also analyzes code for performance bottlenecks and potential reliability issues, contributing to a better user experience.

Centralized Security Dashboard:

Provides a single pane of glass for viewing the overall security posture of your applications, making it easier to prioritize remediation efforts.

Support for Multiple Languages & Technologies:

SonarQube supports a wide range of programming languages and frameworks, making it versatile for diverse application portfolios.

Key Business Impact of SonarQube:

Reduced risk of runtime attacks, improved application resilience, continuous security monitoring, enhanced user experience, and better overall application quality.

III. The Power of Combining Coverity & SonarQube:

A Synergistic Approach

Using both SAST (Coverity) and DAST (SonarQube) provides the most comprehensive security coverage. Here's how they complement each other:

Feature	Coverity (SAST)	SonarQube (DAST)
Analysis Type	Static - Source Code	Dynamic - Running Application
Vulnerability Focus	Coding errors, potential bugs, early-stage flaws	Runtime vulnerabilities, authentication issues, injection attacks
Detection Timing	Early in the development lifecycle	During testing and production
False Positives	Generally lower (more precise)	Can be higher (requires more validation)
Coverage	Deep analysis of code logic	Broad coverage of attack surfaces

How they work together:

Coverity identifies & fixes vulnerabilities early. This reduces the number of issues that make it to testing and production.

SonarQube validates Coverity's findings by confirming whether those vulnerabilities are actually exploitable in a running application. It also finds new vulnerabilities that Coverity missed.

Combined reporting:

Integrate results from both tools into a central dashboard for prioritized remediation.

Shift-Left Security:

This combined approach embodies the "shift-left" security principle – finding and fixing vulnerabilities as early as possible in the development process.

Quantifying the Business Value (Example):

Let's say a company estimates:

Cost of a data breach:

$1 million

Probability of a critical vulnerability making it to production without SAST/DAST: 20%

Probability of a critical vulnerability making it to production with SAST/DAST: 2%

By reducing the probability of a breach from 20% to 2%, they potentially save 920,000((920,000((1 million x 0.20) - ($1 million x 0.02)). This demonstrates a clear ROI for investing in both tools.

Conclusions:

Coverity and SonarQube are powerful security tools that offer significant business value when used together. By combining the strengths of SAST and DAST, organizations can build more secure applications, reduce risk, lower costs, and accelerate innovation. The investment in these tools is not just a security expense; it's a strategic investment in long-term business success.

How long will it take to Brute Force AES?

2013-04-04T06:29:00.001-07:00

How long will it take to brute force a given encrypted text if encrypted with 256 bit AES?

As of April 3, 2013 Using modern cryptanalysis to break AES-256 bit encryption by guessing the key used on a given block of data using the Biclique Cryptanalysis method as developed by Andrey, Bogdanov, Dmitry Khovratovich, and Christian Rechberge [i] will require a minimum of 2^254 operations for a data-space of 2^40 Bits (128 Gigabytes).

Processor	Operations Per Second	Number of Operations	Time in Years (@ 100% Success)
Xeon E5-4650	1.4969 x 10 ^ 13	2^254	6.12818 x 10 ^ 55
I7 3970 XM	1.2969 x 10 ^13	2^254	7.07323 x 10 ^ 55
AMD 7970 (GPGPU)	3.584 x 10 ^ 15	2^254	2.55951 x 10 ^ 53
Titan (Oak Ridge National Labs) Current Top 500 King.	1.759 x 10 ^ 18	2^254	5.2150 x 10 ^ 50

Again, this is a perfect scenario; given a sample size of 2^40 bits ; 128 Gigabytes encrypted with the same 128 bit symmetric key.

The world’s fastest computer would take 5.215 x 10 ^ 50 (That's 50 zeros) years at 100% accuracy; the research stipulates that the best hit / miss scenario is 63% accuracy so we may infer that the best case would actually be far longer than that. Bogdanov stated the following in an interview:

"To put this into perspective: on a trillion machines, that each could test a billion keys per second, it would take more than two billion years to recover an AES-128 bit key"[ii]

If we take Moore’s Law into account assuming that Titan’s number of operations will double every twelve months.

Number of Years = Number of Operations Required / Maximum Operations Available * Efficiency

A good method used to ball park would be to assume that every year the "Maximum Operations Available" for a given computing system will double.

Multibillion Dollar Super computers will be capable of brute forcing using AES using Bogdanov et. al. method using a single operation in 1.6457091 x 10 ^58 years; assuming 100% efficiency.

That’s 1,645,709,100,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 Years.

Current scientific estimates state that our sun will become a red giant; expand due to lack of Hydrogen for fusion and consume all inner planetary bodies including the earth in 7.59 billion years. Current estimates put the sun at 4.5 billion years of age which means around 3.09 Billion (3,090,000,000,000) years are left before this event occurs give or take a millienia.

This analysis only covers the most recently published method to brute force AES; Side Channel Analysis, and other such methods that use attacks on the implementation of the algorithm such as improper key storage, memory management or the failure of security controls on a given system are excluded from discussions here and this is a purely theoretical discussion; we are not considering the platform or implementation of AES on a computer.

These estimates are based on the idea that the current environment remains unchanged: That is of course unless someone builds a quantum computer capable of executing Shor’s, Grover’s or similar quantum factorization and search algorithms (greater than 1000 entangled q-bits) or if there is some kind of rapid change in Moore’s Law; such as inexpensive atomic replication and manufacture of complex systems such as the Drexler revolution, or the Kurtzwiel's singularity occurs where systems become self aware and more intelligent than humanity and become better at designing chips than we are this timeline is likely to remain somewhat constant.

IBM has already demonstrated the implementation of Shor’s algorithm with 7-qbits[iv], in 2001. Although the key requirement for Quantum systems is the sheer number of Q-bits required; the evolution of these systems is far more complex than the traditional computing systems as developed with transistors on silicon using VLSI and their associated developmental challenges.

The estimates for number of q-bits vary but somewhere between 512 and 1000 would be needed to break AES or RSA in a timely way; ie; before the sun explodes. And their development faces both real world theoretical problems in physics and practical engineering difficulties such as environmental isolation that are associated with said physics problems. Good examples of quantum machines include atom smashers built under mountains for CERN between Switzerland and France; they are under mountains for a reason; there's little to no background radiation there.

As stated by Schneier[iii] attacks against cryptosystems always get better, not worse; D-Wave systems is making massive inroads (more like major highways) into discrete optimization problems using quantum computing and their board has announced that soon they will have more computing power than that which is available in this universe according to Rose’s Law; limited by their computing architecture to said optimization problems; various scholars and industry pundits do not fear this event but openly admit the risk it maintains to their cryptosystems which include RSA and AES; the only issue bieng when will a company or organization produce a system like D-wave's only using Shor's or Grover's algorithms;

In a quantum machine environmental background radiation is similar to electrical or RF based noise in a traditional electrical machine; Ever notice how your personal radio may hum next to a fluorescent light? The only difference being the requirement for a kilometer of hard stone to prevent interference vs. the use of a grounded metal box, isolated power supply and exterior antenna.

A cryptosystem is considered broken when a method exists to solve for a key that is more efficient than the existing brute force method using known ciphertexts and cryptanalysis. Even broken crypto systems often remain useful due to the time and effort required to search for a given key.

Easy ways to defeat this and future attacks include developing and using cryptosystems that are lattice based and do not make use of the discrete logarithm or large prime problems.

References;

[i] Bogdanov, Andrey; Khovartovich, Dmitry; Rechberge, Christian (Univesity Luven, Microsoft Resarch, France Telecom, 2011) Biclique Cryptanalysis of the Full AES [PDF Document] Available Online: http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf (Accessed on April 2^nd 2013)

[ii] Neil, Dave (The Inquirer, August 17^th 2011) AES encryption is cracked [World Wide Web] Available Online: http://www.theinquirer.net/inquirer/news/2102435/aes-encryption-cracked (Accessed on April 3rd 2013)

[iii]Schneier, Bruce (August 8^th 2011) New Attack on AES [World Wide Web] Available Online: http://www.schneier.com/blog/archives/2011/08/new_attack_on_a_1.html (Accessed on April 3rd 2013)

[iv]N.a. (IBM, 2001) IBM's Test-Tube Quantum Computer Makes History [World Wide Web] Available Online: http://www-03.ibm.com/press/us/en/pressrelease/965.wss (Accessed on April 4th 2013)

On the nature of Agile Development

2012-03-12T13:49:00.003-07:00

The history of software development within the last twenty (20) years is littered with notable software development and implementation failures; The Denver International Airport’s Luggage Handling System; Ford’s attempts at implementing an ERP / CRM based purchasing system; Avis Europe ERP platform; Hudson Bay’s Inventory Management system and many others; (Ewushi-Mensah, 2003)[i] (Galin, 2004)[ii] Both Galin and Ewusi-Mensa outline that the underlying issues at the root of the cause of software development failures and how they fail are related to the following characteristics of development: in addition to this there is the ever present Chaos report that cites the many reasons for project failure. (Standish Group, 1995)[iii] (Matus, 2009)[iv]; basically the Standish report on metrics about software projects indicate that only 32% are successful, 44% are challenged and 24% of all projects surveyed fail; of the 24% the reasons for failure are cited as further to this the PMI agrees that around only 30% of software development project succeed; this is often due to the following reasons:

1. Stakeholder Involvement
2. Requirements Analysis and Gathering
3. Project Planning and Execution
4. Project Metrics and Analisys
5. Project Risk
6. Software Quality Assurance Planning and Testing

Within the Information technology project management module we reviewed and analysed as well as developed a formal project plan using “Earned Value Management” in conjunction with Microsoft’s Project Management software to develop and analyse Gantt charts according to estimates made with the use of Bohem’s Cocomo II models of software development using the Project Management Institutes (PMI) PMBook as a frame of reference. This in conjunction with the Software Quality Assurance module underscored the importance of two key pieces of planning information when engaging in any project. Basically the PMBook acts as method we may use to determine “How to get to point b from here, point a”; Point B, being the end of the project and the requirements define what the end of said project looks like; by applying Occam’s razor to the project and compartmentalizing the development effort of said software into small manageable segments we may then create a project plan based on real world development time using previous software projects as a means to estimate the Time, Cost and overall requirements to meet the desired development of whatever software project is required. This is done by creating the following documents and plans and including them in a formal agreement with the client.

1. The Formal Software Requirements
2. The Software Development Project Plan
3. The Software Quality Assurance Plan
4. The Software Test Plan (as completed during testing).

Generally these expectations are included in the service level agreement and development contract; often we may employ the use of “Carrots” as bonuses for early completion and limit risk by identifying formal drop dead dates and sticks (punitive damages); associated with missing or failure to deliver on said predefined mile stones.

Why is User Acceptance testing crucial? Why is having their feedback so important to the development cycle? The “Agile” manifesto defines the principles of the “Agile” methodology; the methodology was defined by Beck et al. In 2001. (Beck et al. , 2001)[v] as a means to improve upon the existing software development methods such as Rapid Application Development using RUP and the Waterfall Model’s which have plagued the software development industry for nearly 25 years.

The issues are often that what the client desires is difficult to capture, depending on business, the nature of software abstraction and the use of people as your input agents: Even with formal requirements analysis, risk registers and wireframe design; scope creep is a formidable foe to any software or IT Project and these in conjunction with the inherent risk of working in complete mathematical abstractions only compounds and aggravates the problem of software development risk. The importance of using User Acceptance Testing and Business Acceptance Testing is oft cited by Galin (Galin, 2004)[vi] and Naik et al. (Naik et al., 2011, P. )[vii] That it is critical to defining software development project success factors; in that the End user (The person whom will use your software) defines what your project success is.

These components of stakeholder involvement, constant communications, simple requirements as defined by the client and development team and the rapid application software development life cycle in the Agile development methodology are part of the iterative process thus the definition of success factors for each iterative versions as developed; combined with the rapid software life cycle are designed to foster or incubate success factors within the life cycle of the development project; or at least help change the projects course should it go awry; for whatever reasons.

The ISACA and the (ISC)2 both state that senior management sponsorship is critical to any information technology project, this is also true for any software development project; thus the key to any good development effort is to maintain a body of project knowledge in conjunction with the legal agreements to develop said software and use acceptance testing for both business and users as a means to quantify the project as developed and delivered. Further to this should the project be critical to the businesses income the real risk of failure can be the client or end user bankruptcy and the loss of income for those at the client organization. The proof of the work as requested lies in the UAT along with the “Lessons Learned” briefs as created by the quality assurance plan and software test team; regardless of the nature of development without documented knowledge of what was done or how it was accomplished would lend itself to direct fraud.

This risk is very real when your deliverables are measured in lines of code, or binary executables that are coded by geographically disperse teams of geniuses around the planet and only executed by one parent organization in the internals of some business oriented system for a large multinational organization.

We may underscore the importance of client acceptance testing as being the ability for the client organization to either maintain or adopt the proposed solution with a minimal amount of platform development transfer risk; or undertake the full development of said project with limited and known financial risk according to estimations as generated. Where possible we may even measure against the estimates as a means to deduce project risk for a given iteration.

Software development is defined as both the most profitable industry and the one with the greatest level of risk; it stands to reason that the greatest amount of riches lie in the riskiest ventures. When the success or failure of your company lies in your users ability to use your software; their signature on the hand off documentation or at least of a number of requirements which also include being able to use said platform without aggravation or frustration or complete systems failure; as we see with modern organizations such as Microsoft; Google, Facebook, LinkedIn, Amazon, Yahoo, Apple and other major incorporations whose sole core revenue generators are software; their value is defined as the ability for the average every day person to use their platforms; less the cost of creating said platforms. There we may define the importance of the client sign off, UAT and BAT: as the life blood of the organization for without it lawsuits and bankruptcies may befall such follies.

References
[i] Ewusi-Mensa, Kweku (MIT Press, August 1st 2003) Software Development Failures ISBN: 0-262-05072-2

[ii] Galin, Daniel (Pearson/Addison Welsly, 2004) Software Quality Assurance ISBN: 978-0-201-70945-2)

[iii] N.a. (The Standish Group, 1995 – 2009) The Chaos Report [Online] PDF Document, Available from: http://www.projectsmart.co.uk/docs/chaos-report.pdf (Accessed on March 10th 2012)

[iv] Mateus, Aleh (Model Us, May 4th 2009) Standish Group Chaos Report 2009 [Online] World Wide Web, Available from: http://modelus.com/Blog/post/2009/05/04/Standish-CHAOS-report-for-2009.aspx (Accessed on March 10th 2012)

[v] Beck, Kent; Mike Beedle; Arie van Bennekum; Alistair Cockburn; Ward Cunningham; Martin Fowler; James Grenning; Jim Highsmith; Andrew Hunt; Ron Jeffries; Jon Kern; Brian Marick; Robert C. Martin; Steve Mellor ;Ken Schwaber; Jeff Sutherland; Dave Thomas (Agileinfo Organization, 2001) The manifesto for Agile Development [Online] World Wide Web, Available from: http://agilemanifesto.org/ (Accessed on March 11th 2012)

[vi] Galin, Daniel (Pearson/Addison Welsly, 2004) Software Quality Assurance ISBN: 978-0-201-70945-2)

[vii] Sagar Naik, Piyu Tripathy (John Wiley and Sons, September 23rd 2011) Software Testing and Quality Assurance: Theory and PracticeSoftware Testing and Quality Assurance: Theory and Practice ISBN: 978-1-1182-1163-2

The importance of Ethics

2012-03-02T10:17:00.000-08:00

I have been working in Information Technology for over a decade, throught my career as an “it security guy” I have recieved many questionable requests; the gamut usually includes everything from indviduals to government bodies asking one of the following questions:

1. Can you hack into so and so’s e-mail and screw with them for me?
2. Can you get me free software / movies / music both from friends and employers?
3. Can you find out so and so’s password to this or that resource?
4. Can you engage in this project that is potentially liable and possibly illegal but must be done by our group?

What are morals? what is ethical? certianly there have been many great men and women before myself that have spent lifetimes of study in philosphy arguing the benefice of the populace over that of the individual or nominitive and utilitarian views and many doctors of philosophy have argued the virtues and diffrences between Kant, Descartes, Camus, Wittgenstien and Popper(Edmunds et al.)1 Confucius, Plato and Tzun Tzu even pontificated on what might be ethical two thousand years before we crawled out of the dark ages. There are countless diatribes on the subject of the application of ethics and morality to any given problem. Generally morality may be best summerized as the “right thing to do for all parties concerned given a specific situation.” In the cases of War and Medical resarch the water get’s very muddy and murky very quickly. Is it ethical to test cosmitics on any mammal when almost perfect computer models exist? Is it ethical to test potentially fatal cancer treatments on humans that are not sick? The whole goal of Total War is to eliminate the threat posed by an opponent which less than 75 years ago meant another industrialized nation; as we have seen modern warfare views civilian casualties as a "collateral damage"; instead of "innocent bystanders".

With respect to security resarch; when if at al is it alright to publish security vulnerabilities in sofware is a matter of great debate; the CERT is designed to allow the vendor to fix or patch their issue before it causes grevious harm to their clients. Cisco has actually had consultants and employees alike sued and arrested for publishing vulnerabilities related to thier management and routing and switching hardware and software.(Scheiner)2 .

There are many considerations that I make when I recieve the above requests; one is if I am asked to conduct a formal forensic investigation; I am not a forensics expert but usually law enforcement and private investigators will violate a persons right to privacy as part of a justified investigation where immideate grevious harm may be present. These are conducted where warrants have been granted to process digital assets; This includes people engaging in fraud, or whom have threatened acts of terrorism or violence against others or are at risk of doing causing harm to others. With respect to these situations and only these situations would I even consider recovering someone else password and divulging it to the appropriate parties.

My paticular expierence where I had chosen not to engage a client and avoid legal and political liability; We had recieved a request from a potential client to help revise a medical records database in clear violation of the law. The client had asked me to update a platform they were using as an interim measure while they were waiting on a software release that complied with privacy and adminstrative legislation. Suffice it to say that recently this information has become poltically sensitive and at the time I had mentioned to our client during the initial meetings that thier actions to circumnavigate the process and procedures may land them in jail due to the sensitive nature of the records management involved and the contravention of the privacy act; Not to mention the associated disclosure risk was at a political level.

I delicined the contract offer and I told the consultancy I was working for that if they engaged that client in that project that it would quite literaly result in leagal action in the future if it were uncovered by an inquirty or by any other means as the project it self violated the rights to privacy and both federal and provincial security policies regarding personal medical records and data handeling pratices. In the U.S. Medical companies must comply with HIPPA when dealing in the digital storage of records, Banks must comply with BASEL and FISMA and businesses must comply with Sarbanes Oxley (SOX); Failure to comply with these regulations usually results in punitive damages being exercised by the Federal government; however Sarbanes Oxley has yet to be tested by the courts against any business.

As for the personal “Can you hack so and so for me” requests, I always offer the following guiding pieces of ethical training offered to me during my CISSP training. (Tipton)3 These are based upon the findins of Firtz H. Gupe, Timothy Garcia-Jay and Willion Kuheler.

Golden Rule - Treat others as you wish to be treated.
Kant’s Catagorical Imperative - If an action is not right for everyone it’s not right for anyone.
Descartes Rule of Change - If an action is not repeatable at all times; it’s not right for anyone.
Utilitarian Principal - Take the action that achieves the most good.
Risk Aversion Principal - Incur the least harm or cost.
Avoid Harm - Avoid Malfesance or “Do no Harm”.
There is no free lunch - Everything belongs to somone.
Legalism - Is the action legal?
Professionalism - Is the action contrary to the code of ethics? Does it contravine one of the above rules; or will it require that someone I ask violate the above code?

As Groucho Marx once stated; “These are my principles and if you don’t like them I have others!”, in cases where ethical questions come to light I often find myself returning to this simple page to consider weather or not what I am doing is right. If it violates any of these rules, I tell my client politely that I cannot work with them on ethical grounds.

1 Edmunds, David; Eidinow, John; Wittgenstien, Popper (Harper Collins, October 2002) Wittgenstein's Poker: The Story of a Ten-Minute Argument Between Two Great Philosophers ISBN: 978-0-060-9366-48

2 Scheiner, Bruce (Scheiner on Security, 2005) More on the Lynn / Cisco contraversy [Online] World Wide Web available from:http://www.schneier.com/blog/archives/2005/08/more_lynncisco.html (Accesssed on March 1st 2012)

3 Tipton, Harold F (Auerbach, Taylor and Francis, 2010) The offical guide to the (ISC)2 CISSP CBK 2nd edition P 495 ISBN: 978-1-4398-0959-4

It's All Software anyway

2011-11-03T19:30:00.000-07:00

Over the course of the last thirteen years of my life I've seen many CASE tools; most of which have been Integrated Development Environments. IDE's are language specific CASE tools that include debuggers, memory monitors, compilers if it's a complied language like C/C++ or Delphi or runtime environments with integrated development for organizations that use interpreted languages such as Python or J2EE standards which usually include Eclipse and the enterprise JDK from Oracle; The Oracle RBDMS as the Database with Swing or the SpringSource framework as my application stack running on Apache-Tomcat or BEA weblogic, but I digress. When I was writing my previous module for Programming the Internet; I used Bluefish as an Editor and my IDE consisted of a LAMP stack on a Virtual machine for rapid application testing where I could test my changes “in situ” thus following the Agile standard whilst developing a web-site using XML and Web 2.0 standards on LAMP in PHP, on my trusty work station HAL(2.0). I conducted some rudimentary work in Eclipse for JAVA functions on the website, but I loathe Java. One of the more common IDE's today is the Visual Studio from Microsoft, Visual Studio .NET has some very interesting functions and support C# and the .NET framework which I hear is inc readably efficient but according to the language popularity from DedaSys LLC it falls far behind Java and PHP for web-development. C/C++ still reigns king in the world of systems and application development. (DedaSys LLC, April 13^th 2011)ⁱ They even state the highest demand for work is in PHP and LAMP, this is due to the popularity of that platform, it runs over 60% of the websites used everyday.

My first real job was when I was in high school, in Ontario it's called secondary school and I worked with a startup that conducted RLC based power design in electronics for communications companies I was only 17 at the time, not bad for a high school job it did however pay like fast food. My first introduction to procedural programing was working with the MIPS environment from Microchip Inc. I was tasked with programming a PIC 16F84 as a fan controller for a project we were consulting on; needless to say it was a trial by fire but any programming in a junior career usually is. After the firm hit a major crisis with the local telecommunications industry meltdown in 2000 our path was changed and venture capitol was obtained from the same group that founded MosAid. We went from a consulting firm specializing in power systems design to an ASIC design firm specializing in power control ASIC's to fill a void in the components market in north America. last I heard they had a few plasma television manufactures interested in their products and the company had been sold to Powi Systems. I was laid off before the first chip completed design, To add insult to injury this was less than three months after the passing of my mother; but as always compassion and business rarely mix. It was a bit of a blessing in disguise as I began working as a network and systems consultant there after and I have not looked back ever since.

Working as a Lan Wan administrator I knew enough about the sun solars systems that were purchased to support the Verilog IDE's that were on them; from that experience I know now that all Hardware design is in fact software code; All transistors and accompanying rlc based circuits on any chip are really just a function described in a high level design language such as Verilog or VHDL. Ever since Carver Meade published his tomes on VLSI design (Meade, 1978)ⁱⁱ, Hardware electronics are designed in EDA (electronic design automation) suites that resemble IDE's with native drawing interfaces, you compile your circuits and test them with applications using a SPICE simulator (Nagel, 1971)ⁱⁱⁱ: everything from the printed circuit board to the circuits and schematics are all rendered in software and tested months before any prototype is ever built. This is primarily due to the sheer cost of prototyping both chips and circuits. We have been using computers and CASE tools in an iterative fashion to design better computers to achieve Moores Law: The standards are maintained by a consortium of software houses including AMD, INTEL, IBM and Motorola, companies such as NEC and others have some input to the standard but the bulk of most software design work still occurs in North America both in Silicon Valley in California and here in Ontario; An interesting side note ATI got started in Toronto and has offices in Waterloo and Mississauga; Matrox is still based out of Montreal; Now the ATI offices work for AMD but the design offices are still here: We also have a large Monolithic Microwave Integrated Circut (MMIC) design as well as GaAs (Gallium Arsenide), and InP (Indium Phosphide) tech sector that still survives here in Ottawa but only as boutique desgin firms like Xwave; not as the previously glorious houses that created innovation on crystal substrates that would make any communications engineer envious. Every single technological product ever developed from now on exists on a computer in a virtual environment in it's entirety before the decision is made to build or scrap; we can even calculate the market pressures to build said device before hand using automated ERP based econometrics programs.

Now how does JAD help organizations maintain competitive advantages in the IS and IT world where moors law rules king and Brooks (Brooks, 2006)^iv and Zawinski's Laws of software bloat ensure that the next version of software will bring whatever it is you use now to it knees with third order (O^3) out of sequence calls used in objects that are three times less efficient than what you use now; boils down to one simple thing; The software design life cycle.

Software is only useful for a given amount of time; This property is the usable life. the hardware is only good for five to seven years, that's what it's designed to last to; this also includes every single super computer on the planet. The software running on the hardware is directly responsible for achieving your business office functions, if your organizations business is developing software than your development methodologies, software supportability and maintainability and your organizations efficiencies of object re-use, testing, bug fixes and design considerations directly determine your bottom line; In short you live or die by the quality of the software your organization produces; and this is your competitive advantage within this economy. As Lehman stated in 1980, the usable life of a given piece of software is about 5 to 7 years before it requires a complete rewrite due to environmental changes. (Lehman, IEEE 1980)^v The adoption of the Agile and other such Rapid Application Development methodologies as defined by Highsmith result in code of a greater quality. (Highsmith, 2000)^vi He also states that daily compiles are necessary to achieve this level of quality to reduce overall project risk. As Galin states (Galin, 2004)^vii:

“As software errors are the cause of poor software quality it is important to investigate the causes of these errors in order to prevent them.”

Thus in an IS or design oriented organization where Joint Application Development methodologies are not being used or no use of SDLC can be seen we may assume that the software produced will contain many errors and not be sustainable in nature. It will be of a relatively poor quality. If the business is not producing sustainable software than it itself is unsustainable and may fail due to the burgeoning costs of maintenance of their software after it is sold or implemented in some poor organizations production environment: either by contractual obligation or loss of users and customers. Software and Security fixes are far cheaper when implemented in the design and architecture phases regardless of the methodologies used, by choosing to adopt an Agile rapid application development environment and methodologies such as SDLC and PCDA cycles an organization is effectively committing to reality testing all of its produced software frequently. As the old proverb states, failure to commit is committing to failure.

in.a. (DedaSys LLC, April 13^th 2011) Language Popularity [Online] World Wide Web, Available from: http://langpop.com/ (Accessed on November 2^nd 2011)

iiMeade, C; Conway, L (PaloAlto, Xerox Corporation, California Institute of Technology, 1978) Introduction to VLSI Systems [Online] PDF Document Available from: http://ai.eecs.umich.edu/people/conway/VLSI/VLSIText/PP-V2/V2.pdf (Accessed on November 3^nd 2011)

iiiNagel L. W.; Rohner R. A. (IEEE, Journal of Solid State Circuts, August 1971) Computer Analisys of Non-linear Circuts Exclusion Radiation [Online] PDF Document, Available From: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=1050166 (Accessed on November 2^nd 2011)

ivBrooks, Fredrick (Addison Wesley, 2006) The mythical man month P. 53 ISBN: 0-201-83595-9

vLehman, Meir M. (IEEE, Proceedings, Volume 68, Number 9, September 1980) Progams, Life Cycles, and Laws of Software Evolution [Online] PDF Document, Available from: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.116.3108&rep=rep1&type=pdf (Accessed on November 2^nd 2011)

viHighsmith, Jim (Cutter Consortium, 2000) Extreme Programming [Online] PDF Document, Available from: http://www.cutter.com/content-and-analysis/resource-centers/agile-project-management/sample-our-research/ead0002/ead0002.pdf (Accessed on November 2^nd 2011)

viiGalin, Daniel (Pearson Addison Wesley, 2010) Sofware Quality Assurance From theroy to Impllementation P.19 ISBN: 978-0-201-70945-2

The nature of Trust

2011-10-25T16:11:00.000-07:00

A synopsys from the Ethics Smethics Point of Vue and other reasons why I'll never work with Michael Schrage

http://www.cio.com.au/article/185611/ethics_shmethics/

Do the right thing or implement the system correctly. Well this statement is clearly flawed. If your IT department cannot implement a system correctly than you as the CIO have failed at developing a team with the right skills, Wilcox et al have cited that team composition and dynamic are of prime importance on ERP and CRM development. (Willcocks, Sykes, 2000)^ⁱ If such difficulties arise you might be better off seeking employment as a used car salesmen or tax collector or some other business where a lack of ethics is a good fit.

If you believe that withholding layoff information will help get your projects completed, it’s probably going to be your last project as CIO since the company will have serious issues gaining customer confidence once employee confidence and trust is lost. ; Issues of customer confidence include those experienced by Enron, MCI World Com, Nortel, Arthur Anderson and others. (Patasuris, 2002)^ⁱⁱ

The truth is simple, the bright ones will see the writing on the wall and leave before the layoffs occur, those deer in the headlights will expect a golden handshake for their woes but beyond that is the prime consideration involving the why; Why bother hiring developers if you only need a software tool? Simply buy the tool and it's rights. Microsoft bought the rights to it's first software platform; this still happens every day.

Senario:

CRM Development – Outsourced Support and Administration there after.

Utilitarian –

If you have a development department that is capable of developing a good valuable CRM solution that will function as desired and you plan to outsource support and administration, then you may consider engaging in business with this software house as a means to generate real revenue for your company. If you cannot create a new and profitable business venture than your company should have also outsourced the development as you had no intention of maintaining these employees after the project was completed, if you plain to fail then you fail to plan. The moral good of the collective of the employees would be best suited by ensuring their long term employment over considerations of profit; one such consideration would be that the organization owes these people work, just as this human capital owes the organization productive efforts. As Economics (Samuelson, Nordhaus, 2004)^ⁱⁱⁱ states all production requires Factors that include Human Capitol and Land.

Nomative –

The moral facts of the situation as sited by Schrage are both simplistic and narrow minded. Yes IT is a business, but it’s up to the sales people and directors to ensure that it functions in a sustainable manner. In 2008 the software industry added $280 billion in value to the U.S. Economy alone (BSA, 2008)^{^iv}, If the sales department of this organization cannot capitolize on such a large market than they should be the first to be replaced; The above scenario would not exist if they outsourced all development of the platform, or if they hired developers in a cautious manner. Full time gainful employment as a developer in an economy means that you as an individual have already made the choice to devote 100% of their time and effort to your company, to assume that these people are expendable just because the company cannot find a means to sell their talents is wrong in both the utilitarian and nominative philosophical sense. The prima-face (W.D. Ross, 1930)^{^v} duties in the nominative sense would be that the benefice, fidelity and justice of the organization are co-dependent upon those received by their respective employees and those experienced by their customers. Henry ford once stated, Take aw

Short Term Losses

The short term losses of this organization would include a lack in skills and ability for the organization to product any software product, not to mention a loss in production and morale. Losses to corporate morale can kill a company; if your entire workforce is apathetic then your companies production may grind to a standstill.

Long Term Gains

The long term gains of this company or organization may be that instead of going bankrupt they exist in some form their than they used to. Current examples that include ones like this include “Research in Motion” where they have recently gutted their workforce in an effort to combat a downturn in sales.(Yin, 2011)^{^vi} By reducing 11 percent of their programmers; one such strategic move would have been to refocus efforts on Android development of a blackberry compatible mailer client to further expand on a client base on an exponentially growing client base, thus no longer depending on their own hardware business and leveraging the strength of the mobile marketplace from Samsung, Motorola, Nokia and any other Android based phone manufacturer: however weather or not Rim will survive into the new year remains to be seen.

Good Ethics or Financial Benefits

The example above is just one example, however if all organizations were to invest as heavily into their employees as their employees invest in their organizations than the returns would include competitive advantages as well as financial ones, the best examples include sponsorship of an executive MBa as a means to capitalize on leadership within the ranks of an organization as opposed to purchasing or poaching an executive. Good Ethics lead to a good reputation, a good reputation directly increases sales and revenues regardless of the product or service being sold.

iWillcooks Leslie P., Sykes, Richard (ACM, 2000) Enterprise resource planning: the role of the CIO and it function in ERP [Online] PDF Document Available from: http://dl.acm.org/citation.cfm?id=332051.332065 (Accessed on October 23^rd 2011)

iiPatasuris, Penelopie (Forbes, August 26^th 2002) The croproate Scandal Sheet [Online] World Wide Web, Available From: http://www.forbes.com/2002/07/25/accountingtracker.html (Accessed on October 24^th 2011)

iiiSamuelson, Paul A; Nordhaus, Paul D (McGraw Hill, 2010) Economoic 19^th ed P.295. ISBN: 978-0-07-070071-0

ivn.a. (Business Software Alliance, 2008) Software Industry Facts and Figures [Online] PDF Document, Available from: http://www.bsa.org/country/Public%20Policy/~/media/Files/Policy/Security/General/sw_factsfigures.ashx (Accessed on October 24^th 2011)

vW. D. Ross (Oxford University Press, 1930, Reprinted 2002) The Right and Good ISBN 0-1-992-526-53

viYin, Sarah (PCMag, 2011) Rim Cuts 2000 Jobs, Reshuffles Management [Online] World Wide Web, Available From: http://www.pcmag.com/article2/0,2817,2389071,00.asp (Accessed on October 24^th 2011)

The Nature of Chaos

2011-10-16T21:04:00.000-07:00

"The world must actually be such as to generate ignorance and inquiry; doubt and hypothesis, trial and temporal conclusions... The ultimate evidence of genuine hazard, contingency, irregularity and indeterminateness in nature is thus found in the occurrence of thinking."

- John Dewy (1958)ⁱ

The software enterprise consists of a vast forest of applications with each serving it's own genus and function, each program and system maintaining it's relevant business function. This “Ecosystem” has many dependent factors however it's usually a homogeneous environment, where most systems within an organization are similar in nature or utilize a similar base computing system to ensure that function and form are not chaotic.

To take an organization that has a “Chaotic” environment and standardize it is to undergo the process of maturity or the cyclical process of software and hardware audits according to existing standards and determine which gaps if any exist and what is required to remedy them.

The key aspects to consider in organizing the software enterprise are to determine which standards and guidelines may add value to said organization and to develop a plan to implement them by using or devising road maps to apply said standards by using formal methodologies such as CoBIT from the ISACA.(ISACA,2010)ⁱⁱ

CoBIT is a methodology used to manage methodologies; an example would be to formally apply the CMMI from SEI to an organization to determine the maturity levels and gaps. The CMMI is available free of charge from the SEI at Carnegie Mellon and it incorporates a lot of the standards and process from Six-Sigma. The CMMI is a collection of best practices (SEI, n.d.)ⁱⁱⁱ, so given that it is a collection of what can be done; determining what must be done is a matter of business practice in Gap Assessment and Impact Assessment as well as Risk Assessments and value assessments for the organization's core business practices; the CMMI-DEV would apply if the organization is a development house, the CMMI-SVC may apply if the organization offers services.

In addition to utilizing methodologies to adopt standards we would also need to consider which standards we must adopt to reduce chaos; The ISO standard for software development quality assurance is 9000-3 the current iteration of this standard is entitled ISO 90003:2004 and is available from the ISO/IEC.(ISO, 2004)^iv Other relevant standards include the IEEE 12407, ISO/IEC 15504 for quality assurance plans, ISO 27001 and ISO 27002 to improve the organizations security stance.

Standardization is one method to ensure that a software enterprise is producing quality secure software of great value but it cannot do this without having an enterprise project management office in place to ensure that the desired standards are being met with the current versions or methods thus we must also ensure that project management methods are being observed as well such as the broad adoption of SDLC.

In addition to the above formal methods there is also the question of good “Due Care” as defined by the (ISC)2.(Tipton, 2010)^v Is the corporation or organization engaged in planning for business continuity? Disaster Recovery and Availability requirements? Are all of these formally defined and understood by both the Executive and Employees of all departments; thus not limited to just IT.

Thus the key considerations for any software enterprise are weather or not the office environment is standarized and mature? Is every desktop in said software Enterprise managed by a formal methodology including ITSM standards from the ITIL as defined by the U.K. Office of Government Commerce(ITIL, OGC, 2010)^vi; such as Release and Problem Management along with formal Configuration and Change management? The other common sense consideration is; Does the people, process and technology function as they should to achieve the business goals of the organization?

Now the reasons behind the adoption of standards, methods, and methodologies to be used to apply said standards to said software enterprise are very simple; they are industry proven methods used to improve the value, availability and quality of the software enterprise. The people and process may be simple, the technology is complex and the goal is to reduce the amount of chaos within the software enterprise to a manageable level that can be quantified and measured and reported upon. Not only will this increase the organizations competitiveness it will also make it a far more secure and resilient entity; however we are assuming that these standards methodologies and processes are adopted and implemented with care and wisdom as endorsed by the Executive and understood by the employees.

The ecosystem in a rain-forest is wonderfully diverse and very deadly. The ecosystem in a managed forest is less complex and far more habitable as well as productive. The goal of the exercises in adoption of methods and standards by the nature of assessment and feedback; is to change the nature of the software enterprise from a risky and chaotic stance to a risk averse and standardized one that is measurable and quantifiable in human terms.

If we are unaware of the dangers lurking in the trees how can we ever hope to produce any paper?

Conversely if we have diverse separate groups of individuals formulating software projects with no oversight or consideration for goals in quality or management how may we ever hope to maintain our level of quality or client base?

iKellert, Steven H. (University of Chicago Press, 1993) In the Wake of Chaos P.1 ISBN: 0-226-42976-8

iin.a. (ISACA, 2010) CoBIT 4.1 [Online] PDF Document, Available from: http://www.isaca.org/Knowledge-Center/cobit/Pages/Downloads.aspx (Accessed on October 16^th 2011)

iiin.a. (Software Engineering Institutie, Carnegie Meallon Unviersity, 2010) CMMI Solutions: Process Areas [Online] World Wide Web, Avaialble from: http://www.sei.cmu.edu/cmmi/solutions/index.cfm (Accessed on October 16^th 2011)

ivn.a. (ISO/IEC, 2005) Software engineering -- Guidelines for the application of ISO 9001:2000 to computer software [Online] PDF Document, Available from:http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=35867 (Accessed on October 16^th 2011)

vTipton, Harold F. (Taylor & Francis, 2010) Official (ISC)2 Guide to the CISSP CBK, Second Edition P. 266 ISBN: 978-1-4398-0959-4

vin.a. (APM Group LTD. 2007) Official ITIL Website [Online] World Wide Web, Available from: http://www.itil-officialsite.com/ (Accessed on October 16^th 2011)

Privacy in the Information Age

2011-10-11T09:13:00.000-07:00

Computing has many capabilities and information technology is now a driver for most business ventures including multi-billon dollar companies such as Google, Microsoft, IBM, Oracle, Facebook and Amazon.

The following five basic capabilities are available to any organization via investments in computing

infrastructure.

Long term record storage

The advent of inexpensive desktop and pocket computing has had as much of an influence on business and the Gutenberg press did on the dissemination of information over two hundred years ago. Computing facilities now house all the records for most organizations in a digital format on a file system usually residing either on a series hard drives or a highly available and redundant Storage Array Network; Having these commuting resources allows an organization or business the ability to store records of all practices and procedures; these include records of communications and meetings in the form of E-mail and minutes letters. We no longer measure libraries in terms of psychical storage space but we measure our available storage for information in the number of “libraries of congress” or Gigabytes of data that may be stored upon them. This facilitates the development of a long term corporate memory; where once an agent in an organization would have to peer over archives and file folders for hours on end to locate information they may now simply submit a query to an internal database of records to locate relevant data in the form of Documents, Communications, Actuarial Records (Books of business) or any other relevant information. The availability of vast amounts of information regarding various fields of science are turning once traditional fields of research involving psychical tests and trials into exercises in data management and mining. Cervek et al (1999)istate that the availability of a universal design of a data grid to access these now enormous data sets (peta-bytes of information) must follow a standardized format to ensure interoperability and that any research conducted upon it is sound. Long term storage equates to a perfect memory provided the integrity of the data that is stored is sound.

Knowledge Management

Knowledge Management is defined by Junpil Han and Mani Subrami (1999)ii as the ability to manage the intangible assets within an organization; that is to distribute and manage the intangible information within the individuals that work for said organization. Knowledge Management Systems are IT services and infrastructure that become business enablers and competitive advantages by ensuring that all the Value derived from the knowledge of an organization and it's business are maintained and transferable. This would not be possible without an investment in a Knowledge Management System which resides on computing infrastructure.

Business Process Automation

Business process automation can be loosely defined as the integration of automation engines within an organizations infrastructure; where each independent cost centre may be viewed as having it's own automation engines: ie; Finance and Accounting may use packages such as Accpack, Simply accounting ; Oracle Financial or people-soft to accomplish common tasks like payroll, renumeration and the calculation of balance sheets including current operations. Business process automation would involve the integration of these systems with business intelligence and marketing platforms to further automate various business processes such as “manufactering” or “software production”. Again business process automation requires that multiple IT sytsems be integrated and become aware of one another; this usually involves the adoption of WASDL or XMLRPC and web 2.0 based standards and data interchange. Examples of BPA include automation of the reconciliation of electronic books; say the payroll database with the transactions as input to the accounting platform from the bank directly; basically BPA allows an organization to streamline it's operations and realize effectiveness in staffing and human time by automation as much as can be automated.

General Purpose Computing

When Alan Turing conceived of his machine; the Turing Machine in 1936, Barker-Plummer (1995)iii as a means to conduct thought experiments with computing systems he did not realize at the time that it might be capable of simulating every algorithm ever created. Thus we may define general computing as the application of any system or algorithm by a computer to any data to obtain any information desired. General computing within the day to day activities of an organization would consists of the desktop operations of it's agents and their tool sets however complex or simple they may be. These include the mundane manipulation of information in spreadsheets all the way up ot the most advanced reasarch in statistical applications such as SaaS or similar scenarios. General computing is any computing inolving math and a computer.General computing is using records as maintained by long term storage to facilitate the creation of value or gleaning insight into the available data.

Interconnectivity of Working groups

The information superhighway in it's current form as defined by the companies that run these networks are a series of high bandwidth optical interconnections between geographically disperse municipalities, provinces, states and countries. Realistically the Internet is mapped by CAIDA project n.a. (2011)iv and is governed by international standards bodies in each country with access to it. What the INTERNET facilitates is rapid exchange of information among groups of geographically disperse agents. The nature of these exchanges is usually beneficial when business and commerce are concerned; the risks of interconnection arise when organizations expose themselves via unsound software or business practices in relation to the types and nature in which they engage in communicators on the INTERNET. The risks of Fraud and Exploit by agents in countries where little or no oversight exists has had academics move to the “INTERNET 2” which is a seperate ultra high speed network for the sole purpose of academia.

The current networks that are used by business to manage it's organization and employees are semiprivate or private by using security technologies such as application virtualization or the use of encrypted networks on top of the INTERNET such as Virtual Private Networks or SSL access gateways to ensure that employees have access to the information resources from where ever they may INTERNET access; as INTERNET access is fairly ubiquitous in the industrialized world then your organization may no longer be bound by psychical constraints of available office space. This of course gives rise to the notion of what methods and metrics are to be used to determine if an employee is productive or not; since in effect the punch clock is no longer a physical device. The benefits of utilizing the INTERNET vs physical presence are many, inexpensive video communications over instant messaging is the once dreamed of “Video Phone” and it was developed by software companies not phone companies; this inexpensive access allows organizations to compete at a multi-national level with few key resources conducing far more specialized work in local or remote locations. Many organizations of today including some of the top preforming public ally traded companies reduce travel and operations costs by having virtual meetings.

The Death of Privacy

Privacy still exists as a legal fiction; the police and state may not commit transgressions against an individuals privacy such as searching or monitoring their communications without due cause which is defined by Canadian common law as the procedure and process of hearing before a judge to obtain a warrant to engage in surveillance. This due process is a major component in Habeas Corpus (the write to equality before the law) and forms the basis upon which civilized society functions. The truth about privacy is that it is long dead; it was killed by Visa, MasterCard, American Express, Facebook, Google, LinkedIn, Twitter and Microsoft. The standards of Web 2.0 had a minor role but the agents are these companies and their core business of managing and presenting our information to us. Google is the worst offender when it comes to privacy, it is estimated that Google has over 1,000,000 systems operating in a custom designed cluster as an amalgamation of data-centers across the globe; mostly in north america; hwoever to ensure speedy searched they co-locate as close to major populations as possible. When Eric Schmidt, Richmond (2010)v the previous CEO of Google once stated:

“Our company’s policy is to get right up to the creepy line and not cross it”

The Privacy commissioner in Canada filed a Law suit following the comment and the ensuring enquiry was designed to determine what information Google maintained on the infamous and useful “Street” view trucks; as it turned out, Google would also sample any WiFi networks that were available when driving; they kept this information internally, although they did not publish the WiFi information the use of this information without consent of the owners of these networks in Canada was a clear violation of The Privacy Act.

Recently the CEO and Founder Reid Hoffman of Linked In in the Davos Annual Meeting vistated that:

“Privacy Issues are for Old People since the value of connection is greater than privacy issues”

George Cummings the CEO of Forserter stated that (2010):

"The 15 most trafficked sites of the world seven of them social sites; which constitutes 5 to 6 hours of a day on the consumption of media, twitter has over 25 million unique visitors per day, Facebook 130 million users per day, my space 50 to 60 unique visitors per day, and linked in about 15 million and ming about 6 million these are from Com-score."

Only 17% of the on-line community uses social networking sites; the age ranges are aimed at younger INTERNET users. Thus the current trend is adoption among young adults. In addition to the social networking sites, on-line search and Geo-lcation services; the other major offenders are our own Institutions, our provincial and federal governments in efforts to ease access to our own services these include the databases of our hard information such as property ownership, licensing and registration information as well as birth and death records via sites like “Ancetry.com” where we may review and pay for our genealogy. In addition to these our banks and creditors routinely track our purchases to better serve us and to glean information into our spending habits.

Thus the organizations that have served us for so many decades now with the advent of inexpensive

computing by utilizing the above five capabilities of computing on various large scales; may now

maintain a permanent memory of every action we may have ever been involved with, including any

pictures that others have taken of us or any records we may maintain in any municipal or federal

government. Thus we may see that large businesses have made huge profits by simply asking us to

disclose information we see as valueless to facilitate connection and communications in a transparent

manner but by doing so we have sacrificed our privacy for temporary and transient communication and

connections. I believe that the value of a shared identity is and having a smaller global village is very

real but I also believe that the value of my privacy is incalculable it's a right in my country and I'd like

for my children to enjoy this right as well.

i Ann Chervenak , Ian Foster , Carl Kesselman , Charles Salisbury , Steven Tuecke (1999) The Data Grid: Towards an Architecture for the Distributed Management and Analysis of Large Scientific Datasets [Online] PDF Document, Available from: http://citeseer.ist.psu.edu/viewdoc/summary?doi=10.1.1.32.6963 (Accessed on October 10th 2011)

ii Hahn, Junpil; Subramani, Mani R. (1999) A framework for Knoledge Management Systems Issues and Challenges for Therory and Pratices [Online] PDF Document, Available from: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.114.7693&rep=rep1&type=pdf (Accessed on October 10th 2011)

iii Barker-Plummer, David (2011) The stanford encylopedia of philosophy [Online] World Wide Web, Avaialble from: http://plato.stanford.edu/entries/turing-machine/ (Accessed on October 10th 2011)

iv n.a. (2011) CAIDA Visualizations [Online] World Wide Web, Avaialble From: http://www.caida.org/publications/visualizations/ (Accessed on October 10th 2011)

v Richmond, Shane (October 25th ,2010) How Google crossed the creepy line [Online] World Wide Web, Avaialble from: http://www.telegraph.co.uk/technology/google/8086191/How-Google-crossed-the-creepy-line.html (Accessed on October 10th 2011)

vi World Economic Forum, (2011) Davos Annual Meeting 2010 - The Growing Influence of Social Networks [Online] Video,http://www.youtube.com/watch?feature=player_embedded&v=pexGCUPlUeA#! (Accessed on October 10th 2011)

The Furlong may take a Fortnight and weigh a Firkin

2011-09-08T20:13:00.001-07:00

A project metric is defined any data that may be mapped by a function of math.ⁱ Functions used upon these metrics include; Measurement, Comparison, Analysis, Synthesis, Estimation and Verification.

Performance metrics are defined as any metrics that are used to derive value for a given system under scrutiny, these include financial metrics, intangible projections and EVM related data.ⁱⁱ The process of generating metrics consists of defining requirements for measurement, and developing the measures to determine if said requirements are met as well as establishing well defined targets to measure against.

Methods used to create these metrics include project charting using earned value management, the use of performance based logistics or defining and methods to determine key performance indicatorsⁱⁱⁱ.

Key performance indicators may be classified as into the following groups:

Quantitative

Practical

Directional

Actionable

Financial

Each of these indicators can be used to develop Balanced Score Cards, HeatMaps or as inputs for SWOT or magic quadrant analysis for a given project and it's deliverables. These also include the various methods of charting such as Histogram, Candlestick, Inverted bar, and others.

The distribution of this information once it's created may be via standard methods including e-mail or the internal network (the intra-net) of an organization where proper security and accounting controls may be used to audit and control access to this information as key performance indicators on a major project can indicate corporate risk appetite and potentially damage the reputation of the company or organization should they be disclosed publicly. Eg; when Sony online's network were breached their stock dropped 15% in less than one week due to widespread fear of public reprisals including class action suits due to said disclosure. If a company or organization is spending millions on a software project to improve it's security stance the very existence of this expenditure could affect public confidence. As Tzun Tsu stated “The basics of all combat rely upon a foundation of secrecy”.

The methods cited here are by no means exhaustive such as Six Sigma or TQM as cited by Schwable; however they are used frequently enough to warrant discussion.

Another issue is the standardization of a given organization to agree upon the methods to be used beforehand to ensure consistency in the delivery of these project performance metrics as if the data cannot be read and understood than it might as not exist in the first place. Thus if the organization agrees to conform to ISO 9000 and then standardizes on ISO 12004, 10007, and 15403 for quality management they must also standardize upon the project methodology and related performance metrics to be reviewed by each of these procedures to ensure that they are both consistent and understood.

Thus we may define what performance metrics we wish to measure within our project, apply a ruler of our own design and in turn derive value from the reports generated to be used as inputs for business decisions related to our project in question. Odd units of measure that come to mind are the inverse femtobarn, attoparsec or hoppus foot, for projects we may define dollars per hour per objective feature as a standard if we so wish for efficiency, or time per line of code (t over kloc) per project.

iPocatilu, Paul (Revisita, Informatica Economia, 2007) IT Project Metrics [Online] PDF Document, Available from: http://revistaie.ase.ro/content/44/26%20pocatilu.pdf (Accessed on September 8^th 2011)

iiBrown, Mark Ghram (Productivity Inc. 1996) Keeping score: using the right metrics to drive world-class performance P. 6 – 10 ISBN: 0-527-76312-8

iiiFitz-Gibbon, Carol T. (Blank House, BREA Dialouges, 1990 – 2 ) Performance Indicators ISBN: 1-85359-093-2\

How to Motivate Project Teams

2011-08-25T19:18:00.001-07:00

Ultimately a project manager must determine the best method to motivate their team; the greatest leaders in business use oration to inspire; money to reward and business intelligence to analyze effectiveness.

Methods and Tests

Schwable states that there are the following motivations^ⁱ;

Intrinsic Motivation is classified as motivation that is derived from the nature of the work; ie; a boat builder probably enjoy's sailing, which may be why they studied the profession; a writer may enjoy writing; a programmer may enjoy thinking in mathematical abstraction or the challenge of reorganization abstracted data in a useful way.

Extrinsic Motivation is classified as the tratditional risk reward axis, reward of money for services rendered, risk of bieng unemployed or homeless. These are “Extrinsic” to the subject in question.

The following psychological models may be used;

Myers-Briggsⁱⁱ otherwise refereed to as the MTBI indicator test.

Abraham Maslow, and his Hierarchy of Needsⁱⁱⁱ

Frederick Herzberg, and his Hygienic theory behind the Motivation to work.^iv

David McClelland developed the Thematic Aperception Test which is similar to a Roschact test and designed to be analyzed to discern the subjects unconscious intent. The formal methods include the DMM and SCOR standards.^v

Douglas McGregor's Theory X and Thoery Y.

As with the information age, the nature and power of computers coupled with magnetic resonance imaging has allowed us to realize that most psychological arguments and models are incorrect in fact the entire ontology of human motivation is now being remapped within medical science; including the nature of being (self) and the nature of motivation; this shift in paradigms will supplant most psychology with functional neuroanatomy; where motivation is classified as a given state within a persons connectome as mapped by the anatomy of their mind.

The nature of human anatomy

Levey States the following about Motivation.^vi
“To relate motivation, a psychological concept, to a neurobiology substrate requires that this concept should be translated in operations relevant at the biological level. The term of motivation includes mental elementary processes decoding the emotional value of a stimulus (endogenous or exogenous) and integrating it into the elaboration, control and execution of goal-directed behaviors in order to ensure the maintenance of homeostasis, the well-being and survival of the individual and the species. Thus, in experimental condition, responses to aversive or appetitive situations are the classical markers of motivation. Consequently, the cerebral network of motivation particularly relates to the limbic system, i.e., the amygdala, the orbital and ventromedial prefrontal cortex, the anterior cingulum and the ventral striatum. Within this network, it is possible to distinguish: on one part structures such as the orbital and ventromedial prefrontal cortex, which are essential for the highest level of adaptive responses, allowing the individual to decode the variations of the emotional contingencies in real time, to integrate them into the behavior, and to maintain a behavioral choice during a long course, regardless of endogenous or environmental constraints; on the other part structures like the amygdala allow to build stable and invariants behaviors, that can be automatically activated and are essential for survival and avoidance of noxious situations”

Vilayanur Ramachandran states that the only difference between humans and their individual perception of reality is due to the input from their skin via the autonomous nervous system; which is located and occuled (limited or restricted) within the mirror neurons and the fusiform gyrus; both of these components of the human mind have evolved in the last 75,000 to 100,000 years^vii leading to our use of language, fire tools and every last component in civilization; his research with functional MRI's and Phantom limb pain has shown that all abstracted thought is centered upon the fusiform gyrus located in annular gyrus region of the brain; in humans this portion is eight times larger than in other primates.^viii Thus the nature of all abstracted thought, the center of all creativity lies in this area of the mind it is the intersection of stimuli of the visual, auditory and sensory regions; as he states it's the seat of self.

Management Tools

Motivational Theories since they are based in psychology are suspect as they lack objective specificity when compared to an FMRI study using modern medical techniques; however we may infer from Ramachandrands and Levy's findings that due to very basic motivation either greed or the desire for positive outcomes from various challenges as mentioned in Intrinsic and Extrinsic motivations as they filter through the structure of our minds as specific stimuli; these could theoretically be mapped with fmri to determine the exact areas of the mind the specific anatomy that objectively requires stimulation; however as Project managers we cannot implant neural stimulation devices and must substitute tangible rewards and penalties involving the models mentioned in this lecture which we hope have an equal net effect in said regions; these include monetary gain and peer acceptance, as well as loss and rejection. The old add age holds true that it is far easier to bait a horse than to whip it.

Influence And Power

Influence and power are mentioned by Schwable, however I have found that influence is subjective and power often fleeting; Power is too often abused by those that wield it to an end where the team is dissolved and the risk of failure is high.

Effectiveness

Determining effective methods for team motivation include developing a performance assessment program that is concise and driven by the subject in question; if we allow our team members to specify their respective goals than we may find that they will be aided or determine what these goals may be and may help formulate them in the process. This standard is practiced by a number of organizations; using training subsities and or mentoring programs are excellent methods to develop effective influence over employees and project members alike; the goal is to instill a relationship of trust and empowerment within the team to accomplish whatever task lies ahead, the methods used to do so are quite moot.

Distributed Projects

Since this discussion is about motivation in distributed projects, we can use the entire “Open Source” community as a refrence. RedHat, Ubuntu, Seles, Gentoo in fact every distribution of linux are developed as geographically diverse sets of programmers use standard and formal methods for revision control, auditing and review to develop large families of tool sets. A distribution is defeined by it's parent organization with respect to the organization they have a different business model than the traditional one of a software house in that by opening their code responsibilities to public editing they have further reduced the over all cost of development whilst only maintaining key control over functions and quality of the thousands of programs that make up an OS. Opensource and it's movement uses the primary motivation of programmers to distinguish themselves within their chosen peer group; the financal reward with this business model comes in the forms of consulting, support and administration of said systems. Organizations that make billions on their backs include SAP, IBM, Oracle and others.

The Truth about Managers

The truth about great project managers and leaders is that they do not manage at all; they simply find the best method to remove apathy from the team they are working with and find ways to challenge them to achieve the desired goal. I have in the past used only Expert Advice and Rapport alone to achieve our project goals as defined by my clients; these have included Compliance with SOX, Implementation of X509/ PKI systems according to federal government standards and distributed security systems; in each project I worked as a member of a team and my primary contributions apart from technical expertese was direction and guidance on how to achieve our desired goals.

References

iSchwable, Kathy; (Cenguage Learning, 2009) Informaiton Technology Project Management 6^th ed ISBN:978-0-324-78692-7

iiMyers,Peter B; Briggs Isabel(Davies-Black Publishing, 1995). Gifts Differing: Understanding Personality Type. ISBN 0-89106-074-X

iiiMaslow, A. H. (Psycological Review, 50, 1943) A theory of Human Motivation [Online] World Wide Web, Avaiable from: http://psychclassics.yorku.ca/Maslow/motivation.htm (Accessed on August 24^th 2011)

ivHerzberg, Fredrick; Mausner, Bernard; Synderman, Barbra Bloch (Transacation Publishers, 2009; 12^th Reprint of John Wieley and Sons 1959 ed) The motivation to work ISBN: 1-56000-X

vWesten, Drew. (Journal of Personality Assessment, Volume 56, Issue 1 February 1991 ) Clinical Assessment of Object Relations Using the TAT. p. 56 - 74.

viLévy R. (Fédération de neurologie et Inserm U 610, Hôpital de la Salpêtrière, Paris., December 24^th 2004) The neuroanatomy of motivation in man [Online] PDF Document, Available from: http://www.ncbi.nlm.nih.gov/pubmed/15683980 (Accessed on August 25^th 2011)

viiVS Ramachandran (TED Talks, November 2009) The neurons that shaped Civilization [Online] Video Lecture, Ted Talk, avaiallbe from; http://www.ted.com/talks/vs_ramachandran_the_neurons_that_shaped_civilization.html (Accessed on August 25^th 2011)

viiiS Ramachandran (TED Talks, March 2007) VS Ramachandran on Your Mind [Online] Video Lecture, Ted Talk, avaiallbe from; http://www.ted.com/talks/vilayanur_ramachandran_on_your_mind.html (Accessed on August 25^th 2011)

Zen and the art of the accurate estimate

2011-08-18T21:23:00.000-07:00

Schwable states that Estimates are difficult for the following Reasonsⁱ:

Estimates are done too quickly
Lack of Estimate Experience
Humans are biased towards underestimation
Management Desires Accuracy

In addition to these difficulties there are many methods that may be used to estimate the cost of a software project including:

Top-Down Estimatesⁱⁱ
Bottom Up Estimatesⁱⁱⁱ
Parametric Modeling ^iv
COCOMO^v
COSYSMO^vi
Event Chain Methodology^vii
Function Points^viii
Program Evaluation Review Technique (PERT)^ix
Proxy Based Estimation (PROBE)^x
The Planning Game^xi
Weighted Micro Function Points^xii
Wideband Delphi^xiii

Thus far within the confines of project estimation that we have examined the art of “triangulating” a project estimation method using a top-down and bottom up approach promises to be both the most efficent and accurate method; However Grimstad et al. State that one of the greatest risks of failure for any software project is a “Reliable cost estimate” as previously stated by various studies.^xiv

The etymology of the term to “Estimate” is from Latin, and it's origin is a “Builders statement of projected costs”, from 1796 OED. Builders have the luxury of using tangible assets to develop costs upon.

Software is intangible, that is to say ultimately we may use metrics to measure software but these standards include “Guessing” how many lines of code may be required for a non-existant function, or how many man hours may be derived using Bohem's COCOMO estimates. Since software is based in the art of describing functions in a language of Mathematica abstraction, this abstraction itself further lends to the difficulties of developing an “estimate” of how many lines of code may be needed in what programming language for which function.

Given that we may select a methodology and develop metrics based upon empirical data with a given project; we may assume that we must use estimates based on previous projects with the same group of people, that is to say we must have previous work completed to compare against to help in developing a more accurate method to estimate future projects; this is a common practice derived primarily from fiscal budgeting and actuarial standards ; ie if a given business wishes to develop estimates of income they will use the previous years sales as a starting point; so to would a software development house use the previous years number of lines of code vs profit gained and man-hours of work as metrics for the next or any other quoted project.

The biggest problem in software cost estimation is the simple fact that even considering all of the research, and formal methods we may use; it's still just a very educated and formalized guess at a given cost.

Just as the old proverb states; the only constant in life is change; that is next to death and taxes, so given that the industry of software development is that with the greatest risk and potential for profit the amount of change within the software market in a given year is gargantuan when compared with more traditional areas or segments of industry.

The core business of mining resources for use has not changed in a millennia, neither has farming or travel; all of these sectors realize greater efficiencies in the information age by using software and automated systems along with great leaps in technology.

In the information age the rate of change and evolution is increasing as stated previously by Ray Kurtzweil; although he predicts systems with greater intelligence than their human agents at some point in the near future until then we are the agents of change within the software industry.

The biggest problem in developing accurate cost estimates for any given software project is change; Change in the scope of the project, change in the market forces driving the products development, internal recursive changes in the code used by the programmers to develop the project and a change in the project environment and business including change in it's risk profile or even change composition of the development and testing team of resources for said project.

We can model projects with a fair degree of accuracy given a few constants; these include the teams of people involved in the project, their expected salary, the variance in the software market which is far more volatile than most commodities and securities markets and the expected revenues from the project given previous years market data. However if any of those constants change with respect to the project then we must revisit it's model and cost estimate to maintain an accurate view.

A simple analogy for project costing would include how economists model the prime interest rate for a country. The models used over time vary; but the goal of the rate remains the same to maintain a stable level of inflation.

They may use any models at their disposal or even develop custom models using automated systems but ultimately at the highest levels of research the numbers used for CPI, GDP and the like are aggregates of averages; thus the amount of removal or abstraction in the process may not compensate for a change in the global economic environment. These models are slow to react to change.

Thus any methodology used to develop cost models may use aggregates of averages or even aggregates of aggregates to develop a high level idea of what an enterprise spends on all of it's projects but ultimately these models are all so completely abstracted from reality that they must be sanity checked against expenditures to ensure that they hold any ounce of accuracy. Each of these processes is sensitive to change and although we excel at placing variance in an automated system; we still require experience and previous data upon which to develop our cost models.

This reason alone is why many software startups fail, even why many business fail.

iSchwable, Kathy (Cengage Learning, 2010) Information Technology Project Management P.263 ISBN: 978-0-324-78692-7

iiSchwable, Kathy (Cengage Learning, 2010) Information Technology Project Management P.264 ISBN: 978-0-324-78692-7

iiiSchwable, Kathy (Cengage Learning, 2010) Information Technology Project Management P.264 ISBN: 978-0-324-78692-7

ivSchwable, Kathy (Cengage Learning, 2010) Information Technology Project Management P.265 ISBN: 978-0-324-78692-7

vBohem, Barry; Clark, Bradford; Horowitz, Ellis; Westland, Chris (USC, USC Center for Software Engineering, Annals of Software Engineering, 1995, 57-94)

viValderi, Ricardo (University of Sothern California, August 2005) THE CONSTRUCTIVE SYSTEMS ENGINEERING COST MODEL [Online] PDF Document, Avaialble from: http://csse.usc.edu/csse/TECHRPTS/PhD_Dissertations/files/Valerdi_Dissertation.pdf (Accessed on August 17^th 2011)

viiAktasa , Nihat; de Bodta , Eric, Cousinb, Jean-Gabriel (IAG Louvain School of Management, Université catholique de Louvain, Belgium, November 13 2006) Event studies with a contaminated estimation period [Online] PDF Document, Avaialble from: http://www.sciencedirect.com/science/article/pii/S0929119906000290 (Accessed on August 17^th 2011)

viiiCapers, Jones (McGraw-Hill, 2007) Estimating software costs: bringing realism to estimating P.246 ISBN: 978-0-07-148300-1

ixKeefer, Donald L.; Verdini, William A.; (Arazona State University, Departemnt of Decition and Information Systems, Management Science, Vol 39. No. 9 September 1995) Better Estimation of PERT Activity Time Paramaters [Online] PDF Document, Available from: http://www.jstor.org/pss/2632814 (Accessed on August 17^th 2011)

xJohnson, Philip M.; Moore, Carleton A.; Dane, Joseph A.; Brewer , Robert S.; (Unversity of Hawaii, IEEE, 2000) Empirically-Guided Software Effort Guesstimation [Online] PDF Document, Avaialble from: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.103.5058&rep=rep1&type=pdf (Accessed on August 17^th 2011)

xiWilliam A. Wood, William L. Kleb (IEEE, NASA Langley Research Center, Issue 3, May / June 2003) Software Exploring XP for Scientific Research [Online] PDF Document, available from: http://doi.ieeecomputersociety.org/10.1109/MS.2003.1196317 (Accessed on August 17^th 2011)

xiiSymons, Charles; (Proc. of the 4th European Conf. on Software, 2001) Comeback Function Point Analisys (Modernized) All is Forgiven! [Online] PDF Document, Avaialble from: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.8.2999&rep=rep1&type=pdf (Accessed on August 17^th 2011)

xiiiWiegers, Karl E. (Process Impact, 2000) Stop Promising Miracles [Online] PDF Document, Available from: http://www.uml.org.cn/SoftWareProcess/pdf/delphi.pdf (Accessed on August 17^th 2011)

xivGrimstad, Stein; Jørgensen, Magne; Moløkken-Østvold, Kjetil; (Journal of Information and Software Technology 48(4):302-310 , 19 April 2005) Software Estimation Terminology: The Tower of Babel [Online] PDF Document, Availble from: http://simula.no/research/se/publications/Grimstad.2006.1 (Accessed on August 17^th 2011)

The nature of Input

2011-06-29T07:46:00.000-07:00

All software regardless of purpose, size or cost is designed to conduct three functions; take input, process data and produce output. The environment and purpose of the software determine how the input is generated and the design and operation determine how it is used with resident data and what actions are preformed upon said data. The output may be used by people or other programs or stored in a database.

The cost of securing an application increases exponentially after the application has been developed, thus securing an application is far less expensive during its development.

The secure software development life cycle processes as defined by the following article from homeland security as a survey of current standards and methodologies.

“This article presents overview information about existing processes, standards, life-cycle models, frameworks, and methodologies that support or could support secure software development. The initial report issued in 2006 has been updated to reflect changes.”[DN][i]

Software testing is useful for developing processes that aid in the maturity of an organizations ability to determine software failures; security testing directly increases the software value however since time to market is king it’s often an afterthought or built in during subsequent revisions to the desired applications.

The primary method used to test the security of developed software is called “Fuzz Testing”, Fuzzing is designed to test the method in which input fails in a given application and how to rectify the underlying issue that caused the failure.[NJ][ii]

Other methods of software testing include Black-box, Grey-Box, Decision Table, all-pairs, state transition tables, equivalence partitioning and Boundary Value Analysis; with respect to security we are only concerned with Black Box as the defining characteristic is that there is no foreknowledge of the system under test, where the faults may be decomposed in a disassembled such as IDA Pro or GDB.[BCS][iii]

Ultimately the nature of input is unknown and as such may never be predicted, since the manipulation of input is constrained by the mechanics of the machine in question be they; memory, language, stacks used, constructs, storage media or communications channels dictate which vulnerabilities may occur and although we may mitigate the failures in the mechanics of a program change will always introduce new areas to exploit.

Software Security defined by the (ISC)2 is ensuring that due care and diligence have been observed in the design and implementation of a given platform; according to the Software Engineering Institute (SEI), Capability Maturity Model for Integration and SCAMPI may even be integrated with ISO 21827 [ZM][iv]; even then these methods only ensure that the software under test functions within the limits of the designed test cases for the allotted standards to be tested.

The nature and defining characteristic of software security is that when it does fail due to invalid input within its procedures; it does so gracefully without affecting other system components or memory areas within the system in question.

References

[i] [DN] Davis, Noopur, Carol Woody (CMU, Software Engineering Institute 2009) Secure Software Development Life Cycle Processes [Online] World Wide Web, Available from: https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/sdlc/326-BSI.html (Accessed On June 23rd 2011)

[ii] [NJ] Neystadt, John (Microsoft, 2008 ) Automated Penetration Testing with White-box fuzzing [Online] World Wide Web, Available from: http://msdn.microsoft.com/en-us/library/cc162782.aspx (Accessed on June 23rd 2011)

[iii] [BCS] n.a. (BCSSIGST, 2001) Standard for Software Component Testing [Online] PDF Document Available from: http://www.testingstandards.co.uk/Component%20Testing.pdf (Accessed on June 23^rd 2011)

[iv] [ZM] Zimme, Mark K. (Booz |Allen | Hamilton, 2004) Secure and Mature: Combining CMMI SCAMPI with an ISO/IEC 21827 (SEI-CMM) Appriasial [Online] PDF Document, Available from: http://www.sei.cmu.edu/library/assets/zimmie-secure.pdf (Accessed on June 23rd 2011)

A Brief Synopsis of Micropayments

2011-06-21T08:30:00.000-07:00

A micro-payment is defined by visa as any transaction of a value below $20 U.S.D.[V][i]. The World Wide Web consortium also maintains the micro-payments initiative which has recently been closed; one major reason for the cessation was that organizations such as Paypal and Ebay have developed far more pervasive systems using existing W3C standards [W3C][ii].

Micali et all defined a micro-payment as:

A payment Scheme consists of a set of protocols involving at least three basic parties: An individual, buyer or user, the merchant and the bank. These could be individual entities – such people, device or computer programs or collections of entities.[MSRR][iii]

Transactions across the internet must be encrypted and are usually conducted utilizing transport layer security and x.509 based certificates. Security is a necessity of any financial transaction regardless of location. Companies such as PayPal process hundreds of thousands of transaction requests per day as micropayments are their primary business [PP][iv]. The core of a PayPal transaction is an embedded XML request that transfers the transaction to PayPal for processing directly on pay pals web-servers. Merchants including Ebay use paypal as a payment processor. Paypal uses standard Transport layer security to ensure that the session for the transaction is secured. The core value of PayPal is that as an intermediary they protect the identity and details of the purchaser from the merchant for the duration of the transaction.

One major trend in micro-payments is the use of Peer to Peer technologies to support the transaction as opposed to traditional XML or XMLRPC over encrypted links to facilitate transactions; one example is PPay a recently developed peer to peer based transaction protocol that uses a “floating self managed currency” [YB][v] Another not yet widely adopted online currency is the BitCoin which is based upon the ideas of PPay but utilizes a proprietary PKI based mechanism to transfer generated hashes between parties as a form of virtual currency. [NS][vi]

The goal of Bit coin is to facilitate transactions without the need for a broker or bank such as Paypal or Visa but to have the parties agree to exchange “bitcoins” for goods and services. Bitcoin achieves security by using encrypted connections to transfer hashes generated by using the public key of the receiver and the private key of the sender using PGP and AES as it’s incredibly secure and due to the nature in which bit coins are generated they are very difficult to if not impossible to fabricate. However bitcoins are not a micropayments but a virtual currency similar with a novel micropayment protocol; similar to eGold or Flooz. Both eGold and Flooz failed due to low market adoption rates and that eGold was used for laundering and fraud.

The security considerations of all micropayments are traditionally referred to as fraud and or “Salami slicing” or “penny shaving” where the nature of the fraud involves various individual small manipulations of a system to amount to a large amount of fraud. Penny shaving was an actual practice at one point where the party would shave the edge of a penny to collect the copper whilst still retaining the ability to spend the penny. Although “Salami” techniques involve small thefts they are still considered fraud and computer abuse in most industrialized countries. The concern with micropayment and micropayment systems is the ability for “salami techniques” to be applied to them by using identity theft or fabrication and potential attacks on any transaction systems. As long as currency has value people will find ways to “game the system” regardless of any consideration for law; whether or not the currency is virtual or real is now a moot point.

References:

[i] [V] n.a. (Visa inc., June 24^th 2010) Visa launches a new way to pay online [Online] PDF Document, Available from: https://www.payclick.com.au/getattachment/e693f4a2-3e0b-4811-841e-5c43ef5aa19b/payclick-Press-Release-24-June-2010.aspx (Accessed on June 20th 2011)

[ii] [W3C] n.a. (W3C, Micropayments Initiative, 2010) Micropayments Overview [Online] World Wide Web, Available from: http://www.w3.org/ECommerce/Micropayments/ (Accessed on June 20^th 2011)

[iii] [MSRR] Micali, Sylvio; Rivest, Ronald L (MIT, Cambridge, Laboratory for Computer Science, 1997) Micropayments Revisited [Online] PDF Document Available from: http://people.csail.mit.edu/rivest/MicaliRivest-MicropaymentsRevisited.pdf (Accessed on June 20th 2011)

[iv] [PP] n.a.(Paypal Inc. n.d.) What is Paypal [Online] World Wide Web, Available from: https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/cps/popup/OLCWhatIsPayPal-outside (Accessed June 20th 2011)

[v] [YB] Yang, Beverly; Garcia-Molina, Hector (Stanford Unverisity, 2003) PPay: Micropayments for Peer to Peer systems [Online] PDF Document Available from: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.85.7457&rep=rep1&type=pdf (Accessed on June 20^th 2011)

[vi] [NS] Nakamoto, Satoshi (Bitcoin.org, n.d.) Bitcoin: A Peer-to-Peer Electronic Cash System [Online] PDF Document, Available from: www.bitcoin.org/bitcoin.pdf (Accessed on June 20th 2011)

Watermarks and Copyright

2011-06-20T20:21:00.000-07:00

What is Watermarking?

Watermarking is defined as placing information or data within a media file of any kind, Picture, Audio or Video. The watermarks are placed within the file in such a manner as to not affect the files function. Thus the Watermarked MP3, Picture or Video still function as Audio, Pictures or Video Files with the watermark in place. [VS]^ⁱ

How does watermarking Work?

Steganography

Petitcolas states that modern steganography originates in 1665[PF]^ⁱⁱ; the notion of hiding information in plain sight dates back to antiquity as militaries of all empires had to communicate across potentially “insecure” messengers; the term “Marathon” is actually from Greece where a solder named Pheidippides ran form Marathon to Athens a distance of 40 km and is said to have died after the run from marathon to Athens to give word that they had beaten the Persians. The Spartans used a “Cipher” stick as a means to encode and decode messages in either cloth or paper wrapped around it, if the paper or cloth had a pattern on it other than the message than we may assume that the message may have been steganographic in nature. Steganography is essentially the art of hiding information that is significant in the areas of data files usually in pictures, but they can also be audio or video files.

Least Significant Bit Manipulation

In binary, the lest significant bit is the on the right hand side, as it is either only a 1 or a 0 regardless of how large the number is. Changing the LSB has negligible impact on a JPG or BMP or GIF file if it’s done across multiple bytes of the image equally spaced throughout the image.[SB] ^ⁱⁱⁱ

Algorithms and Transformations

Most steganographic techniques involve the use of complex algorithims or transformations where the desired data to be hidden is planted in the file by either a propritary algorithm or a transform to the data that affects an insignificant portion of the file.

Masking and Filtering

Masking and filtering are alternate methods used to also hide information in images or data in transit where statistical analysis may be used. [DB]^{^iv} [TZ] ^{^v}

CDMA Blind Wavelet

There are many methods that one may use to watermark a file; recently, Maity et al. proposed the use of CDMA based blind wavelet transforms to the LL and HL bands of a media file; ie; a movie with CDMA encoded Text is a reliable method to hide information as well. The encoder and decoder would have to work on the same media files. [MS]^{^vi}

If i wished to hide information in an image or mp3 or Video file, i would first encrypt the message using AES via PGP, if it intended audience is a known associate of mine I'd grab their public key. Then using an application and codebook based transfer i would send a first message to the intended audience with a an encytped hint along the lines of the software needed to unencrypt the next message or I'd encrypt the photo and send it for analysis.

Stego Magic is free, I came across in this archive:

http://members.cox.net/ebmmd/stego/stego/softwarewindows.html

I would use it as it's the easiest client to use, however I'd add the ascii armoured text to the file as the steganographic message. The password would either be encrypted and sent; or would be transferred in an out of band channel.

My messages would be limited in size however Twitter get's the news out with only 140 characters, I'm sure I could manage to communicate with the same amount.

By encrypting the message I would be creating a 2^nd layer of anti-forensics; the first layer would be fact that it's hidden in plain sight in a picture; the second aspect would be that it uses AES on top of being hidden. An interesting side note is that XINE, an open-source media player has a plug-in to render HD content in ASCII; it make's for excellent key's for symmetric one way encryption; so you can use a movie reference as a secret message containing an out of band key that uses a reproduce-able 1080P based signal rendered in Ascii as it's decryption key. The difficult part is getting the reference in SMPTE timing but that's what codebooks are for.

Refrences

i [VS] Van Schyndel, R.G.; Tirkel, A.Z.; Osborne, C.F.; (Department of Physics, Monash University, Clayton, Vic, IEEE international Confrence on Image Processing Proceedings ICIP-94, November 1994) A digital Watermark [Online] World Wide Web, Available from: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=413536 (Accessed on July 16^th 2011)

ii [PF] Petitcolas, Fabien (Peticolas.net, January 2011) Hisotry of Steganography and Cryptography [Online] World Wide Web, Available from: http://www.petitcolas.net/fabien/steganography/history.html (Accessed on June 16th 2011)

iii [SB] Si, Brigitte (Athabasca University, 2004) Introduction to Steganography [Online] World Wide Web, Available from: http://www.infosyssec.com/infosyssec/Steganography/basics.htm (Accessed on June 16th 2011)

iv[DB] Dunbar, Brett (SANS, January 18^th 2002) A detailed look at Steganographic techniques and their use in an Open-Systems Environment http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.157.3117&rep=rep1&type=pdf [Onlline] PDF Document, Available from: (Accessed on June 16^th 2011)

v [TZ] Radhakrishnan, Regunathan; Kharrazi, Mehdi; Memon, Nasir; ( SpringerLink, The journal of VLSI Signal Processing, Volume 41, Number 3, P 293-303 ) Data Masking: A New Approach for Steganography? [Online] PDF Document, Available from: http://www.springerlink.com/content/p7r415u7876037jx/ (Accessed on June 16^th 2011) DOI: 10.1007/s11265-005-4153-1

vi [MS] Maity, S.P; Kundu, M.K; Maity Seba (ACM, 2009) Dual purpose FWT domain spread spectrum image watermarking in real time [Onine] PDF Document, Available from : http://portal.acm.org/citation.cfm?id=1507867 (Accessed on June 16^th 2011)

Universal Solution considerations for Insecure Communications Media

2011-06-14T20:38:00.000-07:00

Sometimes the largest hammer is used to conduct the finest tuning.

Ipsec is defined in RFC's 2401, 2409, 4301 and 4308. [IETF]ⁱ; IPSec's goal is to secure two communicating parties or networks via either an application to gateway or gateway to gateway communications. Where possible virtual private networks are created by the use of IPSec within organizations that maintain multiple campuses or offices. IPSec secures the entire TCP/IP stack by encapsulating all communications above layer 3 for either host to gateway or gateway to gateway or even network to network communications between two gateways.

XML is a standard upon which the “web 2.0” functions; it's a subset of SGML and it's goal is to act as a standard to serve and process content, the “Semantic web” as Burns-lee describes it is composed primarily of servers interchanging and presenting data from various servers of SGML. XML is defined by the W3C and is a standard used to define and markup data to improve interoperability between web-pages and browsers in a standardized format.[W3C]ⁱⁱ Most websites dynamic or otherwise on the internet today use XML with one or more dynamic content languages. XML may be secured by various methods including using TLS or by using the ECDSA algorithm which is based in ECC based digital signatures [IETF]ⁱⁱⁱ and XMLRPC is a formal data interchange standard.

S/MIME is a method used to secure Internet e-mail operations between compatible mail transfer agents as to ensure that the mime components of e-mail messages may not be compromised by anyone with access to the data in transit by using Public Key Infrastructure and X.509 based certificates. It's outlined in PCKS#7[RSA]^iv and the IETF standards 3369, 3370, 3850 and 3851.[IETF]^v S/MIME uses PKI to secure packets of e-mail in transit form one MTA to another MTA.

TLS is another standard widely implemented used primarily to secure web-sessions between a client and a server that also rely upon public key infrastructure. XML is usually secured with the use of TLS on the server serving content to web-sessions or clients. TLS is defined in RFC 5246.[IETF]^vi

Ipsec, TLS, ECDSA and S/MIME are standards and protocols that utilize efficient encryption to prevent external parties from viewing content in transit across a network of given nodes that may be hostile. This is refereed to as the Byzantine general problem. These protocols are not redundant but they are also not exclusive; each protocol serves a specific function with respect to communications between two parties.

IPSec will encapsulate S/MIME, TLS and SSL connections although doing so is not very efficient use of the given communications bandwidth on the network in question.

S/MIME and TLS will encapsulate XML based content in transit but it relies upon the client's level of trust with respect to public key infrastructure. ECDSA can be implemented to secure XMLRPC components with dynamically presented content where the origins are varied separate systems.

The common theme among all of these standards and protocols with the exception of XML is that they are designed to secure communications across an Ipv4 network, IPSec was originally designed for IP v6 as the IETF projected IP v4 address exhaustion in 1998. IP v6 is defined in RFC 2460 and is a newer and backwards compatible networking protocol with IP v4 that incorporates native IPSec support.^vii It's a replacement for Layer 3 communications within TCP/IP designed to meet the address assignment problems with IP v4.

Therefore we may assume that IP v6 can facilitate the adoption of a universal security standard; however even IP v6 has security considerations that must be addressed since it's not in widespread use and adoption rates are slow IP v6 contains many issuse's that need to be addressed. Vogel et al state that PKI for IP v6 is not widely adopted nor is IPSec adequate protection for integrity, Dual stack facilitates attackers hiding behind IP v4 NAT and gateways; there are also 16 methods to generate an address in IP v6 as such it may also be subject to spoofing attacks, in addition to this v6 uses computationally weak cryptographic checksums for integrity.[VD]^viii

Thus there may exist even within IP v 6 the need for TLS and S/MIME as standards to add further layers of security onto business critical functions such as messaging and web-sessions.

The nature of a single security solution being universal to the entire Internet would require formal implementation and standardization of “Insecure Provably secure network coding”[WY]^ix and “Perfectly Secure Message Transmission”[WY]^x and “Secure communication in multi-cast channels”[WY]^xi, once ratified these methods in conjunction with the existing methods in IP v6 would become a perfectly secure universal communications standard at the Nework Layer. There still lie issues with Identity management, this is an NP-Hard problem as the “Chinese delivery room” is still within the bounds of consideration for Identity when a computer is bieng used by a human; basically regardless of the level of effort every authentication system given enough time, effort and resources can be compromised in some way; allowing an attacker to impersonate or abuse another's identity and on-line addresses.

The issues that surround network security are around the enforcement of Law with respect to the source of most intrusions; since the Internet is global in nature failed states and states that do not maintain anti-fraud or computer abuse laws pose a threat to those that do; as the industrialized nations have no recourse outside of the communications network to peruse damages. Therefore it behooves us to ensure that the triumvirate of the Confidentiality, Integrity and Authenticity of all network communications are maintained for all authorized communications with respect to all parties engaging in business or research on line; this is one of the main reasons behind the development of the “Internet 2”; since Internet 1 has issues with both security and abuse.

i[IETF] Hoffman, P; (IETF, Network Working Group, 2005) Cryptographic Suites for IPSec [Online] World Wide Web, available from: http://tools.ietf.org/html/rfc4308 (Accessed on June 14^th 2011)

ii[W3C] Bray, Tim; Paoli, Jean; Spearberg-Mcqueen C. M.; Maler, Eve; Yergeau, Francois (W3C, 26^th November 2008) Extensible Markup Language (XML) 1.0 (Fifth Edition) [Online] World Wide Web, Available from: http://www.w3.org/TR/2008/REC-xml-20081126/ (Accessed on June 14^th 2011)

iii[IETF] Blake-Wilson, S; Karlinger, G; Kobayashi, T.; Wang, Y.; (IETF, UNCC, NTT, CIO Austria, BCI, April 2005) Using the Elliptic Curve Signature Algorithm (ECDSA) for XML Digital Signatures [Online] Availble from: http://www.ietf.org/rfc/rfc4050 (Accessed on June 14^th 2011)

iv[RSA]Kaliski Burton S Jr. Ph.D; Kingdon, Kevin W.; (RSA, May 13^th 1997) Extensions and Revisions to PKCS #7 [Online] PDF Document, Available from: http://www.rsa.com/rsalabs/node.asp?id=2129 (Accessed on June 14^th 2011)

v[IETF] Ramsdell, B; (IETF, Sendmail Inc. July 2004) Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1 Message Specification [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc3851 (Accessed on June 14^th 2011)

vi[IETF] Dierks, T; Rescorla, E. (IETF, RFTM, August 2008) The Transport Layer Security (TLS) Protocol Version 1.2 [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc5246 (Accessed on June 14^h 2011)

vii[IETF] Deering, S; Hinden, R (IETF, Cisco, Nokia, December 1998) Internet Protocol, Version 6 (IPv6) Specification [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc2460 (Accessed on June 14^th 2011)

viii [VD] Vogel, Dennis; Grossetete Patrick (Cisco, North American IP v 6 summit, 2003) IP v 6 Security Considerations [Online] PDF Docment, Available from: http://www.cuba.ipv6tf.org/pdf/na_ipv6_summit.pdf (Accessed on June 14^th 2011)

ix[WY] Wang, Yonnge; (UNCC, November 23^rd 2010) Insecure “Provably Secure Network” and Homorphic Authentication Schemes for Network Coding [Online] PDF Document, Available from: http://coitweb.uncc.edu/~yonwang/ (Accessed on June 14^th 2011)

x[WY] Wang, Yonnge; Desmedt, Yvo;(UNCC, November 23^rd 2010) Perfectly Secure Message Transmission Revisited. [Online] PDF Document, Available from: http://coitweb.uncc.edu/~yonwang/ (Accessed on June 14^th 2011)

xi[WY] Wang, Yonnge; (IEEE Transaction on Information Theory 54(6):2582—2595, June 2008) Secure communication in multi-cast channels [Online] PDF Document, Available from: http://coitweb.uncc.edu/~yonwang/ (Accessed on June 14^th 2011)

Ports and Pipes

2011-06-09T20:10:00.001-07:00

To compare Secure Sockets Layers and Transport Layer Security and Internet Protocol Security let us first discuss their origins and intent.

Transport Layer Security (TLS) is the child of the Secure Socket's Layer protocol. TLS was defined formally by the IETF in 2008 in RFC 5246.[IETF]ⁱ It's origins are rooted in SSL 1.0 as developed in 1996 by Netscape as a means to secure browser sessions. The main goals of TLS are defined as setting up a secure channel between two parties based upon certification exchange that is extensible and inter operable in nature and that is computationally efficient. That is to say it's designed to secure a single channel between a server and a host.

TLS operates at the Transport layer by means of encapsulation by encrypting the underlying protocol after a standardized handshake and authorization have occurred often over Public Key Infrastructure using certificates that have been obtained commercially from one of the public certificate authorities these include organizations like Verisign and are most commonly issued to businesses wishing to secure their website or application. The HTTP protocol has a default header “HTTPS” and both SSL and TLS encrypted web sites operate on the default TCP port of 443. TLS 1.0 is preferable to SSL 1.0, 2.0 or 3.1 versions as it's the most secure cipher and the latest incarnation of the standard; as each iteration of the standard has been revised various security issues have been addressed.

Internet Security Protocol (IPSec) is a suite of protocols where key exchange and payload encapsulation was ratified by the IETF in RFC 2406 in 1998 [IETF]ⁱⁱ and various methods of payload or point to point encryption may be supported within the suite and standard. IPSec may use either IKE or AH and SA methods to exchange secure information and with IPSec only layers 1 through 3 are visible in plain text on a network. It's designed to encrypt communications between either a host to a network, or a gateway to a gateway; ie; two geographical locations via gateways. All implementations of IPSec are colloquially reffed to as a “Virtual Private Network” or VPN, large businesses use VPN's in place of dedicated networks as they offer the same functionality at a fraction of the cost.

TLS and IPSec operate at different layers within the OSI model; TLS operates from Layer 4 up; ie the transport and session layers in a TCP/IP based session are encrypted in TLS using a signed X.509 certificate and escrow authentication; the most common of which is the now infamous “Security Notice” that users see when attempting to connect to a server that is using a self signed certificate; as opposed to a certificate obtained from a certification authority; which would require no notice as the authorities chain exist in the on line web of trust. IPSec operates from Layer 3 and up; it encrypts the entire contents of the packet including session, protocol, transport and application layers. The method of encryption may be certificate based or it may use a popular form of Internet Key Exchange as one defined by ISAKMPⁱⁱⁱ based authentication frameworks, these include KINK or IPSECKEY based DNS records or pres hared secrets such as those used by TACAS and Radius.

TLS is designed to provide a secure port on a client to a server, IPSec can provide either as secure pipe or channel but it's usually used to create a pipe through which IP traffic flows across an unsecured network. Both protocols are deigned to facilitate secure communication between two parties across an insecure medium and both parties use cryptography as a means to do so. The differ in that TLS is a lightweight implemented where only a single method of authentication is agreed upon by the client for the server. IPSec is a suite of protocols including IKE, AH, ESP, ISAKMP, KINK, IPSECKEY or other protocols are utilized for mutual party authentication; in fact both ends of the VPN must agree upon the type and method of authentication to be used to create the PIPE, once created the pipe behaves just like any other TCP/IP version 4 link in that any and all encapsulated traffic may enter the pipe on one segment destined for the other segment. IPSec does have a tax since it encapsulates the entire IP packet thus by duplicating layers 3 to 1 within TCP/IP; these are the Frame, IP SRC and DST headers and other network related information such as routing; the encrypted packets are about 20% larger than their unencrypted counters parts. TLS only suffers a moderate bloat during encryption as it's integrated into the sockets layer.

TLS is easier to implement than IPSec, both provide full security but IPSec is the more secure of the two protocols; TLS will support all kinds of web applications; where as IPSec will support any protocol that works on TCP/IP which is practically everything on the Internet. Tailored services may be provided by establishing a VPN with clients or over SSL examples include on line banking; IPSec is more transparent to applications than TLS however since most applications are now programmed as websites or web-based applications TLS is relatively transparent provided it's configured to support port redirection on the server. Of the two protocols deployment of TLS only requires the installation of a certificate on a web server in either IIS or Apache; IPSec requires two gateway devices or client software that creates a virtual network interface on the host in question.

Generally speaking the choice of technology is Dependant upon the business requirement; if you are connecting to clients over the Internet and you have a website in which you wish your clients to feel secure in it's use and operation than TLS is the ideal choice as it's easier and less costly to implement. If you have a large multinational company with offices all around the planet in various countries engaging in business in all these countries than having a VPN gateway at every offices point of presences is a cost effective way to tie all of the networks in each of these offices together.

i[IETF] Dierks T.; Rescorla E; (IETF, 2008) The transport layer security (TLS) protocol version 1.2 [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc5246 (Accessed on June 7^th 2011)

ii[IETF] Kent, S; Atkinson, R; (IETF, 1998) IP Encapsulating Security Payload [Online] World Wide Web, Avaialble from; http://tools.ietf.org/html/rfc2406 (Accessed on June 7^th 2011)

iii[IETF] Harkins, D; Carrel D; (IETF, 1998) Internet Key Exchange [Online] World Wide Web, Available from: http://tools.ietf.org/html/rfc2409 (Accessed on June 7^th 2011)

Severed Limbs and Poked out Eyes

2011-06-02T19:08:00.001-07:00

Utilizing Biometrics is not a new idea; nor is using the data captured by a biometric device as a unique cryptographic key. The real issue with biometrics as keys is that they may be faked just as easily as a password. Cappelli et al demonstrate that the effectiveness of both capacitive and optical scanning devices at differentiating an imposer versus the actual finger print are marginal at best.[CR]ⁱ Futher to their analysis Sten et al. State that various standard methods utilizing house hold items may be conducted to fool the fingerprint scanner, these include creating a gelatin mold of the available fingerprint left on the laptop case itself or simply breathing on the scanner to reveal the oil of the previous scan then utilizing common forensic methods to lift the print and reproduce it in a usable medium, silicon sealant works well with tape and graphite from pencils for such work.[SA]ⁱⁱ

Poorly written spy thrillers and action films would have us believe that a severed finger or poked out eye may fool even the worlds best biometric systems, the truth is that a severed finger would fool most biometric scanners; we may assume the deformation of a eye given the severe trauma involved in removing it from the socket would modify both the iris and retina characteristics used by said scanning systems beyond acceptable reading norms. However with medical images available on health networks, should an advanced persistent threat so choose to they may recreate the eye including the iris utilizing modern 3D printing techniques and available data from the person in question and ensure it meets the optical characteristics required to maintain authentication. However since we are considering only a general log-on and authentication to a workstation we may limit the scope of discussion to fingerprint scanners as they are the most popular and least expensive option.

Authentication can be augmented by the use of biometrics but these only serve to increase the level of effort and skill a persistent threat requires to circumvent the system's logon process. Identity based crypto-systems simply incorporate the use of biometrics with tokens and passwords. Strong Authentication as defined by RSA [RSA]ⁱⁱⁱ, Tipton [TH]^iv and others involved the use of any two following three characteristics:

something known (ie; a password)
something possessed (a token, smart card or standard IDE card)
something unique (fingerprint, iris, face, retina, hand geometry, vascular structure of the hand or arm, typing gate and pattern, voice )

Considering the recent breaches at both RSA and Lockheed Martin we should reconsider any and all authentication systems to use one of all three of the above and define that as “Very Strong” authentication.

So we can use biometrics as a login to a device of relatively low sensitivity but as the saying goes, security measures should always be commensurate with asset value so if an identity based crypto system is implemented to secure assets of a sensitive nature we should use three factor authentication on said system after passing through a man-trap with three factor authentication and ensure that said system has no connection what so ever to the Internet.

As new methods to identify people evolve they will reduce the cost of implementation said methods which benefits the industry as now most if not all new laptops ship with a fingerprint reader as a standard option. Many software applications may tie into this reader as it does use a standardized interface just as a mouse or keyboard does; however due to the inherent weaknesses in this technology we should only rely upon the fingerprint as a single of three factors to consider when granting access to sensitive information or a sensitive system. Hybrid systems like those from Autenticka and other providers will considerably increase the difficulty required to circumvent a given systems authentication mechanisms.

Even with three factor authentication we are not considering authentication under duress; ie; someone holds a gun to your back and forces you to logon to a system; which in reality may happen in cases of industrial espionage more than any company would like to admit. Or the potential for fraud, as when the system itself becomes more difficult to exploit the people behind it often become the target.

In summary; we will always require a password, we may use biometrics to augment the authentication to a given crypto-system or console but to rely solely upon them is to invite moral hazard.

i[CP] Capelli Raffaele, Dario Mario, Maltoni Davide, Wayman James L, Jain Anik (IEEE, Transacations on Pattern analisys and Machine Intellegence, Vol 28. No. 1, January 2006) Preformance evaluation of fingerprint verfication systems [Online] PDF Document, Available from: http://www.computer.org/portal/web/csdl/doi/10.1109/TPAMI.2006.20 (Accessed on June 1^st 2011)

ii[SA] Sten Antti, Kaseva Antti, Virtanen Teemupekka (Helsinki Unviersity of Technology, 2003) Folling Fingerprint scanners – Biometric vulnerabilities of the Precise Biometrics 100 SC Scanner

iii[RSA] n.d. (RSA, 2011) Strong Authentication [Online] World Wide Web, Available from: http://www.rsa.com/glossary/default.asp?id=1080 (Accessed on June 1^st 2011)

iv[THF] Tipton, Harold F (CRC, Taylor and Francis, 2010) Offical guide to the CISSP CBK 2^nd ED. ISBN: 978-1-4398-0959-4

The big Red Button

2011-05-26T21:30:00.000-07:00

DOM Sicherheitstechnik has been around since 1936, that is to say they existed before WWII, one may even argue that the choice to use a “Dual Key” authentication mechanism was a result of their design; since they were the first Lock company to design a key that had two half and was increasingly difficult if not impossible to pick. [DOM]ⁱ In any military action where dual controls were needed, DOM keys were probably used up until a better option became available. In addition to the dual controls all encrypted messages would have been executed according to a protocol in a per-established manner.

A PAL is a complicated firring mechanism usually for a nuclear weapon; Weapons control is the core business of any military; as once stated all wars are 99% logistics and 1% destruction. Therefore a PAL's main goal is authentication, and enforcement of the chain of command in a given military to control a sensitive munition during it's logistical operations and execution in theater, including it's psychical characteristics and environmental awareness.[BSM]ⁱⁱ

This is really to ensure that should the big red button ever get pushed, the bomb knows who pushed it where and when and that is is to go off over what target. And this control must exist for all weapons, be they in an ICBM, on a submarine, on an Aircraft be it a bomber or multi-role fighter equipped with a nuclear weapon.

Recently 50 ICBM's at the 90^th missile wing at the F.E. Warren Air Force base in Wyoming went off line, that is to say due to a network communications issue the PAL's went into a locked down mode titled LF-Down assuming that the base itself may have been vaporized. Realistically they simply lost communications with their command and control computers however simply losing this control is seen as an incident of note as it has never happened in known history to more than a few devices at once.[AM]ⁱⁱⁱ The root cause was suspected communications cable issues; seeing as they are buried underground, ground water can casue corrosion; corrosion wreaks havok on the RFI and reflective RF properties of signals on a line.

This really underlies the importance of security control systems in general, PAL's are an electro mechanical control that may or may not include software. These would be refereed to within the realm of the (ISC)2 as a “Technical Control”they also have “Procedural Controls” and “Physical controls” to further secure their environment eixisting within the PAL or the procedure used to Arm it. [THF]^iv

The Hanan incident in which a U.S. Signals intelligence plane was detained by Chinese authorities after an emergency landing has demonstrated that failure to physically destroy equipment will ensure that any capable opponent will reverse engineer every aspect of it. The NSA believed that their proprietary Operating System was secure in it's methods; surely if the NSA could have their greatest asset compromised by a team of Chinese engineers in less than 7 years; a nuclear weapon may only take 10 years.[HMS]^v Although the advent of inexpensive solid state based storage will ensure that this never happens again as once chips are burnt, they are not forensically recoverable.

Just like any mechanism or device the PAL is most likely designed by a consortium of companies within the united states, we may assume that Lockheed Martin, Grumman, Bae Systems, Hughes and RSA have been involved since most of their primary business is military and federal consulting in aerospace. The greatest threat to any business involved in this area is espionage or the “Advanced Persistent Threat”; Agents may manipulate those in the employ of such companies like Gregg Bergersen to disclose the secrets any PAL they may have worked on for bribes^vi.

In fact with the American economy in it's current state the threat of espionage is far greater then the very difficult threat of an enemy agent obtaining a weapon and reverse engineering it's PAL.

Tamper proof systems are subject to the same scrutiny as cryptographic methods. That is to say that a “Tamper proof box” may be designed to fail in a specific manner including a small explosion if exposed to light, heat or various forms of ionizing radiation including but not limited to PET or X-ray's. These systems are quite costly since the additional engineering also lends it self to reducing the overall reliability of said system by intentionally increasing it's complexity. Tamper proffing any complex system is costly and increases the testing and development costs of said system exponentialy, in the commercial communcations sector power supplies, signals boards and even chips are tamper proofed by encasing them in lead paint, removing markings and placing expoxy over any critical components of a given circuit. If the cirucut utilizes an RF housing this may be achieved by simply putting globs of epoxy over the desired components to prevent manipulation and visibility of said components.

There's even a large industry within the united stated devoted to the reverse engineering of said tamper proof systems. It's a matter of Competitive intelligence.

NTI states that the overall cost of the American nuclear program from 1940 to 1996 is around 5.8 trillion dollars. We may assume a good portion of that was in the development of PAL systems for warheads, as we can see they are neither cheap nor elegant but they must be a necessity to ensure the safety and operation of the current arsenal.a

iN.A. (Dom Security, 2011) About DOM [Online] World Wide Web, Available from: http://www.dom-sicherheitstechnik.com/Company.736.0.html (accessed on May 26^th 2011)

iiBellovin, Steven M. (Coloumbia Unviersity, 02 September 2009) Permsissive Action Links [Online] World Wide Web, Available from: https://www.cs.columbia.edu/~smb/nsam-160/pal.html (Accessed on May 26^th 2011)

iiiAmbinder, Marc (The Atlantic, October 26 2010) Failure Shuts down Squadron of Nuclear Missle [Online] World Wide Web, Available from: http://www.theatlantic.com/politics/archive/10/10/power-failure-shuts-down-sqaudron-of-icbms/65207 (Accessed on May 26^th 2011)

ivTipton, Harold F. (Taylor and Francis, 2010) Offical (ISC)2 Guide to the CISSP CBK 2^nd ed P. 47 ISBN: 978-1-4398-0959-4

vHersch, Seymor M (The New Yorker, November 1^st 2010) The online Threat [Online] World Wide Web, Available from: http://www.newyorker.com/reporting/2010/11/01/101101fa_fact_hersh (Accessed on May 26^th 2011)

viShuster (60 Minutes, February 28^th 2010) Caught on Tape; Selling Americas secrets [Online] World Wide Web, Available From: http://www.cbsnews.com/stories/2010/02/25/60minutes/main6242498.shtml (Accessed on May 26^th 2011)

Security Models and Mechanisams

2011-05-16T19:22:00.000-07:00

The nature of all computer systems security relies upon systems
access and how privileges are granted to a given user object or
application program to system subject. Most security models are
designed around the Subject, Object and User permission. Regardless
of weather or not we are considering local Operating System or Client
and Server interactions, these models are usually only concerned with
Subjects (files and folders), Objects (Applications and programs) and
Users. Some incorporate procedures as well (transactions).

Every computer regardless of operating system maintains a set of “Rings”
with respect to system and application access and program execution.
Windows 7, Linux and Unix clones all utilize these divisions with
respect to applications running on x86 based hardware. These modes
allow the system to differentiate between a program and a device
driver and the kernel at the hardware layer. Thus if a device driver
fails it would not take the kernel with it and if a program fails it
would not corrupt drivers or the kernel; in theory this is an
excellent model; in practice programs often take the kernel when they
fail due to improper programming techniques.

Illustration 1ⁱ

Discretionary access control (DAC) is defined by the TCSEC as the “Absence of MAC”. Where every object has an owner and that object may also be read by the system or other users.ⁱⁱ

All Unix implementations and Linux distributions utilize DAC as the
standard permissions mechanism within the file system; where each
directory may only be readable or writable depending upon the parent
directory and it's applied or inherited permissions. The superuser or
administrator may modify group memberships and object ownerships.
Users are limited by group memberships on the system to which objects
they may manipulate or where they may create or destroy objects by
their assigned permissions. Examples of this are how a user must be a
member of the “Wheel” group if they wish to use the command “su -” to become root.

The root user would usually assign that membership to other users that may also be admins from time to time. Most access-matrix and AAA models are based upon the DAC standard with some minor modifications involving the use of
Access control lists which reside on an object or AAA standards
include Radius and TACACS and TACACS+ models.

The level of systems access at the OS level is usually determined by the security model implemented by the operating system in question.

Mandatory Access Control is the result of the adoption and Implementation of the “Bell-La-Paullda” confidentiality modelⁱⁱⁱ and BIBA integrity model^iv and can be considered a derivative work of the Lipner^v security model usually implemented on a system in addition to DAC^vi.

The modern definition of MAC also includes considerations for
integrity in addition to security where the Subject, Object and
access matrix is primarily determined by a policy applied to the
system in question; where read and write object rights are inherent
in the subject label; Again this was originally defined in the TCSEC
standard as “Multi-Level Security” designed to address sensitive data classifications and their manipulat within classified systems; however it's most prolific modern implementations are SELinux and AppArmor. The primacy of purpose for MAC is to ensure that a given subject cannot write to an object of a
higher classification or that a given object may not be read by a
given subject of a lesser classification. Again the administrator may
only change an object security label or a subjects clearance, they do
not have object access; administration and operations of MAC on-top
of DAC increase the operational and maintenance complexity of any
system that uses either of these options. Essentially employing MAC
ensures that data on the system will maintain it's integrity and
security according to the security policy. Pre-configured polices
often exist for standard server configurations including Oracle
database services, Apache – tomcat web services and other
standard server configurations. MAC is very complex in nature and
increases troubleshooting overhead for applications by a great deal;
it's notorious for breaking oracle installations or preventing apache
from serving web pages correctly; however these common errors are
usually the result of a lack of planning on the administration's
part.

Illustration 2^vi

Role Based Access Control is yet another security model; it has been
formalized as a standard by the NIST.^viii RBAC is a newer standard than MAC or DAC and is implemented by using a centralized directory service such as Active Directory, or Novell eDirectory or specialized permissions and roles stored within a database or directory service. RBAC relies on user objects being assigned roles that may have associated transaction or session
permissions which are queried when subject access requests occur.
Thus a user is limited in what they may accomplish within a given
environment by their assigned roles and the authorizations that those
roles have and the subjects they are attempting to work with
including which transactions they may be attempting as well as the
subjects and the transaction based assigned permissions. Again an
administrator must assign roles to user objects (subjects);
permissions to resources, including transaction permissions as well
as session permissions they may even have to assign role activation
constraints. Active Roles is a product that assigns roles based
administration and offers a predefined transaction permission
framework for active directory. Generally speaking RBAC is the most
complex of the three security models and requires the greatest amount
of effort for both the implementation in an organization and the
maintenance required. The complexity of RBAC is offset by it's
granularity, you may specify at a very granular level what a given
user may accomplish with a given object, subject and transaction;
it's employed primarily by the Military and Banking sectors.

Illustration 3^ix

Web Services Security is the extension f Integrity and confidentiality to the world of Web 2.0 standards including XML and SOAP transactions by utilizing signatures, encryption and tokens of XML and related services including the creation and use of the WS-Security lawyer on top of the standard certification layer of trust currently used to deliver SSL based HTTP transactions using SOAP and XML.^x

Level	Security Model as applied
OS	DAC
Local Users and Applications	MAC
CLIENT / Server	MAC/AAA
Web Services	WS-Security

Generally security models are layered upon one another, this layering process is refereed to as “Hardening” and a system may be hardened depending upon it's sensitivity and classification. The greater the risk within the system the more hardening and “due care” are required.

The following Tables will compare and contrast the limitations at given
levels of each of these models:

OS Level	Complexity	Goal	Limitations	Benefits
DAC	Low	Limit acces to system files	Administrator has access to everything	Standard file permissions on Windows and UNIX
AAA	Medium	Authorize an individual using a trusted third party server	Requires a dedicated directory server	Group permissions on shared drives facilitate simple file management.
Access-matrix	High	Authorize a user or group to a specific object	Requires planning on the administrators part. Can limit object from administrator access Time intensive Complicates troubleshooting	Can limit object from administrator access

Client Server	Complexity	Goal	Limitations	Benefits
DAC	Low	Limit acces to system files	Administrator has access to everything	Standard file permissions on Windows and UNIX
MAC	High	Limit access to objects by security clearence labels (Integrity and Authenticity)	Requires a lot of planning	No one user of a lesser clearance may read an object of a greater clearance No one subject of a greater clearance may write to an object of a lesser clearance
RBAC	High	Limit systems use and transacations by pre-defined job roles	Great administrative Overhead Requries dedicated expertise on site Time intensive Complicates troubleshooting	Can prevent fraud in Banks. Limits the “Area of potential destruction” that an unwitting subject may engage in.

OS Level	Complexity	Goal	Limitations	Benefits
DAC	Low	Limit acces to system files	Administrator has access to everything	Standard file permissions on Windows and UNIX
AAA	Medium	Authorize an individual using a trusted third party server	Requires a dedicated directory server	Group permissions on shared drives facilitate simple file management.
Access-matrix	High	Authorize a user or group to a specific object	Requires planning on the administrators part. Can limit object from administrator access Time intensive Complicates troubleshooting	Can limit object from administrator access

Client Server	Complexity	Goal	Limitations	Benefits
DAC	Low	Limit acces to system files	Administrator has access to everything	Standard file permissions on Windows and UNIX
MAC	High	Limit access to objects by security clearence labels (Integrity and Authenticity)	Requires a lot of planning	No one user of a lesser clearance may read an object of a greater clearance No one subject of a greater clearance may write to an object of a lesser clearance
RBAC	High	Limit systems use and transacations by pre-defined job roles	Great administrative Overhead Requries dedicated expertise on site Time intensive Complicates troubleshooting	Can prevent fraud in Banks. Limits the “Area of potential destruction” that an unwitting subject may engage in.

iN.A. (Wikimedia, n.d.) Ring (Computer Security) [Online]
World Wide Web, Avaialble from: http://en.wikipedia.org/wiki/Ring_%28computer_security%29 (Accessed on May 12^th 2011)

iiN.A. (DoD, December 26 1985) DEPARTMENT OF DEFENSE STANDARD TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA [Online]
World Wide Web, Available From: http://www.iwar.org.uk/comsec/resources/standards/rainbow/5200.28-STD.html (Accessed on May 12^th 2011)

iiiTipton, F. Harold; (Taylor and Francis, 2009) Official (ISC)2 Guide to
the CISSP ISBN: 978-1-4398-0959-4 P685

ivTipton, F. Harold; (Taylor and Francis, 2009) Official (ISC)2 Guide to
the CISSP ISBN: 978-1-4398-0959-4 P691

vTipton, F. Harold; (Taylor and Francis, 2009) Official (ISC)2 Guide to
the CISSP ISBN: 978-1-4398-0959-4 P691

viN.A. (DoD, December 26 1985) DEPARTMENT OF DEFENSE STANDARD TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA [Online]
World Wide Web, Available From: http://www.iwar.org.uk/comsec/resources/standards/rainbow/5200.28-STD.html (Accessed on May 12^th 2011)

viiWalsh,
Dan (RedHat Magazine, 2007) Whats new in Selinux for Red Hat
Enterprise 5 [Online] World
Wide Web, Available from: http://magazine.redhat.com/2007/05/04/whats-new-in-selinux-for-red-hat-enterprise-linux-5/
(Accessed on May 13^th 2011)

viiiN.A. (NIST, October 10^th 2007) RBAC standards page [Online]
World Wide Web, Available from: http://csrc.nist.gov/groups/SNS/rbac/standards.html
(Accessed on May 12^th 2011)

ixN.A. (Microsoft Inc, December 2009) Understanding Management Role
Groups [Online] World Wide Web,
Available from:http://technet.microsoft.com/en-us/library/dd638105%28EXCHG.140%29.aspx
(Accessed on May 12^th 2011)

xAlonso, Gustavo (Swiss Federal Institute of Technology, ETHZ, 2009) Security Web Services [Online] PDF Document, Available from: www.systems.ethz.ch/education/past-courses/fs09/web-services-and-service-oriented-architectures/slides/8-WS-SOA-Security.pdf(Accessed on May 12^th 2011)

The onion and it's Ilk

2011-05-05T07:49:00.000-07:00

Historically traffic analysis has been used by government agencies to derive intelligence from messages that may utilize one time pads as a means of perfect forward secrecy . Currently One time pads are still utilized by the various agencies of all industrialized nations in conjunction with numbers stations utilizing shortwave radio as a means to conduct global espionage. The legacy of the cold war techniques of communications include laws that may have one found with Nitrocellulose paper on their person to be immediately charged with espionage which requires no trial, as the key to a One time pad was usually on these precursors to our sticky notes.

An anonymizer is a protocol or service that creates a secure communications channel by the use cryptographic protocols amongst a pool of proxy servers.

Onion routing is the use of pools of proxies in conjunction with secure sockets layer cryptography to obfuscate the source and destination of a given protocol or message across the internet.

Figure 1

The most common implementation of an onion router is the “Tor Project”, this project is an open source initiative that utilizes a network of global proxies to anonymyze web browsing sessions. It is an add on for the Firefox web-browser and operates by creating a proxy interface on the local host computer and then dynamically routing said proxy connection across the internet via a pool of other proxy servers so that the egress of said web-session appears to originate from a remote location. TOR was originally developed by the Office of Naval Research with the goal of creating a system to be used by the U.S. Navy; it is available publicly at no cost.

Anonymisers are a tool for Military, Global Espionage, Activists operating on the premise of free speech within Dictatorial regimes; and any party that wishes to place a priority on the value of privacy when engaging in communications online. This is a double edges sword as by creating a means to communicate globally in a secure and untraceable manner TOR may also be used by criminals to launch attacks against unwitting victims and thus bypass many forensic tools. Examples include the use of the TOR network by the Russian Business Network to foot print networks within North America that have already implemented “AS” level domain and IP blocking at their firewalls to mitigate such risks. We do need anonymizers as the freedom of speech is the basis of any democratic society; and even industrialized governments have been found to punish any citizens that can be observed dissenting publically.

As an example; In Canada during the recent election students that had been identified by the conservative party were ejected from conservative rallies when they had been observed to be blogging and using twitter at rallies for other parties including the Liberals and NDP. Since the electorate is expected to make an informed decision; these student had committed no offence and broken no law; but were asked to leave on the basis of security, when the true motivation was to prevent them from speaking about their experience at the conservative rally.

In mainland china any dissent is seen as an offence against the state and anyone charged with dissent is placed under house arrest, in some cases permanently. In extreme cases they are sent to re-education institutes or “prisons that offer low cost labor” to various parts of the Chinese economy.

The legal implications within industrialized countries for the use of anonymity tools are to be resolved since there are a number of issues; currently the use of Deep Packet Inspection by large ISP’s within Canada is tantamount to wiretap and is a clear validation of the individual’s right to privacy granted in both the Charter of Rights and Freedoms and the Privacy act; however within Canada Internet service providers use DPI to throttle services that compete with their associated media empires; these include the throttling of peer to peer services and protocols like torrent. These businesses have lobbied to have the judiciaries rule in favor of Deep packet inspection; the reasons are that service providers like “Netflix” may offer a superior product at a competitive price and these providers wish to ensure that a competitor may not use their infrastructure as a delivery mechanism. Other examples include the fact that Youtube a google company is now more popular than most Cable and broadcast companies. These same providers may also use DPI to throttle any Onion routing protocols to an unusable level since most of these protocols do not maintain perfect forward secrecy. Within the united states the use of cryptographic tools are strictly regulated as any cryptographic software is conserved a military grade munition and subject to the same strict controls; ie; the United states government and DoJ views SSL on web-severs with the same level of regulations as laser guided bombs, tank shells and missiles. The export of any cryptographic software made in the united states is Strictly regulated and may subject any offender to jail time.

The main issue with anonymisers is that by introducing so many encrypted tunnels the latency of the communications channel created has such reduced bandwidth available that it can only be used for asynchronous communications such as web-browsing or the use of instant messaging. Real-time video, video conferencing and broadcast are currently not feasible as the technical limitations of onion routers reduce the level of available bandwidth to a level that only permits such intermittent use.

References

[i] Shannon, Claude (Bell Labratories, 1948) Communication Theory of Secrecy Systems, Online [PDF Document] Available from: http://netlab.cs.ucla.edu/wiki/files/shannon1949.pdf (Accessed on May 4^th 2011)

[ii] Sokol, Brett (Miami New Times, February 8^th 2001) Espionage is in the Air, Online [World Wide Web] Available from: http://www.miaminewtimes.com/2001-02-08/news/espionage-is-in-the-air/ (Accessed on May 4^th 2011)

[iii] Neal, Harrison (Wikimedia, March 2008) SVG Diagram of the Onion Routing Principal, Online [World Wide Web] Available From: http://en.wikipedia.org/wiki/File:Onion_diagram.svg (Accessed on May 5^th 2011)

[iv] N.A. (Tor Project, N.D) Tor Overview, Online [World Wide Web ] Available from: https://www.torproject.org/about/overview.html.en (Accessed on May 5th 2011)

[v] Elliot, Louise (CBC, April 5^th 2011) Conservative try to explain student ejections from rallies , Online [World Wide Web], Available from: http://www.cbc.ca/news/politics/inside-politics-blog/2011/04/conservatives-try-to-explain-student-ejections-from-rallies.html (Accessed on May 5th 2011)

Software Quality Trends

2011-03-29T19:48:00.000-07:00

Franco et al state that there are the 4 R's with regards to trends in Software Quality Assuranceⁱ;

Risk
ROI
Regulations and Compliance
Rich Customer Experience

ROI is defined as “Return on Investment” this term is borrowed directly from the financial industry and refers to how much of a return is gained from a given investment.ⁱⁱ

ROI is calculated using the following formula:

ROI = (Investment Gain - Investment Cost)/ Investment Cost)

The ROI of Software Quality Assurance can be calculated by utilizing COCOMO based estimationsⁱⁱⁱ.

Basic COCOMO utilized thousands of lines of code as a base metric of calculation; it also has only three classes of Software Project team size:

Organic Small teams with extensive experience and non-rigid requirements
Semi-Detached Medium sized mixed teams with mixed experience and rigid requirements
Embedded Tight Constraints such as hardware or operational environments

Basic Equations are as follows:

Effort Applied in Man-Months:

where KLOC is 1000 lines of code;

Development Time in Months:

People Required:

Equation Co-efficients are as follows:

Software Project
Organic	2.4	1.05	2.5	0.38
Semi-Detached	3	1.12	2.5	0.35
Embedded	3.6	1.2	2.5	0.32

COCOMO is a standard cost model developed by Bohem; we can integrate COCOMO into ROI calculations to develop cost projections for any given project.

The cost model also requires that we estimate the size and potential earnings of a given software product. Sales forecasting is a common method used by industry to estimate earnings for a given quarter based on sales from previous quarters.

A standard method to forecast sales is to use a moving average model, the following formula is a simplified method used to forecast moving averages^iv:

First we must calculate the current average using the previous quarter's earnings data:

Then we calculate the new average using the projected quarters data:

This is a simplified non-weighted formula, and is used for illustrative purposes; weighted moving averages are far more accurate but also far more complicated and may require smoothing and various other considerations given a specific dataset.

Another needed variable is the loaded labor rate for the given people used or the project member loaded labor rate, the loaded labor rate is the cost per person per hour including all incidental costs of said persons employ.

Where w = number of hours in a working day; this value varies per employer and locale; Cb equals the cost of benefits and Cc equals the cost of office space for the individual in terms of Lease per square feet of space and Cd equals any other incidental costs. All other costs associated with the employ of this individual must be added to this formula for each employee on the project costs such as parking or transit subsidies, health club memberships should also be considered to further improve the loaded labor rate calculations.

The total SQA cost may be estimated by using COCOMO and Loaded Labor rates using the following formula:

The Cost of Software Quality equals the daily loaded labor rate times the number of days required multiplied by the the number of people involved.

Given the sales projection and the loaded labor rate cost for the project members the ROI of the SQA portion of a software product may be calculated using the standard ROI formula as follows:

Thus the return on investment includes the Sales projection minus the cost of software quality over the cost of software quality. Should the projection be very large; say in the millions of dollars then the return is positive. If the return is negative then the organization may need to re-examine the risk models for this project.

The applications of the above formula for software quality allow an organization to determine weather or not a given investment is sound and offers great value for a given project and it's software quality. Practical applications include the costs and benefits of testing a given operating system before sale and the potential gains; however this model is limited in it's projections and the availability of previous financial data. Finical estimates are just that; educated guesses about how well a product may do; thus the ROI is variable and dependent upon estimations.

References

iFrancino, Yevette (Tech Target, March 8^th 2010) Software Quality Insights [Online] World Wide Web, Available From: http://itknowledgeexchange.techtarget.com/software-quality/sharma-opines-software-qa-trends/ (Accessed on March 25^th 2011)

iiN.A. (Princeton, WordNet 3.0) Return On Investment definition [Online] World Wide Web, Available From: http://wordnetweb.princeton.edu/perl/webwn?s=roi (Accessed on March 25^th 2011)

iiiBohem, Barry (Prentice Hall, 1981) Software Engineering Economics ISBN: 0-13-822122-7

ivN.A. (SAP, n.d.) Forecast Formulas [Online] World Wide Web, available from: http://help.sap.com/saphelp_nw70/helpdata/en/96/d26256e39011d3b78e0000e82debc6/content.htm (Accessed on March 25^th 2011)

CPM and Earned Value

2011-03-19T15:22:00.000-07:00

Objective Achievement Comparison

We may assume that Xrider has formal methods for project management and reporting in place to manage each of these departments including formal methods of Gantt Charting[i] and project cost tracking; these charts would include costs and milestone tracking and would be managed by the assigned project managers for each of the departments. To develop any formal method of achievement analysis and comparison we would first require data and methods to be documented and available within a database. With respect to Xrider we would be using the total cost of development and the project burn rates for comparison. The daily project burn rate for a given software project will be defined as the total project development cost per day. This may be calculated with the following formula:

1/CPI

Where CPI equals the Cost performance Index.

Documenting Software Projects

Projects may be documented by Mile-stones and by using requirements to function maps. These maps would be rolled into the project management suite of software such as MS Project or Rational. These tools have built in functions to associate costs to timelines which are critical when using objective or formal methods of project cost analysis. EVM is an ANSI Standard EIA-748A and is used widely by the DoD in the united states and was popularized in the 70’s.[ii] Once costs and timelines exist in a database they may be subject to formal analysis.

Project Management Methods

Earned Value Management

Earned value management is a formal technique for measuring performance and progress within a given project in an objective manner[iii]. EVM is an ANSI standard available directly from them[iv]. EVM consists of the following three components:

1. A project plan that identifies the work to be done.

2. Valuation of planned work (called PV), or budgeted cost of work scheduled (BCWS).

3. Predefined earning rules or metrics used to quantify the amount of completed work (Earned Value or Budgeted Cost of Work Preformed).

The following formula issued to track a project according to earned value:

Figure 1

This equation allows us to determine whether or not a project is over or under-budget[v] this equation may also directly determine the financial risk of a given project.

Figure 2

This chart is for illustrative purposes used to demonstrate how the above function may determine project budget status the value on the X-axis is the number of weeks, the value of the Y-axis is the amount of money spent in $1000’s. As seen here the actual cost is running at less than the projected value of work, this is an example of a project delivering under-budget.

Earned Value Management in Depth:

Budget at Completion (BAC)

This is the total planned budget for the project, how much will it all cost?

Cost Variance (CV)

Figure 3

If the cost variance is greater than 0 it’s considered good. If it’s less than 0 the project is over budget.

Cost Performance Index (CPI)

Figure 4

If the cost performance index is greater than 1; the project is under budget; less than 1 the cost of competition is too high and greater than 1 the cost may be too low and quality may suffer.

Estiamte of Completion (EAC)

Figure 5

The Estimated Cost of Completion (EAC) is the projected total cost to complete the project.

Estimate To Complete

Figure 6

The estimate to complete the project is the amount required from the present to the completion of the project; ie; how much is left?

To Complete Performance Index (TCPI)

The To-complete performance index is designed to provide a projection of the anticipated performance required to achieve either the Estimated At Completion or Budget At Competition.

TCPI (BAC)

Figure 7

TCPI(EAC)

Figure 8

Independent Estimate At Completion

The IEAC is a metric used to determine the performance of a project to date to be compared to the EAC.

Figure 9

All earned value formula are provided within the standard by ANSI and are cited here for discussion.

Critical Path Methods

Other formal methods apart from Earned Value that may be used include the Critical Path Method.[vi] CPM was used by the United States government to manage the Manhattan Project.

The critical path method is designed to use PERT Charts to continuously monitor project milestones and to alert the project manager if any critical component risks project delay[vii].

The basic functionality of CPM is as follows:

1. List all activities required to complete the project

2. List the time taken for each activity

3. Link each activity by it’s dependency.

Here is an example of a PERT Chart[viii]:

Figure 10

Pert charts are a good way to offer an illustrative estimate of project completion dates and can be used with CPM estimates to develop project costs.

Limitations

Critical path and Earned Value management are both formal fiscal and time methods and measure only the quantitative data available for a given project; they do not include Culture of the organization or any qualitative methods such as Errors or Defects in the software projects as released and therefore offer no considerations to project quality. These are good methods to evaluate the return on investment for a given project do not make any guarantees on project quality at delivery. Thus by only considering financial and time domain data when utilized effectively they may still result in a software product that has insufficient quality.

PERT is also subject to a large judgment bias of the project manager, and assumes that all datasets are of equal value thus it may not work with unusual development cases.

EAV is not compatible with AGILE driven software development methodologies as it requires a project plan; Both CPM and EVM require that project accounting and project network schedule management are in place at Xrider and without either neither would be useable.

References

[i] H.L. Gantt, (The Engineering Magazine, New York, 1910; Easton, Republished by Hive Publishing Company, 1974) Work, Wages and Profit, ISBN 0879600489

[ii] N.A. (NDIA, PMSC, 2005) ANSI/EIA-748-A Standard for Earned Value Management Systems [Online] PDF Document, Available from: http://www.srs.gov/general/EFCOG/02GovtReferences/03NDIAANSI/NDIAIntentGuide.pdf (Accessed on March 18th 2011)

[iii] N.A. (NDIA, PMSC, 2005) ANSI/EIA-748-A Standard for Earned Value Management Systems [Online] PDF Document, Available from: http://www.srs.gov/general/EFCOG/02GovtReferences/03NDIAANSI/NDIAIntentGuide.pdf (Accessed on March 18th 2011)

[iv] N.A. (ANSI, EIA, 2007 ) Earned Value Management Systems ANSI/EIA 748B [Online] PDF Document, Avaialble from: http://webstore.ansi.org/RecordDetail.aspx?sku=ANSI%2FEIA-748-B (Accessed on March 18^th 2011)

[v]N.A. (Defense Systems Management College, 1997). Earned Value Management Textbook, Chapter 2. Defense Systems Management College, EVM Dept., 9820 Belvoir Road, Fort Belvoir, VA 22060-5565.

[vi] Kelley, James; Walker, Morgan. (Eastern Joint Computer Confrence, 1959) Critical-Path Planning and Scheduling. [Online] PDF Document, Available from: http://portal.acm.org/citation.cfm?id=1460318 (Accessed on March 18^th 2011)

[vii] Kelley, James; Walker, Morgan.(Institute of Radio Engineers, Professional Group on Electronic Computers, 1959) Critical-Path Planning and Scheduling. [Online] PDF Document, Available from: http://portal.acm.org/citation.cfm?id=1460318 (Accessed on March 18th 2011)

[viii] N.A. (NetMBA, PERT, ND) PERT CHARTS [Online] World Wide Web, Available form: http://www.netmba.com/operations/project/pert/ (Accessed on March 18^th 2011)

The grain and it's beach

2011-03-03T20:27:00.000-08:00

A software unit is defined by the IEEE in 1008-1987 asⁱ:

“The smallest unit of a software program.”

Depending on the type of program being tested the software unit may represent a single function, sub-routine, or given algorithm. The languages may be functional, procedural, low level or object-oriented, however each language and program will have a defined function and desired operation.

Since all software applications are composed as the “sum of their parts” however simple or complex the program may be; each of the parts plays a role in the operations of said program. There are numerous philosophies around what makes a high quality reliable software; the Unix paradigm states that a program should be as small as possible and have only one functionⁱⁱ. This Bottom-Up approach has created Linux and the entire open-source movement. Top down approaches exist and most formal testing and development methods are top-down in nature, Agile and XP and SCRUM are examples of methodologies that are top-downⁱⁱⁱ. Each of these approaches has their respective merit; however we are simply mentioning them here to illustrate what a software unit may be defined as.

The importance of isolation of a given software unit for test is that this unit must be verified according to formal methods to ensure that for all desired operational states the unit functions as required, since malfunctions of the software unit will ultimately lead to errors, faults and failures.

Formal methods for software verification include; Black Box, White Box, Correctness and all other validation and verification methods as defined by Galin^iv.

An oft used metaphor is that of an internal combustion engine; it's purpose is to generate motive power from some combustible fuel, all engines have the same purpose and within modern engineering, one stated piece of common knowledge is that if a given engine has too many moving parts it will be less reliable than a similar one with fewer moving parts.^v Fewer parts means less to potentially go wrong.

Within a software application, the “moving parts” are composed of mathematical abstractions defined as software units. The verification of which requires that both the logic of the math behind the algorithms being tested be sound.

The methods to isolate the software unit as defined by Galin^vi include “Black-Box” and “White-Box” testing; where the only major difference between the two is access to the source code. If one has access to a programs source then each “Sub-routine” may be defined as a software unit for testing purposes. Without access to the source code, black box testing focuses on application functions versus stated business requirements.

Another method of testing quite frequently used to locate software defects is disassembly and reverse engineering; disassembly of obfuscated binaries allows anyone with physical access to computing resources to view and interpret a software programs intent and function.^vii All malware development is based on defects found utilizing static disassembly techniques. Though disassembly is not a formal method it does offer insight into the function of a given software program without access to the relevant source code.

The modes of testing may be automated; or standardized and manual. Each has their respective benefits, most automated tests using software will offer only as much insight as they are programmed to offer. Standardized manual tests for senarios that are seen as eccentric or unique will further increase time requirements but they will also increase the reliability of a given program or system.

The success or failure of a given software unit may be defined by the test data from the unit testing; this includes conformance to all formally stated requirements for function; conformance to all expected input via output and functional tests and general sanity regarding the function as defined mathematically.

Since software is the most complex machine ever developed by man, each unit equating to a given mechanical cog; should a single cog rotate ineffectively; or worse rotate backwards, then the machine will fail. Each grain of sand may not be visible on the beach; by removing the grain and inspecting it we can discern it's origin, composition and age. This is the goal of software unit testing; it's designed to ensure that the software preformes as it should by testing as many parts as is warranted by the project at hand.

iN.A. (IEEE, ANSI, 1987) 1008-1987 IEEE Standard for Software Unit Testing [Online] PDF Document, Available from: http://standards.ieee.org/findstds/standard/1008-1987.html (Accessed on March 1^st 2011)

iiMcIIlroy, M. D.; Pinson D.E.; Tague, B.A. (Bell Labratories, 1978) The Bell System Technical Journal, “Unix Time Sharing System forward” 1978, 57 (6 Part 2) P. 1992 [Online] World Wide Web, Available from: http://www.faqs.org/docs/artu/ch01s06.html (Accessed on March 1^st 2011)

iiiStallings, Brian (Agile Journal, March 2007) Agile Top-Down: Striking a Balance [Online] World Wide Web, Available from: http://www.agilejournal.com/articles/columns/column-articles/273-agile-top-down-striking-a-balance (Accessed on March 1^st 2011)

ivGalin, Daniel (Pearson Addison Welsly, 2008) Software Quality Assurance from theory to implementation P.187 ISBN:0-201-70945-7

vBrommley, Richard; Newton, David; O'Connor, Patrick T; ( John Wiley and Sons, 2002) Practical Reliability Engineering P. 215-221 ISBN: 0-470-84463-9

viGalin, Daniel (Pearson Addison Welsly, 2008) Software Quality Assurance from theory to implementation P.189-192 ISBN:0-201-70945-7

viiKrugel, Christopher; Robertson, William; Valeur, Fredrick; Vigna, Giovanni; (University of Santa Barbara California, 2004) Static Dissassembly of Obfuscated Binaries [Online] World Wide Web, Available from; https://www.usenix.org/events/sec04/tech/full_papers/kruegel/kruegel_html/disassemble.html (Accessed on March 1^st 2011)

The Lilliputians and their Gremlins

2011-02-25T10:26:00.000-08:00

The Denver international Airport baggage handling system has become an example of what not to do when engineering software for anything. It has been said that BAE systems costs for the 193 million dollar system began hemorrhaging 1.1 million a day in interest and operating costs.ⁱ Eventually it was replaced with manual baggage handlers. Giese states that one of the major reasons for this failure were lack of communications of the stakeholders and the fact that software quality was an afterthought as was the design and integration of the system.ⁱⁱ

The Capability Maturity Model for Integration (CMMI) from the Software Engineering Institute at Carnegie Mellon University is the de-facto standard methodology for Software development and organizational maturation measure.ⁱⁱⁱ The SEI maintains a common sense staged approach to managing software development and quality through the development life cycle by defining 5 stages of maturity for an organization. Currently the CMMI-DEV standard is at version 1.3 and is available from the SEI directly.^iv

The following table describes each of these stages of the CMMI:^v

Level	Process Areas
1 Initial	Product and Process Quality Assurance
2 Managed	Integrated Teaming (2 man rule) Requirements Management Project Planning Project Monitoring and Control Configuration Management Supplier Agreement Management Measurement and analysis
3 Defined	Quantitative Project Management Requirements Development Technical Solutions Product Integration Verification Validation Organizational Process Focus Organizational Process Definition Organizational Training Integrated Project Management Risk Management Decision Analysis and Resolution Integrated Supplier Management
4 Quantitatively Managed	Causal Analysis and Resolution Organizational Process Performance
5 Optimizing	Organization Innovation and Development

The CMMI for Software Development includes the four basic levels of maturity these are numbered as follows:^vi

Incomplete
Preformed
Managed
Defined

Essentially the CMMI is a method for defining goals of an organization with respect to it's development requirements in such a manner that the ISO 9000 Series of process standards may be used to obtain Maturity but are not necessary to do so. Any organization by attempting to adhere to CMMI standards will improve and develop a Software Quality Assurance process.

Six Sigma – Originally developed by Motorola in 1986 to improve batch process, Six sigma methods and management may be used to improve software quality, although arguments have been made that it stifles creativity. It's also a very large and involved process and may take any organization years to achieve.

Lean – Dr. Womack developed the LEAN methodology for Toyota in the 1980's, as Toyota has managed to become one of the largest manufacturers of vehicles in north America, LEAN is considered one of the many reasons; it's often reffed to colloquially as the “Toyota Way”.^vii Lean's core concepts are to use the minimal amount of effort required to increase customer value.

The Information Systems and Audit Control Association (ISACA), maintains a number of certifications in reference to IT related audit and support operations. The CoBIT standard is a standard of Management and Governance and is not directly related to Software Quality Assurance, however if any organization implements CoBIT Compliance they will have a mature SQA process although it may lack definition.^viii

The ITIL Service Management framework is yet another methodology and standard aimed at the formal certification and management any organizations IT Assets and services; should an organization engage in software development the ITSM states that theses processes must be mapped and defined; thus even though the ITIL framework is not a direct SQA standard, it's application would result in a defined and managed process for software quality assurance.^ix

Each and every software development project is as unique as the team of developers delivering it; which when considering the respective level of entropy in given set of human genetics is a pretty unique. The DIA project used over 400 electric eyes, over 1000 bar-code scanners and miles of underground rail track. Had they implemented any of the available methods such as the CMMI, SixSigma, Lean, ISO or even CoBIT their process for achieving the goal of an automated baggage system may have been realized.

The Software Quality Assurance methodology is usually a hybrid of the above standards; implemented by development and project management teams assigned the task of delivering the software system; The main benefits of implementing and conforming to SQA standards as defined by the CMMI standard are as follows^x:

A Clear view of the Software Defect Trend
Continuous Software Improvement
Reduced Cost of Software Development
Greater Productivity
Higher Quality Software Products
Increased Customer Satisfaction
Positive Client View of your Organization
Overall Reduced Risk

I would not recommend that hybrid approaches be used as the CMMI is complete and mature enough to accommodate any software development project regardless of complexity.

Baggage handling is a Big-O, Complex and difficult problem. It requires advanced robotics, software and an iterative and reliable development process to make any kind of inroads. ALSTef^xi, Webb^xii and Vanderland^xiii currently use CMMI to develop their systems which are the global standards in Baggage sorting and handling. The SEI's CMMI is possibly the easiest of all of the methodologies to implement and offers the greatest return on investment, and offers continual improvement over other standards and methods.

iGibbs, W. Wyat (Scientific American, Septemeber 1994) Despite 50 years of progress, the software industry remains years-perhaps decades-short of the mature engineering discipline needed to meet the demands of an information-age society [Online] World Wide Web, Available from: http://www.cis.gsu.edu/~mmoore/CIS3300/handouts/SciAmSept1994.html (Accessed on February 23^rd 2011)

iiDr. Giese, Holder (University of Paderborn, Software Engineering Group 2005) Software Quality Assurance Introduction [Online] PDF Document, Avaialble from: http://www2.cs.uni-paderborn.de/cs/ag-schaefer/Lehre/Lehrveranstaltungen/Vorlesungen/SoftwareQualityAssurance/WS0405/SQA-I-p1-59.pdf (Accessed on February 23^rd 2011)

iiiGodfrey, Sally (NASA, 2011) What is CMMI [Online] Powerpoint Presentation, Available from: http://software.gsfc.nasa.gov/docs/What%20is%20CMMI.ppt (Accessed on February 23^rd 2011)

ivN.A. (SEI, CMU, 2011) CMMI for Development, Version 1.3 [Online] PDF Document, Available from: http://www.sei.cmu.edu/library/abstracts/reports/10tr033.cfm (Accessed on February 23^rd 2011)

vGodfrey, Sally (NASA, 2011) What is CMMI [Online] Powerpoint Presentation, Available from: http://software.gsfc.nasa.gov/docs/What%20is%20CMMI.ppt (Accessed on February 23^rd 2011)

viN.A. (SEI, CMU, 2011) CMMI for Development, Version 1.3 [Online] PDF Document, Available from: http://www.sei.cmu.edu/library/abstracts/reports/10tr033.cfm (Accessed on February 23^rd 2011)

viiN.A. (LEAN.org, 2011) What is LEAN [Online] World Wide Web, Available From: http://www.lean.org/WhatsLean/ (Accessed on February 23^rd 2011)

viiiN.A. (ISACA, 2011) COBIT 4.1 [Online] PDF Document, Available From: http://www.isaca.org/Knowledge-Center/cobit/Pages/Downloads.aspx (Accessed on February 23^rd 2011)

ix N.A. (OGC, 2011) ITIL V3 Standards [Online] World Wide Web, Avaialble From; http://www.itil-officialsite.com/BestManagementPractice/BestManagementPractice.aspx (Accessed on February 23^rd 2011)

xHefner, Rick, Phd (Northrop Grumman, November 2005) Achieving the Promised Benefits of CMMI [Online] PDF Document, Avaialble from: http://www.dtic.mil/ndia/2005cmmi/wednesday/hefner2.pdf (Accessed on February 23^rd 2011)

xiN.A. (ALSTef, 2011) Baggage Handling Systems [Online] World Wide Web, Avaialble From: http://www.alstef.com/Systemes-Aeroportuaires/index.htm?s=10 (Accessed on February 23^rd 2011)

xiiN.A. (WEBB, 2011) Baggage Handling Systems [Online] World Wide Web, Avaialble from: http://www.jervisbwebb.com/Categories/BaggageHand.aspx?cid=1 (Accessed on February 23^rd 2011)

xiiiN.A. (Vanderland Inc. 2011) Baxtorter Specifications [Online] World Wide Web, Avaialble from: http://www.vanderlande.com/Baggage-Handling/Products/Sortation/BAXORTER.htm (Accessed on February 23^rd 2011)

Vindication

2011-02-25T10:25:00.000-08:00

Vindication

Verification

According to the CMM from the SEI, Verification is:

The process of evaluating software to determine whether the products of a given development phase satisfy the conditions imposed at the start of that phase.[i]

There are many differing methods of Verification for software; formal verification refers to the proof of underlying concepts and algorithms within the software using the formal methods of Mathematics[ii]. These include model verification and checking; logical inference with the use of formal proving software. These include Prefect Developers, ArC, ACL2 or Coq therom providers, Boyer-Moore, Esterel, ttOL, Nuprl, 2OBJ, and the OCCAM transformation system and KIV[iii]. Bowen et al., highlight the foundations of formal verification within “Hall’s Original Seven Myths”[iv] and how various industries often lend prejudice to Verification methods; in addition to these they are often ignored by the development industry at large as they may be seen as too complex, or require too much excess work for a given development project.

Essentially, Software verification at its core is to answer the question; does this thing we have made do what we need it to do?[v]

The idea behind software verification as a task and project item is to increase the correctness of the software itself. The Goal of software verification is to ensure that all modes of operation for a given bit of software are mapped and understood both logically and mathematically, within the context of their operation and the framework of the system in which the desired software is to function.

Validation

According to the CMM from the SEI, the Validation is:

“The process of evaluating software during or at the end of development process to d3teermine weather it satisfied specified requirements.”[vi]

Validation is designed to ensure that once development on a given iteration or release of a given piece of software is completed that it meets the formally defined specifications as per those gathered and designed during the design and planning phases of said development.

Essentially, Software validation at its core is to answer the question; does this thing we have made meet our clients desired functionality requirements?

Validation and Verification are the backbone of software quality assurance, validation and verification tasks are usually preformed during staging, unit and acceptance testing of a given suite of software or it’s platform, prior to deployment. The goal of validation and verification is to improve the software quality but also to define and understand how the software will behave within its desired environment.

Validation and verification are essential to map out faults, failures and malfunctions within the platform, these in-turn become the bug tracking database and issues register used to verify that the next iteration of development will aim to fix or which functions need be addressed with a given patch release.

How Validation and verification differ is that validation is the process of stating that a given software requirement is met with a given software component. Verification will map out every possible mode of said software component.

Both Validation and Verification rely on good formal requirements gathering and definition methods; ie; without planning Verification and validation may not occur. If there are no stated requirements to verify or offer validity to then no test cases may be constructed.

The CMMI requires that an organization that produces software conduct formal verification and validation testing prior to offering certification.

An interesting aside is that the PCI-DSS[vii], and Evaluation Assurance Levels[viii] from the Common Criteria methods of accreditation require that auditable trails of Verification and Validation testing may be conducted by external 3^rd parties prior to offering certification to any product or software.

If an agency or organization wishes to sell software or hardware to the financial payment processing industry or to any federal government in the G8, they must be accredited to the PCI-DSS and EAL certified; each of these certifications requires that considerations and formal methods are in place for software development quality assurance including standardized and documented procedures for validation and verification testing; one of the fastest methods to achieve these is CMMI certification.

References

[i] CMMI Product Team, (CMU, SEI, 2002) CMMISM for Software Engineering, CMMI-SQ, V1.1 [Online] PDF Document, Avaialble from: http://www.sei.cmu.edu/reports/02tr029.pdf (Accessed on February 25th 2011)

[ii] Gossett, Eric (John Wiley and Sons, 2009) Definition 3.1 page 86 {Mathmatical Proof} ISBN: 0470457937

[iii] Reif, Wolfgang (Karlsruhe University, Institute for Complex Logic, 1995) The KIV-approach to software Verification: Methods Lanaguages and Tools for the Construction of Correct Software: Lecture Notes in Computer Science, 1995, Volume 1009/1995, 229-368, DOI: 10.1007/BFb0015471 [Online] PDF Document, Available from: http://www.springerlink.com/content/m0255741574317l0/ (Accessed on February 25^th 2011)

[iv] Bowen, Jonathan P.; Hinchey, Michael G; (Oxford University Computing Laboratory, University of Cambridge Computing Laboratory, 1994) Seven More Myths of Formal Methods: Dispelling Industrial Prejudices: FME’94 Lecture Notes in Computer Science, 1994, Volume 873/19894, 105-117, DOI: 10.1007/3-540-58555-9_91 [Online] PDF Document, Available from: http://www.springerlink.com/content/73n6h6u78350306x/ (Accessed February 25^th 2011)

[v] NA (IEEE, ) IEEE STD-610: Computer Dictionary [Online] PDF Documents, Available from: http://ieeexplore.ieee.org/xpl/mostRecentIssue.jsp?reload=true&punumber=2267 (Accessed on February 25^th 2011)

[vi] CMMI Product Team, (CMU, SEI, 2002) CMMISM for Software Engineering, CMMI-SQ, V1.1 [Online] PDF Document, Avaialble from: http://www.sei.cmu.edu/reports/02tr029.pdf (Accessed on February 25th 2011)

[vii] N.A. (PCI-DSS, 2010) PCI DSS V2.0 [Online] PDF Document, Available from: https://www.pcisecuritystandards.org/security_standards/documents.php (Accessed on February 25th 2011)

[viii] William Lacy, (U.S. Gov, GAO, 2006) Information Assurance, National jPartnership Offers Benefits, But Faces Considerable Challenges [PDF Document] Available from: http://www.gao.gov/new.items/d06392.pdf (Accessed on February 25th 2011)