Many IT systems are insecure, others are simply dangerous. Some people argue that this is because the vendors that develop them are ignorant. I think not. However, I do believe they like money. A quarterly report with great numbers is never wrong.

It costs 5-10% more to develop a secure system than a clumsy and insecure system. If the organisation making the system has never worked securely in the past the cost can be up to 25% more, but this rapidly decreases as the processes become embedded. Despite the cost, the investment is worthwhile because higher quality radically reduces downtime, successful hacker attacks and other ills. Not to mention fewer headaches.

When development is placed with an external provider, the problem is that you take the business risk while the supplier delivers to a specification. If security is not included in the specification, then security will not be delivered. Why would the supplier reduce their margins by 5-10%? If a provider includes security in the price when it hasn’t been requested, they may even lose the deal because the customer chooses a cheaper alternative.

There is only one solution. Include security requirements in the contract and follow them up. Believe me, you do not want software that does not meet at least the following:

1. The system should not have any of the SANS 25 programming errors and, if it is a web application, it should not have any security holes in the OWASP Top 10.
2. The supplier should specify which software components, including version numbers, are used to create the system.
3. The supplier should use only standard methods for encryption and signing. All security-related documentation should be available on request.
4. You should have the right to review the security system.
5. The supplier should provide documentation on how the system has been installed, with a minimum of access rights to the operating system and what network traffic is necessary for the system to work in the particular environment.
6. The supplier should indicate the update cycle.
7. The supplier should be able to demonstrate how security is integrated into the system lifecycle.
8. Depending on which comes first, the supplier should provide information on vulnerabilities detected in the system within thirty days or when an update is issued that resolves the problem.
9. The system should log all events and comply with SIEM standards.
10. The system should be able to identify and authenticate users and confirm eligibility. It should comply with open IAM standards.

Really, you should conduct a security analysis to ascertain the right level of security and cost framework. But the above points are a good start. Then you won’t be disappointed by system crashes or being pulverised by hackers. And you can happily throw the headache pills in the bin.

Share/Bookmark

1 1

The holidays just around the corner and many project leaders running around in panic, I guess that could sum up the life for many this time of year. Now you might wonder why this time of year might be a headache for a project leader, the reason is quite simple and it spells resources. During Xmas holidays you often only have a ghost crew for a couple of days, you still want anyone actually in the office too have something to do. Just having people sitting around doing nothing is quite expensive and also very boring. Of course there is no silver bullet to fix this “problem”; you just have to be a bit creative. Here are at least a few suggestions:

• If you use scrum it might be an idea to switch to Kanban during Xmas, you could still keep the same delivery schedule etc to avoid getting out of rhythm.
• Seek and destroy defects
• Build competence!
• See who manage to eat the most of the left over Xmas candy!

If you have any other great idea, feel free to send it to me and I might post it on the blog!

Share/Bookmark

1 2

I now and then get questions on how the life as a consultant is. I’m going try and answer the most common questions here. If you happen to have any questions you wonder about you can of course mail me, or ask in comments, and I’ll try and answer it to the best of my knowledge. I can of course not talk about specific assignments or customers.

Do you like working as a consultant?

Yes I like it. Of course there is up sides and down sides, as to pretty much everything else. I like the fact that my job is constantly changing and that I have the opportunity to meet new interesting people all the time. I learn a lot by working with so many different people and hopefully they learn something from me as well. Of course it’s always sad when you leave people that you enjoy working with a lot, however just cause you finish your assignment it doesn’t mean  that you have to stop talking/hang out with people.  :)

Do you always work alone when going to a customer?

Not always, but it happens. For me this isn’t a problem to be honest, I feel comfortable going on my own just as well going with colleagues. I honestly don’t think any serious consultant company would send a consultant on his own to a company if the consultant didn’t feel comfortable with this.

Do they expect you to know everything?

Maybe I have been lucky but I have never had any problems with anyone having absurd expectations on me. I’m very open about what I can, what I cannot and what is possible for me to learn in the given time frame.

Is it not hard/boring to do interviews all the time?

I actually don’t see it as interviews in that sense. I see it more as a two way street, I want to understand the problem better so I know if I actually can help them solve it and they usually want to get a better idea on who I am. I’d hate getting an assignment where I felt useless and couldn’t contribute!

That was a few of common questions and like I said I’m happy to try and answer any questions you might have just as long as it isn’t about specific customers or assignments.  :)

Share/Bookmark

1 2

I’m a bit puzzled. I think anyone that works in the IT business today know how vital the testing is, and that it takes all shapes and forms. You have everything from actually poking the 1’s and 0’s with an oversized stick until it breaks to from afar analyzing the “if’s and the maybe’s”. My point is that testing is a whole lot more than just “that stuff that happens just before the code is delivered”.  With that in mind I’m a bit puzzled on how many fresh out school workers, and still in school for that matter, I meet that has almost no clue that testing even exists. Usually the only experience from testing they have is that they made some attempt on unit testing in a java school project or similar. I must say I have kind of the same experience from school, apart from writing very few and extremely simple unit tests I can’t remember ever hearing anything about it.

I hope I’m wrong and the schools actually got kickass courses within all areas of testing, someone please prove me wrong!

Share/Bookmark

0 5

I hosted a workshop regarding web security tonight where the main objective was to actually hack into something (a demo app). A part from actually letting the group investigate/test the site for XSS vulnerabilities, bad implementations and overall horrible architecture the idea was to show how easy a small “flaw” can become a major problem. Very few people will be worried by seeing some demo page just showing some “alert window” displaying the word test or something. I think/hope my approach by actually showing how all these “small” flaws together actually made it so the “evil hacker” could perform a session hijacking and get complete access to the demo app highlighted that even the smallest flaw could end up being something very serious.  I’m pretty sure quite a few of these flaws would only make the usual web developer (or tester for that matter) shrug their shoulders and move on saying, “nothing serious…”, this while the “evil hacker” stand on the other side of the fence saying “just smile and wave boys, just smile and wave” (bonus points if you know the movie reference! ).

The group did very well and even though most of them had no previous experience of these things the group together identified all the flaws needed to actually do the session hijacking. Well done!

Share/Bookmark

0 3

“I’ve been circumventing antivirus systems today.” His eyes glistened when my colleague Mattias told me this during the latest after-work get-together. It’s not as strange as it sounds. All our clients have antivirus systems, and they are a natural part of penetration tests.

Traditional antivirus systems collect large numbers of so-called signatures of malicious code, which they then compare with the files on your computers. This approach is called blacklisting. It worked reasonably well in the past, but is becoming increasingly difficult for several reasons.

Firstly, the number of known viruses is increasing exponentially. As soon as they are modified just slightly a new signature is needed. Secondly, there are more and more black hats hacking for a living. When they discover new security holes or develop their own code, they use the information in targeted attacks. In the old days they manufactured viruses that were dispersed on a large scale and could be captured and analysed. Now they keep the knowledge to themselves. This means there is more and more malware circulating on the black market.

Most antivirus systems nowadays look not only for signatures but also for suspicious patterns and behaviours. The result is better, but the fact remains that they are still looking for things they know about.

In summary, traditional antivirus systems can only ward off script kiddies and viruses that make use of known methods. They are important for hygiene, but cannot prevent advanced hacker attacks. Moreover, different antivirus systems are good at different things but do not always work if installed together on the same machine.

More recently, a method called whitelisting has come into focus. Instead of trying to find every malicious program, only a certain number of programs that do the right things are accepted. The downside of this technology is that it requires a finely tuned database that suits precisely your system without interfering with business operations. The advantage is the much lower chance of targeted attacks being successful.

Unfortunately there is no single antivirus program that solves the problem of malware. First you have to decide what information is worth protecting. Then, you need a well thought out strategy that includes several different types of protection: antivirus programs, firewalls, intrusion detection systems and possibly whitelisting of applications. Nor is it wrong to have several types of anti-virus software installed on different computers. Since a large proportion of corporate information is held on mobile devices, extra thought must be given to these.

But above all, we must remember that security is so much more than just antivirus software. An individual security mechanism can always be circumvented. It is the whole picture that really matters.

Share/Bookmark

0 3

In the back of my head I’m remembering something about how music can affect car drivers in traffic (sorry, I can’t be bothered to actually look for a reference at the moment). I’m curious if this might be true for testers as well!

So if there happen to be a project leader or similar out there that would like to try this little experiment I would be very happy to see the result from it. Try and play nice and calm music (like Enya and stuff like that) for a couple of days, then try a lot harder and faster music (any heavy metal will do I  guess). At the end of the experiment try and see if either music actually made the testers find more defects; broke the software/hardware more often or perhaps made the developers cry randomly…

I think this would be an awesome experiment!

Share/Bookmark

0 2

The event consists of lectures and demos with also an opportunity for the guests to demonstrate their own applications.

We have opened a Cybercom Developer Day 2010 -page, where you can find more detailed information about the event, for example its Agenda and Speakers. The amount of seats in the event is limited, but you can request an invitation to try to ensure your attendance in the definitely interesting event!

6 0

Collaboration summit 2010 has been very interesting this year especially because of all the buzz that MeeGo has caused. It seems that all those gigantic companies like Intel, Nokia and IBM are all about linux and the way how they do it, is very open.

IBM

The most essential message here has been that don’t do things behind the closed doors, do it in public, do it in the community and contribute, contribute and contribute. In the second  keynote IBM’s Vice President, Open System Development Dr. Daniel Fry told everyone how things can go wrong if you try to make business from open source in a way that companies usually do.

Jim Zemlin, Linux Foundation & Dr. Daniel Frye, IBM

The message was that don’t create your own community, make your  developers to join the community and contribute to the upstream. Also the code that you contribute should be general enough, not specialized to your own purposes.

Nokia

Ari Jaaksi from Nokia was a real blockbuster and made the room full of audience. The message was pretty much same as in the Frye’s presentation. Jaaksi told that MeeGo is bringing the brightest minds of the industry together and it should give the best UX for MeeGo users. The UX comes basically from a platform. The platform provides multitasking, the best mobile browser in the market and the best communication for people. I guess you have heard Nokia’s slogan: “Connecting People”.

Ari Jaaksi, Vice President Maemo Devices & MeeGo Operations

Jaaksi  explained why they decided to have collaboration only with Intel and not with more companies. The reason for this was that it’s faster get things up and running when there are only two big companies together. In the next step of MeeGo is to prove to people, that it truly is an open source and open. Open in this context means that even the steering group meetings are public meetings in irc.

Intel

Imad Sousou from Intel, continued Jaaksi’s keynote with the same message. Good addition was that MeeGo will provide the same set of APIs for every MeeGo device and MeeGo applications will run on all MeeGo platforms. Interesting point was also the fact, that devices may contain closed source components like device drivers (from hardware manufacturers) or closed source applications and libraries like Skype or flash player. The reason for this is that some of the manufacturers just don’t want to share their driver code.

Imad Sousou, Director, Open Source Technology Center, Intel

Sousou made clear that MeeGo is not just for phones, it’s for Netbooks, IVI, TVs etc and of course it’s open. Imad also announced that there will be a MeeGo conference in September 2010. I will wait that event. At least the previous two Maemo Summits have been really nice events.

Google and Android

Google was also present here in the Collaboration Summit. Chris DiBona, from Google gave a pretty fun presentation. Google has received plenty of criticism because what they do, is not always very open.

Chris DiBona, Open Source Program Manager at Google

Chris’ presentation got really much attention here especially at the end  because they promised to give a new Google Nexus One phone for everyone. Well when the room is full of nerds, it’s always quite easy to get their attention by giving new gadgets.

Qt Quick

I’ve been working with Qt for several years. Therefore I’m really interested in what’s happening in the Qt world and I’m trying to follow the new technologies even before they are released. Henrik Hartz from Qt Development Frameworks gave a good presentation about the new technology called Qt Quick.

Henrik Hartz, Product Manager, Qt Development Frameworks

Henrik demonstrated how powerful Qt Quick is when you need to develop neat looking UI’s with animations and transitions. He also showed couple of code examples how easily and fast you can create cool UIs. One of the ideologies behind the Qt Quick is to bring UI designers closer to the actual software development. UI designers can quite easily to create prototypes of the UI and still use the real business logic, implemented in C++.

Qt Quick Architecture

This will of course bring new challenges to the team work and requires that the interfaces exposed to QML from the C++ side must be designed well.

QML looks promising and I have already started to implement small QML application called QuickFlickr. Personally I think that it’s amazing how fast you can build UI from scratch. Of course, if you have Qt background, it helps you to get into  Qt Quick easier.

The Future of Linux

The future of linux looks promising now. In my opinion it looked promising even in five years ago:) Linux is pretty much everywhere and it’s getting more popular all the time. The instances like Linux Foundation are getting bigger and more money moves around the Linux. It’s really interesting to see where all this MeeGo stuff will go and what kind of form it will get.

The summit itself was really nice place to hang out, meet other nerds and discuss about a nerd stuff. I’m really waiting to get to the MeeGo summit or to the Qt Developer days in the next autumn, but before that, I really need to figure out how to get back to the Europe:)

3 2

PhotoTranslator Alpha Features

As you probably have understood already, the PhotoTranslator is not a final version yet and it lacks features. It may, or it may not work as you expect, but as stated before, use it at your own risk. We also needed to remove bunch of languages from the application because they  increased the package size to 95M.  PhotoTranslator supports only the following languages from  tesseract i.e. the languages that it can read from the images (OCR) at the moment:

• English
• Finnish
• German
• Spanish
• Portuguese

NOTE: This means that you can translate, but you can only use the OCR for the languages listed above. The workaround for this is that you can write the text manually and then translate it.

PhotoTranslator Beta Features

For beta version we are planning to implement the following set of features:

• Separate package for each supported language
• User can download different language packages via PhotoTranslator
• Disabled buttons for languages that are not installed
• Support for capturing images with PhotoTranslator

We are also investigating if we could open source the application at some point. More details will follow later.

Installing PhotoTranslator

The only thing you need to do is to enable extras-devel repository from your application manager. Check the details below.

In the Application Manager:

• Navigate to the application menu (tap the title bar)
• Select ‘Application catalogs’
• Select ‘New’
• Enter a catalog name of ‘Maemo extras-devel’
• Enter a web address of ‘http://repository.maemo.org/extras-devel’
• Enter a distribution of ‘fremantle’
• Enter components of ‘free non-free’
• Select ‘Save’

Feedback

We would like to receive feedback of your user experience. You can give your feedback about PhotoTranslator in comment section. We will also later provide an email address, which you can use to send your feedback directly.

Thank you for reading our blog.

4 0