Be open -- be secure

Be open -- be secure
[ By David Gabel, Contributor ]

It may seem like a paradox, but companies can use open source software (OSS) to secure the whole enterprise. The contradiction comes in this observation: Information that is secure is normally not open. Can you imagine some sort of classified government information that was open to view? Now, we know that some of that type information does become public, but not to the delight of the people who want it to remain under wraps.

It's the same for sensitive personal information: It's not open. So why can OSS, which a company can download the source code and modify it to suit its particular situation, secure the enterprise? If everyone can see it, then how secure can it be?

The solution to the paradox is in the nature of the information and the software. The information companies want to secure needs to stay private, but the toll for accomplishing that task is available for study, download and modification. That is the nature of OSS and, many people argue, that is the primary benefit of such software.

"Open source software is sometimes more secure than proprietary software, sometimes it isn't," said David A. Wheeler, author of the reports "Why Open Source Software/Free Software (OSS/FS, FLOSS or FOSS)? Look at the Numbers!" and "Secure Programming for Linux and Unix HOW-TO." "In fact," he added, "a lot of enterprises would be in trouble were they not using OSS." But, he added, companies have to first determine their security requirements. Then, they need to examine and compare their options.

It's much like everything else in life, or at least in information technology. You have to suit the tool to the requirement, after determining which tools are available to take care of that need and then compare the tools against one another to see which is the best fit.

But what can OSS tools do for companies? For one thing, there is a whole list of OSS that performs various security functions, from Snort, which is a very well-known and widely used intrusion-detection solution, to firewalls, to software that will lock down a PC and stop intrusion.

"You can just about create your whole security infrastructure [with OSS] and be very well served," said Bernard Golden, president of Navica Inc., a systems integrator that uses open source software in many of its applications.

He added that he has several clients who have used OSS, either alone or in combination with proprietary software, to build their security setup. Wheeler reinforced this point as well, noting, "OSS is already important to computer security." He also said the U.S. Department of Defense has been using free and OSS for computer security purposes for years.

Golden explains that security software is often like a burglar alarm: People put them in after an intrusion. In IT, it's too often an afterthought in system planning, and when IT managers get to thinking about it, there's no budget left. So the lower cost of OSS (for most OSS, there isn't a license fee) makes it a good choice.

So, if a company decides to use OSS for its security requirements, then is there a good method for determining how to do it? Of course. It turns out that it's a lot like the method a company would use for any similar kind of choice.

For example, Wheeler said, the most important task is that companies need to first figure out what their requirements are. "That's a step too many people forget," he added. "What are your threats? What are you trying to accomplish?"

He noted that it might be that once a company analyzes its situation thoroughly, it will find it may not need software for at least some of the requirements. "Maybe buying a separate un-networked machine will meet your requirements, for example," he said.

Once a company has determined what its needs are, it will have to answer more questions: Should it create an information fortress into which no one can penetrate? Or does it just need firewalls? If there specific machines that need to be locked down, then Golden recommends a multi-step process for going about it. "First, harden the machine, then protect the machine, then harden the network and then, finally, manage the whole thing," he said.

By hardening, he means putting policies in place that will keep the machine secure. And protecting, he said, is putting something (a firewall, perhaps) in front of the machine to keep people from getting to it.

Once the company has identified the tasks and the steps to follow, it is in the selection stage. Said Wheeler: "Once you get down to the point of starting to evaluate specific software products, you need to evaluate them on the basis of a whole host of important attributes." He proposed four basic steps for selection: identify candidates, read existing reviews, briefly compare the leading programs' attributes to the company's needs and then perform an in-depth analysis of the top candidates."

Golden explained that once the software is in place, managing a company's security situation is critical. That's because there will be so much security information generated by the company's security solutions that it will be difficult making sense out of it all.

"How can you use that real-time information?" he asked rhetorically. Well, there are various open source tools for this management task. Golden mentioned Analysis Console for Intrusion Databases (ACID) in particular, noting that companies can hook ACID up to a database and to Snort, and "ACID will let you make sense out of mountains of data."

So it's a sure thing that companies can secure their enterprise with OSS. If they do, there will be two distinct advantages: lower cost than proprietary software, and the fact that OSS is, well, open. If a company gets attacked, it may be able to change its security infrastructure quickly. And there's a huge community of developers that can help companies and get patches ready much faster than a proprietary vendor typically does. In some ways, this makes the open source solution better than the alternatives.

ABOUT THE AUTHOR:
David Gabel has been testing and writing about computer and information technology for 25 years.

Customer loyalty counts

Customer loyalty counts
November 2, 2004

EVER wondered if customer loyalty programs are worth the trouble?


Spoilt for choice.... Keep customers with loyalty programs. Picture: Chris Pavlich

According to marketing communications firm Tick Yes, businesses can benefit in seven ways:

1. Predictability
Knowing your customers means you can predict the future of your business. When you can predict your customers' buying habits, you are also able to predict staffing, inventory, and every other aspect of your business.

2. Save money
It costs a lot to attract new customers. By holding something like a loyalty card, a consumer has shown a commitment in which they are bound to the company in some form or other.

3. Save time
It takes time to learn how to best work with new customers. How demanding are they of your product or service? How responsive are these new customers to special sales or promotions?

4. Word of mouth
Positive word of mouth is free advertising and is the most effective way to attract new customers. Your customers have more credibility with their friends and family than you do.





5. Sense of importance
Maslow, Freud, Jung and many other great scholars of the human condition tell us that only two forces motivate people: the sex urge and the desire to be important.

6. We like you
People respond to and naturally like people that like them. People don't have to be alike to like each other.

7. Customer knowledge
Gives you a better understanding of your customers and what motivates them to return. Each time they communicate it's a chance to learn more about who they are and what they like.


The Daily Telegraph

10 secrets to success

AFTER researching enterprises here and overseas, IBISWorld has come up with its Top 10 successful practices of the world's best firms.

Sticking to the Top 10 could be what takes a business to its next step.

Focus on a single industry
"Specialisation is critical," says IBISWorld Australia general manager Jason Baker.

"Position yourself as a major, niche or ultra-niche player."

Pursue intellectual property
The mix of unique systems, special competencies, cultures, patents, copyright, technology, processes, formulas, skills and brands is vital.

Value it and R & D "above all other assets," Mr Baker says. "It is the holy grail of an enterprise."





Outsource non-core activities
Outsourcing in the interest of flexibility, enterprise growth and focus will help you get ahead.

Don't buy hard assets
Mr Baker says businesses should reject owning hard assets (land, buildings, equipment, stock and debtors), via securitisation, operating lease and factoring.

Create a virtual business
It is important to create a virtual corporation structure, drawing upon strategic alliances, networks, and/or franchising, based on the concept that the most powerful assets an enterprise has are its intellectual property, followed by cash strength.

Have an external focus
Plan outside-in, not inside-out, by understanding the external business environment before fashioning your own enterprise, its strategy, structure and management, Mr Baker advises.

Go global
IBISWorld advises expanding overseas because the aggregation of nations into regional economies paves the way for the "global village".

At the very least, companies should strive to understand and emulate world best practice for their own industry, in their own country.

Develop a unique culture
Create it with equal opportunity, contractualism (rather than owner-employee status) and vision.

Be a leader
"Leadership is, by nature, demanding of special attributes such as loneliness in ultimate decision-making," Mr Baker says. "Leadership is the opposite of management: it involves more external focus than internal."

Follow best-management practices
Value leadership over management, keep operations simple, develop achievable visions, have sound business financing, encourage employee self-development and embrace the borderless world.


The Courier-Mail

A New Spin on Outsourcing

How much work do you farm out? Probably not as much as you should.
FORTUNE SMALL BUSINESS
Saturday, November 27, 2004
By Pat Croce

When I left the Philadelphia 76ers' president's suite three years ago, I lost the invaluable support of my partner, Comcast-Spectacor, and its crack staff of lawyers, accountants, webmasters, graphic designers, and payroll personnel. Clearly it was vital that I secure such expertise for my new small business, a multimedia firm I called Pat Croce & Co. How else could I compete with the same intensity as the big dogs? Also clear was that I couldn't afford to hire a crack staff of my own.

That's when I discovered the joy of outsourcing. Yes, when it came to building the core of my business—giving speeches, writing books, developing TV shows—I'd hire staffers. But if it was a job someone else could do better, I'd outsource it. As a result, Pat Croce & Co. today is a place where the "& Co." consists of more key consultants than core employees.

Most entrepreneurs keep too many functions in-house. In a study of small businesses that outsource, Gartner, a research firm based in Stamford, Conn., found that on average entrepreneurs farm out only 27% of back-office functions such as accounting, legal services, and human resources. The good news, according to Robert Brown, a principal analyst at Gartner, is that "small-business outsourcing is poised to grow appreciably over the next three to five years as chief executives strive to cut costs and raise quality."

In the early days of Pat Croce & Co., I turned to my connections. I was able to tap a team of proven professionals I had worked with over the years to help evaluate my every move. With a great lawyer in Tim Broadt, a fastidious accountant in Andy Zelenkofske, a wise financial manager in Issy Friedman, and a sharp insurance administrator in Jim Gannon, I was ready to leap back into the world of entrepreneurs. They were ready to jump with me because they knew they would reap healthy fees from my new venture. I outsourced a few other services. My payroll and benefits went to Paychex. I hired IDC Partners to administer all my infotech. And finally, Design One Associates got the call to create my marketing material and brand identity.

Small-business owners know that the value of an outstanding outsourced team is greater than the sum of its parts. And whereas saving money may have been my initial motivation, outsourcing services provided (and continues to provide) my business with innovation, expertise, idea sharing, and a world of valuable information I didn't even know I didn't know!

For example, corporate motivational speeches have been the bread and butter of my company's income statement. And my decision three years ago to forgo the hiring of a marketing director in favor of going directly to respected speakers' bureaus has paid off handsomely. Following their advice, I created a videotape of my speaking excerpts to provide their customers with a taste of my style. That made it easier for the bureau's sales reps to sell me to their corporate clients, which made us all financially happier in the end. As the old pirate motto goes, "No prey, no pay!" In other words, by outsourcing my marketing arm, I ensured that all marketing expenses were clearly connected to profits. If no talks were booked, no fees would be due to the bureaus. I've forwarded significant fees to several speakers' bureaus. And I couldn't be happier!

Capability Maturity Model for Software (CMM)

Model adalah simplifikasi, penyederhanaan yang
repfresentatif tentang keadaan dunia nyata.

Maturity dapat diterjemahkan sebagai matang atau
kedewasaan. Matang adalah hasil proses, Dewasa adalah
hasil pertumbuhan.

Capability berarti kemampuan tetapi lebih mengarah
pada integritas. Deinisinya Integritas susah. Jadi
saya kasih contoh aja. Kalo kamu janji a maka a akan
terjadi dalam kondisi apapun.

Jadi CMM adalah suatu representasi untuk mengukur
tingkat kedewasaan sebuah organisasi dalam
mengembangkan perangkat lunak.

Kata kunci dari CMM adalah mengukur. Jika anda
mengikuti diskusi stop pirate ... di milis ini, anda
akan langsung kebayang bahwa mengukur itu selalu
berhubungan dengan 4 hal yaitu :
1. parameter apa yang diukur
2. bagaimana parameter itu diukur
3. bagaimana standard nilai
4. bagaimana hasil pengukuran diinterpretasikan

Dilihat dari standard levelnya ada 5 level :
1. chaos
2. repeatable
3. define
4. measurable
5. optimize

Level chaos berciri-ciri :
a. tidak ada rencana pengembangan software (tidak ada
sdlc)
b. tidak ada dokumen
c. ada seorang guru/master yang tahu segala hal
tentang sw yang dibuat. Akibatnya kalo guru ini out
matilah perusahaan
d. tingkat keberhasilan bergantung pada usaha
individual

Level repeatable berciri :
1. sudah ada project planning
2. sdlc sudah diterapkan walaupun tidak baku
3. dokumentasi mulai ada
4. tingkat kesuksesan mulai bergantung pada sistem
bukan pada project
Kelemahan dari organisasi yang berada di level ini
adalah :
1. mereka merasa sudah menguasai proses sw
engineering.
2. sdlc sudah ada tapi tidak ada enforcment dari top
manajgemen atau komitment dari semua orang untuk
melaksanakannya.
3. sangat mudah kembali ke level chaos

Level define berciri
1. commitment terhadap sdlc sudah ada dari seluruh
anggota organisasi.
2. dokumentasi lengkap
3. Tingkat kesuksesan jauh lebih tinggi dibanding
level 2.
Kelemahan organisasi di level ini :
1. kualitas sw dan proses tidak dapat
dipertanggungjawab karena ukurannya kualitas bukan
kuantitas( baca : tidak diukur/ tidak ada statistik )
2. Sangat bergantung pada orang yang paham tentang
kualitas sw untuk menilai kualitas pekerjaan

Level measurable berciri
1. Metode pengukuran sudah ada
2. Statistik kualitas sw, team(orang) dan proses
diukur
terus menerus
Kelemahannya :
1. Seluruh pengukuran dilakukan manual berarti
memungkinkan banyak kesalahan pada proses pengukuran.
2.sangat boros terhadap human resources karena
pengukuran dilakukan oleh manusia
3. Pengukuran cenderung bias. Ingat efek thorne.
Ketika orang diperhatikan maka ada kecenderungan
prilakunya berbeda.

Level Optimasi berciri
1. Pengukuran dilakukan secara automatis
2. Peningkatan kualitas team(orang), team work dan
proses dilakukan secara kontinue

Manfaat secara teknis :
1. mengukur tingkat kematangan perusahaan dalam
pengembangan sw

Manfaat non teknis :
1. Filter peserta tender
Misalkan saya punya project yang akan saya outsource
kan maka saya dapat meminta perushaan yang memiliki
sertifikat cmm level 3 sebagai syarat ikut tender.
2. Menjatuhkan pesaing dalam tender
Jika pesaing nggak punya sertifikat cmm level x dan
kita punya, kita memiliki bargaining power lebih.

>Terus proses yang terkait apa aja?
Untuk pertanyaan ini saya tidak mengerti arahnya jadi
tolong diperjelas.

Semua bahan disarikan dari Managing Software Process
karya Watts Humprey

IBM Enables e-learning at NITK

Publishing date: 2004-11-30 18:00:53

After the Indian Institute of Information Technology, Bangalore, signed an agreement with IBM in May for setting up e-learning infrastructure, it's now the turn of the National Institute of Technology Karnataka (NITK) to sign a similar deal with IBM.

After the Indian Institute of Information Technology, Bangalore, signed an agreement with IBM in May for setting up e-learning infrastructure, it's now the turn of the National Institute of Technology Karnataka (NITK) to sign a similar deal with IBM.

The infrastructure investment is expected to improve the reach of its academic programs and faculty resources. The memorandum of understanding will help NITK adopt "effective e-learning strategy", create e-learning content and develop systems to monitor students' academic performance. It could also minimize administrative overheads through the implementation of appropriate systems.

E-learning content will be developed based on processes and methods used at IBM Knowledge Factory using IBM Content Producer and Simulation Producer tools. The performance management systems are based on the IBM Teacher's Workbench Tool. Other solutions include Campus Automation Solutions for academic programs and evaluation policies.

NITK will use these tools to prepare e-learning material for the formal engineering degree programs, for teaching pre-university students of science subjects (to help prepare them for the various national engineering entrance examinations) and prepare e-learning material in science and technology subjects for the general public, focused on popularizing science.

A steering committee will be set up comprising of teams from IBM and NITK to oversee the project implementation and ensure fulfillment of objectives.

Prof S.S. Murthy, Director, NITK, "Our faculty will be equipped to create live and interactive content for students to aid the learning process."

M Ganesh, Director, Global Midmarket Business, IBM South Asia, said, "IBM understands that education offerings are much more than a set of well-designed courses, equally important is the support structure that facilitates training, troubleshooting, and course updates for rapidly changing technologies."

Appraising the Performance Appraisal

If you've got something to say to employees, spit it out--don't wait for their annual reviews.
July 02, 2001
By Aubrey Daniels

Q: I've been in business for a couple years and have never done performance appraisals for the few employees I have. I'm beginning to think I should, as I have one or two employees who are not performing to my expectations. How should I handle this situation?

A: I read recently that Jack Welch, former CEO of General Electric, said that if you want a high-performing company, you should fire the bottom 10 percent of your employees each year come performance appraisal time. We have 55 employees. That would mean that I should fire five or six people every year. Is this effective in a small business?

No, this practice doesn't work for either a small or a large business. Given its tremendous success over the years, GE obviously does a lot of things right—but that is not one of them. If employees are not doing their jobs, that should be dealt with in a timely way. You should certainly not wait until performance appraisal time to terminate someone who isn't performing satisfactorily.

And do not copy the performance appraisal methods of large companies. I know of none that do it well. Some large companies have done such a poor job of dealing with poor performers, they've resorted to paying them to quit. A large bank did this recently and was sued by an employee who claimed that he was a poorer performer than someone who had been terminated. His suit claimed that he deserved the "firing bonus." Any organization that has to resort to these methods of dealing with poor performers has serious management issues.

Some experts, in fact, recommend eliminating the performance appraisal altogether. I agree. The people who get them don't like them. The people who give them don't like them. Why would we do something that no one likes or thinks is effective?

More important, the research on performance appraisals has never shown that they improve performance. Why, then, are they so prevalent in the workplace? The answer I get in my seminars is that they are a way to document poor performance—in other words, a step in the firing process. This practice is coming under increasing scrutiny. Class action lawsuits being brought against several large companies claim that appraisal systems are discriminatory. I believe the companies will have a difficult time proving they aren't when they have mandated that a fixed percentage of employees be given the lowest score—and fired. In most organizations, it would be almost impossible to show that there was a significant difference between the first person to be fired and the lowest-scoring person who was kept on the payroll.

Let me suggest that the best performance appraisal is one that is done every day. While this may seem onerous for a small business, it's becoming increasingly necessary, not just as a way to justify a raise or a termination, but because it will allow you to do things that will increase performance and morale. Measurement allows you to see small changes in performance so that you can do things in a timely way to either correct performance or to provide positive reinforcement for improvement or for a job well-done. The best outcome for your company is to have all employees doing their best every day. Your success should be measured by the percentage of employees that you make successful, not by the number that you fire.

Aubrey C. Daniels, Ph.D., founder and CEO of management consulting firm Aubrey Daniels & Associates (ADA), is an internationally recognized author, speaker and expert on management and human performance issues. For more about ADA's seminars and consulting services or to order Aubrey's book Bringing Out the Best in People: How to Apply the Astonishing Power of Positive Reinforcement, visit www.aubreydaniels.com, or contact Laura Lee Glass at (800) 223-6191.