Enterprise

Why Rule-Based Log Correlation Is Almost a Good Idea: The Future of SIEM

Wed, 01 Feb 2012 07:45:00 EST

These past few weeks, I published several blogs pointing out problems with static rule based correlation, their current limitations, their high TCO, etc. Because these solutions have been sold for many years as the end all be all to security problems, it has created false expectations in the industry and among clients. But SIEM as a general discipline holds plenty of promises, let’s not throw the baby with the bathwater.

Why Rule-Based Log Correlation Is Almost a Good Idea... (Part 6 - APTs)

Sat, 14 Jan 2012 13:00:00 EST

You remember that "False Sense of Security," the feeling that you are secure, but in fact you're not...? Attackers know that an attack is a process, it is not an event. And they use this - and they use time - to their advantage. They use time scales that static rule-based correlation simply cannot cope with. If you want to correlate disparate events, you need to keep state information on these events, and of course the longer you need to keep the state, the more expensive it becomes, expensive in RAM, CPU, storage etc etc., to the point where it is not affordable anymore. Did you know that many/most static rule-based correlation engines cannot keep state for more than a few minutes? This means for example that many correlation engines will not even be able to address the Scenario 1 - Identity Theft - discussed above.

Apple, Google, Amazon – Three Tech Horsemen – Who Is the Fourth?

Fri, 13 Jan 2012 10:30:00 EST

If you consider the CNN Money survey it is IBM which has beaten Microsoft by a whisker. They did not consider Facebook as it is not publically traded. If you listen to Eric Schmidt, it is off course Facebook. Off course anybody from Google will consider Facebook in the list because Larry Page is turning Google upside down to compete with Facebook. However, if you go by what Jeff Bezos say then it has to be Microsoft. According to him “…they’ve done a lot of innovative things, some of which get overshadowed by their big existing businesses…” So, who will it be – IBM, Facebook or Microsoft?

Oracle Fusion Applications - Installation and First Impressions (Part 2)

Wed, 04 Jan 2012 12:02:12 EST

In the second article of the Oracle Fusion Applications installation series we are looking at Repository Creation Utility which populates transaction database with OFA schemas. The Oracle Fusion Applications Repository Creation Utility (Applications RCU) creates applications-specific tablespaces and schemas. According to the OFA installation manual: The Applications RCU loops through all the middleware components in the component definition file and applies the relevant ones to the database. For each component, the Applications RCU creates the appropriate middleware tablespace and schema user. After creating the schema user, it defines the tables, views, and other artifacts that the schema owner owns.

Build Your Own Integration Stack?

Fri, 11 Nov 2011 09:00:00 EST

"DIY", "homegrown" or "hand-coded" is the most commonly used method of data and application integration. It's also almost always a terrible idea. I remember back in the mid/late 1980's talking to IT departments about the concept of a relational database, and why having one on their VAX would be a good idea. In many cases, my recommendation was met with some head scratching, brow furrowing and comments along the lines of "why would be buy one of those, when we can just build our own data storage system using RMS records?" 100 years later, it's a pretty rare occurrence that someone would decide to build their own data storage and manipulation system - if they do, it's because of some unusual requirement. As far as I know, nobody considers "build" as the default strategy in this area.

Business Technology Centers of Excellence - Investing in Your Future

Fri, 21 Oct 2011 10:00:00 EDT

It is time to invest in the advanced technology that provides the foundation and tools for the people and processes to meet their true potential. This means investing in the organizational construct known as a business technology Center of Excellence (CoE). The general concept of a business technology CoE has occasionally been incorporated into everything from a skunkworks-oriented IT research & development team to a full-fledged enterprise architecture organization. Corporate enterprise IT R&D teams are typically assigned a mission to constantly assess trends in business technology and make recommendations regarding their usage. These teams can serve a vital purpose in some companies, but are often challenged in making the connection between the new technologies and their immediate benefit to the business’ bottom line. Similarly, enterprise architecture teams have been very successful in documenting and establishing governance over the existing business, organizational, and technical constructs of a corporation, but have been challenged in delivering ongoing, proactive, and immediate strategic value to the business. A well-defined CoE with a specific mission addresses both the tactical and strategic issues associated with implementing new business technology solutions while remaining focused on the value the technology provides to the business.

Business Design for the Service-Oriented Enterprise

Fri, 14 Oct 2011 07:00:00 EDT

Business design is set to undergo a dramatic transformation. The convergence of ecosystem automation and autonomics, architecture for continuously evolving business, together with the merger of consumer and business IT will have a profound impact on conventional business models, which will in turn affect business modeling techniques and enterprise architecture. In this article we provide an outline of what we believe will become de facto best practice using some new and not so new patterns to guide the design process. The original SOA vision of the enterprise as a network of services is now attainable by many enterprises. But the route to the Service Oriented Enterprise is not so direct; it must evolve and integrate with an ecosystem of services that reflects business reality.

Apache Hadoop and WebSphere eXtreme Scale

Tue, 13 Sep 2011 06:45:00 EDT

WebSphere eXtreme Scale can be used in different ways. It can be used as a very powerful cache or as a form of an in-memory database processing space to manage application state or as a platform for building powerful Extreme Transaction Processing (XTP) applications.

A Maturity Model for Application Performance Management Process Evolution

Thu, 23 Jun 2011 10:30:00 EDT

As IT systems form the backbone of business operations, their performance plays a key role in business growth. Understanding this fact, organizations work toward obtaining best performance from the software systems to maximize ROI on IT. Now an application’s performance can be improved by tuning numerous factors like the underlying infrastructure, deployment configuration, application architecture, design, workload, etc. Yet there is another important factor driving the performance of all applications of an organization – the performance management processes adopted by an organization. The performance management process consists of activities performed to get a better understanding and control of application performance. Here we present a maturity model that will help organizations evaluate and evolve their processes on certain key dimensions. The scope of the model presented is limited to the activities that have to be carried out as part of the performance management process. In addition, as the people and technology used for process implementation are equally important to achieve the required success, equal emphasis has been given to them. The model describes a six-level evolutionary path to progressively mature performance management processes in an organized and systematic manner. With the increasing maturity of the performance management process implementation, organizations can see a positive impact of the performance engineering adoption on the business.

Examining the Current State of the Enterprise Architecture Profession

Fri, 11 Feb 2011 10:48:00 EST

Everyone seems to want to be an enterprise architect or an IT architect right now. It's that label to have on your business card. What we're trying to do is separate the true architects from one of these, and certification is a key part of that. Learn how EA is becoming more business-oriented and how organizing groups for the EA profession are consolidating and adjusting. To delve into the current state of EA, we've interviewed Steve Nunn, Chief Operating Officer of The Open Group and CEO of The Association of Open Group Enterprise Architects.

Cloud Expo, Inc. Announces Cloud Expo 2011 New York Venue

Fri, 28 Jan 2011 20:45:00 EST

Cloud Expo, Inc. announced on Thursday that Cloud Expo 2011 New York, the 8th International Cloud Computing Conference & Expo, will take place June 6-9, 2011, at the Javits Center in New York City. The International Cloud Computing Conference & Expo series is the world’s leading Cloud-focused event and is held in New York, Silicon Valley, Prague, Tokyo, and Hong-Kong. Over 600 corporate sponsors and more than 65,000 industry professionals have participated in Cloud Expo since its inception, 10-folds more than all other Cloud-related events put together.

ERP for IT (ERP4IT) - An Approach to Creating Greater Shareholder Value

Sat, 21 Aug 2010 06:00:00 EDT

The management of people, capital, relationships, assets, and information is one of the most critical functions of business AND information technology. However, the resource planning and management of IT across the enterprise is typically either an undisciplined practice or an underinvested operation. The ramification of either of these approaches to ERP4IT results in misalignment with the business

The Next Chapter in the Virtualization Story Begins

Mon, 31 May 2010 06:45:00 EDT

Cloud Computing Journal recently caught up with Pete Malcolm, CEO of cloud management innovators Abiquo - a major new player in the fast-emerging Cloud ecosystem and Platinum Plus Sponsor of 6th Cloud Expo being held in Prague, the Czech Republic, 21-22 June 2010. Malcolm is keynoting at the event. His theme will be "An Open Cloud Ecosystem - the Gathering Storm."

I Am Talking About IAM in Cloud Computing, Says Cloud Expo Presenter

Sun, 28 Mar 2010 08:45:00 EDT

Discussing the core challenges that face every organization, such as SSO, Access Controls, Identity Provisioning, and Federation, we’ll take a deeper look into the components of a comprehensive IAM system. Specifically addressing the extension of IAM to the Cloud and identity integration with SaaS partners, this session will share critical information required to achieve powerful ROI while avoiding pitfalls and hype that may compromise your organization’s security.

Current Trends in the Data Management Market

Fri, 05 Feb 2010 08:00:00 EST

In an interactive general session that forms part of its Data in Action virtual conference, IBM has really hit the jackpot. It has managed to snag Donald Feinberg, VP Distinguished Analyst at Gartner, to talk about current trends in the Data Management market. There is a live Q&A session too, and all of it - both the general session and the Q&A - are well worth viewing.

A Framework for REST in Java

Fri, 30 Oct 2009 23:45:00 EDT

Not long ago I worked on a team charged with building up a Java-based REST infrastructure. Our goals were to first support what was then an emerging specification for Java-based RESTful services called JAX-RS. Beyond that, we had thoughts of building an entire framework, both server and client, around RESTful services written in Java.

Join Me at the 1st Government IT Conference & Expo 6 Oct

Wed, 30 Sep 2009 09:00:00 EDT

I hope to see you at the SYS-CON sponsored GovIT Conference and Expo 6 Oct 2009. I’ll also spend time during the day attending the day thinking through everything I’ve ever written and learned about Cloud Computing and Federal IT and hope to bring that to bear in my interactions with Jeremy Geelan, Terry Woloszyn and Barry X Lynn at the end of conference panel on Cloud Computing and Federal IT. Jeremy will focus this panel on the future and I’m sure this action-oriented panel will help bring clarity to this fast moving subject. Related posts:

Is Amazon EC2 As a Platform Secure?

Thu, 24 Sep 2009 12:30:00 EDT

Following on from my last post, Securing Applications on the Amazon Elastic Cloud, One of the biggest questions I often see asked is “Is Amazon EC2 as a platform secure”? This is like saying is my vanilla network secure? As you do to your internal network you can take some steps to make the environment as secure as you can, such as:

Twitter 101 Guide for Business

Wed, 26 Aug 2009 12:00:00 EDT

Twitter is a communication platform that helps businesses stay connected to their customers. As a business, you can use it to quickly share information with people interested in your company, gather real-time market intelligence and feedback, and build relationships with customers, partners and other people who care about your company. As an individual user, you can use Twitter to tell a company (or anyone else) that you've had a great—or disappointing—experience with their business, offer product ideas, and learn about great offers.

IT Architecture Is Not Enterprise Architecture

Fri, 17 Jul 2009 10:15:00 EDT

For many years I have observed lots of confusion with some basic definitions such as IT and Enterprise Architecture among other terms. I will not try to define the meaning of Enterprise Architecture by myself (despite I have my own view on this) as this is something being right now redefined by the Open Group (which by the way used to call their events “IT Architecture Practitioner Conference” and changed only recently to “Enterprise Architecture Practitioner Conference”).

Use The Source, Luke!

Fri, 17 Jul 2009 10:00:00 EDT

Is ESB just an expensive integration hub or is there more to the story than we heard…

In the beginning, the ESB (Enterprise Service Bus), was marketed as much more than an integration technology. While the core of an ESB is certainly about connectivity between services, there was – and still is – so much more to an ESB than just integrating disparate protocols and technologies. Transformation, parallel processing, content based routing, and service orchestration are among the more useful and beneficial capabilities of an ESB.

That’s why it was somewhat surprising to see the CTO of an organization that offers an (open-source) ESB essentially quoted as discouraging the use of ESBs unless it’s for use as an integration hub. Dana Gardner, in To ESB, or Not to ESB?, analyzes MuleSource CTO Ross Mason’s recent blog that actively discourages architects from leveraging an ESB unless it’s necessary.

While the conversation focused on the pitfalls of using an ESB where you don’t need one, the Mule CTO naturally believes there are architectures where the ESB makes sense. To begin with, you need to be working on a project where you have three or more applications that need to talk to each other, he explained.

“If you’ve got three applications that have to talk to each other, you’ve actually got six integration points, one for each service, and then it goes up exponentially,” Mason said.

The ESB technology is also needed where the protocols go beyond HTTP. “You should consider an ESB when you start using Java Message Service (JMS), representational state transfer (REST), or any of the other protocols out there,” Mason said. “When communications start getting more complicated is when an ESB shows its true value.”

I could disagree more, but not much. The reduction of a robust technology like ESB – once considered the backbone of SOA – to little more than an integration hub was painful to read.

But what’s more painful is that the paraphrasing in Dana Gardner’s article misses most of Mason’s guidance. Reading through the original blog clearly indicates that Mason believes an ESB is much more than an integration hub and even spells out a rather lengthy list of “selection criteria” to help architects understand when and ESB will be beneficial and when it will not. But Gardner’s article appears to make the case that the only good use for an ESB is as an integration hub.

SECOND HAND INFORMATION OFTEN LACKING NECESSARY CONTEXT

The only disagreement I have with Mason’s list is that some of the criteria seems to contradict other criteria. For example, he states: “Do you need to use more than one type of communication protocol? If you are just using HTTP/Web Services or just JMS, you’re not going to get any of the benefits if cross protocol messaging and transformation that Mule provides.” but then offers “Do you need message routing capabilities such as forking and aggregating message flows, or content-based routing?”

But what if I need aggregation of message flows and content-based routing between three or more HTTP/Web services? Oh the conflict!

Aside from that particular nit, which is really not all that much of one given that architects are smart enough to resolve that apparent conflict, Mason’s extensive set of questions not only offer proper guidance but also subtly lays out a comprehensive list of what an ESB can (and should) really do. He is not, as it appears from Gardner’s article, implying ESB is nothing more than an integration hub. In fact it appears that Mason is doing exactly the opposite as the list of criteria clearly leads the reader toward an understanding that if the only thing you need is integration, you might want to look at solutions other than an ESB. The problem is that the secondary article distills Mason’s guidance in an attempt to succinctly get to the point and in doing so oversimplifies the answer to the question “Should I use an ESB or not?”

The article about the original article is lacking the context necessary to properly interpret and understand Mason’s points. It’s much the same as we see in an application infrastructure, where multiple point products are chained together in an attempt to provide a variety of application delivery related services: security, optimization, load balancing, secure access, and acceleration. As data flows from one solution to the next, the original context is lost and the loss of that context means that most of the hops are bereft of all the juicy information (the lengthy list in Mason’s article) necessary to actually make intelligent decisions regarding the application of policies designed to improve application security, reliability, and performance.

The use of disparate solutions to provide related but separate application delivery functions takes the transaction out of context much in the same way second-hand sources tend to distill the original source until its context is nearly gone and changes its intended meaning. That leaves folks (and devices) interpreting information without the benefit of the original context, which can lead to the wrong conclusion (wrong policy, wrong decision, etc…).

Too, the simplification of a technology-related matter also bothers me not just because it does a disservice to ESB, but because it happens all the time with technology; I see it every day with load balancing and application delivery. Load balancing is certainly core to application delivery, the latter deriving from the former over time, but application delivery is, like ESB and any other evolutionary solution, comprised of much more functionality and value than its predecessor. Load balancing is certainly easier to implement, like point-to-point integration between two services, but the optimization, security, and acceleration benefits of application delivery are lost when focusing solely on load balancing much the same way the orchestration, processing, and management benefits of an ESB are lost when focusing solely on its integration capabilities.

Distillation is all well and good, and oft times necessary, but should not happen at the expense of the technology.

Technorati Tags: MacVittie,F5,ESB,SOA,integration,application delivery,load balancing,optimization,acceleration,security,protocols,JMS,content-based routing,Ross Mason,Mule Source,Dana Gardner,web,internet,blog

Related blogs & articles:

Categories: Development and General , SOA Delivery , General SOA

Three RIA Tools Examined: JSF, Flex, and JavaFX

Fri, 18 Apr 2008 16:00:00 EDT

2008 is going to be an important year for Rich Internet Applications. Most organizations are delivering or planning to deliver Rich Internet Applications; however, at the same time, most IT managers are facing a dilemma: which Rich Internet Application technology and platform to use? The number of different frameworks and libraries is too vast to even consider evaluating a fraction of them.

Slow Receivers in a Distributed Management System

Mon, 07 Apr 2008 11:00:00 EDT

A slow receiver is a node in a distributed system that can't process incoming messages due to network bandwidth issues, CPU issues, I/O issues or a combination of these factors. In all cases, the slow receiver either fails to pick up data from its incoming network buffers, causing the system to bottleneck, or fails to send application- or protocol-level acknowledgements that would let the sender proceed.

Spring and Java EE 5 (PART 1)

Tue, 26 Jun 2007 09:30:00 EDT

The Java Platform, Enterprise Edition, or Java EE, is the most popular middleware platform for developing and deploying enterprise applications. Java EE offers developers a choice of vendors, portability, scalability, and robustness. However, it has been criticized for its complexity and its need for a lot of redundant and procedural code. In addition, lightweight frameworks such as Spring and scripting platforms such as Ruby on Rails have emerged to challenge the platform's supremacy in the middleware world.

Spring and Java EE 5 (PART 2)

Tue, 26 Jun 2007 09:15:00 EDT

In the first part of this article you learned how Java EE 5 has simplified enterprise application development by adopting a POJO programming model and making use of Java 5 metadata annotations. You also discovered how the Spring Framework version 2.0 integrates with Java Persistence API (JPA) and makes it simple to use from enterprise Java applications.

Configuring WebLogic Server 9.x JDBC

Tue, 30 Jan 2007 16:00:00 EST

WebLogic Server 9.x provides database connectivity with data sources. A data source is a pool of database connections from which a connection can be obtained. A data source can be configured separately or as a multi-datasource. A multi-data source is collection of data sources. A data source is configured with a JNDI binding. A DataSource object is obtained with a JNDI lookup. A Connection object can be obtained from a DataSource object with the getConnection() method. WebLogic Server provides an administration console to configure a data source. WebLogic Server 9.x includes Type 4 JDBC drivers from DataDirect for DB2, Informix, Microsoft SQL Server, Sybase, and Oracle databases. JDBC drivers for other databases can be incorporated in the server by including the JAR files for the JDBC drivers in the server classpath.

The Paradox of Writing Perfect Code

Mon, 29 Jan 2007 17:15:00 EST

Don't you love looking at a good piece of code? I'm talking about the kind of code where the design is so sound that the code practically wrote itself, where there were no nasty surprises at implementation, where it was 100% feature complete and bug-free, and you didn't have to patch it up a bunch of times. Maybe I'm squarely in the land of Santa Claus and the Easter Bunny, but I believe, deep down, all developers want to write that perfect piece of code. Unfortunately, real life has other ideas. Deadlines, unclear or conflicting requirements, ridiculous scope, being human - all these things keep us from the promised land of perfect code.

Performance Management 101 for WebLogic Portal

Wed, 24 Jan 2007 15:00:00 EST

Even experienced Java Web developers are often surprised by how big a leap it is to develop a portal. The simple, slick interface that end users see belies the deep power and complexity provided by commercial products like BEA WebLogic Portal. This makes it extremely challenging to diagnose performance issues when portal applications go into production.

AOP, IoC, and OO Design Patterns Without Frameworks

Tue, 24 Oct 2006 14:00:00 EDT

I'd like to share some of the design highlights of a large-scale content distributing system I worked on a while back. Some of the highlights may seem trivial; some may be a little more complicated. To me, software design is a matter of finding a balance between applying available technologies and fulfilling real-world requirements and constraints. The goal of design is always to ensure both the runtime and development-time quality of the software.

Building a Simple VocabBuilder Application

Sun, 22 Oct 2006 16:30:00 EDT

To make a good impression, one needs to have a good vocabulary. Management Professionals, University Professors, or GRE/GMAT aspirants - we all benefit from a decent set of words in this competitive world. There are different ways we can improve our vocabulary, such as reading novels, articles, dictionaries and so on, but we often find very little time to do so.

Where Has My Data Gone?

Tue, 26 Sep 2006 16:00:00 EDT

With software architecture evolving toward SOA, many projects in this space have encountered challenges associated with accessing data.

Java Bookshelf

Thu, 21 Sep 2006 16:30:00 EDT

Finding and buying Java books online is great...as long as you know what to look for. The thing is in many cases it's not obvious from the book title what the book about (I'll give you some examples below). So visiting a real bookstore can be a much better experience. I'm lucky to work right by a large bookstore, so I have the luxury of visiting this store a couple of times a week. This is how it goes. You slowly move your eyes along the bookshelf...Stop, let me open this one. No hurry. I believe in the chemistry between books and readers: either you like it or not. This very moment. Without even reading it. No rush. Do you know that books are not put on the shelves randomly?

Tangosol Extends Data Grid Access throughout Enterprise

Tue, 12 Sep 2006 10:00:00 EDT

Tangosol, Inc., the leading provider of reliable data grid solutions, today announced the Coherence Data Grid Solution Set, which cost effectively extends enterprise access to the data grid with three new client connectivity options, each addressing unique business needs.

Parasoft Streamlines Java Enterprise Software Development

Mon, 11 Sep 2006 12:45:00 EDT

Parasoft has released Jtest, 8 which takes testing to a whole new level, well beyond any other testing solution, stated Luis Barbier, Software Consultant for ISO.

SOA Web Services - Data Access Service

Sun, 27 Aug 2006 15:15:00 EDT

Service Data Objects (SDOs) have become a foundation technology for Service Oriented Architecture (SOA). Recently, BEA, IBM, Oracle, SAP, Iona, Siebel, and Sybase announced their support for an SOA-enabling framework specification named Service Component Architecture (SCA). SD O provides the primary data representation in this framework.

Dead Souls From Overseas

Tue, 22 Aug 2006 13:00:00 EDT

Today's topic is how to lead offshore programmers. To make this discussion a bit more interesting, let's go back in time into the first half of the 19th century.

Introduction to Acegi

Wed, 02 Aug 2006 08:30:00 EDT

I recently evaluated the use of Acegi as the security framework for a Web development project. In the end, we decided to move forward with Acegi but in the beginning it took a couple days to come to that decision. The amazing thing is: once you get over the initial learning curve, it's smooth sailing. Hence, I wanted to share my experiences with it because first, I wanted to expose the Acegi security framework to JDJ readers and, second, I wanted to make it easier for JDJ readers to get over the initial learning curve. Once you're over that, you should be well on your way with Acegi.

Exploring the Architecture of Javelin with a Dependency Structure Matrix

Sat, 10 Jun 2006 10:00:00 EDT

Javelin is a compiler framework written entirely in Java. It lets developers support new languages or extend current languages. It also provides interfaces to the parsing and compilation process. For instance, an IDE's editor can take advantage of Javelin to support syntax highlighting, code completions, and refactoring. Javelin could be extended to compile languages like XSLT, XQuery, and PHP. It already contains a Java compiler and an XML Schema compiler, which is fully integrated into BEA Workshop and provides support for various editing and compiling tasks. The JSP compiler also uses the Javelin framework.

JavaOne 2006 Notes

Thu, 08 Jun 2006 10:00:00 EDT

This major Java event was one of the largest conferences ever. Sun Microsystems deserves a lot of credit for accommodating the needs of thousands and thousands of people so efficiently and smoothly. The electronic registration for the show and receiving a special badge with an embedded chip took less than a minute. The auditoriums in which the technical sessions were held were huge - each holding between 700 to 1,000 people. How long did it take to check enrollment and let all these people into the room? Less than 10 minutes. This is clearly registration 2.0. For the most popular sessions, meeting planners arranged so-called overflow rooms in which people could watch a live video broadcast of the session on two huge screens. Serving lunch was another wonder. Fast food chains can only dream of being this efficient. Imagine hundreds of people moving into a huge food court non-stop. The entire lunch process took 10 minutes, unless you wanted to network with other people.

J2EE/.NET Interoperability

Sat, 13 May 2006 12:00:00 EDT

Due to the benefits of each, J2EE and .NET have penetrated most markets and companies to the point where 95% of medium and large-scale enterprises support both .NET and J2EE, and 30% or more of new application development will include both by 2009, according to a study published by Gartner. Data centers of these companies rarely work in 'silo' mode where J2EE and .NET work independently and don't need to interoperate with each other, but instead form a mesh of applications in what is termed a 'mixed-mode' deployment. These deployments have driven the emergence of standards such as Web Services to ease their integration.