Enterprise Architecture: From Incite comes Insight...

The Open Web Application Security Project is conceptualizing the notion of a maturity model to help the industry understand better practices in making web applications secure. In usual form, this project is free and open for any and all to participate.

If you would like to contribute your thoughts, please join the mailing list...

The OWASP Certification Survey is now closed. The results are posted here. I will probably regret sharing this link, but in the spirit of being open, all insights are appreciated...

IT continually disappoints the folks on the business. My thesis is that IT interviews is at the root cause as most test presentation skills vs ability...



Why does IT have to continue the HR facade of interviewing when the pendulum has swung too far towards emphasis on soft skills? Imagine if business customers were smart enough to figure out that the person running IT didn't actually know anything about IT or that their coveted very expensive enterprise application will fall apart in actually implementing it as the folks who sold it have never actually built anything.

Business/IT alignment cannot occur without having credible members on the team. This goes above and beyond their ability to present and there needs to be a common set of core skills that all within the enterprise has. If you are an employee of a large enterprise, have you considered asking each and every member of the enterprise architecture team what skills they 100% have in common?

The obvious answer of course is usage of Microsoft Office tools as we can draw pretty cartoons in Visio, our IDE is PowerPoint and we are more than capable of ranting via email and scheduling meetings of nebulous value via Outlook, what other skills do we all have?

If we all have nothing in common but soft skills, how can we concretely implement our strategy? How can we expect business customers to trust IT? Do we really think business customers are that dumb?

To make matters worse, we attempt to hire even more folks just like us. Have we ever realized that diversity should be embraced? The enterprise needs folks with soft skills. Likewise, we also need folks with technical skills and those who can hang technically with the best of them.

Nowadays, with the emergence of work from home strategies where face-time as a construct will become extinct, if we focus on soft skills, aren't we hiring to the past and not for the future?

Developers needed; hackers need not apply
Jay Fields provides a scenario of who should receive an offer after a job interview. The funny thing is he is describing exactly how outsourcing to India works

Call for Practitioners: expertise in SOA & Security or sOA & ITIL
The OMG is attempting to bring together a group of practitioners with expertise on SOA & Security for a roundtable conversation. Why practitioners? They want to explore actual requirements and issues prior to hearing from vendors and consultants on answers.

Issuing Managed Cards
One aspect of the conversation around CardSpace that seems to never be discussed is the secure coding aspects. Many members of OWASP believe that parsers are the weakest part of XML security, yet Cardspace makes this a vital component and puts it right up front. This begs the question of whether the parser used by Cardspace can be considered as secure as say the one used by DataPower. I know that Rich Salz won't comment, but someone out there must have an opinion.

Active Directory 2.0
I have been curious if Nishant Kaushik, Mark Wilcox and others from Oracle have a different definition of what constitutes an enterprise than say Microsoft?

Lack of ECM Standards and how it hurts the industry
It has been a long time since anyone from Nuxeo, Documentum, Stellent, Alfresco or others actually talked about creating valuable standards as the conversation to date has only been about the challenges.

Identity Maturity
Paul Madsen posts a listing of Liberty Alliance award winners. I wonder if he knows where the general public can get their hands on an actual federation agreement. No, not a framework or guidelines but one that has actually been executed (in a legal sense) between two parties.

Data Portability Governance Framework
The concept of promoting open standards, whilst allowing people to own their personal data, to enable interoperability. The identity crowd should be following this...

Directory Trek Wars
A humorous comparison between Microsoft Active Directory and Virtual Directories.

I bet you don't know what it takes to become a certified Scrum Master...



For certification be truly meaningful, a certification must have some sort of experiential component to it (typically involving internship or apprenticeship) and the applications must be verified by other certified professionals.

The Scrum Alliance continues to embarrass itself, and to a lesser extent the agile community as a whole, with its continued operation of the Certified Scrum Master (CSM) program. To "earn" this designation you need to take a two-day course, at the end of which, the instructor decides whether to award you with it. There is no test and there appears to be a 99 percent plus pass rate.

It is clearly deceptive to claim that you're a "certified master" of something after taking a two-day course. Maybe those who are believers in the Agile Manifesto can learn something from the OWASP Certification Project...

Yesterday, I got to see Grandmaster Frank Corbo receive is his promotion to tenth degree...



Grand Master Corbo began his training 1960 at the age of five. His first instructor at that time was his father who introduced him to boxing, grappling and knife defenses. Returning home from the Marine Corps in 1976 he sought out instructors who could help him expand his martial arts knowledge and develop his skills into an integrated system of martial arts training. Grand Master has had the pleasure of training under the guidance of some of the greatest martial artists to date. Grand Master William Chen, Grand Master Hu Jianqiang, Grand Master Pan, Grand Master Duan, and Master Jiang Jian-ye all have made impressions and improvements to his Integrated Martial Arts system.

My son who is six years old, got the opportunity to do Jiu-Jitsu demonstration with his sensei (ninth degree in Komushinryu) where he demonstrated his routine. My son wasn't wearing his Gi at the time and was upset with his dad for leaving it in the car. Anyway, the video will be up shortly on Youtube and I will be posting a link here.

I also had the opportunity to meet a wonderful master from New York who demonstrated close quarters combat along with a monk from the Northern Shaolin temple. Afterwards, we all pigged out at It's only natural which I highly recommend.

Grandmaster Corbo is a judge on the 69th circuit probate court and a Marine. Duty, honor and country are no better represented than through the life of this master...

Always remember your weapon was made by the lowest bidder...

Give a jackass an education and you get a smartass...

I will be starting on my second OWASP Project which is to create a maturity model to help enterprises index themselves in terms of maturity related to application security. We hope to have something published by the end of the year that will aid IT executives in understanding areas in which they need to focus.

If you are interested in contributing, please visit the OWASP web site and subscribe to the listserv. In the meantime, I will be spending cycles on figuring out how to get Gartner, Forrester and other industry analyst firms to pay more attention to security (other than Microsoft Patch Tuesdays). After all, if they aren't paying attention to it, then software vendors aren't going to either and the industry will remain insecure...

This is a bit of a challenge to Smalltalkers as well as a request for education...



1. What commercially packaged enterprise applications were developed using Cincom Smalltalk?

2. Where is the java.net equivalent for finding open source Smalltalk projects?

3. What is the largest e-commerce site exclusively written in Smalltalk?

4. Has anyone written a relational database engine in Smalltalk?

5. Should developers be able to write Cincom Smalltalk using Eclipse?

In my humble opinion, emphatically no!



There is a shortage of perfectly healthy unmarried childless folk who need no benefits, aged between 22 and 26, who need no visas, who have done a previous job within the last two months so much like the one you need that they require absolutely no ramp-up time and who are willing to live anywhere and work cheaply in noisy cubicles on inferior computers without sunlight.

IT executives need to stop being silly by imposing unrealistic requirements on talent. Fundamentally, I believe even if you ignore the above that we actually need less people in IT than today. Consider how much energy is put into time wasting activities such as governance which allows for increased financial transparency at the expense of productivity.

I suspect that if you were to align all of the IT initiatives into two columns where one column is productivity and the other were transparency and you weren't allowed to practice hybridism as a mental disorder then the transparency column would outweigh the productivity column by ten to one.

As far as recruiting talent, if you accept people over 27, give them time to learn what you need, keep them long enough to pay back the cost of training them in value to you, give good benefits, locate the jobs where there is already a supply of unemployed or contract IT folks, be willing to pay them a little higher than local market wages, give them state-of-the-art computers, and put them in one-person offices with windows to the outdoors, you will have a stampede of candidates battering down your door. No problem.

If a young person asked me, I would advise them not to go into IT. Learn to use a computer much as one used to learn a foreign language or typing, but train to be the one that owns the business. That way you cannot be outsourced.

However, there are more than enough older folks around to do everything you need...

The Open Web Application Security Project (OWASP) is working on creating a certification targeted at software development professionals. The survey is located here.

The survey closes on Friday July 25th (tomorrow)...

I used to be a big believer in GPL, but my perspective is slowly shifting...



My significant other is working on a project which she hopes will allow her to work 100% from home while making more than I. A conversation between us emerged where we each debated our own philosophies on open source. She believes that BSD and its variants are the best for fairness and will serve to increase market competition which is important to her since she needs to get her software in a Gartner magic quadrant which right now doesn't exist. We concluded that GPL is useful for undermining competition and not encouraging it.

More importantly her solution is avoiding all forms of GPL as she believes it is scary for business. She points to the GPL Violations site as evidence. 100 cases completed at 100% success rate! Is this a good story for open source? History will tell the true story. What is factual though is that regardless of who wins, everybody loses when it comes to litigation costs and the wasted marketing dollars that goes behind this activity.

The one opinion that grows even stronger in my own mind is the evilness of dual licensing. On the surface, it appears to be the easiest arrangement to explain to consumers. However, the real problem of maintaining this strategy will be seen in software developer. The constraints of developing, testing, and packaging two separate but related software packages, each time a released version of the software, you have to go through the steps twice.

Dual licensing also creates a usability obstacle for users simply because it requires users to run several interfaces at the same time. Isn't it better to have one license and one way to do things rather than complicate things for end users...

If genius is one percent inspiration and 99 percent perspiration, I wind up sharing elevators with a lot of bright people...

Several folks have pinged me offline in hopes of getting a peak at the results of the OWASP survey. Many folks wanted to understand the answers to such questions as which industry analyst firms best understand the challenges of Web Application Security. I found it somewhat insightful how folks perceive firms such as Redmonk, Gartner, Forrester, Entiva and the Burton Group.

Anyway, below are preliminary results to a few select questions. The full report will be made available at the end of the week...