Microsoft Dynamics pains...

My organization has been using Microsoft Dynamics CRM and AX for almost 2 years now and have gone through one cycle of upgrades for both in that short time. And the reason? well, sad to say, is because both products fall short of what we wanted (and promised by vendor) initially as well as even now. Below are just a few examples of our disappointment:

1) AX Multi-timezone issue - we adopted the solution as a regional platform supporting 12 countries spanning 5 different timezones. Amazingly, the so-called enterprise class AX (previous version 4.0) cannot do this OOTB and even our vendor's promised workaround posed serious limitation to the way we do things. Having said that, the latest version 2009 does solve this problem.

2) CRM performance issue - The client side component of CRM is _extremely_ heavy (lots of small file fragments to load for a page and heavy use of javascripts) causing poor performance over WAN connections, adding substantial traffic to our regional corporate network (To make matters worse, network infrastructure across AP is still relatively poor, patchy and insanely expensive), and lastly requires reasonably powerful client side PC for snappy processing. We resorted to using Citrix to mitigate these issues (moving the load and traffic back to the server side) and even then, we are starting to find this "workaround" getting really expensive (Client license, rapidly growing Citrix farm increased hosting and management costs) as we scale up and throws our ROI right out the window. To top it off, the bloated and leaky (memory-wise) Internet Explorer in Citrix is NOT a good combination!

So in conclusion, IMHO, Microsoft Dynamics (especially CRM) is probably more suitable for small local shops rather than regional platforms with large number of users spread over geographically diverse locations.

Ready made LAMP Virtual Machines

Recently, one of the projects I'm working on urgently required a LAMP environment for testing. Rather than going through the hassle (not to mention time consuming process) of securing hardware, getting the infra guys to set up the network and OS and finally getting my own guys to set up the rest of the middleware, I did a search online and found myself a ready made LAMP VM all in a compact 166mb package. Download the package, unpack it into a directory of choice, add it in my Virtual PC 2007 console and click run; it couldn't be any simpler.

Thirty minutes later, I was up and running with my LAMP environment compared to weeks if I had gone the other route. Oh, and half that time was taken by the download... Yeah, my corporate network sucks...

Kudos to the guys at Virtual Appliances. Other than the LAMP VM, they also provide ready made VMs for LAPP (Linux, Apache, PostgreSQL, PHP), Tomcat (App server only, no database), Cacti (Network device monitoring and data collections), and NTOP (Realtime network traffic monitoring). These packages are available in VM formats for Virtual PC (and Server), VMware and Virtual Iron. Oh, and best of all? Its Free! (for now at least as its still in beta)

Virtual Machine - a software engineer's best friend

Here is another reason why Virtual Machine(s) are a developer's best friend. If you are a packaged software developer (doesn't matter if its desktop or server software), you will probably realize that platform compatibility testing is a large part of the release cycle; not only is the actual testing tedious and time consuming, setting up and maintaining the many testing environments is a whole lot worse. In addition, it can get pretty expensive too as you will need multiple machines to contain them.

Back in the days when I was developing packaged software, one of my strategies for managing test environments on the cheap is to use boot loaders (such as LILO and GRUB) and hard disk partitions. Using this approach, I had up to four environments running on a single PC (only four environments due to a limitation on the number of primary partitions a hard disk can have). Not long after, I figured that I could further cut down on the number of boxes required by using removable caddies to facilitate the swapping of hard disks on a single PC.

This strategy was indeed cost effective (I managed to reduce my farm of test PCs from eight to just two) but it was darn tedious and not as robust as I had wanted; I could only have one environment up at a time on one PC and it was time consuming to shutdown and startup another. In addition, the OS images are practically tied to the specific hardware it was installed on as we all know how crappy Windows is when it comes to swapping hardware.

Then enters VMware and its (then) flagship product VMware Workstation. My test environments became normal files and were able to run off any host OSes as long as the hypervisor supports it. With it, I was no longer bounded by the four primary partition limit on a hard disk, could run multiple environments all at the same time and copy/move them between PCs seamlessly (even if they are running different host OSes!). In addition, with the snapshot feature, I could create a base image of each test environment and easily revert to it after testing.

Out went the drive caddies, the stack of hard disks and backup tapes piled up on my desk, LILO, PartitionMagic and Norton Ghost! In addition to cost savings, the time saved was also considerable and it was appropriately channeled to our LAN parties in the office! :)

WebApp Security Test tool - IBM Rational AppScan

This is part 3 (after Introduction, HP Application Security Center) of the series on web application security test tools. This week, I invited IBM to present their offering called IBM Rational AppScan.

• Formally Watchfire Corporation before its acquisition in July 2007.
• Does not have a code analyzer component like HP. [Edit: Will have one in the upcoming version come Sept 2008 as pointed out by Chris.]
• Run-time analyzer comes in three flavors:


1. Standard Edition
• Targeted at standalone usage scenarios.
• Black-box testing tool (does not require source code but requires a running system).
• Underlying implementation technology independent.
• Works by crawling an entire website (link depth and type is configurable) after been given a root URL.
• Suggests common fixes when vulnerabilities are found but cannot automatically fix them. (Obviously since it has no knowledge or access to the underlying code!)
• Will not be able to detect threats on pages that are not explicitly defined in the test, exist as links in the website or directories that do not allow listing.
• Supports legal and regulatory compliance by scanning against well known policies (e.g. Sarbanes-Oxley, HIPAA, PCI Data Security Standard, OWASP Top Ten) and generate the necessary reports.
• Requires regular updates to keep up with latest threat signatures (like anti-virus software).
• Must run full suite of tests after an update as the tool is unable to determine the delta.
• Includes a whole bunch of advanced tools for penetration testers.
• Supports only Windows Platform for running the tool.


2. Tester Edition
• Targeted as part of the Quality Assurance process usage.
• Contains same features as the Standard Edition plus the following.
• Automatic test creation, modification and maintenance capabilities to enable testing and remediation.


3. Enterprise Edition
• Targeted at multi-user environments.
• Contains same features as the Standard Edition plus the following.
• Centralized test management and reporting, remote scanning administration.
• Continuous monitoring and aggregation of metrics to ensure remediation and trend improvement over time.
• Sophisticated dashboards and flexible reporting views to provide enterprise-wide visibility of risks and remediation progress.
• Web based access for users.
• Supports only Windows Platform for server components.

WebApp Security Test tool - HP Application Security Center

The first product we are looking in the area of web application security testing tools is from HP. This is actually a suite of products collectively called HP Application Security Center. The following are some notes I have taken after hearing their presentation and browsing through their website.

• Formerly SPI Dynamics before its acquisition in June 2007
• Full security test suite that offers tools for different phases of the SDLC:


1. DevInspect – Development stage
• Primarily a source code analyzer or white-box testing tool (i.e. requires full source code but does not require running system).
• Underlying implementation technology specific (C#, Java, JavaScript, HTML, XML, AJAX).
• Tight integration in development process (via the IDEs) hence allowing threats to be detected early (even before a developer checks the code in).
• Suggests and can automatically apply code fixes when vulnerabilities are found.
• Requires regular updates to keep up with latest threat signatures (like anti-virus software).
• Note that this tool catches only compile-time threats, not run-time threats. Hence needs to be partnered with one of the below.
• Deploys as plugins to Eclipse and Visual Studio.


2. QAInspect – UAT/SIT stage (maybe even as part of continuous integration)
• Black-box testing tool (does not require source code but requires a running system).
• Underlying implementation technology independent.
• Works by crawling an entire website (link depth and type is configurable) after been given a root URL.
• Suggests common fixes when vulnerabilities are found but cannot automatically fix them. (Obviously since it has no knowledge or access to the underlying code!)
• Will not be able to detect threats on pages that are not explicitly defined in the test, exist as links in the website or directories that do not allow listing.
• Supports legal and regulatory compliance by scanning against well known policies (e.g. Sarbanes-Oxley, HIPAA, PCI Data Security Standard, OWASP Top Ten) and generate the necessary reports.
• Requires regular updates to keep up with latest threat signatures (like anti-virus software).
• Must run full suite of tests after an update as the tool is unable to determine the delta.
• Tight integration with HP Quality Center and HP TestDirector hence allowing security tests to be managed as part of an overall test plan/run including functional and/or performance tests.
• Automatically generate defect logs in HP Quality Center based on vulnerabilities found during the tests.
• Integrates with HP AMP (Assessment Management Platform) to provide enterprise assessment management. i.e. centralized control over user permissions, security policies and remote scanning administration.
• Supports only Windows Platform for running the tool.


3. WebInspect – anytime (after you have a running system of course)
• Essentially the same as QAInspect except that its targeted for standalone use.
• Includes a whole bunch of advanced tools for penetration testers.
• Does not offer integration with HP Quality Center or HP TestDirector for overall test management but can push vulnerabilities as defects to HP Quality Center.
• Does integrate with HP AMP for enterprise assessment management.
• As far as licensing goes, in Singapore, comes in two flavors:
1. Single User (i.e. one PC), Single Target (i.e. one IP address)
2. Single User (i.e. one PC), unlimited Targets (for about double the price of the above)

Web application security testing tools

Ever heard of XSS and/or SQL Injection? How about CSRF? You should if you are a web application developer. In fact, beyond just knowing what they are, you should be well versed in its countermeasures and make them a part of your day-to-day coding routine.

Unfortunately, these are just a tip of the iceberg and there are many more exploits and vulnerabilities that exist today as web technology advances and attack surface increases. It will not be feasible and practical to know them all, not to mention ensuring every single line of your code to free from them; Just like it is not possible to write code that is bug free.

Web application security is no longer an area that can be ignored or treated as second class citizens. Given the exponential growth of online applications that deal with valuable data (e.g. B2B marketplace, partner self-service apps, consumer ebanking and ecommerce, webmails, online docs and spreadsheets, even online data backup services, etc), the implications (usually financial) of losing them to hackers are not to be taken lightly.

Even if a company's web applications do not contain personal and private data, any defacement due to web exploits can cause loss of customer confidence and/or negatively affect the branding, all of which will ultimately hurt the business.

Having established the need for more emphasis on web application security, what can one do about it? Well, you can:

1. include the skillset as a requirement in recruiting your development team,
2. skill up your development team in this area,
3. create development guidelines/policies that encourage/enforce exploit-safe coding practices,
4. setup regular peer reviews focusing specifically on web application security,
5. develop test cases that attempt to flag out possible vulnerabilities.

OR

You can look into acquiring some web application security test tools to offload your development team from some of these worries.

Generally speaking, here are some key benefits that you can hope to reap from using such tools:

1. Consistency in overall quality of code produced as you no longer depend on skill levels of individual developers.
2. Quickly and easily satisfy regulatory compliance to well known standards such as SOX, PCI, HIPAA, etc as most tools can run tests against the standards and generate the necessary reports.
3. Keep up with the latest threats via the auto update feature in the tools.
4. Include the security tests as part of the QA cycle (test planning, execution, even defect tracking).

Here in Sony, I am leading the initiative to explore and evaluate the product landscape with the goal of creating a Centre of Excellence (covering both governance and service provisioning) for web application security to support our internal IT operations.

Over the next couple of weeks, I will be meeting up with the various vendors to understand their offerings as well as evaluate their strengths and weaknesses in depth via PoCs.

Understanding Defense in Depth

Some IT folks I speak with seem to think the phrase "Defence in Depth" in the IT context refers to how a computer network is segmented or zoned. For example, having demilitarized zones (DMZ) and secured zone, implemented via firewalls and routers constitute defence in depth.

Unfortunately, this is not entirely correct. The concept has a much larger scope than just network. Generally speaking, it refers to how one can use multiple methods at varying layers for a more comprehensive defence strategy. The layers (and corresponding methods) can be classified as follows:

• Security Policies
• Physical Security (e.g. dead bolt locks, biometrics)
• Perimeter Security (e.g. Firewalls, Routers, VPN, RAS)
• Network Security (e.g. IDS, IPS, Packet filters, IPSec)
• Server Security (e.g. Antivirus software, access control at host levels)
• Application Security (e.g. access control at app level)
• Data Security (e.g. data encryption)

The good news is that in most circumstances, these folks are already using the strategy without knowing it. i.e. In a typical data center setup, you will have some form of security at each of the first five levels;

• Some form of security policy governing access and use of your networks/servers/applications
• Locked gates/doors in front of your data center building/room
• Routers and Firewalls in front of your application servers
• Intrusion detection/prevention systems monitoring the network traffic for abnormalities
• Access control at the operating server level of the hardware boxes

For more information on this topic, you may want to check out Microsoft's Defense in depth security model in these series of webcasts.

Back in Istanbul again...

I'm back in Istanbul again for a 2 days workshop with our counterparts in Europe to discuss and confirm the architecture for Homepage Phase 2. This is a working level meeting and our main points of contact were Fabian and Fabrice from the GISS-E group.

For this trip, I am putting up at Conrad Istanbul instead of Radisson SAS (where I stayed previously) as it was full. Conrad is much bigger than Radisson in terms of hotel size and room size. The hotel is perched on top of a hill and offers a wonderful view of the city and the Bosphorus strait in most of the rooms (unfortunately not mine).

On the night of our arrival, our hosts took us out for dinner at an upmarket and classy joint called the Sunset Grill & Bar which is famous for its Japanese fusion cuisine (and sushi!) as well as its wine list. Apparently a popular dining destination with locals, I was told that this is the place to rub shoulders and mingle with the local celebrities and corporate head honchos.
As luck would have it, Simon and Frank (the top guys in Sony Europe, on the left towards the end of the row) were in town and joined us for the welcome dinner.

The restaurant is perched on the hills of Ulus and overlooks the Bosphorus. The view is spectacular in the day and even more so at night when the city lights up.

I finally get to try a Turkish wine this time round (Turkey wine exports are limited in quantity and I don't think I have ever seen one in Singapore before) and it was a 2004 Kayra Buzbağ Rezerv Öküzgözü-Boğazkere. The taste is refreshing and I enjoyed it very much. Needless to say, I had quite a few to drink as I savored the excellent T-bone steak and talked shop with the hosts till late into the night. Side note: It's usually times like this, in a casual setting outside the office with lots of booze, that you get to have frank and honest discussions on work topics!

Microsoft launched Windows Server 2008

Microsoft launched Windows Server 2008 (together with SQL Server 2008 and Visual Studio 2008) today at Suntec Convention Center. Typical of most Microsoft events, the launch event had plenty of fanfare, jam packed with attendees and partner showcases (a total of THIRTY!).

One reason for the huge turnout is likely to be the freebies. This year, Microsoft gave away stuff like Windows Vista Ultimate, Office (not sure which edition), Xbox 360 and even a Sony Bravia LCD TV! (and no, I did not get any of those cool stuff *sniff*)

Talking about partner showcases, it came as a surprise to me (and most I suspect) to find SUN Microsystems present and they sure made their presence felt by being a Platinum Sponsor (the highest available) plus occupying the largest booth strategically placed at the entrance of the event. In the Keynote session, Mr Ong Chee Beng, MD for SUN Singapore, shared that SUN and Microsoft have been quietly working together for the past few years and they even deployed a number of their engineers in Microsoft's HQ up in Redmond.

Well, back to the main star of the event, Windows Server 2008. Key defining features in this release are Hyper-V, Server Core and Windows PowerShell.

Hyper-V is essentially a host manager (or hypervisor) that manages multiple VMs running in a physical machine. This is a big shift from the single OS to single physical machine concept in previous generations of Windows Server. With the entry of this type 1 hypervisor in it's portfolio, Microsoft can finally compete head-to-head with the likes of VMWare (ESX Server) and Citrix (ZenServer) and take a share of this lucrative Enterprise Server Virtualization market.

Server Core is a packaging/installation concept where you get to choose what feature sets (also called server roles) you want to install. This is in stark contrast to the previous generation of Windows Server (i.e. Windows Server 2003) where all the binaries are installed whether you use them or not. According to Microsoft, this reduces the software maintenance and management required as well as the attack surface.

The last defining feature is the Windows PowerShell. This is a task-based command-line shell and scripting language designed especially for system administration. Above and beyond a normal text based shell interface (like cmd.exe, CSH, BASH, etc), it gives you the ability to manipulate objects rather than just text (say goodbye to text parsers like awk and sed!). This is possible as its built on top of the .NET common language runtime (CLR) and the .NET framework. It accepts and returns .NET objects and comes with a large set of built-in commands. Gone will be the days where you write cryptic shell scripts that nobody understands (including you too over time) using Win32 ports of the popular Unix text parsers.

Want to find out more about Windows Server 2008? Check out the reviewers guide.

Seamless sign on to internal web applications using your Windows credentials

I was recently tasked to architect and lead the Single Sign On (SSO) implementation within the Pan Asia region. This is part of the global identity management initiative whose vision is enable any employee in any part of the world to access any authorized internal application, be it web or desktop, using a single username and password.

Given that:

1. the scope is for internal systems only,
2. all workstations are part of an Active Directory domain,
3. Windows authentication (aka NTLM/Kerberos) is the standard authentication protocol for non-web related access (shared folders, printers, Microsoft Exchange, etc) in our environment,
4. Internet Explorer is the standard browser application used in our environment.

Its a no-brainer that the cheapest and quickest way to achieve SSO is by enabling Windows authentication on the web application end.

Besides cost savings, the other major benefit to this approach is that users only have to sign on to their workstations once (i.e. the normal Windows login process) and enjoy seamless access to any (internal) web applications just like how you access Microsoft Outlook or shared folders today.

Getting this up and running in ASP/IIS based web applications is a piece of cake. See recipe. (No pun intended.) The key steps are:

1. Disable Anonymous Access and enable "Integrated Windows authentication" in IIS for the ASP/ASPX application in question.
2. Do the same in the web config file if this is an ASP.NET application.
3. In your code, grab the id of the user using the code Request.ServerVariables["LOGON_USER"].

On the Java front, there are two choices mainly:

1. via a servlet filter like JCIFS NTLM HTTP Authentication module, or
2. via Andy Armstrong's JAAS login module

One gotcha to take note of. The above works when your application, hosted in the internal network is accessed from the web browser:

1. via an internal IP.
2. via the hostname of the IIS server.
3. via a fully qualified domain name (FQDN) that is a sub-domain under your Windows domain. i.e. your Windows domain is acme.com and your application domain name is abc.acme.com.

If, however, your application is accessed via a FQDN other than the above, you will find that user is prompted for his credentials in a popup dialog much like what you get in Basic Authentication. Details on this issue (and workarounds) can be found in this KB article (ID 303650).

In summary, its due to Internet Explorer mistakenly identified your site as an Internet site and the default browser settings prevents it from sending your Windows credentials for security reasons. To overcome this, you have to add the FQDN to the "Trusted sites" or "Local Intranet" lists.

To make life easier for your users, and since they are all on the domain, you can get your system administrators to push this configuration change to their PCs transparently via group policies or logon scripts.

Hey, Thats me in the newspaper! :)

This photo appeared in page 29 of the "Digital Life" section of "The Straits Times" published on the 11th Sept 2007. Nothing special there except that I'm in it! (Good luck guessing which one's me! :)) The article was about wikis but I'm guessing that the author must had ran out of ideas finding a suitable illustration to match for having to recycle such a old photo. (And just how the heck did you find and associate this photo to wikis?? This I'm dying to know!)

A little background on this photo for the curious. It was taken way back in the year 2000 when a bunch of geeks came up with a brilliant (of course *sic*) idea to capitalize on the booming internet advertising market. The idea revolves around the creation of a new advertisement delivery channel that is capable of sending targeted and highly relevant rich media ads over low bandwidth connections to a consumer's desktop. (this is ground breaking stuff back in those times!) More importantly, the model/system is capable of accurately tracking the end-to-end buy cycles of the consumer (both through the channel and otherwise) hence giving the retailers and advertisers the holy grail of internet advertising or any other mass media form of advertising for that matter - to be able to accurately measure the "look-to-book" conversion rates of a marketing campaign.

Personally, I think the concept rocks given that back in those days, retailers/advertisers were paying big money for blasting the masses with banner ads (usually not even targeted) and yet not having the slightest clue on the effectiveness of the campaigns due to the nature/limitation of the approach.

Unfortunately, we came out of the "stealth" phase at a really bad time. The last quarter of 2000 marked the beginning of the melt down of the dotcoms and one of the hardest hit segment is, you guessed it, internet advertising. Trying to convince investors and advertisers alike to come on board an innovative but ultimately untested model, amid shaken confidence and shrinking profits, is akin to convincing a die-hard coffee drinker to try tea; the product may be sound but the interest is just not there at the time.

Anyhow, back to the picture. Looking at it really brings back lots of memories; all the late nights and long weekends burned in office working our ass off, our regular lunch time fragging sessions (counterstrike, unreal tournament) led by our CEO as well as cooking sessions led by our COO. I have to say that although work was tough then, the company was great; one of the best team I have the pleasure to work with. And hell it has been a long time since.

Well, if you guys happen to be reading this, this post is dedicated to you lot of merry man (and women) and lets make an effort to meet up again!! Its been a bloody long time since I last put on a CT uniform! :)