Author Archives: Dirk

The Scrum Guide

Ken Schwaber and Jeff Sutherland wrote The Scrum Guide as manifesto for Scrum.org. It is there view on how to approach agile projects.

The document is very concise and explains scrum in all it aspects:

  • The Scrum team
  • Scrum events
  • Scrum artifacts

But don’t be mistaken it is not because the theory is easy to understand, Scrum is simple to apply and to master.

More info on:

https://www.scrum.org/

Share this postSave this post

The Lean Startup

“The Lean Startup” by Eric Ries is organized around 5 principles:

  1. Entrepreneurs are everywhere
  2. Entrepreneurship is management
  3. Value learning
  4. Build – measure – learn cycles
  5. Innovative accounting

A startup is an experiment under extreme uncertainty. Most startup fails and often only the success stories make the news.

Lean startups must be managed differently. Classical management skills fail because they do not take into account the level of uncertainty in startups General management skills do not work for the two guys in the garage. Startups survive because they pivot fast: use a foundation, adapt quickly to circumstances and apply the lessons learned. Startups win through the speed they can adapt and before they run out of money.

Failures are successfully executed bad plans. You achieved to deliver on time, budget and with the correct quality something nobody wants.

To avoid the failure trap feedback cycles must go fast and must be iterate multiple times “Release early and release often”:

  1. Build ideas and measure the results.
  2. Learn from the results to generate new ideas.

Build should focus on a Minimum Viable Product (MVP). The MVP is put in front of customers as a kind of experiment and measured.

Measurements must be tripe A: Actionable, accessible and auditable. The measurements are used to tweak and improve the MVP. If the cycles show diminishing returns it is time to pivot or change the game plan.

Share this postSave this post

The One Minute Manager

“The One Minute Manager “ by Kenneth Blanchard and Spencer Johnson explain management according to a set of one minute tasks.

  • One minute goals
  • One minute praising
  • One minute reprimands

“People who feel good about themselves produce good results.”

“Help reach people their full potential. Catch them doing something right.”

“The best minute I spend is the one I invest in people.”

“Everyone is a potential winner. Some people are disguised as losers. Don’t let their appearances fool you.”

“Take a minute to look at your goals. Look at your performance. See if you behavior matches your goals.”

“We are not just our behavior. We are the person managing our behavior.”

“Goals begin behaviors. Consequences maintain behaviors.”

Share this postSave this post

The Web Application Hacker’s Handbook

“The Web Application Hacker’s Handbook” by Dafydd Stuttard and Marcus Pinto.

The book was written already in 2008 but points out many, still to date, common security risks that every developer should know about. Security is for most either a developers a nightmare – it is my job but I have clue –  or either an afterthought – this is not my job.

The book covers many ways your custom build website is at risk, some examples

  • Mapping the application: the structure of URI’s and parameters gives away a lot of information.
  • Bypassing client controls: the back-end should never assume a safe front-end.
  • Authentication: weak passwords.
  • Session management: the need for state introduces risks around the tokens to identify sessions.
  • Injecting code: the well known SQL injection issues.
  • Exploiting path traversal: elevating your rights as a user.
  • Application logic issues: parameterized query strings or clear text parameters that control certain business limits can easily be spoofed.
  • Information disclosure: errors that are too verbose.

 

 

Share this postSave this post

Concepts of Application Security

Confidentiality

  • Definition: Confidentiality means that sensitive information should not be readable by unauthorized persons.  For a part, confidentiality can be achieved by authentication and authorization.  In this chapter, we discuss other confidentiality measures you can take to keep private information private.
  • Remediation: SSL + Cryptography, browser settings: disable browser features, directory listing on web-server, cached data + cookies.

Integrity

  • Definition: Integrity means that data should not be able to be changed during data transmission.  If data is tampered with, this should be detected.
  • Remediation: SSL + Cryptography.

Authentication

  • Definition: Authentication means we should assure that only legitimate persons are able to access the application.  During authentication, the identity of a user is established, and his credentials are checked.
  • Remediation: Authentication + Access Control, caching authentication tokens, account locked out after retries, hard-coded credentials in code, difficult and encrypted session ID’s, limit number of sessions, session timeout, no default passwords, secure kept open channels, secure administrative interfaces, apply patches, secure DB connections.

Authorization

  • Definition: Authorization means we should control access to application resources by authenticated users or code.
  • Remediation: Code-access security, role based security, secured DB accounts, secure DB admins to avoid direct data manipulation bypassing the system.

Non-repudiation

  • Definition: Non-repudiation, in its simplest form, means that proof should be provided about the fact that a certain message has been sent by a certain party.  Non-repudiation of this kind can be obtained by using cryptography: digital signatures assure that a certain message is sent by the owner of a certain private key, and that the message has not been tampered with. 
  • Remediation: SSL + Cryptography

Availability

  • Definition: Availability means that we should prevent attacks that try to make the application unavailable for legitimate users of the application.
  • Remediation: Input Validation, HTTP request validation, input length validation, unsupported characters, character set validation.

More details in the following overview slide deck:

Share this postSave this post