Software security has and continues to be a top line issue for most organisations, yet software and IT teams still continue to produce and deploy insecure code and applications with serious consequences for the brand, reputation and, of course finances of their customers and their own organisation.

Creative Intellect in association with the IASA have recently launched a survey that seeks to understand the security challenges across the development cycle and look to see if it is handled better by large or small projects, organisations and if there is a difference across industries.

I thoroughly recommend you taking part in the survey. All respondents will get a free copy of the full report and will be entered into a draw to win a free half day consulting session with Creative Intellect Consulting Ltd in the field of software delivery and application lifecycle management.

The survey link is: https://www.surveymonkey.com/s/SecuritySurvey-CIC

So what does a Microsoft Architect do after Microsoft? Well more architecture it seems from the business through to its people and the systems the use. There are actually three main strands to my post-Microsoft strategy that I’ll summarise below:

As you may know I’ve had a long history with IASA, especially here in the UK where I founded and have chaired the UK chapter for around 6 years now.

Over this time we’ve been developing a credible and sustainable education and certification program for IT architects and now, along with my colleagues at IASA, I want to bring this to Europe. We’re holding our next UK certification boards this November but the plans for IASA Europe are much bigger than just this.

inTHiNK! is the name of my new professional services practice www.inthink.co.uk. inTHiNK! will offer services from business & technology strategy, architecture practice and guidance through to cloud readiness and enablement. This will scale out through an extensive associate network of solid top-level IT professionals. Contact info@inthink.co.uk if you want to follow up.

As a brand new bizspark partner I will be seeking to exploit the value of the Azure platform delivering a new breed of SaaS enablers and business offerings to the market!

So that’s about the end of the Microsoft blog but if you want to keep in touch then take a note of the following links.

Best regards and good luck!

Matt Deacon
CEO, inTHiNK! Ltd
www.inthink.co.uk
mattdeacon.wordpress.com
www.twitter.com/mattdeacon

https://mattdeacon.wordpress.com/2010/09/22/white-papers-from-matt-deacon/

www.mattdeacon.com/2010/09/15/soa-a-square-peg-in-a-round-hole/

It's an easy URL:

www.mattdeacon.com

so please drop by and take a look:)!

I'll run the blogs in parrallel for a while ... hope to see you there some time:)!

GreyBeards is comprised of Martin Banks and David Tebbutt, both seasoned journalists and technology writers who offer a range of strategic consulting and training courses focused in part dealing with the media. I’ve had the good fortune to be on the receiving end of their wisdom, both in the class room but more often outside through our engagements at events and meetings. David, sent over a really useful graphic they use as an aid-memoire for those that engage readily with the press. However, as he pointed out, it’s really applicable to almost any circumstance where you have a message to convey which immediately made me think of the challenges we face as IT professionals in gaining the support and commitment from our peers.

Copyright GreyBeards Ltd. 2010
(Click here or on image to see a fully annotated version)

If you click on the picture it will send you to David’s version that is full annotated, just hover over any part of the diagram to get relevant information.

The “egg-timer” (triangles) demonstrates the need for preparation and in constructing, simplifying, refining, and I think, symbolised by the image, consolidating your key messages. This then flows into the bottom half which represents the expansion into the interview itself.

The “bridge” to me is central and key to your interview technique in my opinion as it is a reminder that where ever your conversation may start, you need to seek to get back to your key messages, the areas you are experienced and knowledgeable to talk about.

The “rat hole” is the place that needs to be avoided and the reason you need to use the “bridge” to link back to saver ground.

The“safety zone” is where you want to be to deliver your message and is amplified on the right hand side of the diagram. The circular nature of this reminds you that you can roam any where within the safety zone, but remember the closer you get to the borders, the nearer you get to the rate holes so use the bridge to move to safer ground.

Getting across the river!

Another useful analogy I was shown sometime ago was to imagine that you need to cross a river.

You have a pile of rocks in your pocket that you can throw out into the river that will help you get across. These represent your key messages you wish to relay.

However, as with all stones in water, be aware that they become slippery when wet! Many are uneven and wobbly too.

You must avoid the water at all costs so you must try to balance on your stones. If not then the shark is sure to get you!

(Picture drawn using Expression Blend 4!)

So I’ve seen all the flashy demo’s DeepZoom like the infamous Hard Rock Memorabilia site, but I must confess that I’ve often got stuck in the “nice technology, now where’s the problem” camp. Pivot from Microsoft Live Labs has fundamentally changed all that and it’s potential for business intelligence I think is fantastic.

The video below is a little twee but it makes the point.

What’s more is that Pivot is free and available Now!

Where to get it

Documentation:

Source code:

The Review

As a piece of “Achitectural” guidance I am to be convinced that this delivers on its promise. In what states to be the first in a series it, rather oddly, decides to focus on “Migration” as the first topic. Personally, I was expecting more of a architectural review of the platform itself taking into account architectural considerations of reliability, scalability, redundancy and security and the like. These, instead, are confined to a rather light-weight platform overview, that raises more questions than it answers, including several inaccuracies, that reads more like marketing literature than offering technical insight. This may be because it is assumed that the “what is Azure?” discussion has already been done to death, but I don’t agree. No one has really addressed the architectural considerations of the platform, providing a thorough explanation of how features have been implemented and on what their limitations are. Certainly, nothing exists, to the level required by architects facing real business and technical opposition to cloud adoption. This, in my opinion is a missed opportunity and something that is still required.

That said, this is couched as being “guidance” and therefore the fact that it seeks to investigate the process of “migration” should not make it any the less useful. However, in this regard too, it fails to really deliver what, in my opinion the architect requires. Rather than considering a wider range of ‘adoption’ scenarios, it chooses instead, a simple, straight forward migration scenario in the context of an enterprise that has no concerns over use of cloud services. The real issues architects face in convincing others of the value of cloud, and even in convincing themselves in order to champion the opportunity is therefore avoided. A broader look at migration approaches and patterns and how these apply in the context of Azure I think would have provided more value to the architect.

However, it is important to note that the guidance is not completely devoid of any architectural value and the “How much will it cost?” section is a pretty useful evaluation approach to considering the cost impact of design decisions. It also does a reasonable job at introducing the subject of lifecycle management, although this is rather over simplified, it is still useful in highlighting the requirement. But it is on the developer side where the guidance starts excel, providing hundreds of developer gems hidden through out the document, such as the effect of partition keys on table query performance and in identifying the differences between development and windows azure table storage, referencing a useful MSDN article on the subject. In valuable stuff, but hidden from view.

In fact, it is pretty clear why the scenario was chosen, this is not really about providing architectural guidance, but in providing a context for explaining how to implement claims-based identity on Azure. As a technical resource for providing practical developer guidance on implementing a Claims-Based Identity and Access Control using Active Directory with an Azure application, this guidance actually scores pretty high. This type of guidance is simply not available else where. The problem and shame is that all this architectural veneer, hides the fact that this delivers genuine and much needed technical value and further, that no one who needs it will actually find it.

All in all, this is a valuable and well written resource, but my concern is it’s misdirected and that it’s value wont be fully recognised unless the right audience find it and in its current format, this audience would find it hard to get past the first pages to find all the goodness inside. The need here is to liberate the value and consider re-delivery as a straightforward, honest, simple to follow, developer how to guide. In the mean time, if you want to try and implement claims-based identity on Azure than I’d recommend skipping straight to Phase 1: Getting to the Cloud or even straight to the source on codeplex.

The Verdict

Rating (as Architectural Guidance): 5 out of 10. There are gems, but they’re hidden.

Rating (as Developer “How to”): 7 out of 10. If reformatted as a developer guide I’d put it nearer a 9!

There’s plenty I could talk about, such as UML support and more significant, that you can reverse engineer the likes of sequence diagram directly from your code. Or the architectural explorer and the support for creating layer diagrams with rules that you can then validate your code against plus the support for dependency matrices, and so the list goes on.

However, this raised a slight concern for me that with the growth in tools like these could eventually lead to a significant overhead in learning how to use them. Obviously they are built to be intuitive and easy to use but all the same, the shear volume could become overwhelming.

But as luck would have it the meeting coincided with the release of a codeplex project that provides guidance on how to get the best out of Microsoft’s Architect Tooling in Visual Studio. This has been produced by a set of Microsoft Rangers who have the job it provide out of band solutions for missing features or guidance on the product so you know it’s always going to be useful and based on real-world experiences.

Finally, as this guidance had input from Alan Wills, who has long been synonymous with the world of software modelling, I can’t recommend it highly enough. It’s worth downloading an evaluation copy of VS2010 Ultimate and having a trail if you haven’t already upgraded!

Architect Tooling:
vsarchitectureguide.codeplex.com/

Visual Studio Ultimate:
www.microsoft.com/visualstudio/en-us/products/2010-editions/ultimate