Friday, September 26, 2008

IV&V

I had an opportunity to meet with Mike Rollings of the Burton Group the other day and had a very interesting conversation, touching lightly on several topics.

Regarding enterprise architecture maturity models, he agreed that every model that is currently available is either wholly or largely process-centric and in most cases is not what customers want. They want a quality-based, more tangible maturity model. As a consultant, when I get asked to perform an architectural analysis, the questions my customers inevitably want answered include what's working (and how well), what's broken (and how badly), what can I salvage, what can I exploit, what do I toss, what can I buy, what do I have to build?

Regarding enterprise architecture frameworks in general, he noted a distinct lack of pragmatism in many of them. He agreed that the various framework stewards, including the Open Group, are confusing comprehensiveness for consumability. I wondered aloud if the current frameworks are really being shaped by the (in)ability of the current suite of vendors to implement various, pragmatic facets.

Without answering my question about frameworks, he commented on the almost ubiquitous frustration most enterprise architects have with the existing tools. I'll take that as a diplomatically indirect answer. My major complaints about existing tools are threefold. First, they don't allow complete round-trip visibility from business idea to production. Second, they fall apart when trying to model systems-of-systems. Third, they are built for the needs of modelers, not the needs of the end-customers who need to understand the models. Hmm, just like most of the EA frameworks. Notice the link?

I wanted to chat about business processes, security and the malleability of architectural models but, we ran out of time. It's always good to get some independent validation and verification of one's sanity from a fellow practitioner. Hopefully, we can continue this conversation in the near future.

Monday, September 22, 2008

Security Professionals and Software

James McGovern simply confirmed what I have observed all along:

I then asked, how many of them actually had a software development background and pretty much every single hand in the room dropped.

This is why we, who do have a software development background, pretty much discount just about everything "security professionals" say. Not only are the overwhelming majority of "security professionals" ignorant of software development and actual code, they seem to be intimidated by anything that's not sold in a black box that they can push buttons on.

Instead of focusing on what not to do, perhaps they should start focusing on how to do something securely. And at the very least, learn enough SQL so a properly parametrized query can be illustrated on a whiteboard.

I have yet to come across a "security professional" I can't send packing after speaking 3, simple words: "Show me code."