Reflection on Software Architecture

Vista SP1 - Get more free space after installation

dchandra — Mon, 14 Apr 2008 04:59:00 GMT

I recently applied Vista SP1 on my laptop running Vista X64. I must say that I noticed the improved file copy performance, although I also fully appreciate the changes made to it as nicely described in Mark R blog here:
http://blogs.technet.com/markrussinovich/archive/2008/02/04/2826167.aspx

I also noted that my available free space reduced by quite a bit after the install. I came across this reference: http://technet2.microsoft.com/WindowsVista/en/library/0505991e-49c2-494b-8703-257a14c3d4721033.mspx?mfr=true that allows the removal of archived RTM files. The CAVEAT is that after you use this, you will NOT be able to remove SP1 from your system. The tool is really straightforward to use, and it freed around 1Gb of space from my C: drive, not bad for commiting to SP1..

Unified Communications

dchandra — Wed, 05 Dec 2007 07:47:00 GMT

A few months back I wrote about getting leverage from your investment in the technology platform. In this column, I will cover one specific topic that demonstrates this. One of the most notable inventions of the late 1890s was the telephone, it allowed people to communicate over long distances instantaneously. Over the last few years a variety of new mechanism to communicate and collaborate has materialised. People can now communicate through email, instant text messages (through computer or through the mobile phones), voice and video over the Internet. However, these methods of communication are still limited to private use due to the slower adoption of these technologies in the corporate and government area.

Technology adoption occurs in stages, as many in the IT industry are aware. A particular technology becomes pervasive when the majority of the people started to use and adopt it, this usually occurs when the technology has manifested in a way that allow people to use it as part of their day to day life. In the next few years the convergence in communication will proliferate because the accessibility to the way we use these technologies is becoming more integrated with the way we do our business. Today, all government departments in developing and developed nations are equipped with a telephone and a significant majority are using email. However, we still see a divide in our phone system and email system. We also see a divide in our instant messaging system. Why couldn’t we access our emails and calendars through the telephone, why can’t we access voice mails through our email system and why can’t we be reached on the same telephone number even while we are travelling. Well actually, you can do all of these today, we call it unified communication.

Unified communications bring many benefits; one of the most interesting benefit is having the ability to detect presence or the status (busy, away, offline etc) of your fellow colleague or friend. This information can help determine the method of communication that you can use to interact. If the person is busy you may decide to send an email instead of calling or using instant message. A more interesting capability that can be delivered using this information is a tighter integration into an organisation workflow. As an example, imagine in your department you have one person in charge of approving a certain type of document. Current automated workflow usually has a static list of approvers, without regard or knowledge on the availability of that individual. Imagine if your workflow can now automatically detect the user presence status (away, on annual leave etc) and then automatically re-route the document to an alternative person. This status information is constantly updated using current knowledge of the user schedule on their calendar and it can also be set based on their current work status (they may be busy processing a document). We have integrated these disparate technologies into a coherent, consistent and smart experience for the end user. This is a true example where a platform can be leveraged by the whole organisation and allowing various departmental applications to leverage the capability once deployed.

Another more obvious benefit of unified communications is cost savings and convenience that can be derived by organisations. If we look at the diagram, (point 1) organisations generally need to deploy a computer and a handset to each of their employees. There are costs associated in doing this, there is the telephone handset cost and there is also the maintenance cost for the back end system, costs with moving the numbers around and costs with having to employ individuals with the telecoms skills. If at the user end (point 2) this is converged on a single device (the computer), the company can combine the costs of maintenance into managing the computers and leverage greater economies of scale and can also reduce the skill set needed to maintain the equipments. Organisations that have multiple offices, especially those that are located in different countries or states will be able to realise greater cost savings on communication bill by communicating over the Internet (point 3).

If your employees travel or move around a number of times a year, the benefit of unified communication is amplified greatly. They can literally be reached anywhere they are connected to the Internet on the same telephone number while saving the company on long distance charges (point 4). Another important aspect is the ability to be reached by customers on a single number. How often have the people in your organisation become unreachable because they are travelling and to make matters worse they did not receive important voice mails or were even aware they were called by the customer?

Communication convergence is happening, the unification of communication and collaboration into the day to day tools you use for business is happening.

Find out more about Microsoft Unified Communications: http://www.microsoft.com/uc

System security beyond the firewall

dchandra — Tue, 16 Oct 2007 08:44:00 GMT

System security is an interesting topic and as most readers of this publication would appreciate, there is always a trade off in security. Security by default introduces overhead. The way we commonly decide the appropriate level of security to apply is to think about the amount of risk we are willing to take.

One of the commonly used concepts in security is defence in depth. The key underlying assumption of this concept is that at different areas or layers of the system we need to ensure there is adequate protection because there is no guarantee the previous layer is impenetrable. To secure an enterprise, we need to take a holistic approach that covers people, processes, policies and technology. This article covers aspects of security technology showing that security in the Enterprise require more than just a firewall which is the first line of defence. The following diagram illustrates the key areas of security within an Enterprise.

Let us take a tour through this diagram through the labelled numbers:

1. The most common mechanism to secure the enterprise is to install a perimeter firewall. This is useful in preventing unauthorised users from outside the corporate network from getting into the enterprise network. This is the first line of defence.

2. Most modern computers would have a firewall installed and also have a mechanism for users to be authenticated and authorised to use the computer. Authentication is about verifying the user identity. Authorisation is about ensuring the authority to perform a certain action or task. This is the second line of defence.

3. Most organisations would probably have no further protection mechanisms beyond the two described above. The data that resides in the computers and laptops are often left unprotected. Data at rest is a big issue with laptop computers, even though a data thief may not be able to access the laptop by trying to login through the operating system, there is nothing stopping them from taking the hard drive out and plugging it into another system and use that to access the information. One of the built in feature of the new Windows Vista operating system is a technology called BitLocker, which enables the entire hard drive to be encrypted, preventing data thief from getting access to any information on the hard drive. This technology can also be used to secure removable storage devices.

4. Information Rights Management (IRM) provides the ability to restrict information flow. This technology enforces information security policies and helps reduce the unauthorised re-distribution of information. This is an area where Microsoft is recognised as a leader in vision and implementation by Gartner.

5. The corporate network (outside the data centre) is normally left unprotected because it is usually supplemented with physical security, only authorised person can enter the office building. However it is common for business partners to enter our offices and join the network as guests. When they plug into the corporate network, how do you know their computer is free from viruses or malware? The technology exists with Microsoft Windows Servers to provide network isolation allowing only authorised corporate computers to communicate with each other. This means a virus or malware would not be able to communicate with authorised corporate computers, significantly reducing the chance for it to infect. The technology also provides the capability to only allow authorised corporate computers with the correct set of software installed to connect (E.g having Antivirus software with the latest update)

6. For travelling corporate users, a common mechanism to connect back to the company network is via a Virtual Private Network that allows secured communication over the Internet. However, some public places may block the VPN connection so the user would not be able to connect through.

7. Another mechanism to access corporate information and resources is through an application gateway. This allows browser based Intranet application to be accessed securely from the Internet and it also allows the types of information and functionalities that can be accessed by users when they are not connected directly in the internal network. Microsoft has recently launched a product that specifically handles this capability called the Microsoft Internet Application Gateway (IAG). This allows your Intranet applications to be accessed securely from the Intranet. It also allows the administrator to determine which specific functionalities and information is allowed to be viewed outside the corporate network without having to modify the application code.

Microsoft takes security seriously and embarked on a vigorous focus on security back in 2002 under the Trustworthy computing initiative introduced by Bill Gates. This initiative focuses on 3 key pillars: Technology Investments, Prescriptive Guidance and Industry Partnership. Technology investment focuses on the way Microsoft design and built software. Prescriptive guidance focuses on ensuring our customers and partners have access to education and training and providing the technology to easily access the latest security patches. Industry partnership focuses on ensuring we cooperate with other vendors to ensure our products work together seamlessly and securely. To learn more about this initiative please visit http://www.microsoft.com/security

Microsoft, EMC & CISCO recently released an announcement on SISA (Secure Information Sharing Architecture) that will offer one of the most comprehensive, security-enhanced, commercial, multi-vendor, end-to-end information-sharing technology architectures for helping protect and share sensitive government information. http://www.sisaalliance.com/

The Architecture Journey

dchandra — Mon, 06 Aug 2007 11:07:00 GMT

In an Organization, there are usually more than one computer systems connected to each other via computer networks. In a networked corporate environment you will find two types of computer systems: clients and servers. Clients usually referred to as Desktops, interact directly with the user. Servers are usually maintained by the IT department and most users interact with the server capabilities through their client desktops. A simple example is storage of a file on a network file share, a functionality provided by a server.

These clients and servers form an ecosystem. In a small organization maintaining this ecosystem is not difficult. Each client usually contains a number of locally installed applications that help the user to perform their business tasks. Information can be shared manually or through a network file share. However in larger organizations the number of desktops and applications that supports the business increases and so does the complexity in managing them. Complexity in sharing of information also increases. A quick analogy would be the difference in managing your house versus managing the city.

Computer system Architectures exists to provide coherent structure in this ecosystem, much like a building architecture provide the guidance on how the building should look and what features it should provide (number of bedrooms, bathrooms etc).

In the course of running your business, you are likely to have come across the terminologies: EA (Enterprise Architecture), SOA (Services Oriented Architecture), Application Architecture, Technical Architecture and Infrastructure Architecture (there are many other variants, but most will likely map or relate closely to one of the five I just covered). Why are there so many Architectures and how do they relate to each other? The figure below provides a quick snapshot on how they relate to each other. Note: it is very common for large organizations to also have an information or data architecture, security architecture etc. For this article, we can assume that these architectures are embedded within Enterprise Architecture or SOA.

Let’s start from the bottom of the stack - Infrastructure architecture is usually associated with the “plumbing” of the systems. They normally deal with network topology, identity management, server management and security.

Application architecture deals with the structure of custom and commercial off the shelf (COTS) applications that provides specific business functionalities. End users perform their business tasks through the use of these applications.

Technology architecture usually provides specific technology and product guidance for an organization. This architecture requires a lot of governance. It exists to increase the predictability of system roll out and it is usually done as part of a cost reduction. Minimizing the technology choices reduces complexity and chance of failure. This is similar to restaurants. Each restaurant will have a menu of what it can provide. It is not practical to have a very much wide variety of choices. However as a side effect, this may hamper innovation from newer technologies. Effective organizations have investments and processes in place that allows new technologies and business capabilities to be piloted and incorporated in a systematic manner into the Technology architecture.

Service Oriented Architecture (SOA) is a model or a pattern on how business functionalities can be exposed and used. The main attractor to SOA is the ability to provide modular organizational capabilities, allowing the system to be more flexible. By providing better system flexibility, the organization can be become more agile, because it will be easier and quicker to compose new capabilities. A simple analogy is to imagine that you are building a new house. To get electricity, clean water and sewage all you need to do is get an electrician and plumber to make the necessary connection to the street outside this new house. You don’t need to know where or how the electricity and water is made available, just that it is there and it is provided within a certain standards. SOA is essentially trying to mimic this in the computer world, allowing you to build new business applications by leveraging existing business data and processes quickly and easily. To make this happen, the systems from various vendors needs to agree on certain standards for communicating and exchanging information, the Organization must also have clear knowledge of their core business capabilities that can be used as a foundation. Microsoft currently spends a lot of effort to ensure that our products and technologies adhere to open standards, we compete on providing the most effective implementations and tools.

Enterprise Architecture (EA) is usually the most complex after SOA. One of the main reasons is the breadth of coverage. Effective EA will usually cover across an entire department, organization or even multiple organizations that belongs to the same holding company (although a much more common scenario is within the department or organization). In the discussion with respect to EA, you may have also come across the term Architecture Framework such as Zachman framework, US DoD framework (DODAF), Federal US Federal Architecture framework (FEA), UK Ministry of Defense Architecture Framework (MODAF), and the list goes on. In a very simplistic description, architecture frameworks are used to provide a consistent mechanism to document and communicate system architecture. It is important to establish a consistent framework within the enterprise to reduce misunderstanding on terminologies and views.

Hopefully the very quick overview on the five architectures helps clarify what they cover. The more interesting question is “do they really matter?” Having worked in a number of large organizations, I have seen how easy it is for centralized architecture groups tasked with EA or SOA to become isolated and drive policies that is not necessarily practical or in total alignment with the organization or business objectives. A recent working paper by the MIT Sloan Center for Information Systems Research http://web.mit.edu/cisr/working%20papers/cisrwp359.pdf provides interesting findings on the area of EA. One of the interesting topics discussed is the concept of Architecture maturity. The study found that most companies go through four stages of architecture maturity, from business silo through to business modularity. Business silo means each business unit will independently develop and maintain its own applications. Business modularity means each business unit core processes and capabilities are available in a modular fashion such that it can be quite quickly assembled to create a new business capability. There are three very interesting points covered in the paper that I would like to draw out:

1. It is the journey through the stages that matters most. They found that most organizations will not succeed in trying to jump stages too quickly or skip stages. This is similar to having a 13 year old child attend university level classes; only in very few cases can we expect the child to grasp what is actually being thought. Not all organization needs to be at the business modularity stage. It is far more important for the organization to learn through the journey and discover what and how technology can be infused with business direction to deliver the required capabilities.

2. As companies go through the journey, those with successful EA has been found as the result of the CIO having a good understanding and influence of the technology and business. In the businesses they have studied, the CIO usually carries another business role.

3. Business modularity stage is essentially what SOA is trying to provide. This architecture maturity model and the two items above really help explain why SOA is still not a reality in most companies. To deliver an effective SOA, companies need to be at the right maturity stage.

Recently I came across a very interesting quote by Brad Mercer from MITRE in his presentation “If you don’t control the Architecture of your system then that Architecture will control your system!” Imagine if you are the mayor of a city. If you do not provide a plan of what type of building should fill up which area then the population will determine it for you. Enterprise Architecture is the same, if you do not control it, it will be determined by the various projects within your organisation.

You may have heard of Infrastructure Optimization mentioned by Microsoft people. This is an initiative Microsoft has undertaken to classify the maturity stage of Organizations based on the work done by Gartner and MIT. In the Microsoft Infrastructure Optimization stages, there is specific classification and guidance on the initiatives organizations can undertake to move their maturity stage. More information for IO can be found here: http://www.microsoft.com/io

Microsoft Services has a core mission to ensure our customers and partners derive the most benefit from Microsoft products and technologies. Microsoft Consulting Services provides guidance and assistance for organizations in areas of Architecture and, application and system design. Microsoft Support Services provides assistance in IT systems management and product support. The Services organization is a relatively small unit compared to other outsourcers and consulting firms. The aim is to transfer knowledge into our customers and partners so they can become more effective on Microsoft products and technologies.

Most of Microsoft products are designed with easy to use wizards that allow small organizations to quickly learn and deploy these systems. Unfortunately in a more complex environment this becomes the problem point. The barrier of entry to deploy a technology solution is relatively easy that most organizations do not appreciate the complexity involved in planning and designing for the larger organization. It is important to ensure that these are considered up front.

As mentioned earlier, it is the journey through the architecture maturity stages that really matters. Microsoft Support Services can help your IT professionals become more efficient in managing the systems within your organization. This is in essence helping create a solid foundation to ensure that your desktops can be rolled out and managed efficiently. The servers are up and running. As business leaders you can be kept up to date on how your systems are performing.

One of the key areas that Microsoft Consulting Services can assist you is in analyzing and planning of your systems across the organization. Microsoft Services Business Architecture (MSBA) is a framework that has been developed over a number of years that has helped businesses rationalize their portfolio of business applications and better understand where to direct IT investment to receive the best ROI. By engaging Microsoft Services early in your journey, you will have a partner that will help you create a solid technology platform and also help you to navigate through the maturity stages. The following diagram shows one example output from the tool used by MSBA. The border color indicates the current performance (red = low performance), the fill in color indicates the importance of the business function (red = high value). The glyphs (black colored shapes) show the projects and/or initiatives that are currently planned to handle this specific area. From this small example we can clearly see where overlap of initiatives is occurring.

These types of exercises will help provide a clear picture of which areas will require attention.

Enabling BitLocker on Removable Drives (USB Flash drives, USB Hard Drives)

dchandra — Fri, 08 Jun 2007 09:02:00 GMT

There is a way to encrypt removable drives. Prior to attempting to enable BitLocker on your removable drive you need to ensure that the drive is formatted using the NTFS file system and you have backed up the data inside in case things go wrong and you cannot unlock your drive.

This link provides a high level overview of BitLocker: http://en.wikipedia.org/wiki/BitLocker_Drive_Encryption

Here is the executive version for the non-techie people: http://technet.microsoft.com/en-us/windowsvista/aa906018.aspx

Here is a reference to BitLocker FAQ: http://technet2.microsoft.com/WindowsVista/en/library/58358421-a7f5-4c97-ab41-2bcc61a58a701033.mspx?mfr=true

And if you’re really geeky and want to learn more about what encryption algorithm is used and why.. http://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf

Notes:

BitLocker is only available on Windows Vista Ultimate and Enterprise.
You can use BitLocker even if TPM is not present in your computer.

Before you begin

Before you start to encrypt your removable drive, you will need to think where you will store the key that will be used to unlock the drive. If you loose this key you will loose access to the data in the drive. To know where you want to store the key you need to know how badly do you want to protect the data inside.

Personally, I wanted a level of security over my data so that if I loose my USB drive someone can't just plug it into a computer and get access to the data. I am willing to sacrifice a little bit of security for the purpose of convenience. So I have actually decided to store the keys in 2 places, one is on my laptop hard drive, the other is on my home computer hard drive and I also have a backup key in another USB drive. This is so I can easily gain access to my USB key data on both computers and at the same time, I can also get access to the USB data on another computer by having the key on another USB drive. I have also chosen the default 128 bit AES key because I think this is adequate for my purpose.

To run the utility you will need to do:

Open command prompt using "Run as Administrator". Quickest way to do this is by right clicking the command prompt icon.
Make sure you are in %WINDIR%\System32 directory
Type the following command, this will list out the available parameters. I have also dumped out the parameters below:

cscript manage-bde.wsf

To encrypt the removable drive:

Assumptions:

Your removable drive has been assigned the drive letter R:
I want to have a recovery password automatically generated for me
I want to put my recovery key on D:\

Command to type:

cscript manage-bde.wsf -on R: -recoverykey d:\ -recoverypassword

This will encrypt the removable drive and put the key file in your d:\.

After the encryption, you will see your recovery password generated. Make sure you make a copy of this. It should be in a format similar to this: 111950-074411-044704-271238-313841-511626-093401-026598

To see the key file you will need to make sure in windows explorer you set the option to be able to view hidden and operating system files. The file will look something like: E181C91B-20A9-4702-87C9-33F901D38DE9.BEK

Note that it may take some time for the encryption process to complete. You can check the progress by typing the command below:

cscript manage-bde.wsf -status R:

To access your BitLocked drive:

When you load your removable drive, you an manually type the following (if you want to use your password) - (please use your specific password)

cscript manage-bde.wsf -unlock R: -recoverypassword 111950-074411-044704-271238-313841-511626-093401-026598

Or you can type the following command (Please use your specific key file)

cscript manage-bde.wsf -unlock R: -recoverykey D:\E181C91B-20A9-4702-87C9-33F901D38DE9.BEK

If you want to make life easier for yourself, you can create a batch file with the command above in it.

WARNING: Again before I get flame mails, by keeping your key file in your computer and if you type in your password in the batch file you are reducing the security of your encrypted drive because if someone has access to your computer and your removable drive, they can potential decrypt it.

Parameter Reference (just the relevant ones)

The table below provides a list of the parent parameters and the sub-parameters for each (where applicable)

Parent level syntax:

manage-bde[.wsf] -parameter [arguments]

Parameter

Description

-status

Provides information about BitLocker-capable volumes.

-on

Encrypts the volume and turns BitLocker protection on. Note that this process continues even after the script finishes executing in the command prompt. Use the -status flag to check encryption progress.

-off

Decrypts the volume and turns BitLocker protection off. Note that this process continues even after the script finishes executing in the command prompt. Use the -status flag to check decryption progress.

-pause

Pauses encryption or decryption.

-resume

Resumes encryption or decryption.

-lock

Prevents access to BitLocker-encrypted data.

-unlock

Allows access to BitLocker-encrypted data.

-autounlock

Manages automatic unlocking of data volumes.

You can enable the autounlock option for an encrypted volume if the following conditions are true:

•

The encrypted volume is unlocked when you enable the autounlock option. If the volume is locked, unlock the volume, enable the autounlock option, and then lock the volume again.

•

The operating system volume is encrypted. If you have not encrypted the operating system volume, you receive the following error message when you enable the autounlock option for an encrypted volume:

An error occurred while enabling the volume for auto-unlocking. (code 0x80310020)

-protectors

Manages protection methods for the encryption key. This parameter allows you to add, remove, enable, disable your keys or password to the encrypted drive.

-tpm

Configures the computer's Trusted Platform Module (TPM).

-ForceRecovery

Forces a BitLocker-protected OS to recover on restarts.

-fr

Same as -ForceRecovery

-ComputerName

Runs on another computer. Examples: "ComputerX", "127.0.0.1"

-cn

Same as -ComputerName

-? Or /?

Displays brief help. Example: "-ParameterSet -?"

-Help or -h

Displays complete help. Example: "-ParameterSet -h"

-status

manage-bde -status [Volume] [{-ProtectionAsErrorLevel|-p}] [{-ComputerName|-cn} ComputerName] [{-?|/?}] [{-Help|-h}]

Parameter

Description

Volume

A drive letter followed by a colon. Example: "C:"

-ProtectionAsErrorLevel

-p

Used in developing batch files.

Examples:

manage-bde -status

manage-bde -status e:

manage-bde -status e: -ProtectionAsErrorLevel

-on

manage-bde -on Volume

[{-RecoveryPassword|-rp} [NumericalPassword] ]

[{-RecoveryKey|-rk} PathToExternalKeyDirectory]

[{-StartupKey|-sk} PathToExternalKeyDirectory]

[{-TPMAndPIN|-tp} PIN]

[{-TPMAndStartupKey|-tsk} PathToExternalKeyDirectory]

[{-EncryptionMethod|-em}

{aes128_diffuser|

aes256_diffuser|

aes128|

aes256}]

[{-ComputerName|-cn} ComputerName]

[{-?|/?}] [{-Help|-h}]

Parameter	Description
Volume	A drive letter followed by a colon. Example: "C:"
-RecoveryPassword - rp	Adds a Numerical Password protector. If this option is used without additional values, the system will generate a random password. If you want to specify your own pass key, you will need to follow the rule below: The password must contain exactly 48 digits, which can be divided into 8 groups of 6 digits each. Use a hyphen (-) to separate groups of 6 digits on the command line. Each group of 6 digits in the 48-digit numerical password must be: 1. Divisible by 11 2. Less than 720896 For example, "000000" is a valid group of 6 digits. Invalid groups include "123456", "720896", and "888888".
-RecoveryKey -rk	Adds an External Key protector for recovery.
-StartupKey -sk	Adds an External Key protector for startup.
-TPMAndPIN -tp	Adds a TPM And PIN protector for the OS volume.
-TPMAndStartupKey -tsk	Adds a TPM And Startup Key protector for the OS volume.
-EncryptionMethod -em	Configures the encryption algorithm and key size. Default is set to AES 128 with Diffuser. If you want to know more about the encryption algorithms you can read it here: http://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf
-SkipHardwareTest -s	Begins encryption without a hardware test.

Examples:

manage-bde -on C: -RecoveryPassword

manage-bde -on C: -RecoveryKey e:\ -RecoveryPassword

manage-bde -on C: -rp -rk "f:\Folder" -SkipHardwareTest

-off

manage-bde -off Volume [{-ComputerName|-cn} ComputerName] [{-?|/?}] [{-Help|-h}]

Parameter	Description
Volume	A drive letter followed by a colon. Example: "C:"

-unlock

manage-bde -unlock Volume

{[{-RecoveryPassword| -rp} NumericalPassword] |

[{-RecoveryKey|-rk} PathToExternalKeyFile]}

[{-ComputerName|-cn} ComputerName]

[{-?|/?}] [{-Help|-h}]

Parameter	Description
Volume	A drive letter followed by a colon. Example: "C:"
-RecoveryPassword - rp	Provide a password to unlock the volume.
-RecoveryKey -rk	Provide an external key file to unlock the volume.

Examples:

manage-bde -unlock -?

manage-bde -unlock e: -RecoveryPassword ...

manage-bde -unlock e: -RecoveryKey "f:\File Folder\Filename"

-autounlock

manage-bde -autounlock Volume

[-enable | -disable | -ClearAllKeys] volume

[{-ComputerName|-cn} ComputerName]

[{-?|/?}] [{-Help|-h}]

Parameter	Description
Volume	A drive letter followed by a colon. Example: "C:"
-enable	Enables automatic unlocking for a data volume.
-disable	Disables automatic unlocking for a data volume.
-ClearAllKeys	Removes all stored external keys on the OS volume.

Examples:

managee-bde -autounlock -enable E:

managee-bde -autounlock -disable E:

managee-bde -autounlock -ClearAllKeys C:

-protectors

manage-bde -protectors

manage-bde -protectors -get Volume -parameter [arguments]

manage-bde -protectors -add Volume -parameter [arguments]

manage-bde -protectors -delete Volume -parameter [arguments]

manage-bde -protectors -disable Volume

manage-bde -protectors -enable Volume

Parameter	Description
Volume	A drive letter followed by a colon. Example: "C:"
-get	Displays key protection methods. Include '-?' for parameters.
-add	Adds key protection methods. Include '-?' for parameters. The options in here is the same as when you use the -on option.
-delete	Deletes key protection methods. Include '-?' for parameters.
-disable	Disables protection. Allows anyone to access encrypted data by making the encryption key available unsecured on disk. No key protectors are removed.
-enable	Enables protection by removing the unsecured encryption key from disk. All key protectors take into effect.

Interesting and free resources

dchandra — Sat, 02 Jun 2007 03:50:00 GMT

I took a venture out to codeplex to browse through what new interesting tools, components etc that people are developing. It always amazes me how much good items are out there. Below are some that maybe of interest:

1. Sharemap - this is a framework that allows the use of custom graphics and arts and mesh this up with GEO data. http://www.codeplex.com/SharpMap

2. Project 2007 and VSTS 2005 project connector - if you need to create sync between the two, this is a good tool to consider. http://www.codeplex.com/pstfsconnector

3. SDC Tasks - this one is for the big project system developers. Contains alot of useful tools to help with large project development. http://www.codeplex.com/sdctasks

Defense Industry Related Resources

dchandra — Fri, 13 Apr 2007 07:54:00 GMT

DoD (Department of Defense) IT Acronyms

C4I Center of Excellence.

This will also link you to their specification projects. One of the more interesting one is the BML (Battle Management Language), which is project that focuses on standardising the commands and syntax for command control. http://c4i.gmu.edu/

Network Centric Industry Consortium: http://www.ncoic.org/home/

How to get started on SOA

dchandra — Thu, 12 Apr 2007 05:44:00 GMT

Its amazing how travelling on a plane can help the thinking process (assuming you can have peace and quiet).

I had a reflection back on what I have observed on companies that have embarked the SOA bandwagon over the last several years. There were a lot of disillusionment on the promise of SOA. I think the key reason is that SOA idea is very logical and seems easy to implement at the conceptual level. But as they say, the killer is in the details.

A few observations where large companies have made good in roads on this journey:

Usually a small project team started with a specific problem to be addressed. However, the architect had enough vision and know how to ensure the application is contain some flexibility in the design to allow for some of its common components to be exposed as a service. The full focus of the project is still on delivering the biggets value to the project stakeholder.
The vision is quite specific and practical. So the benefit can be realised. Most of the time, the technologist in these teams have a very practical approach to problem solving. They understood the difference between having a vision that can be delivered vs a vision that will remain in the realm of theory.
They understood that as Technologist they should and need to play a part in helping the business owners in specifying the requirements. They don't hold onto the idea that "If the business folks don't know what they want then they ain't getting it". They understand that as the business asked for new systems to help them, they are also venturing into a new teritory (new business processes or idea that has not really been tested). The theme of design a little, develop a little and show a little is very effective, especially if its coupled with a good and solid Architecture guiding principles.

Companies that have had issues:

The technologist usually paints a grand picture of nirvana where once developed the next time the business changes its process and direction the technology can be easily configured. This is not so. Having a solid understanding of the key business processes and more importantly being able to refactor the key common processes that can be re-used is very important. This will determine the Services that can and should be reused across business units.
Another common failure is getting too caught up in designing the "Perfect" architecture. Architects generally falls into this trap. We all want to have the best and perfect design that will last for eternity. The reality is that as technology change, the architecture theme or design will also change. Continous evolution and improving on the desing is a better approach than design once and they will flourish approach. This is similar to building architectures, go back 500 years ago when concrete was not readily available available, the way they design building is very different than today because the materials they can use is different.
"us vs them" approach between group of technologists that sits in a centralised "think tank" and the people who actually worked with the users and developed practical systems. The best approach is to pick a particular project to start with and desing it with expansion in mind. This will ensure we start small and design for the bigger whole.

SOA for beginners

dchandra — Sun, 11 Mar 2007 03:41:00 GMT

The term Service Oriented Architecture (SOA) is now used frequently and it is usually associated with providing better agility to the business capabilities. In most instances, this has not translated into reality.

So what is SOA, how can it really help your business and what are the caveats?

SOA is a concept. The concept is to provide functionality without having to know the inner details. The aim is to be able to create software pieces at a good level of isolation so that we can re-use them much like a Lego block to build different systems with different capabilities quicker and cheaper. The concept is an evolution of the component based design principles that has been around for the last two decades.

Figure 1 (the words in brackets provides sample application, service and component) puts into context where components are used and where a services are exposed. From Figure 1, it seems logical that the level and type of functionalities provided by a component and a services would be different.

Figure 1

This should be the case. An exposed service should reflect a task within a business process.

A well designed system that exposes key services can result in business being able to provide new capabilities quicker by allowing these services to be re-used. However, one of the trickiest thing about designing an SOA capable systems is determining the level of granularity of Service to provide. What do I mean by granularity? When SOA is relatively new, a lot of system developers exposed services at a very fine level granularity. For example, a Login service is provided to log a user into the system, a GetName service is provided to retrieve a user name. This fine level of granularity proved to be a hindrance, causing developers to spend more time writing code, reducing system performance and not providing enough re-use value.

With time comes experience. Numerous people have learned that aligning a Service to a task within a business process provides the correct level of granularity. In practice this means the following things needs to happen:

A well thought out and working business process need to be in place or designed. This means the business process owners need to know well in advance what are the key business priorities and which particular parts of the business process needs to be flexible and made reusable. In real life, this does not happen very often.
As the services provides more capability, this means more data needs to be passed in. Having a canonical data format (common data format) is essential in allowing easy re-use between enterprise. Again this is easier than done. The good news is that in most industries, there are standard bodies that have started work on providing standard schemas (schema is a method to describe how a data is structured). A good starting place is OASIS http://www.oasis-open.org to find one relevant to your organisation.

The current advances in computer technology and the continuous improvement of network connectivity means SOA will become more important and prevalent in the future. Recent events in the world have required governments and agencies within governments to collaborate within and with commercial entities in a short amount of time. Technology concepts like SOA is key in improving the ability of system to system collaboration to occur easier. However, as I hope I have briefly highlighted, SOA by itself is not a silver bullet it will require better partnership between business decision makers and technology providers to achieve success.