TEAM Zarate Tarrani Notes From the Field

2009-03-07T16:21:00.000-05:00

I have moved to Process Notes, which is a forum. I may be adding content here from time to time, but the forum is a more interactive vehicle.

2002-07-02T04:14:00.000-04:00

Update. I am still behind on final release of the content in our sister weblog, Postcards from the Revolution. I should have it up to date and released within the next day. I appreciate your patience.

Issues. That word has multiple meanings in this context. One meaning is that we have all been obviously busy these past six weeks, which means that we've been dealing with a plethora of issues, with more to come. Another meaning is that new issues of two of my favorite magazines are out.

The magazine that I most look forward to is CrossTalk, The Journal of Defense Software Engineering. Since we've been so far behind I failed to report on the past two issues - a situation I am going to rectify now:

July 2002 is devoted to Information Assurance.
June 2002 is focused on software estimation techniques.

Each of these issues contain other articles outside of the main themes, and both are well worth reading. The full list of back issues between 1994 and present are worth bookmarking.

The other magazine I make sure I read as soon as it comes out is The Data Administration Newsletter. In the most recent issue, Issue 21.0 - 3rd Quarter 2002, you'll find a fresh set of papers and articles, and the insightful feature columns that are written by genuine industry experts.

Also noteworthy are the following new issues of newsletters that I read:

STQe-Letter, Information for Software Testers, Managers, and Quality Assurance People.
Amy D. Wohl's Opinions Volume 2, Issue 26 (28 June 2002).
The Server Side Connection.
Doug Kaye's IT Strategy Letter.
Mike Sisco's E-Zine (June 2002 issue).
Methods & Tools.

Yes, I do a lot of reading. Until tomorrow, enjoy these resources and have a wonderful day.

2002-07-01T04:59:00.000-04:00

Magic? Mystery? Why have five weeks worth of entries suddenly appeared? Answer:we've been adding the content, but didn't release it until a few minutes ago. Among the reasons for this are work, my trips to Florida and Texas, and Linda's busy schedule which includes frantic preparations for her OCP examination and a plethora of other issues.

Appreciation. One gentle voice who encouraged us to release the backlog of entries is Nikhil Joshi of Pune, India. Thank you for your support and encouragement Nikhil, and rest assured that we will try to not get so far behind again.

But ... The content for Postcards from the Revolution is going to take an additional day before we're ready to release it. Please be patient.

2002-07-01T00:10:00.000-04:00

Quality and Testing. Rarely do I stray far from these topics, and the reason I am back in this entry is to share an excellent book titled Software Quality and Software Testing in Internet Times.

This book is a collection of papers that address the full spectrum of testing issues and challenges in rapid development/rapid deployment environments. Although the title implies that this book is about quality and testing of web applications, many of the papers go well beyond that narrow scope.

The papers are divided into five categories:

Managing for Optimal Time to Market. This categories contains an obligatory paper on high-speed web testing, which does address the key challenges. However, two of the papers are exceptional: Using QA for Risk Management in Web Projects drives home the relationship between QA and project risk, and Establishing Quality Procedures for Incremental Software Development is essential reading for anyone who needs to integrate testing into methodologies such as the Rational Unified Process or any other incremental/rapid development approach.
Processes. This section of the book has papers covering topics ranging from how to use Extreme Programming to manage project risks to adapting test processes to web applications. In many respects the papers in this section capture the essence of the book's theme.
Testing from the User's Perspective. This is my favorite section, especially the papers on business oriented testing for e-commerce and the paper titled "Strategic Testing: Focus on the Business". All of the material here reinforces my own experience and observations, and clearly shows the relationships among meeting business requirements, quality and project success.
Technical Testing. Test professionals will get the most from this section because it provides techniques. My favorite is "Securing E-Business" because this important aspect of testing is usually given superficial treatment (if it's covered at all) in most testing books. Another paper I liked in this section is "The Back-End Side of Web Testing: Integration of Legacy Systems", which is applicable to enterprise application integration and e-business system testing. In addition to papers on testing techniques, other aspects of quality are covered in this section, such as performance monitoring (more aligned to capacity planning and performance management than testing, but certainly applicable to quality and service level management).
Test Automation Techniques and Tools contains a single paper titled "Automated Testing of mySAP Business Processes". If you're involved in web-enabled ERP or portal quality this paper is a treasure.

Although this book is an anthology, the topics and editing make it coherent and focused. It is not a book that covers quality or testing as a unified methodology. If you're seeking such a book read Quality Web Systems: Performance, Security, and Usability by Elfriede Dustin, Jeff Rashka and Douglas McDiarmid does go into details and is one of the best books on end-to-end web systems quality.

2002-06-29T23:02:00.000-04:00

Taking Care of Business. Schaum's Quick Guide to Business Finance: 201 Decision-Making Tools for Business, Finance, and Accounting Students is a reprint of "McGraw-Hill Pocket Guide to Business Finance: 201 Decision-Making Tools for Managers" with a single difference. The now out-or-print book came with a runtime version of MathCAD and formulas for using each of the tools, while this new version does not. Also, don't let the title fool you - this book is as useful to working professionals as it is to students.

The 201 tools contained in this small, highly useful book range from Acid Test (doing a quick ratio of financials) to Z-Scores. Each tool is listed alphabetically, its use explained, and instructions on how to use it is provided. What I particularly liked is the worked examples that accompany each tool.

As an IT consultant who specializes in service delivery this book is not one I would normally include in my professional library. I was introduced to it when a colleague and I were writing a white paper on recovery management. We were searching for a way to link business imperatives to justification for investment in recovery strategies. We found one piece of the puzzle in this book - the Altman Z-Score. This tool predicts whether or not a company is likely to enter into bankruptcy within one or two years. This led to the development of a copyrighted model that addressed survival level objectives, and also became a key part of the Tarrani-Zarate Information Technologies Management Model. All this from a single entry in a small book!

Aside from discovering a relatively obscure, but important, tool I also found other useful tools in this book. Because I am not a business consultant or financial expert the tools were like a cram course in financial management for non-financial people. For example, I was able to apply some of the tools to personal financial matters - the real costs of a loan become quickly apparent when you compute them. I was also able to employ some of the tools to conduct realistic cost/benefit analyses, examine trade-offs supporting approaches to projects, etc. In this respect this small book has significantly improved my professional skills and has inspired me to read other books on financial management.

I strongly recommend this book - collection of tools really - to anyone who deals with finance, anyone who has P&L responsibilities, and business and IT consultants. The latter group will find this book to be invaluable for developing proposals, deliverables and project plans that add value.

2002-06-28T22:33:00.000-04:00

Capability Maturity. Most books on the CMM assume that you're headed for Level 5 and then proceed to write a confusing and overwhelming guide for getting there from ground zero. Implementing the Capability Maturity Model is different.

The author of this excellent book give a realistic roadmap to achieving CMM levels 2 and 3, which are major hurdles in capability maturity, especially level 2 from a culture-shock point of view.

What makes this book realistic is the way you're lead through the important steps, with a complete focus on what it takes instead of theory. The book starts off with an obligatory overview of the CMM, but quickly segues into the steps needed to attain level 2 (repeatable), which are creating the structures, processes, training program and policies. While each of these are important, I especially like the inclusion of policies because they are necessary to codify goals and are frequently overlooked. This section also includes subcontractor management, which is important for aligning those with whom you are using on projects with your own organizational capabilities. This makes sense because if your organization is repeatable and your subcontractor(s) aren't, then you either need to go shopping for more compatible subcontractors, or get dragged back into ad hoc approaches.

The same approach to graduating to level 3 is used, with slight changes. In the section that covers level 3 the first topic is about focusing on organizational process improvement, followed by an in-depth chapter on defining organization processes. These reflect the key changes between level 2's repeatable goals and level 3's focus on defined processes. After these are clearly and completely explained the same formula - structures, processes, training program and policies - is addressed for level 3.

Following the steps to get to levels 2 and 3, the next section is centered on implementation and assessment. This section prepares you for the assessment process itself, and offers excellent advice on how to get through it. Additional information of value is provided in appendices B (Annotated Level 2 Preassessment Questionnaire) and C (Samples of Level 2 Policies), both of which are provided in PDF format from the book's associated web site.

One key question that needs to be answered: Which is better, this book or CMM Implementation Guide: Choreographing Software Process Improvement by Kim Caputo? My opinion is that both books are equally important and both should be read because they cover two different aspects of attaining CMM levels 2 and above. This book concerns itself with the nuts and bolts of processes, where Caputo's book is more focused on organizational change. I recommend both books, and think that they nicely complement each other.

2002-06-27T23:41:00.000-04:00

Production Matters. The most critical phase in a systems life cycle is the transition to production. Done wrong and all of the work performed in the requirements, design and development phases count for very little, no matter how well the work was managed and how mature the processes. A book that specifically addresses this make-or-break event is The Unified Process Transition and Production Phases. In the Unified Process (or any systems life cycle) the milestones/phases up to transition are well documented, but these represent the tip of the iceberg with respect to determining project success and total cost of ownership. This unique book examines the transition and production support requirements, addressing some of the deficiencies in the Unified Process (production support is all but ignored), and can be applied to other development life cycle models, nearly all of which have the same blind spots.

Many of the ideas and the approach for this book were born in the author's earlier book, More Process Patterns, which examined the very transition and support requirements in a more generic manner. In fact this book, like the earlier one, is a collection of best practice patterns that cover the transition and production milestones. After an introduction that explains the rationale and approach, the book covers the workflows and patterns in the sequence in which they will occur: testing, deployment and environment, operations and support, project management and infrastructure management.

What makes this book important is that it extends the Unified Process to include the key milestones that account for cost and quality, and goes into great detail about what is required and how to avoid failure. If you work in operations and support you will find the material in this book invaluable - you should also buy copies for key members of the project team that is delivering your system so they have an understanding of and appreciation for the task of supporting their creation. While this book will obviously benefit shops that employ the Unified Process, the information and workflows are equally useful in any development approach.

2002-06-26T17:47:00.000-04:00

The Important Part of PM. A friend who is an experienced PM once remarked that there are three stages to becoming an enlightened project manager:

learning the techniques
realizing that it's really about people
epiphany - it's about ensuring that someone else gets the blame if things go wrong and 1 & 2 are core skills in achieving this

Regardless of how true his theory is, People in Projects will certainly get you to the second stage of enlightenment, and also provide you with the knowledge and skills to manage stakeholder expectations, use effective intervention methods when things do get off track, and to maintain high project team morale.

The nine chapters in this 305 page book systematically cover all aspects of the people part of the equation. It starts with an accurate description of key management skills and duties required of a PM. It then addresses the basics of organizational planning, which focuses on roles and responsibilities. From personal experience I can attest that establishing roles and responsibilities is essential to project success.

Chapter 3, Human Resource Theory and Charts, sets the tone for the chapters on Staff Acquisition and Kickoff, and Team Development, both of which provide refined techniques for managing people and teams.

I particularly liked the chapters on resolving conflict (something that PMs deal with daily) and managing change, which is a constant. Since I work with multi-cultural teams that are international I also liked the chapter titled Worldwide Teams and Cultural Issues.

The chapter on project closeout and evaluation is a good reminder that there is a shutdown phase to projects, and this chapter provides guidance for how to perform this step in a structured manner.

Although this is a book on the PMI approach to project management, the material is also applicable to any project management methodology, including the UK standard (PRINCE2) and CompTIA's IT Project +.

2002-06-25T10:21:00.000-04:00

Data Warehousing. Two books that will interest architects, developers and DBAs are:

Data Warehousing Fundamentals. This is one of the best introductory books on data warehousing I've read. The authors make few assumptions of reader knowledge beyond the fact that they are IT professionals who have a technical background that doesn't necessarily include database and data warehouse knowledge. They do assume a basic knowledge of IT operations, project management skills and systems analysis and design - skills that IT professionals are expected to have.
The book is divided into five parts: Overview and Concepts, Planning and Requirements, Architecture and Infrastructure, Data Design and Data Preparation, and Implementation and Maintenance. These follow a development life cycle, making the structure of the book easy to follow.
What I like about this book is it doesn't just cover the theory and concepts (which it does do well), but sets data warehousing in the context of a larger architecture designed to meet specific business requirements. I also like the way the authors address real world issues such as planning and managing a data warehouse project, and the issues and factors surrounding adding a data warehouse into an existing technical architecture. This information is what IT professionals are seeking when they are faced with a technology with which they may not have strong knowledge, and it makes this book useful to the intended audience.
Among the chapters that I most liked are: Principles of Dimensional Modeling, Data Extraction, Transformation, and Loading, and Data Quality: A Key to Success. These capture the essence of data warehousing in my opinion and are topics that IT professionals without a data background need to understand. I also thought that each of the appendices were useful. They provided a finishing touch by covering project life cycle steps and checklists, critical success factors and guidelines for evaluating vendor solutions - each of which provide practical information.
Data Warehousing and Web Engineering. This is a collection of papers that cover salient issues in data warehousing with an emphasis on business intelligence, data mining and knowledge management applications. While many of the papers in this book are more useful to technical professionals, there is a lot of material that will also be useful to marketing and competitive intelligence specialists in the business domain.
Some of the papers are more basic and introductory, such as "Justification of Data Warehousing Projects", "An Introduction to Information Technology and Business Intelligence" and "Some Issues in Design of Data Warehousing Systems". Some, however, address advanced topics such as "Data Mining Methods Databases and Statistics Point of Views" and "Incremental Data Allocation and Reallocation in Distributed Database Systems".
My personal favorite papers were "Specification of Components Based on the WebComposition Component Model" (reflecting professional interests in component-based development), "Complementing the Data Warehouse with Information Filtered from the Web", and "Using Business Rules Within a Design Process of Active Databases" (another area of professional interest).
In addition, the papers cover topics in data mining, data quality and knowledge management, which means that there is at least a few papers that will intersect with a reader's professional interests. The best audience for this book includes academics (the papers are citable), consultants who specialize in business intelligence and data mining, and organizations that have a solid base of experience with advanced uses of data warehousing.

Note: This book is also available as an eBook in PDF format.

2002-06-24T23:47:00.000-04:00

Softer Side of Risk. I find much comfort in quantitative methods because numbers are unambiguous. However, numbers alone only tell part of the story. Experience is a good teacher and it is from experience that we grow as professionals. Coping With IS/IT Risk Management This is probably one of the most unique books on IT project risk management in that it doesn't go into the process and techniques of risk management, but in the common risks and how to deal with them.

Don't expect qualitative or quantitative risk assessment methods, or even a risk management process that is almost an obligatory part of most project management books. Do expect the collective wisdom of real people who were interviewed, and their recommendations for dealing with the real risks.

These risks range from misaligned or unwarranted expectations to slippery requirements. If you've managed an IT project many of the risks will be familiar. How the PMs who were interviewed handled them will be illuminating.

Aside from the fact that this is a highly readable book that is packed with wisdom and advice, the appendices also add a considerable value. Appendix 1 cross references the risks (constructs) by theme making it easy to quickly find the solution to a particular issue. Appendix 2 gives 5 hypothetical project profiles that reinforce the information in the body of the book, and Appendix 3 is a collection of strategies from the body of the book.

Regardless of whether you are preparing to manage your first project or are seasoned and battle-scared, this book provides knowledge and advice that you can use.

2002-06-23T19:59:00.000-04:00

More ABout Project Management. Mike is now going in one direction and I another with respect to our topics, and that adds balance to the material we're posting. One of the critical success factors in project management is taking the time to develop a work breakdown structure (WBS) before proceeding with planning, estimating and scheduling. In fact, it's nearly impossible to realistically estimate if you haven't decomposed the project into a WBS. Most people don't know where to begin. I've found that the Project Management Institute Practice Standard for Work Breakdown Structures to be a clearly written guide and one that I recommend all project managers read.

The four chapters in this short, focused book introduce work breakdown structures, define them from a conceptual point of view, explain why they are the foundation of project planning, and show how to create one. These chapters comprise a scant 18 pages, but are thorough enough to accomplish the objective of explaining the Project Management Institute's practice standards for WBS.

The real value of the book is contained in appendices E through O, in which a WBS for common industry project types are given as examples. These 44 pages are the real reason to buy the book because they show real examples of the conceptual and brief "how to" approach compressed into the first 18 pages. The project types in these appendices are:

E - Oil, Gas, and Petrochemical (OGP)
F - Environmental Management
G - Process Improvement
H - Pharmaceutical
I - Process Plant Construction
J - Service Industry Outsourcing
K - Web Design
L - Telecom
M - Refinery Turnaround
N - Government Design-Bid-Build
O - Software Implementation

Appendices A-D are filler that descripe the PMI standards process and associated information, and can be safely skipped unless you are interested in those topics.

Overall this is a much needed book because WBS are still skipped during the project planning phase in too many projects. This is unfortunate because the first thing that a professional does when called in to rescue a project is to examine the WBS, and if there isn't one, the first step towards rescuing a project is to develop one. By following this book, especially if any of the example WBS is similar to your project, will go a long way towards ensuring its success.

2002-06-22T21:58:00.000-04:00

Tools of the Trade. Since I've dragged a business-oriented discussion into this weblog, I'll continue until Linda jumps in and changes the direction. One of the most valuable skills an analyst can develop and build upon is decision making. Not making snap decisions based on gut feeling, but doing it the right way. The foundation for decision making is in Decision Analysis for the Professional.This book is an excellent intermediate-level text on decision analysis that deals with both uncertainty and risk. It uses realistic examples that working professionals will appreciate and to which they can relate.

It's written as a tutorial that uses two tools, Sensitivity, which is used with the chapters dealing with decisions under uncertainty, and Supertree for developing decision trees related to risk analysis. Instructions on obtaining the student versions of these programs are included in the book. Note that the student version of Supertree accommodates trees with up to 250 endpoints, and the student version of Sensitivity performs sensitivity for up to 12 variables.

My most used text on decision analysis is Making Hard Decisions by Robert T. Clemen. Where that book is more comprehensive, it's also less suitable for the working professional who needs a refresher and a desk reference. Therein lies the main value of this book - it's more aligned to real world problems that you'll find in the workplace and is written to be both a tutorial and a reference.

2002-06-22T00:45:00.000-04:00

Consultant, Manage Thyself - Part II. In my last entry I discussed Building Professional Services. This book, in my opinion, is the best starting point for anyone who is involved in establishing and managing technical services or starting a consulting company. PSA: Professional Services Automation by Rudolf Melik, et al is the second book you should read because of the way both books complement one another. Actually, one should follow the other because PSA: Professional Services Automation is about automating the professional services organization after it has been established.

In the past I gleaned information and techniques from books about managing professional services from the perspective of law firms and other industries - good information to be sure, but fell short of the realities of technical services.

What I like about this book is the complete look at professional service management, with an emphasis on both personnel and cost management. I especially like the way the authors show how to go beyond mere cost management to optimize revenue and profit. The information and strategies they provide reflect extensive experience and a strong focus on the business aspects of professional services. I also like the ties to customer relationship management and various types of services, and the PSA components. This first decomposes the components of professional services management (manual or automated) into the critical success factors, then reconnects them into a coherent whole.

Although this book is about automating professional services management, most of the information, especially part 2, can be used effectively without automation. Therein lies the main value of this book and the reason why I think it's simply the singlemost important book a professional services manager can have. In order to get the information collected between the covers of this book you'd have to purchase a pile of related books from other industries, and spend a significant amount of time reading articles and surfing the net. If you are a professional services manager you already know that you don't have time for that. If you're being placed in a professional services management position you need this book.

2002-06-21T00:18:00.000-04:00

Something New. If you are a consulting, and particularly if you manage a services group, you'll find that Building Professional Services fills a sorely needed gap in the computer consulting industry, and is especially valuable for start-up consulting companies, established companies that want to achieve higher profitability, and for internal IT organizations that are seeking a way to move from a cost center to a profit center.

Regardless of your goals or motivations, the first two chapters helps you to clarify your objectives, decide on the appropriate business model and mission statement, and introduces key concepts that will be used throughout the book. One of the most effective techniques in this section of the book is the way the authors lead you through framing your mission and goals and employing a service alignment risk factor to test the clarity of your mission and how it aligns to other business processes. This is especially important if technical services is not your core business.

Chapters 3 and 4 are, in my opinion, the heart of the book because they address revenue and profitability, and organizational structure - two areas with which many companies struggle. The information in these chapters will show you what you need to do to become and remain profitable, as well as how to best organize your resources to deliver in accordance with your chosen business model. For start-ups Chapter 3 provides an excellent framework for business plan pro formas. Chapter 5, Selling, thoroughly covers the critical success factors and metrics for selling services.

In chapters 6 through 8 services delivery, productizing and promotion are given the same thorough and insightful treatment. Of particular value is the customer engagement workflow that is provided in Chapter 11, and the four phases of professional services given in chapter 12. The phases provide a path by establishing basic implementation services as a service offering, then building upon these to provide integration services, consulting services and productized services - each phase represents an increase in what you offer customers (external or internal). For each of the phases the authors address the following factors: value proposition, profitability triangle focus, critical skills, required operational infrastructure, target mix, revenue growth rate, target gross margin and target operating profit.

I like the way that these (and all of the chapters) end with sample budgets and issues to watch, and the key financial models provided in Appendix D.

You can get more information about this book, including associated articles and PowerPoint presentations, from the author's webpage.

2002-06-19T02:24:00.000-04:00

Building a Bridge. Building systems in a vacuum results in technical achievements that fail to meet business requirements. In other words, a disaster. One book, Totally Integrated Enterprises, bridges the business and IT domains. It educates business process owners on the capabilities and technologies that provide tools to support operations, and gives IT insights into how to best develop and deploy systems that meet business requirements.

Integration is assumed to be within the context of ERP systems, which are enterprise-wide in scope. The level of detail is kept reasonably high so that both audiences can easily grasp the key issues and understand the challenges and needs of the other. What I like about the book is the fact that it never loses sight of business requirements, and the manner in which it stays focused on quality and real world issues. I also like the way case studies are used to reinforce some of the more abstract aspects of enterprise integration.

Highlights of this book that will interest both business and IT include:

Totally Integrated Enterprise Goals and Agile Enterprise, which give a business framework for the technology solutions that are discussed later in the book.
Methodology for Understanding Enterprises, which places integration and technology into the context of meeting business requirements.
Business Development and Product Management, which provide insights to IT about the challenges that their business constituents face and their support requirements.

Because this book is a high level view of enterprise integration many details that support the decision to employ integrated systems and how to implement them are missing. However, the true value of this book is the way it brings together business and technical information and the way the authors have managed to address both groups that are normally widely separated.

If you are seeking a book about deciding whether of not to implement an enterprise-wide system I recommend Enterprise Resource Planning Systems: Systems, Life Cycle, Electronic Commerce, and Risk by Daniel Edmund O'Leary. If you are more interested in an implementation methodology I recommend E-Business and ERP: Rapid Implementation and Project Planningby Murrell G. Shields.

2002-06-16T03:14:00.000-04:00

Then There's That Stuff in the Middle. One of the biggest challenges in designing, building and implementing an enterprise-wide system is the middleware component. Enter The Complete Book of Middleware, which is a collection of papers divided among eight major topic areas, each on a specific middleware category. The main value of this book is the wide range of technologies and vendor solutions, and the fact that it's up to date.

I like the complete coverage of both transaction and queuing approaches, and the vendor-specific information that includes Microsoft's .NET and Sun's Java, as well as everything in between. The sections database middleware and middleware performance are especially valuable because they are more generic and applicable to a wider audience than the MS- and Java-centric sections.

While individual papers have a slight vendor bias, the book as a whole is vendor neutral. This is not a book for learning about middleware as much as a good description of what's currently available and their strengths and weaknesses. If you are looking for a more general book I recommend Chris Britton's IT Architectures and Middleware: Strategies for Building Large, Integrated Systems for the fundamentals, and David Linthicum's B2B Application Integration for a detailed text on how to employ middleware in practice. However, this book will give vendor-specific details and a more up-to-date view of middleware that are missing from Britton's and Linthicum's books. If you're a system architect or consultant this book is an excellent desk reference.

2002-06-15T22:37:00.000-04:00

It's About the Data. The foundation of any system, standalone, single-user, or enterprise-wide, is the data. Manufacturing Data Structures is an essential reference for ERP analysts, developers and DBAs. It is unique in that it addresses data requirements for materials management within the context of manufacturing processes, with an emphasis on bills of materials.

The chapter on engineering change control stands out because this aspect of both data structures and process change management are not covered (or only lightly touched upon) in other ERP references. This chapter and its companion on implementing change add significant value to the book and reflect mature and best practices. I also liked the chapter on new product introduction and custom manufacturing because these aspects of the manufacturing process come with a different set of challenges and requirements from steady production processes.

Regardless of whether you're using SAP, Baan or another ERP package (or are developing custom applications to automate manufacturing materials management) this book will expose the relevant details of the data structures, which are the foundation of any application.

2002-06-14T23:17:00.000-04:00

Integrating the Enterprise. My next few entries are going to deal with some of the better books about enterprise systems. One such book is Enterprise Systems Integration.The audience for this book consists of architecture and integration group members, making this book an ideal addition to group libraries. The focus is on ERP architecture, although the range of topics overlap into non-ERP domains, and is best used as a desk reference because it's a collection of short papers written by 70+ authors instead of a book that focuses on a specific approach or methodology. The papers comprising this desk reference are organized in logical groupings that are akin to layers in an enterprise architecture.

Each section is devoted to carefully chosen papers, some of which reflect individual authors' experience. The strength of this approach is that you benefit from a rich diversity of viewpoints and deep subject matter knowledge. The weakness is that some of the material is inconsistent with what precedes or follows in the book.

Since this is a technology-focused book the highlights are that the information is current and reflects issues, methods and technologies that are valid as of the date this review was written. The editors ensured that information that is not commonly used in ERP integration, such as web services, are not addressed. This doesn't imply that web services will not play a future key role (such as in PeopleSoft 8), but that most ERP implementations are integrated using middleware, XML and other methods. The more typical integration methods are covered in great detail, and the sections on database servers and data warehousing are especially informative.

I also like the section on Internet commerce, which covers topics ranging from web-based testing and capacity planning to XML-based B2B commerce - topics that are not commonly found in other ERP texts. The section on project and systems management also contained excellent information, such as the paper titled "Service Level Management Links IT to the Business", which touches upon a critical aspect of integration. Each of the four papers in the Component-Based Development section also included information that should be carefully considered by large enterprises, especially those that are using off-shore development of off-site contractors to develop modules. This section goes into each of the major critical issues, including economic considerations, domain engineering, server-side Java development and object library management.

Some of the information in this book is time sensitive in that it will be rendered obsolete as web services play a larger role in ERP systems (which is already happening in a sense), and XML and/or ebXML emerge as a core component of all of the major packages, such as SAP, PeopleSoft, Baan, etc. If you have a defined architecture or integration group this book will make a good investment because of the wide array of topics covered. If, however, you are seeking a book that provides a methodology or focused technology description this book may not be for you.

2002-06-13T18:43:00.000-04:00

Project management is a core skill that all IT professionals need to master in order to achieve increasing levels of responsibility and professional growth. There is another facet to project management in software, which is how to align project management processes and procedures to an enterprise operational model. One unique book that deals with this is Software Project Dynamics. This is not a book about project management per se, but a book about how to integrate project management processes into a large software development organization using analysis based on system dynamics.

If you are not familiar with system dynamics, it's a methodology for studying and managing complex feedback systems using time graphs and causal loops, and more formal analytical methods such as simulation and exploring alternatives in a structured manner.

This book uses those techniques to align project management processes to software development. The best way to determine if this book is right for you is to answer the following questions:

Is your core business software development?
Is your organization at approximately the same level as that described by SEI's CMM for level 3 or above?
Is there a commitment to implement an integrated process that is driven by the executive or board level and does this commitment have a strong sponsor?

If the answer to at least two of the above questions is yes, then this book will be valuable. Also note that some knowledge of system dynamics is assumed. If you need to become familiar with this discipline I recommend Business Dynamics: Systems Thinking and Modeling for a Complex World by John D. Sterman. This book addresses system dynamics from public policy and strategy points of view, but will provide a thorough understanding of the subject.

Those who will benefit most from this book are organizations that have found existing PM methodologies to not fully meet objectives. For example, the U.S. standard based on the Project Management Institute's Project Management Body of Knowledge (PMBOK) is too generic for software development, and the U.K. standard called PRINCE2 is not as well suited for product-line and software vendor approaches to development. While the PMBOK and PRINCE2 contain processes and procedures that can be used, the system dynamics approach defined in this book gives a method for selecting, evaluating and integrating the processes and procedures borrowed from these two standards. Moreover, since the CMM and related models identify key process areas for project management, they do not prescribe how they are to be implemented. This book will provide the tools and techniques for tailoring the techniques to PM process areas.

If your objective is to find a book that describes a complete project management maturity model you will be better served by Strategic Planning for Project Management Using a Project Management Maturity Model by Harold Kerzner; if you are looking for an off-the-shelf methodology to use with iterative processes such as the Rational Unified Process I recommend Software Project Management: A Unified Framework by Walker Royce. However, if you are seeking to develop and implement a best-in-class, tailored project management methodology that is seamlessly integrated into your software development processes this book will show you how to achieve that goal.

2002-06-11T12:31:00.000-04:00

Shifting Once More. We normally cover project management in Postcards from the Revolution, but when material is also applicable to the more technical readers of this weblog we cross post here. One such book is The Project Workout, which is one of the most business-focused books on project management that you can read. Where other books go into techniques that are specific to project planning, scheduling and control, this one ensures that business issues are interwoven into each element of project management.

Parts that set this book apart from the others include an emphasis on developing a business case and the structured way in which all project stakeholder requirements are considered in project quality and reporting. I also like the way projects are managed at the enterprise level as portfolios and integrated into programs instead of standalone projects. In addition, the many forms, checklists and diagrams are highly useful and can be used with little or no modification.

This book is also completely consistent with the PMI PMBOK and UK PRINCE2 methodologies, and the author's web site that supports this book contains a wealth of up-to-date information that adds to the value of this book.

2002-06-09T22:40:00.000-04:00

More About Components. It appears that Linda and I are locked into some spiral, because my chosen topic before she posted was also about components. Foundations of Component-Based Systems is an excellent secondary companion to Component Based Software Engineering: Putting the Pieces Together by Heineman and Councill. It is a secondary text for practitioners and academics that will provide insights into a narrow slice of component-based software engineering issues. Organization is a collection of papers that are grouped in four sections:

Frameworks and Architectures. Consists of four papers of which I particularly liked Key Concepts in Architecture Definition Languages and Acme: Architectural Description of Component-Based Systems because of professional interests in ADLs.
Object-Based Specification and Verification. The three papers in this section were focused on narrow topics; however, I gained much from Modular Specification and Verification Techniques for Object-Oriented Software Components. This paper alone made the book worthwhile to me, but this is a subjective remark with which you may not agree.
Formal Methods and Semantics. Each of the three papers in this section were, in my opinion, valuable. My favorite, Toward a Normative Theory for Component-Based System Design and Analysis, contained a viable framework and approach to component design, which is a topic that receives little coverage in other component-based books.
Reactive and Distributed Systems. The two papers in this section are interesting in that their topics intersect nicely with the discipline of semantic web engineering. If your interests or work also includes that knowledge area then the papers (Composition of Reactive System Components and Using I/O Automata for Developing Distributed Systems)will 'connect the dots' in a manner of speaking.

Much of the material in this book is academic and/or theoretical, but is backed up with results from projects and supporting project data. What I like most is that the material uses tools and technologies that are hot topics, such as UML, EJB and COM.

The second book is Component-Based Product Line Engineering with UML. Where most books on the subject cover the component-based development life cycle at a high level with an emphasis on the development, deployment and QA aspects, this one is about requirements and design. That is what sets it apart and an important work. It becomes even more important if you are using or trying to adapt the Unified Process to a component-based environment. Obviously if your environment also includes product line development the value of this book increases even more.

The book contains five parts which build upon each other. Part 1 is a thorough, 60-page introduction that compares and contrasts development life cycles, summarizes the approach the book proposes, and the concepts, artifacts and process associated with "KobrA" (a German abbreviation for "Component-based application development".

Part 2 is devoted to component modeling based on the KobrA component model, and covers all aspects in 153 pages. This part ends with an excellent introduction to patterns and UML, which lays the groundwork for the next part. The information in this part drills down into requirements and specifications, which is one of the reasons I cited above that sets this book apart.

In Part 3 (Embodiment) refinement and translation, component reuse and incremental development are covered in detail. Part 4 introduces and covers product line, framework and application engineering. It is here that the KobrA foundation laid in the previous parts begins to become coherent and the viability of the approach becomes apparent.

Part 5 is my favorite because, like Part 2, it gives a view of component-based development that most books gloss over. In particular, the chapters on maintenance and QA are filled with information that reflects the realities of component-based development, and the chapter on quality modeling is among the best treatments of the topic in any book or paper I've recently read. The 60 pages of appendices are also valuable sources of information and knowledge about metamodels, maintenance and process. I found this book to be an invaluable reference and recommend it to anyone who is heavily involved in component-based software engineering in conjunction with product line development.

2002-06-06T15:29:00.000-04:00

Building Things. Mike introduced me to component-based development last summer. It's a subject that interests him, and also piqued my interest. However, the book he recommended at the time, titled Component Based Software Engineering: Putting the Pieces Together, was overwhelming at 800+ pages. However, I recently came across Component-Based Development: Principles and Planning for Business Systems, which at 224 pages is a more realistic introduction. This book is an excellent and clearly written introduction to component-based development from business and software engineering process perspectives.

It does not contain technical information for developing components in various environments, nor does it go into the relative merits of component-based development from the viewpoint of any vendor. What it does contain is a tutorial on component-based development as a software engineering discipline, and makes a strong business case for adopting this approach to software development.

If you're expecting an end-to-end life cycle you may be somewhat disappointed because the book only covers the design through build phases of development. However, since this book is more about showing the value of components this scope is more than sufficient. If, on the other hand, you are evaluating component-based development as a business strategy you'll like the details about the value and underlying processes, and how this approach differs from more traditional software development. In particular you'll like the way the author goes into organizational issues (who owns the process), and the unique requirements of component-based development (such as strict configuration control and reuse strategies, and cataloging and certifying components). The case study at the end of the book pulls the preceding 13 chapters together and provides a realistic view of the strengths and weaknesses of components.

2002-06-04T20:48:00.000-04:00

Back to Me? Linda is absolutely correct - the foundation of any process improvement or quality initiative is measurement. There are two excellent books on the subject that are specifically for software professionals:

Applied Statistics for Software Managers. If you're working in SQA or managing software development projects this book is an excellent introductory text to statistical analysis.
What I like about this book is that it's a tutorial on the statistical skills and knowledge that you'll need, and it combines this learning goal with the basics of software metrics and how they can be employed to measure productivity, estimate projects, and manage costs and organizational quality. The core approach is data analysis, and the main tools that the book employs are multi-variate techniques, regression analysis and correlation and sensitivity tests. The author has a talent for clearly explaining a dry subject, and while it will take a good deal of effort to master the material because of its nature, the excellent writing and illustrations will make it easy to quickly grasp statistical fundamentals and put them to use.
The lessons are taught within the framework of four case studies that are realistic and apply to the real world. The case study topics are: productivity analysis, analysis of time to market factors, development cost analysis, and maintenance cost drivers. These cover the full range of both internal development and product-line software engineering. I especially like the inclusion of maintenance costs as a topic of study because this area contributes significantly to total costs of ownership, but is often overlooked.
Measuring the Software Process. This book contains the keys to meeting core CMM level 5 requirements, which defines key processes for optimizing and continuous improvement, and for achieving 6-sigma processes. However, you need not be striving for either (or both) of these goals to use the techniques and approach in this book to full advantage.
Implementing and employing statistical process controls are the basis of this book. The authors lead you through the steps and techniques necessary to implement and use SPC, starting with background information on processes and a process measurement framework, and moving through topics such as planning your measurement strategy, data collection and analysis, and developing and interpreting process behavior charts using common SPC chart types. The most common controls are x-bar (mean) and r (range) charts. Be aware that any SPC approach requires two conditions to be met:
- defined processes
- the processes are in statistical control (meaning that the data points being measured have settled into a normal distribution that are randomly clustered around a mean and have defined upper and lower control limits)
New processes, or processes that are not managed well enough to have these characteristics are not candidates for SPC.
This book requires knowledge and skills in basic statistical analysis. If you require a refresher I recommend reading Visual Statistics before tackling this book.

Deciding which of the two books is better is a matter of assessing your needs. The key strengths of Measuring the Software Process are the tutorial nature and the wide range of case studies that are used to reinforce the learning. The key strengths of Applied Statistics for Software Managers are that it goes much deeper into analysis and also includes statistical process controls and other techniques that are present in highly mature development organizations. Regardless of which book you choose (or if you choose both), the information and knowledge to be gained is the foundation of SQA and best practices in project management.

2002-06-03T23:01:00.000-04:00

Games People Play. Mike and I have been playing tag in our recent entries. I come in from left field with a new topic, he follows, then changes it and I follow. In this spirit I'll augment his last entry on software process improvement by discussing two books that provide foundation knowledge and skills for any process improvement initiative.

Understanding the Essentials of the Six Sigma Quality Initiative is a short book that does one thing and does it well - clearly explains what Six Sigma is and why it's important. It accomplishes this in less than 100 pages, making it a succinct guides to a highly complex topic.

Practitioners will find the material too basic, but business managers will find it sufficient to see the value of a Six Sigma initiative. It's also useful for communicating an initiative and its importance to employees who are not directly involved, but need to be on board to imbue it into the corporate culture.

It devotes the first 35 pages to explaining the what's and why's in clear, non-technical prose, and the rest of the book covers the how's by explaining each of the tools that are used to achieve Six Sigma. Each tool, ranging from Analysis of Variance to Team Development, is quickly described at a high level, with all key factors and a brief summary of what it is and how to use it.

If you are a member of the organizational implementation team I recommend that this book used to communicate the reasons for the initiative and what Six Sigma will mean to your organization to employees. If you have a direct role in Six Sigma and your statistics are rusty I recommend augmenting this book with Visual Statistics by Jack R. Fraenkel, Enoch I. Sawin and Norman E. Wallen.

I've struggled with statistics for years, and had resigned myself to continuing that struggle until I read this wonderful book. Where most books assume that you remember lessons from high school this one starts from scratch. It also differs from other books by teaching you how statistics work instead of force feeding you formulas that you learn by rote, but do not impart an understanding of how statistics work.

I like the way that this book uses illustrations and clearly describes the 'whys' to make statistics come alive. Shortly after I started reading this book (which is actually interesting!), I began seeing the significance of data distributions, relationships and dependencies. This not only will improve your understanding of statistics, but also gives you the confidence to tackle problems that may have intimidated you or were beyond your knowledge level.

If you need to quickly refresh your knowledge and skills, or want to understand statistics instead of crunching formulas, this book is a fast way to get there.

2002-06-02T22:49:00.000-04:00

On Software Process Improvement. Before we become mired down in Oracle topics I am going to take an abrupt turn back towards quality and process improvement. One excellent book on the subject that covers both process assessment and improvement, is Software Process Improvement. With exceptions that I've noted below this is an in-depth examination of standards, initiatives and methods for software process improvement (SPI) and software process assessment (SPA).

The book is divided into twelve chapters, each of which contains two or more papers written by top experts in the field, including Mark Paulk (of CMM fame), Watts S. Humphrey (creator of PSP and TSP, and prolific author of software engineering process papers), Robert B. Grady (author of three standard references on metrics), and others who key players, but are not as widely known outside of the SPI and SPA community.

Chapter 1 covers software process assessment with an article by Paulk that surveys the more common models for SPI and SPA, and a reprint of Sarah Sheard's excellent article from CrossTalk Magazine titled "The Frameworks Quagmire". Chapter 2 contains three articles on the SW-CMM, which seems to be the centerpiece of this book. Chapter 3, "Other Approaches to Software Process Assessment" contains four articles that add balance by covering non-CMM approaches that are in common use, especially in Europe (Bootstrap). I especially liked the article by David N. Card titled "Sorting out Six Sigma and the CMM", which combines two hot topics. One of the exceptions that I cited at the beginning of this review is the article on Trillium, which in my opinion has been superseded by TL 9000 in the telecommunications industry.

The three articles in Chapter 4 (Software Process Improvement: How To Do It) address common concerns and barriers to any SPI initiative, and each add well thought out ideas, especially Sandra McGill's "Overcoming Resistance to Standard Processes, or, Herding Cats", and William Florac's "Statistically Managing the Software Process".

Watts Humphrey's Personal and Team Software Processes, and CMMI are the key topics in Chapter 5, which covers developments inspired by the SW-CMM. All of Chapter 6's Software Product Evaluation articles were my favorites from among the collection in this book, and I particularly liked Jørgen Bøegh's "Quality Evaluation of Software Products" and Geoff Dromey's "A Model for Software Product Quality" because they go to the heart of key issues in both product line engineering challenges and user acceptance testing.

Chapter 7, ISO 9000 Series and TickIT, is the second exception that I previously noted. Much has changed in ISO 9000 with the 2000 standard, which renders this entire chapter moot in my opinion. I also thought the five articles in Chapter 8, The SPICE Project, would have been a better fit in Chapter 3. The same goes for Chapter 9, Experiences of Software Process Assessment, which is nearly an extension of Chapter 8, and is closely related to Chapter 3.

Two other favorite chapters are 10 (Software Process Improvement for Small Organizations) and 11 (Benefits of Software Process Improvement). Chapter 10's three articles dispell any notion that SPI is only feasible for large organizations, and the three articles in Chapter 11 focus on the benefits of SPI, especially Herb Krasner's article titled "Accumulating the Body of Evidence for the Payoff of Software Process Improvement". I also liked the final chapter, which covers software processes in general, including an excellent article on modeling. I felt that this chapter should have been at the beginning of the book instead of the end.

Overall, this is a book for those of us who are nearly religious about SPI; but is not a good introductory text. It's main value will be to IT consultants who specialize in either SPI or SPA (or both), and who need to be familiar with the mainstream standards and approaches.

2002-06-01T20:04:00.000-04:00

A Challenge. In my last entry I didn't really take Linda's spot - XLM and Oracle (or any database) have a natural affinity. XML is the magic. You can stuff the results of a SQL query into a DTD, which is the stuff of application and database integration. However, there are also security challenges. The topic of this entry is XML and database security, and is based on two excellent books I recently finished reading.

The first book is Translucent Databases. This book contains an innovative and viable approach to securing databases, and one that I've not encountered anywhere else. In a nutshell the author provides techniques, based on standard SQL and Java, for securing sensitive data without restricting general access of less sensitive data to authorized users. The core of this approach is based on encryption and one-way functions, including PKI and secure hashing, and accepted authentication techniques such as digital signatures.

What makes this book unique is that while it's based on solid theoretical ground, the material is practical. As the techniques are discussed they are illustrated by 15 different scenarios, all of which contain problems faced by e-commerce, HIPAA and other high security environments, and code examples that show how to solve the problems. I like the way the author shows how to implement his solutions in common database environments (PostgreSQL, MySQL and Oracle - the approach should also work in the MS SQL Server environment). As I read this book I saw interesting possibilities for implementing role-based access controls and securing against SQL-based statistical attacks using the author's approach.

This book is essential reading for DBAs, system architects and IT security professionals, especially those in healthcare who are struggling with meeting HIPAA requirements, and in e-commerce who are challenged by protecting credit card and account information. This book shows the DBA how to secure his or her database, and the system architects and security professionals what is possible using SQL and Java. The book also has an associated web site which is supposed to have soft copies of all of the source code contained in the book. As of this entry the link to the source code is on the site, but the code itself is not yet available. When it is the value of this book will increase even more because of the time it will save by not having to manually create the code from scratch.

If you are new to the cryptographic techniques introduced in this book I recommend Cryptography Decrypted by H. X. Mel and Doris M. Baker, which is one of the best introductions to this complex subject. I also recommend reading Secrets and Lies: Digital Security in a Networked World by Bruce Schneier, which covers the technical, organizational and social aspects of security and gives a clear description of the technical underpinnings discussed in this book.

The second book is XML Security. Given the fact that XML is a key component of web services, and extensively used in e-commerce and enterprise applications integration, this book addresses a genuinely important topic. For one reason, XML is text-based and can expose proprietary information, which is a vulnerability for competitive intelligence specialists and corporate spying.

Before going into what the book contains it's important to know that much of the material is based on RSA's view of the security. This isn't a criticism, but an up-front statement of fact because if you're looking for a book that is 100% vendor neutral you are going to have to wait until one is written - this is the only book I know of that is solely about XML security.

The book starts with primers on security and XML to set the context. It then covers, in succession, digital signatures (chapters 4, 5 and 6), and XML encryption. These chapters are consistent with work and specifications produced by XML Signature WG (joint the Working Group IETF and W3C for digital signatures) and the W3C working group for XML Encryption.

Chapter 8 is specific to RSA products. It shows how to implement XML encryption using RSA BSAFE© Cert-J, which can be downloaded in a trial version from RSA's website. Chapter 9 covers XML key management specification, which are consistent with the W3C working group's specifications, and how XML security relates to web services.

Despite the slight bias towards RSA this book is an invaluable reference. It provides an in-depth discussion of major security issues, as well as how they are being addressed by the W3C. It goes without saying that anyone who is responsible for system architecture, design and/or security should carefully read this book.

2002-05-31T22:01:00.000-04:00

Reality and Sanity. I have to agree with Mike that wading through thousands of pages of technical text is not the best use of time and energy - unless you are cramming for a certification exam. For the working professional a better book, especially for mastering SQL and PL/SQL, is Database Systems Using Oracle: A Simplified Guide to SQL and PL/SQL. This book is remarkable for the clear manner in which it explains the basics of relational databases in general and Oracle in particular. I am currently in training for Oracle Certified Professional and had been using study guides and class material to learn Oracle. These are fine for passing the OCP exam, but they leave many gaps in the finer points which lead to thoroughly understanding Oracle.

Since this book's goal is to explain Oracle's SQL Plus and PL/SQL languages instead of getting you through an examination with a passing grade it goes into details that my training missed. I especially like the way that database concepts, design and modeling are covered in the first chapter, and the step-by-step approach to teaching SQL and PL/SQL by actually performing useful tasks such as creating tables and working with tables.

In addition to the basics, this book covers advanced topics such as row locking, performance and joins and set operations. PL/SQL is given the same thorough treatment as SQL Plus and as you read through the book and actually perform the tasks on a real Oracle instance your understanding and skill level increases greatly. Since PL/SQL is rich in features and programming constructs the care with which the author explains the basics and how to apply them in a real environment made learning fun and builds your self confidence.

I also liked the attention given to database administration tasks in the final part of the book, and found the SQL Plus and PL/SQL quick reference in the back of the book useful on many occasions.

If you don't have the luxury of attending Oracle training this book is an excellent substitute, and even if you're going through OCP training this book will fill in the gaps that will surely arise since the course is fast paced. Note that this book uses Oracle 8i as the example environment, but the material works with the newer 9i version too.

2002-05-31T03:38:00.000-04:00

Taking Linda's Spot. The boxed set of Oracle books that Linda discussed in her last entry are a bargain for someone who is immersed in a training program. However, who really has the time to wade through thousands of pages and a stack of CD ROMs? (Unless you're facing a certification exam). What if you merely want to gain basic Oracle skills and are overwhelmed by the six inch thick books out there? A refreshingly slender book is So You Want to Be an Oracle DBA?. First, you need to know that this book is based on version 9i and is focused on the UNIX environment. If you're using Oracle 8i and have no immediate plans to upgrade you will find that the previous edition to be more suitable.

The ideal audience for this book is the new Oracle DBA or UNIX system administrators who have either inherited DBA responsibilities or who want to gain cross-functional skills. Experienced DBAs will find much of this book too basic, and may complain that it doesn't cover the full range of database administration topics.

In my opinion the relatively narrow scope of this book is one of its strengths. Instead of overwhelming the new DBA with hundreds of pages it sticks to the essentials. Another point in its favor is that the author doesn't attempt to go into gory details about how things work (information that you can get from other books as your comfort level and self-confidence improve), but remains focused on what you need to do in order to effectively manage and support an Oracle 9i instance.

While I liked the Getting Started and Some DBA tasks (Sections I and II) that start this book, I especially liked Section III, which covers tuning. This is the essence of what a DBA does, and the basics are well covered. This section also gives some excellent scripts that the new DBA will find invaluable. Section IV, is somewhat useful, but Section V is another favorite because it shows how to begin building your own set of tools, which is the hallmark of an experienced DBA. The scripts that are provided in this section are the foundation of database administration, and will spark ideas for additional and more specific scripts. The value is that you can learn much from what is provided.

Each topic in this book is given a brief 2-3 pages, which makes it somewhat terse. In many cases you'll have to go to other books for deeper explanations, but at least you'll be quickly functional.

If I had to choose a single book with which to get started this would be it. Of course you'll outgrow this as your skills and experience evolve, but it will get you started and does so using good practices and workable techniques.

2002-05-30T03:54:00.000-04:00

Trapped in a Time Warp? Are you currently stuck in the mainframe or mid-range world and are seeking an escape? Or perhaps you realize that your skills are growing obsolete and you want to remake yourself. Programming the World Wide Web may be your ticket out. If you're trying to break into development and are seeking a basic book that will prepare you for a career as a web developer, this isn't what you're looking for. It's neither a programming tutorial nor a book on specific environments, such as .NET. However, if you're doing maintenance programming in, say, RPG/400 or writing JCL and are wondering how you can refactor your skills and get out of the mid-range and mainframe environment this book is ideal.

Solid programming skills are assumed (preferably in C or C++, but that isn't essential). You should have a basic understanding of databases and data structures. If you have these skills this book will systematically familiarize you with the web programming environment and common tools and programming languages that you'll need to master in order to transition out of the data center. I like the way the book touches all of the key knowledge areas, starting with HTML and going through javascript, perl and the usual cast of mark-up, scripting and programming languages. More importantly, this book doesn't skim the surface - it does into databases, XML and server-side development. If you've read the table of contents and are tempted to question why CGI was included in such a relatively new book, bear in mind that most of the information in this book is ideal for maintenance programmers, and there are literally thousands of systems that still employ CGI scripts. This also reinforces my opinion about who will benefit most from this book - maintenance programmers from mid-range and mainframe environments.

In a nutshell, you bring your knowledge of algorithms, data structures and development methodologies, and the book will show you how to apply them to web programming.

2002-05-29T15:53:00.000-04:00

My Turn. Mike's been plowing through topics, and before he gets stuck in XML I am going to break his stride. I'm still in Oracle OCP training, and want to share a collection of books that I've found useful: OCP Oracle9i DBA Certification Boxed Set. This collection of study guides and the CD ROMs that come with it represent potential value, but the decision to go with this set versus buying 'best of breed' books on each subject area boils down to a personal choice. Factors include budget and how willing you are to endure some of the typos in most of the books in this set.

What you get: This collection consists of the following books, each of which I have reviewed on their product pages. I am summarizing the reviews to save time:

OCP Introduction to Oracle9i: SQL Exam Guide. I rated this at 4 stars - be aware of the fact that this book does have errors, make sure you read the errata and you'll find it quite helpful.
OCP Oracle9i Database: Fundamentals I Exam Guide. Another 4-star rating - there are editing flaws and inconsistent writing that do make this book ponderous at times. There have been times when I wished the authors and editors had paid more attention to the book, and other times when I silently thanked them for clarifying a concept.
OCP Oracle9i Database: Fundamentals II Exam Guide. 4-stars. Among the strong points of this book are the self tests and practice exam questions. Weaknesses include poor editing, which seems to plague this series, and the inconsistent writing that is at times extremely clear and others quite obtuse. I prefer OCP: Oracle9i DBA Fundamentals II Study Guide by Doug Stuns and Matthew Weishan, which is better written, consistent and complete. It is also a 'best of breed' book.
OCP Oracle9i Database: Performance Tuning Exam Guide. Unlike the others in this set this book is a 5-star gem. All of the key elements of performance tuning are covered, the illustrations are excellent and aid in understanding, and the drills, self tests and practice questions have been a tremendous help.

Pros: price, over 2000 pages of materials and CD ROMs with practice questions and other material.

Cons: with the exception of the Performance Tuning Exam Guide the guides in this set have editing problems and errors.

You choose.

2002-05-29T01:13:00.000-04:00

Still More XML Resources. I mentioned Definitive XML Application Development in my last entry. If you're a developer this is an excellent resource. Be aware that the book requires a solid working knowledge of XML and associated protocols (XLST, XPath, XML Schema), Python and Java), and is written for practicing developers who are involved with web services, e-commerce and extended supply chain applications. You should also be reasonably familiar with DOM, data structures and relational databases to get the most from this book.

After a quick introduction to the XML processing the author wastes no time getting to the meat by going into processing types in Sections II (Event-Based Processing), III (Tree-Based Processing) and IV (Declarative Processing). Each of these sections are comprised of chapters and topics that cover the strengths and weaknesses of each approach, common tools and example applications, and tips and techniques.

Section V is focused on Java development, including SAX in Java, DOM in Java and XSLT In Java Applications. This section covers APIs, tools and specific considerations for each topic.

The final section addresses XML processing in detail, and deals with alternative processing approaches (including hybrids of event-, tree- and declarative-based models), schemas, and RSS.

In addition the appendices are informative and add to the value of this book. In particular, Appendix A, A Lightning Introduction to Python, will get seasoned developers up-to-speed (augmented by Appendix C which covers Python XML Packages). Appendix B is a glossary that goes into considerable detail, making it a handy reference.

2002-05-26T17:19:00.000-04:00

More XML Resources. It's one thing to have a book of spcifications, such as the one cited in my last entry, but such books are more useful as references than as learning tools for mastering the underlying technology. One of the best collections of XML resources is The Definitive XML Professional Toolkit. This boxed set contains three books that have been published in December 2001 and represent the essentials for anyone who is working with XML and web services. The books are:

Charles F. Goldfarb's XML Handbook (4th Edition) by Charles F. Goldfarb and Paul Prescod. Goldfarb invented SGML, upon which XML is based and which had a significant influence on the design of HTML. At 1200 pages this book is probably one of the most complete references that one can have. It covers every conceivable topic, ranging from a good description of XML and how it evolved from SGML, to semantic web and web services (each of which are disciplines onto themselves).
Expected topics are given in-depth treatment (XML, schemas, DTDs, datatypes, XSLT, XSL-FO, XLink, XPath, XPointer, XSDL, namespaces, topic maps, RDF, SOAP, UDDI, WSDL and VoiceXML), with a focus on the following:
- integration of XML and the older EDI approaches to e-commerce and extended supply chain systems
- a sound approach to content management - how XML fits into the web services framework
- chapters on important topics such as portals, databases, content acquisition, conversion and publishing
- a series of chapters devoted to tutorials on XML basics, schemas, and transformation and navigation protocols
In addition this book comes with two CD ROMs that are packed with applications such as IBM's AlphaWorks suite and NeoCore XMS Native XML Database (Personal Edition). A trial version of TurboXML IDE & Schema Editor is also included among the 175 programs on the CD ROM set.
This is an overwhelming book for beginners, but is a valuable resource for anyone who is deeply involved in web services, XML and related technologies. If you fit the latter category this is probably the only XML reference you'll need.
Definitive XML Schema by Priscilla Walmsley. In a nutshell this book gives a detailed description of the XML schema and associated topics. The author is a member of the W3C working group that created XML Schema, and the material in this book is consistent with W3C recommendations. See the editorial description and reviews on this book's product page for specifics.
Definitive XSLT and XPath by G. Ken Holman. Covers everything you need to know about transforming information structured vocabularies and output formats. The author is the chair of OASIS's XSLT/XPath Conformance Technical Subcommittee. See the editorial description and reviews on this book's product page for specifics.

What's not included in this set, but worth getting is Definitive XML Application Development by Lars Marius Garshol. However, the books that do come this this boxed set will provide you with a solid foundation of the basics as well as software tools that you can evaluate as candidates for your own development environment.

2002-05-25T23:26:00.000-04:00

XML Resources. Because XML is so versatile, especially for enterprise applications integration, and as a core component of web services and e-commerce systems, I want to share some of the better XML books that are available.

Although you can download XML specifications from the W3C working groups, a single book that summarizes these specifications is worth the investment. XML Family of Specifications: A Practical Guide is such a book. It's a comprehensive and up-to-date (as of this review) reference on XML as defined by the W3C. Part I is more of a desk reference (with a lot of example code), which covers XML syntax, modeling and parsing, DTDs and schemas. Part II, also with many examples, is a complete treatment of parsing with APIs, with separate chapters on SAX, DOM, JDOM and JAXP. Transformation and display protocols are covered in Part III, including CSS2, XSLT and XPath. XSLFO for formatting is also covered in this part. Xlink and Xpointer to facilitate referencing operations are the subjects of Part IV, and the book wraps up the formal descriptions of the family of specifications in Part V, which covers XHTML and RDF. I have a personal interest in RDF, and found the chapter devoted to it complete, but terse. This characterizes all of the chapters in this book. What makes this book valuable is the way the information is displayed. Each chapter starts with either an overview or concepts, and each clearly explains each specification and gives clear examples to demonstrate how they work in practice.

Appendices at the back of the book are especially valuable because they summarize much of the information in the body of the book. For example, Appendix A depicts the family of specifications in a format that clearly shows the relationships among them. In addition, the web site that supports the book provides a lot of supplementary material, including over 900 links to related resources and an image map of the family of specifications that is one of the most visually appealing and informative resources one can have at their disposal. Note that the web site is not up-to-date - some information that was cited as coming in April and May were still not online as of late June.

This is not a book for learning XML as much as it's a reference. The main value over W3C material that is available over the web is the clear writing and many examples. It reads much better than dry specs and is complete in its coverage.

2002-05-25T03:53:00.000-04:00

Now For Something Strange. As long as I'm dredging up old books that I think are still useful, here is one that is worth tracking down: Testing to Verify Design and Manufacturing Readiness This book, despite the editorial description on this page, is entirely about hardware/software integration as it pertains to managing acquisition risk for the buyer and the processes and procedures that need to be employed by the developer.

If you work within the framework of the FDA's General Principles of Software Validation or the FAA's DO-178B for safety-critical avionics the material is consistent with these governing documents, but is too outdated to be useful.

However, if you are working on integrated projects that are unregulated with respect to government controls you may find this book useful. It contains a wealth of useful guidelines for establishing and managing processes to support development of products that are based on embedded software or hardware/software integration, The core of this book is a collection of templates that were developed and proven in the DoD industry, and are designed to manage integrated testing, failure management and field feedback. Each element is applicable to commercial environments, especially for companies that are manufacturing intelligent network devices, data storage systems and specialty products such as digital control systems, sensors and other integrated hardware/software products.

The templates are introduced in Chapter 1, and each of the seven functional areas covered by the templates are discussed in separate chapters. These functional areas are: integrated testing, failure reporting, design limits, product life, test/analyze/fix process, uniform test reporting and field feedback. A chapter on applying these follows, but the material is slanted towards DoD issues. If you apply thought and imagination while reading this chapter you should get ideas on how to refactor the cases into your own environment.

Section 2 devotes three chapters to software design and test, which are based on the older waterfall development life cycle. However, this particular life cycle lends itself well to developing embedded systems, making this material valid and applicable to commercial environments.

Overall, this is a useful book for the intended audience I cited above if you can track down a copy. In particular, the checklists and overall framework are valuable, and much can be learned from the risk-based approach taken in the book.

Shifting Gears. Although I'll inevitably return to quality and reliability, I am going to shift to another topic in my next entry: XML. Also, most of the topics for the next few weeks will be in the form of book reviews instead of the tutorials and news items that we've been writing about. That will change as soon as things stabilize. We're all busy and haven't the time to do the research we normally do, nor the freedom to craft original essays on topics that are dear to us. That will change in due time, but until then please bear with us.

2002-05-24T14:10:00.000-04:00

Oldies, But Goodies. One of my personal favorite books, and one that has had a profound influence on me, is Quality Assurance for Information Systems. This book represents a pivot point in Perry's prolific published works that date from 1981. What makes it pivotal is the fact that this book synthesizes his approach to IS quality assurance from a production support viewpoint and his future work which focuses on software testing.

Although over 11 years old the QA approach contained in this book is still valid. To get at the gems, though, you have to overlook a few things. For example, terminology common in the mainframe data center of past decades sounds quaint even to those of us who came from that environment. Also, the code examples used to illustrate quality problems are sure to confuse the younger generation of C++ and Java developers and test professionals who probably never heard of PL/I and only vaguely know about FORTRAN.

What I like about this book and the reason why I think it's still an important reference is the fact that application quality from an enterprise perspective is addressed. This goes beyond testing and release processes, as well as beyond project issues surrounding applications delivery and SQA. The focus is on production and maintenance, although testing, SQA and project metrics are addressed.

In addition to the focus, the book contains checklists, questionnaires and sample forms that can be updated to reflect modern computing environments - and you may be surprised to find that much of this 'ancient' material requires very little modification. Another aspect of this book that I like is the material on software maintenance, which seems to be a lost art, although it's as important now as it ever was.

Don't let the age of this book deter you if you're interested in quality assurance from a production support point of view. The best recommendation I can give is that this book has served me well in over a decade of consulting, and it probably will for years to come. However, it shouldn't be your only reference either.

2002-05-23T16:12:00.000-04:00

More on Quality and Testing. In previous entries I covered most of the newer books on quality, reliability and testing. However, there are some older books that are still valid or contain enough information of value that they merit a mention.

Testing Very Big Systems. After you've peeled back the layers of testing techniques that are better documented and more refined in more recent books, and archaic language that characterized the mainframe lingo that was dying out when this book was first written a decade ago you'll find gold.
First, the way test case management is presented stands the test of time. The author is obviously well versed in managing complex system testing and it shows in his detailed approach to developing a test strategy and managing a large array of test cases. As good as this material is, it isn't a sufficient reason to track down a copy of this book because Rick Craig and Stefan Jaskiel have a more modern book, Systematic Software Testing that accomplishes the same goal.
The real gold is in the way that this book integrates testing, issue management and metrics. Although there is a large body of knowledge on these topics, this book manages to sort out the complexities in the clearest terms I've encountered. I also think that the approach change management is excellent, and especially the way this is linked to issue management. On the subject of issue management, the taxonomy of issue types has served me as a model during numerous consulting engagements for service delivery and software engineering process development, and have been proven in the field.
Additional gold is in the chapters on test documentation (especially the treatment of status reporting) and managing management. I also like the way that the author takes economic considerations into account, which was not much in vogue when this book was written in 1992.
If you're an SQA or applications delivery practitioner I strongly recommend tracking down a copy of this book. Look past the archaic parts and you will find one nugget after the other of useful information. I wish this book would be rewritten to reflect today's environment and the lessons that the author learned in the decade since this book was first published because there is much in this book that you will not find elsewhere.
Ensuring Software Reliability. Despite this book's age and the subsequent software reliability books that have since been published, it adds a perspective and information that is either not in more recent books, or is not given the same comprehensive treatment.
If you are familiar with software reliability as a discipline and with any of the major books, such as John Musa's Software Reliability Engineered Testing, you'll probably not find anything new in Part I, although chapters 3 (software failures and failure processes), and 6 (reliability terms and definitions) add clear, succinct descriptions and definitions to these topics.
Part II, however, is where this book shines and why I use this book as one of my principal references. Specifically, chapter 7, which covers software reliability data collection, is thorough and comprehensive. I especially like the way data collection is integrated into a reporting process, and the near exhaustive list of error, product and process metrics and their associated descriptions. Chapter 8 is another gem. It describes 12 major reliability models, ranging from Musa's models to predictive models. One of the most interesting models in this catalog is the 'Leone Test Coverage Model', which is based upon percentage of completion and coverage of specific development and testing tasks. For each model the author gives a summary description, provides assumptions and parameters of the model, and the associated math. Each model's summary contains strengths and weaknesses, and when in the life cycle the model is best employed.
Overall, this book contains some invaluable information and information that has been superseded by newer books (especially the last chapters in Part II). If you're seeking information that I've highlighted above, this book is a worthwhile investment. If you're looking for a book that is more up-to-date I recommend Software Reliability Engineered Testing by John Musa. This book will remain an often referenced part of my library for some time to come.

In my next entry I'll provide additional books that I like in spite of their age.

2002-05-22T07:08:00.000-04:00

Short Break. I am going to briefly break from the testing, SQA and reliability thread because I don't have time right now to devote to properly wrapping it up. I will offer an interesting article titled Use of Metrics in High Maturity Organizations to keep the pace alive until I return to the topic.

Wireless and M-Commerce Development. I just posted my take on a book titled Mobile Business Strategies: Understanding the Technologies and Opportunities in our sister weblog, Postcards from the Revolution.

That weblog focuses on service delivery and business/IT alignment issues, while this one is slanted towards software engineering and more technical topics. The book fit within our theme for Postcards from the Revolution, but there is a related book that is more suitable for this audience. The title is The Complete Wireless Internet & Mobile Business Programming Training Course (with CDROM), and the friend who called it to my attention was enthusiastic. It appears to be a complete training course in all aspects of wireless and mobile commerce development. Judging from the content of the thirty-four associated PowerPoint presentations that are available for free download this is, indeed, a complete training course. If you need to get yourself or your staff quickly up-to-speed and you have a constrained training budget this may be a cost-effective alternative.

Back to Quality. Before ending this entry I want to revisit quality. If you are pursuing the ASQ CSQE certification you may want to get a copy of Fundamental Concepts for the Software Quality Engineer. This book is published by the sponsor of the certification (ASQ), and the book editor is Taz Daughtrey, who is editor-in-chief of ASQ's peer-reviewed quarterly journal, Software Quality Professional.

2002-05-21T19:20:00.000-04:00

More on SQA + Reliability. In my haste to provide SQA resources yesterday I left out two important ones that should be bookmarked and frequently visited by anyone who is interested in software quality assurance:

These are my personal favorites, and I have been using them for years as primary resources.

Software Reliability - Short Version. I am still pressed for time, so this entry is going to be as terse as my last. In the same manner that I use a single book as my primary reference for SQA, I use Software Reliability Engineered Testing by John Musa as my primary reliability reference. My 11 May 2001 review on Amazon will show why I hold it in such high regard. That doesn't mean that it's the only book I use - I have a large collection of SQA and reliability books - it means that it's the first one to which I turn for authoritative information on the topic. On the web the first place I go is the Data and Analysis Center Software Reliability page, which points me to the resources I need for particular aspects of reliability.

Past Information. Reliability has been addressed in this weblog in many previous entries, so I am not going to repeat much of that material here. However, during the next few days (when I get a break in my routine) I am going to wrap up this thread with a few longer entries that describe my own views about SQA and reliability.

2002-05-20T14:07:00.000-04:00

SQA. We've now come to SQA, and while most of my testing resources are books, there is only one book that I use as a primary reference for SQA: The Handbook of Software Quality Assurance by Gordon Schulmeyer and James McManus. My reasons for using this book as a primary reference are cited in my 18 April 2001 Amazon review. However, my most frequently used resources for SQA, and the ones which have shaped my thinking, are:

CrossTalk Magazine.
Software Technology and Support Center, which has a rich cache of technical documents, great material about software quality engineering and testing, as well as related topics.
Data and Analysis Center for Software SQA page.

One interesting page I want to share that crosses SQA and software engineering practices is Nine Steps to Defect-Free Software, which should be made into a poster and placed in every cubicle in development.

I am pressed for time, so am going to abruptly end this without further commentary. I'll pick up where I left off tomorrow.

2002-05-19T18:11:00.000-04:00

Closing In. This thread started with a brief set of reasons why I was enamored with Systematic Software Testing by Rick D. Craig and Stefan P. Jaskiel, and has grown into a series about testing, quality, SQA and reliability. I opened the last entry with a quote attributed to Hesiod, who remains an influential Greek poet and philosopher. The theme of this entry is metrics, so I am going to open with a quote by Albert Einstein:

Not everything that can be counted counts, and not everything that counts can be counted.

How true. Einstein's legacy of genius will live on for ages because he has influenced generations of mathematicians and physicists.

While perhaps not at the same level as Einstein, Robert B. Grady will remain in my memory because of the deep influence his work has had on my thinking. I first discovered Grady in 1992 when I read Practical Software Metrics for Project Management and Process Improvement (see Linda's 22 April 2001 Amazon review). This is Grady's first book and it sets the tone for his later two books discussed below. What makes this book so important is that it is one of the first to integrate software metrics with project management metrics.

What I particularly like about this book includes:

Complete view of metrics that matter, and the chronicle of how these metrics evolved in a large company (Hewlett-Packard).
Recognition that any software metrics initiative extends beyond the project that delivers the software - Grady examines post-production metrics and ties them back to not only the development life cycle, but the product life cycle as well. Ten years after this book was published there are still large organizations that are struggling with doing this, yet Grady's book provides a clear roadmap to achieving this elusive goal.
Continuous improvement is the central theme in this book. Grady does not stop with collecting and analyzing metrics, but how to effectively employ them to spot improvement opportunities and develop a strategy to effect those improvements.

The book is written as both a story of how a successful metrics program evolved, complete with anecdotes that will prove helpful, and as a collection of data that illustrates what is and is not important to a comprehensive metrics program.

Among all of Grady's books I like this one the best; however, I recommend that his other two also be carefully read if software process improvement is your goal. He has much to say and backs it up with data and a chronicle of his experiences from real projects.

Five years later Grady wrote Successful Software Process Improvement, which followed-up on the foundation he laid in the first book by showing how his metrics-based approach can be leveraged into a viable process improvement program. This book uses the TQM Plan-Do-Check-Act framework as the basis for process improvement. However, he goes deep into the issues and factors to give a complete approach to developing and managing a continuous improvement posture.

Highlights of this book include:

The same story telling approach he successfully used in his first book. The conversational writing style and the logical sequence of the book makes it easy to read. Moreover, the real life examples add credibility and make the content practical instead of merely blue sky theory.
A complete survey of assessment methods, such as the CMM, Software Productivity Research's Software Quality and Productivity Assessment, and Hewlett-Packard's internal QUality Maturity System. The latter two are especially interesting because they are, in essence, balanced scorecards.
Business-oriented - the approach taken never strays from cost/benefit and ROI.

The parts I especially liked included the chapter on software failure analysis (a personal interest), key lessons from adopting best practices, and moving past reasons not to succeed. In fact, if you get nothing else from this book the last part will make this book a worthwhile investment because he shows how to deal with the six most common excuses for not pursuing process improvement (or any other initiative for that matter).

In also like the wealth of metrics, data and examples. While this book is longer than his first one, it's still a manageable 314 pages and is highly readable. If you are involved with software process improvement initiatives this book should be on your short list.

His last book, Software Metrics: Establishing a Company-wide Program, is about how to establish a viable metrics program. See my 28 November 2000 review on Amazon for details.

There is one other book that has deeply influenced me, Software Excellence: A Total Quality Management Guide. This book is a collection of papers that were made into a text under the editorial control of Shigeichi Moriguchi. Mr. Moriguchi did a superb job of ensuring both readability and structuring the content in such a manner that it can actually be viewed as three books:

A textbook on software quality control.
Catalog of techniques used in testing and SQA.
Training guide for testers and SQA professionals.

More details can be read in my 20 February 2002 on Amazon.

Moving Along. Life is a journey, not a destination. This thread is going to imitate life because in the next entry I'll continue the journey, which will pass into the realm of SQA - a strange place inhabited by many cultures, and whose inhabitants are still trying to figure out who they are.

2002-05-18T14:02:00.000-04:00

Picking Up. My last entry opened the door to test process improvement, which is summed up in a 2800 year old quote by Hesiod:

It is best to do things systematically, since we are only human, and disorder is our worst enemy.

Isn't it amazing how something uttered so long ago by a Greek poet is relevant to software testing?

It's beyond question that the Greeks made many lasting contributions to culture and civilization. In the world of test process improvement the lasting contributions may well be coming out of the Netherlands. As an aside, our Dutch brothers and sisters are also making significant contributions to service level management (see my 5 April 2002 entry in our sister weblog, Postcards from the Revolution). The reason I believe that the Dutch are leading the way in test process improvement is because the Test Process Improvement (TPI) and Test Management Approach (TMAP). Each of these approaches are documented in the following books:

Test Process Improvement: A Practical Step-by-Step Guide to Structured Testing. This book provides a coherent process improvement approach for software testing. It provides a model that supports the assessment of strengths and weaknesses of an existing software testing process and an approach for developing and implementing remedial action to rectify the weaknesses. As such this book is not useful to organizations that have not achieved a mature and stable testing process because the model will not apply. If you are seeking a book that will get your processes stable you will find Systematic Software Testing by Rick D. Craig and Stefan P. Jaskiel a better place to start.
However, if your processes are stable this book is among the best because it stays focused on improving the testing process and does so in the same manner that SEI's CMM does for software development. In fact, the TPI approach in this book is cross-referenced to the CMM, which gives you an approach that can be viewed as a testing maturity model that aligns nicely with the CMM (including the newer CMMI). This is one of the strong points of the book and TPI.
Another thing to know about this book is that it's written more like a specification than a narrative. Some readers may find this difficult, but if you are involved in mapping the TPI key process areas to the CMM (or SPICE, Bootstrap or PSM), you'll appreciate the format. Also, the book views TPI as a subset of software process improvement, and software process improvement as a subset of TQM. While the authors focus on the software testing process, they do not isolate it from the bigger picture. This allows you to view then entire quality process as a coherent whole when you're assessing the software testing process and developing improvement strategies.
I personally think this book adds considerably to the software testing body of knowledge, and that the approach the authors give is both practical and sensible. If you work in an organization that has a stable testing process or is at CMM level 2 or above this book is essential reading.
Software Testing: A Guide to the TMAP Approach My first introduction to TMAP was in the above book, which the author co-authored. It piqued my interest, but unfortunately all of the literature on TMAP was written in Dutch. This book makes this powerful test management approach available to English speaking readers, making it invaluable.
First, a little about TMAP to explain why I think the approach is important and useful: It views testing as a process instead of a collection of procedures. The advantage is that once a process is in place it can be stabilized and improved upon. The key to testing is repeatability, and without a process there can be no repeatability. TMAP consists of four elements that combine to form a cohesive test management model:
Testing life cycle that is aligned to the development life cycle. This life cycle is encapsulated within a planning and control framework that easily fits into the project management activities of the development life cycle.
Testing techniques - not the techniques used in the execution of test cases, but the techniques employed for defining a test strategy, developing test specifications, and the associated artifacts. This book does cover some basic test execution techniques, but they are not the focus of the book and are not covered in great detail.
Infrastructure and tools - addresses what are the minimums for an effective test process in the form of environments and tools. If you're establishing a test organization this aspect will be invaluable.
Organization - how the test organization is structured and how it relates to external functions, such as development, configuration and release management, project management and other major stakeholders.
Each of the above elements and their parts are covered in great detail, resulting in a sound framework for test management. That alone makes this book invaluable, but there are some additional gems that I especially liked:
Test point analysis and estimation, which is an estimating method for test effort that is based on function point analysis. This is incredibly valuable because accurate estimation is one of the shortfalls in testing. This alone is reason to buy the book. For more information about Test Point Analysis you can download Test point analysis: a method for test estimation or look through the presentation slides from Conquest 2000, which also includes presentations on TPI and other items of interest. Although off topic, Test Effort Estimation Using Use Case Points is a related approach that fits nicely within the unified process.
The wealth of checklists - I especially liked the comprehensive list of quality characteristics.
Testing in maintenance situations - probably the most common situation for software testing and this book covers it well.
This book and the first one I discussed above combine to give a complete picture of test management and test process improvement.

There are a few other books about test process improvement that are worth reading:

Software Testing in the Real World (see Linda's 21 March 2001 Amazon review for details).
Lessons Learned in Software Testing
Surviving the Top Ten Challenges of Software Testing: A People-Oriented Approach

While the last two are more slanted towards advice and examples, they do promote process improvement by showing what does and does not work.

2002-05-17T15:23:00.000-04:00

Testing, Quality and Process. In our 13, 14 and 16 May entries Linda and I have taken turns discussing quality- and testing-related books.

The software testing profession came into its own in 1979 when Glenford Myers published The Art Software Testing. Although this book is still in print (a remarkable feat in itself), it's quaint when compared to what we now have in published works and the body of knowledge. What this book did for the profession is legitimize it as a valid career path and to portray software testing as a profession instead of an activity to which mediocre programmers were exiled. Myers deserves the credit bestowed, but there is an unsung hero in the software testing and quality movement whose prolific writing has had considerable influence: William E. Perry.

Perry was writing about maintenance, testing and quality before Myers' book arrived on the scene, and his 1991 book, Quality Assurance for Information Systems: Methods Tools, and Techniques, is an interesting blend of holistic IT quality and software testing. I still refer to my copy for ideas when I am researching metrics. This book is about mid-point in Perry's publishing career. While his subsequent books focused more on software testing, this one is among the first to cover both software quality assurance and software testing in a coherent manner.

William Lewis' Software Testing and Continuous Quality Improvement that both Linda and I have recently discussed here (and reviewed on Amazon) extends Perry's work with respect to a holistic view of software quality.

Testing vs. SQA. I make the distinction between testing and SQA as follows:

Testing is an activity to find or prevent defects in software using older inspection techniques or more modern preventive techniques. Note that I am not including value judgments in my definition, else I would have ignored the inspection approach. What I want to do is highlight differences between testing and SQA.
SQA is an oversight function that collects and analyzes quality data to be used in pursuit of process improvement.

Based on my definitions testing belongs in the application delivery domain and serves as the boundary between application delivery and service delivery (i.e., production). This is shown in the organizational diagram that Linda and I developed. SQA, in my opinion, should be a function of a program management office (an ideal spot for oversight), or an entirely separate function that reports directly to the CIO.

However, software testing is evolving to the point where testing and SQA are becoming blurred. In fact, to put it crudely, finding the boundary between testing and SQA is akin to picking fly shit of pepper. I apologize for that analogy, but it best describes the situation. The two books I've recently discussed, Systematic Software Testing and Introducing Software Testing each integrate testing and SQA, and it looks like the direction that software testing is going to take. There are some strengths and weaknesses to this:

Strengths: end-to-end quality infrastructure, with a viewpoint that encompasses the entire systems life cycle (not just the development life cycle).
Weaknesses: misses the big picture because testing is a narrow viewpoint of software quality. Other stakeholders in the service level management and project management domains have different viewpoints. See our Life Cycle Quality Gates document for an overview of metrics we deem important and you'll see why many will not be on the RADAR of a test organization.

I fall on the side of centralized SQA as an oversight function. I believe that Edward Deming was correct when he stated, [I]f the measurements you’re using are unfair, inconsistent and not within the control of the person being evaluated then you will demoralize and de-motivate your employees. Testers should be concerned with testing, not the politics of metrics. In fact, Craig and Jaskiel raise this as an issue (in different words) in Systematic Software Testing.

Clouds in My Coffee. The way I see it the maturity of the software testing profession, as evidenced by the two books I discussed yesterday, and the affinity of testing and SQA, are on a course that needs to be carefully considered. For small organizations this isn't such an important issue, but for large enterprises the strengths and weaknesses need to be more carefully examined and weighed than I've done in this entry. The good news is we have reached a point where quality is considered to be important and proactive approaches to achieving it are becoming more prevalent. Better yet, thses approaches are wrappd in process.

Where the issues become even more cloudy is in the growing (and excellent) body of knowledge and practices supporting test process improvement. My next entry will focus on that aspect of testing and quality before moving on to software reliability in a future entry.

Have a wonderful weekend!

2002-05-16T03:43:00.000-04:00

Proverbs. There is a proverb about a jackass that starved to death while standing between two bales of hay because it couldn't decide which one to eat first. The moral is to make a decision and move forward. My dilemma is that I have two new books on software testing and I am having difficulty in deciding which is better. At the risk of starving with such delectable food for the mind within reach I am going to give my opinions about the merits and best audience for each. The books are: Systematic Software Testing by Rick D. Craig and Stefan P. Jaskiel (see my 14 May entry) and Introducing Software Testing by Louise Tamres. One thing is clear: May 2002 will go down as the month and year that the software testing body of knowledge dramatically improved. That said, here are my thoughts about each of the books:

Systematic Software Testing. Synopsis: Process-oriented and applicable to test professionals at all levels; test managers will benefit the most.
This book provides a detailed roadmap for establishing and managing a comprehensive test process that is closely aligned to the IEEE standards for software testing. The process, called Systematic Test and Evaluation Process (STEP) is designed to improve quality by early involvement in the development life cycle instead of having testing as an activity on the critical path at the end of the build phase. This approach ensures early detection of defects, including those introduced in the requirements, specifications and design milestones. Clearly, the STEP approach supports testing and SQA (where SQA is an oversight function outside of the testing domain).
The STEP process has three main steps:
Plan the test strategy (develop a master test plan and associated detailed test plans).
Acquire testware (define test objectives, design and create test plans).
Measure (execute the tests, ensure that tests are adequate and monitor the process itself).
This framework is supported in Chapters 2-8, each of which addresses supporting activities and artifacts in detail. Chapter 2 covers risk analysis since testing is by its nature done to reduce the risk of defects escaping into production systems. I like the way the authors separate technical and schedule risks in this chapter because each are integral to the realities of testing.
Chapters 3 and 4 show how to perform master and detailed test planning, and provide example plan templates and how to develop them, and requirements and factors for each test phase for the detailed planning (unit, integration, system and acceptance testing).
The analysis and design activities covered in chapter 5 are focused on test design. The systematic and structured way the authors approach these activities walks you through developing test cases. You're shown how to ensure that they account for requirements and features, and are given high level advice about how to types of tests to employ. Test implementation covered in Chapter 6 introduces organization and process issues from a team perspective. One of the strongest chapters, 7, does deeply into the issues and factors surrounding test execution, and gives metrics to consider and internal processes for managing defects. I felt that this chapter should have paid more attention to issue and defect management from an enterprise problem management perspective, but despite this the information is solid.
The chapters that will most benefit test managers, especially new ones, are 8 through 10 that address the test organization, people and management issues. These sections would warm the heart of HR professionals and is unique in that leadership is given the same weight as management techniques. The detailed comparison of certifications from ASQ (CSQE), IEEE (CSDP), QAI (CSTE) and IIST (CSTP) includes everything you need to know to select the best certification to pursue, including salary increase data for each of these certifications. I also liked the chapter on improving the test process and thought the discussions of the CMM and the TPI model that is the subject of Test Process Improvement: A Practical Step-by-Step Guide to Structured Testing discussed. The appendices are also valuable in that they provide a glossary and templates that are consistent with IEEE specifications for software testing, and other valuable aids, such as checklists, an example master test plan and process diagrams.
Overall, the 15 years of field experience in teaching testing that is embodied in this book shows. It's practical, captures best practices and provides a solid model for a process-oriented test organization that employs preventive techniques.
Introducing Software Testing. Synopsis: Teaches good habits to new testers, and offers much to experienced test professionals.
I cannot imagine a better introductory book for software testers because this much needed text bypasses the theory that similar books inundate you with and goes straight to the essence of what testers spend most of their time doing: writing test plans and developing test cases. In fact, the first chapter (Tackling the Testing Maze) is the roadmap for the rest of the book, as well as the test process itself. The approach is modern in that it's aligned to iterative development life cycles, which is based on eight stages:
Exploration
Baseline test
Trend analysis
Inventory
Inventory combinations
Boundaries
Data
Stress the environment
What I like about this book is the no-nonsense approach to developing a test outline from which the test plan(s) and test cases will be derived, and the way that this documentation is aligned to the real world. For example, due diligence in the form of meticulous attention to sign-offs and authorities to proceed is emphasized. This alone is a common failure point in many test organizations. I also like the way that the realities of the project are highlighted, especially the interactions with the development team and the integration of project considerations into the process - in particular, the schedule constraints that all testers must juggle while meeting quality goals.
Other areas that make this a realistic look at testing include the chapters on object-oriented and web testing, and the inclusion of security testing - especially the latter which has been neglected in many advanced books and is an important, but overlooked, aspect of the full test suite.
Because this is an introductory text the author uses case studies and copious examples to illustrate and reinforce concepts and activities. But most important, the focus is on activities that reflect what testers do and theory only when required. This makes the book interesting and will give to anyone who follows the approach solid skills that will increase their worth to their team as well as dramatically increase their professional knowledge and skills.
For new testers this is probably the most important book you can buy. If you're a test manager you'll find this book to be an ideal training tool, and if combined with Systematic Software Testing by Rick D. Craig and Stefan P. Jaskiel will give you a complete reference library. The approach in the Craig and Jaskiel book is completely consistent with the approach in this one, making both books all the more valuable.

Which to get? Why not both?

In my next entry I am going to continue this theme and extend it with my thoughts on SQA, software process improvement and software reliability.

2002-05-15T06:22:00.000-04:00

Foul Play. Linda's last entry highlighted some disturbing behind-the-scenes maneuvering that, frankly, are a threat to open computing and interoperability. A 14 May article By Wylie Wong titled Microsoft ploy to block Sun exposed uncovers more foul play.

This goes much deeper than Microsoft's shenanigans. IBM shares the guilt, and based on past history Sun isn't exactly clean either. In this case they are the victim, but do you doubt that they would have been the perpetrator given the opportunity? No, this isn't a Microsoft or IBM sin, it's an indictment of the lack of ethics in our industry and it underscores the reason why we have anti-trust legislation to begin with. However, the courts should not bear the burden of sorting this mess out. We have a responsibility to just say no to technology based on proprietary standards. Until that happens we're going to get what we deserve, and it will be a regression to closed-systems and lack of interoperability.

On a Positive Note. If you develop in the J2EE environment you should be frequently visiting The ServerSide, which contains news, articles and other resources. Registration is free, and two great reasons to register are free PDF copies of:

Mastering Enterprise JavaBeans (the same material that is contained in the paper book with the same title by Ed Roman, Scott W. Ambler, Tyler Jewell and Floyd Marinescu). The source code that goes with the book is also available for free download.
EJB Design Patterns in PDF format, which is identical to the paper book with the same title by Floyd Marinescu and Ed Roman. Note: the PDF version of the book has not been put in the download section yet, but you can still get the source code.

Remember, you need to register for a free account to download these valuable books and source code. You'll also get access to discussion boards and articles, such as Critical measures when beginning a J2EE project, that are sure to increase your knowledge (not to mention saving money on books).

The ServerSide has a sister site called The Middleware Company, which also requires registration and also has invaluable resources. Their article library is filled with whitepapers and articles that you'll find useful.

2002-05-14T12:47:00.000-04:00

Eye's Wide Shut? In a 7 April article titled IBM, Microsoft patents pose dangers David Berlind exposed behind-the-scenes acts that would do Machiavelli proud. A quote from the article is an attention grabber:

The potential for the two giants to erect a toll booth is tied to the likelihood that Web services protocols such as SOAP, WSDL, and UDDI--and the related ones to which the two companies hold patents or other intellectual property rights--will one day be as important as the standard protocols (such as TCP/IP and HTTP) on which the Internet is based today.

A month later Mr. Berlind reports that IBM and Microsoft are not going unchallenged. His 7 May article titled Web Services Hero shows that both Hewlett-Packard and Apple are proactively challenging the moves by IBM and Microsoft. While Mr. Berlind's reporting is well written and researched, and his tenacious investigation is a true service, one of his readers, Gary Edwards, summed up the issues and threats in his Reader Talkback. This is important stuff and I think both David Berlind's articles and Mr. Edwards' thoughts merit a careful read and a lot of thought.

Yesterday I singled out Soft Java for its light, humorous approach to teaching Java. I found another site, Java Ranch, that uses the same approach and am now becoming interested in Java. One final note: If you are interested in CASE tools you'll like the collection of Freely Available CASE Tools that I stumbled upon by accident.

2002-05-14T10:41:00.000-04:00

Linda's thoughts about Software Testing and Continuous Quality Improvement in the previous entry are on the mark. The book takes a wide look at software quality improvement across the life cycle and wraps it into a continuous improvement process. I just received a review copy of Systematic Software Testing by Rick D. Craig and Stefan P. Jaskiel and have to exclaim, what a difference a day makes. I've only had this book for 18 hours as I write this, and in my opinion it's destined to become the standard reference for software testing. It won't completely supplant Software Testing and Continuous Quality Improvement because, as Linda pointed out, that book's encyclopediac format for testing techniques, and the complete picture of pre- and post-production metrics make it useful in its own right.

The reason I believe that the Craig and Jaskiel book will become the standard reference is based on:

It not only proposes a preventive testing process (called STEP; Systematic Test and Evaluation Process), but is also aligned to IEEE standards for test documentation and uses IEEE terminology throughout. These accomplish three things: (1) it gives a test process that takes the entire life cycle into account and employs an approach that begins before a single line of code is written, (2) leverages established standards and shows how they can be successfully used in practice, and (3) uses established and standardized terminology.
The STEP approach is based on risk management, which is missing other books on testing. The up front risk analysis in the test planning phase makes sense when you consider that testing is all about finding and removing defects, which represent risks to the software to be delivered. Finally, someone gets it right!
The chapters on master and detailed test planning add clarity and consistency to these processes. If you've worked in more than one organization you'll understand the significance of this because it seems that no two organizations approach it the same way, and I have never seen an organization approach it in the logical manner in which it's outlined in this book.
The same structure and consistency is applied to test implementation and execution - and the combined benefits will promote repeatability, which is a fundamental goal of testing.
Forms, checklists and templates (unfortunately only in hard copy) that are provided are invaluable. If you tailor them to your own organization you'll have a ready-made set of testware that covers every facet of the QA process.

A few other highlights that I picked up in the 18 hours since I've had this book include: a side-by-side comparison of software quality and test certifications. There were some interesting surprises here. For example, there are a little over 1900 ASQ CSQEs, compared to over 2200 QAI CSTEs, which means that the I lost the debate with Manisha Saboo of eRunway over which was the most prevalent certification. Another fact that emerged from the comparison makes Manisha's arguments in favor of CSTE even more compelling is the average salary increase for those who attain one or the other certification, which is a mere 3% for CSQE and 19% for CSTE. The two other certification programs compared in the chart, IEEE CSDP and International Institute for Software Testing CSTP, are relatively new certifications with less than 200 certified professionals each.

I also liked the chapters on test management (from a test manager's perspective) and improving the test process. If you are with an organization that is assessed against the CMM or are considering going in that direction, the brief piece on how to align the test process to the CMM is invaluable. If you are familiar with Test Process Improvement approach proposed by Koomen and Pol in Test Process Improvement: A Practical Step-by-Step Guide to Structured Testing, you'll especially like the way that this book cross references STEP to TPI.

Obviously I will have much more to say about this book as I read through it in detail, and after I have I'll post a comprehensive review here. However, I found the book to be so impressive and compelling on the first scan through that I wanted to get the word out that this is, indeed, a book that is essential if you're involved in software testing.

2002-05-13T18:38:00.000-04:00

Mike's earlier mention of the Life Cycle Quality Gates document, that Mike developed and we both continue to refine, caused me to think of the source material we used as its basis. Software Testing and Continuous Quality Improvement was probably our most influential resource. This book represents the most complete and comprehensive approach to total quality of any I've read on either software testing or software quality assurance.

Highlights include:

A structured quality cycle based on Plan-Do-Check-Act. This cycle is the foundation of continuous improvement, which is the theme of the book.
Complete description of testing techniques. In this respect the book is an encyclopedia for software test professionals and a definitive reference.
Comprehensive resource for forms and checklists (I wish these were also provided in soft copy on a CD ROM or author's web site, but they are not).
Full view of metrics across every aspect of the development life cycle. In the same manner that the testing techniques are encyclopedic, the metrics are also an encyclopedia for SQA professionals.

It does not confine itself to testing alone, and in fact, has something for production services and service delivery professionals, as well as project managers involved with large scale development and implementation projects. You would have to buy at least a dozen books or download thousands of documents off the Internet to get the information contained between the covers of this book.

I recently finished reading Business Rules Applied, which covers business rules from an implementation approach, and does so in great detail. If you are new to business rules you should first read Business Rules and Information Systems: Aligning IT with Business Goals by Tony Morgan, which is better for beginners. That book introduces business rules at a basic level.

This book expands Morgan's work by drilling down into details and exposing the nuances that a seasoned practitioner will appreciate. However, the main value of this book is the way Ms. von Halle steps you through the complexities of implementing business rules as an organizational methodology. This is not an easy task, but she manages to provide a complete and comprehensive approach that will guarantee success if carefully followed. I think the work breakdown structure alone that is provided in the book makes it essential to anyone who is tasked with implementing business rules.

In addition, the tables, checklists and documents and information from the book's web site add even more value. This is an important book about an important topic. It's not easy to read, but the diligent reader (assuming prior experience) will find everything he or she needs to know about business rules, the value proposition for using them, and how to implement them. It's the most authoritative book on the subject, and will probably remain so for years to come.

There's always some delightful site to be discovered, and the most recent is Soft Java, which is the creation of two women, Jeannie and Joy who are funny, slightly over the edge and have other similar qualities that will endear them to you. Their site is dedicated to teaching Java to the masses. I'm up to my eyeballs with my Oracle OCP training and am not about to add learning Java to my workload at this time, but when I do have the time and energy I might just return to their site and add Java to my skills.

2002-05-13T07:05:00.000-04:00

Monday Morning Postscript. I forgot to include an interesting assessment of Extreme Programming within the context of CMM level 2. If this topic interests you, you'll also want the associated PowerPoint presentation and Excel worksheet that were used in connection with the assessment. An interesting viewpoint is contained in an article by Mark C. Paulk (Software Engineering Institute's CMM guru) titled Extreme Programming from a CMM Perspective.

2002-05-13T06:45:00.000-04:00

Software Process Improvement. There are three outstanding sources of information for SPI:

The last one contains documents by categories ranging from assessments to strategies and is one of the best collections of information I've seen in a long time.

Software Configuration Management. The clearest overview of SCM that I've found is on a University of Calgary page for a software engineering class. This page also has a PowerPoint presentation on software configuration management that is excellent.

Configuration Management for Software by Stephen B. Compton and Guy Conner is the best book I've read on SCM. This wonderful book was out of print, but a quick check on Amazon shows that it is once again available. If you get one book on SCM this is the one I recommend.

Another source of SCM information, along with software engineering processes by CMM key process area is the Systems Engineering Process Office maintained by the Space and Naval Warfare Systems Center, San Diego. Their document collection is mostly in MS Word and PowerPoint formats.

An Old Friend. Linda and I have a document that we frequently cite. It's titled Life Cycle Quality Gates and provides key metrics for every phase of the development life cycle, with attention paid to production (a phase that is too often ignored). Another of our old standbys, titled Configuration Management - The Big Picture, is a quick reference guide for configuration, change and release management. We've included both the technical and business value of each facet of configuration, change and release management, which is a starting point analyzing the ROI that will result from establishing and managing these critical processes.

Project Management. I've written three fairly comprehensive articles in the 9, 10 and 12 May entries in Postcards from the Revolution. If PM is a topic of interest you should read the articles.

2002-05-12T13:32:00.000-04:00

Small World. This entry is dedicated to a good friend, Julia Jamal, who is a consultant at iPerintis in Malaysia. What makes this world so small is the fact that I met Julia via e-mail when she commented on one of my Amazon book reviews. That in itself is not uncommon, even though she lives half way around the world from me. What we did discover through a chance encounter is that while we are separated by distance and culture, we have many things in common: we're in the same business (IT consulting), we're both Muslim and I speak a language (Tagalog, the national language of the Philippines) that is derived from Malay.

Julia's current research interests center around M-Commerce, so this collection of links and documents is dedicated to her:

From IBM, a large collection of articles and papers about wireless technologies, and a related collection of papers about security. While many of the security papers are generic, some are specific to wireless and M-Commerce.
Internet World's M-Commerce Portal.
VoiceXML Review.
A collection of papers (mostly in PDF format): On Designing M-Commerce Applications, Why M-Commerce Requires Robust Middleware, Next Generation of Communications Technology (M-Commerce architecture overview), Consistent M-Commerce Security on Top of GSM-based Data Protocols.
Proceedings from Mobile Summit 2001 (sponsored by IST)
Building Trust in Secure M-Commerce (MS Word format.
V-Commerce Application Design (PDF format)
Singapore Testing Mobile Location Services.
Mobile Commerce World.
M-Commerce Revolution (PDF format).
Direct Payment Systems for M-Commerce.
M-Commerce Readiness Checklist (online version), also in MS Word format.
Wireless Web Magazine.
Miscellaneous M-Commerce Articles and papers.
Sun's end-to-end M-Commerce solutions based on Sun ONE.

There are also books on the subject that I either have read and reviewed or have been highly recommended by colleagues:

The Mobile Internet: How Japan Dialled up and the West Disconnected (see Linda's 17 December 2001 and my 4 April 2002 reviews).
Mobile Commerce: Opportunities, Applications, and Technologies of Wireless Business
M Commerce: Technologies, Services, and Business Models
Managing Internet-Driven Change in International Telecommunications (also see the author's personal page, which contains numerous articles).
The Wireless Application Protocol: Writing Applications for the Mobile Internet
GPRS and 3G Wireless Applications: Professional Developer's Guide (see my 16 September 2001 review on Amazon)

In addition to the above, Sridhar Iyer's personal page contains an impressive collection of resources, including two excellent PowerPoint presentations:

Wireless Application Protocol. The 100 slides in this presentation cover WAP in great detail. Regardless of whether you're designing, developing or managing WAP applications you should grab this presentation and study it.
M-Commerce: Mobile Applications. All you need to know that's important is contained in this 36-slide presentation.

I'll be posting more focused entries about M-Commerce in future entries. This collection will provide ample background material across a wide spectrum of technical and business factors.

2002-05-12T00:12:00.000-04:00

Architects and developers will gain a wealth of knowledge from a new book titled The Power of Events: An Introduction to Complex Event Processing in Distributed Enterprise Systems. The short description is: adds a structure, formal approach to system and business events. This book applies structured engineering methods to systems and software engineering, making it a unique and much needed addition to the body of knowledge. Prior to this book event processing was in the domain of embedded and realtime systems developers and hardware designers. This book shows how to effectively use these techniques in IT.

The first two chapters give reasons why complex event processing (CEP)is essential to the distributed systems that characterize supply chain, e-commerce and internet-enabled applications. They also sort out the key issues and present a paradigm for a global event cloud that is decomposed in subsequent chapters. Instead of providing an in-depth analysis of each chapter, which would make for a lengthly and boring review I'll give the highlights of what I liked:

Architecture is an important theme throughout the book. In particular the Rapide architecture description language adds formality and structure. The key elements of Rapide are causal event modeling, event patterns/pattern matching and event pattern maps and constraints.
Events, timing and causality, and their interrelationships, are thoroughly explained. These are the key to understanding the treatment of patterns, rules and constraints that follow, and for tackling the subsequent discussion of complex events and event hierarchies. This is slow reading, but the essence of the book.
Event processing networks, which are a practical use of the knowledge imparted by this book. Moreover, the two case studies showed real world application of the concepts instead of abstract theory. They reinforced all of the key points made earlier in the book.

CEP is particularly applicable to enterprise application integration projects that depend on business events and network and systems management instrumentation (especially developers who write Tivoli software adapters, develop network monitoring solutions or similar endeavors).

2002-05-10T16:18:00.000-04:00

Capstone. It's only fitting to put a capstone on my previous entries about architecture. I have a few loose ends in the form of documents and links that complete the picture of what constitutes architecture, and a tie-in to component-based software engineering, which is a close cousin.

The quick and dirty list:

SEI essays on software architecture.
ISO TC 184 SC 5 WG1 Page on international standards regarding enterprise modeling and architecture.
Documenting Software Architectures: Organization of Documentation Package, also available in PDF format. This document is the basis for a forthcoming book to be published by Addison Wesley on 5 July 2002 titled Documenting Software Architectures: Views and Beyond. The authors of the paper are the same authors of the book.
Proceedings from Component-Based Software Engineering Workshop.
Packaging Predictable Assembly with Prediction-Enabled Component Technology and the related document, Predictable Assembly from Certifiable Components.

Also related are two documents from IBM: Business Rules for Electronic Commerce and Multi-Dimensional Separation of Concerns Using Hyperspaces (see also: previous entries about separation of concerns).

2002-05-09T06:31:00.000-04:00

Architectures Redeux. I've been discussing architecture within the context of web services, which is but one facet of the topic. First, I want to get a pet peeve out of the way: architect is a noun, not a verb. You can be a software architect, but you don't architect software. This atrocious misuse of the English language was introduced by Steve Jobs many years ago, and has unfortunately become a permanent part of the IT lexicon.

What is the essence of architecture? One of the best descriptions of software architecture is provided by Bredemeyer Consulting's Software Architecture Page. Despite the use of the dreaded word, architecting, the definitions provided capture the essence. My personal view is to consider architecture in its traditional form, which is the development of a high level design - the big picture. That is what those folks who design buildings for a living do. However, there are some marked differences between the original architects and software architects, which can be summarized in these three comparisons:

Those who design buildings are have stringent education requirements and are licensed. There are legal definitions as to who can proclaim themself to be an architect. In software anyone can claim that he or she is an architect - and they frequently do just that. No credentials other than a proclamation and, perhaps, some references that will support the claim that they actually functioned as a software architect.
Architects who design buildings are held to legal and engineering standards to which their designs must comply. Software architects can do pretty much anything they can get away with without legal or professional oversight.
Building architects blend design with engineering constraints. They use both creativity and a good deal of science and math. Software architects may or may not employ either - and they are not compelled to do so in order to claim to be an architect.

However, my objective is not to bemoan the misuse of English or the sorry state of software architecture, but to provide reference material that I hope will be used to get one thinking about the essence of software architecture and advance our profession through knowledge sharing. The resources that I am providing portray many different ways to approach architecture, and some are better than others. Moreover, some of the resources conflict with one another, but what they have in common is the fact that the approach is based on methodology and quantification. Each provides an opportunity to learn.

Resources that I recommend include:

Introduction to Software Architecture
Software Architecture: A Roadmap
Discipline of Software Architecture
Architecture Blueprint: the 4+1 model
Software Architecture: Foundation of a Software Component Marketplace
Object-Oriented Software Architecture A Practitioner's Approach
USC's Software Architecture Page
UCI's Software Architecture Research Page (also see their ArchStudio 3 architecture development tool page).
Software Architecture Resource Sites
The Three "R's" of Mature System Development: Reuse, Reengineering, and Architecture
A Two-phase Process for Software Architecture Improvement
Don't Let Architecture Astronauts Scare You, an interesting and opinionated essay by Joel Spolsky

Architectures also define the building materials and techniques needed to execute the design developed by the architect. This is true regardless of whether the architect is a licensed professional or a software architect. Both the building and the software architect need to understand the characteristics of the materials and techniques. To that end I am including miscellaneous references to materials and techniques that a software architect will find interesting:

Java resources related to architecture
Redundant Arrays of Independent Components(RAIC)
xADL 2.0 Architecture Description Language
xArch XML Representation of Architecture
A Formal Architecture-Based Approach to Software Integration Testing

My next entry will depart from the architecture theme, and will focus on M-Commerce and related topics.

2002-05-09T04:00:00.000-04:00

No Surprises Here. According to an 8 May eWeek article titled Error in MS Protocol Could Compromise Security, "Microsoft Corp. has already identified at least one protocol and two APIs that it plans to withhold from public disclosure under a security exemption in the federal antitrust settlement proposal agreed to in November, according to Jim Allchin, Microsoft's group vice president for Platforms, who testified in the antitrust case in court Tuesday."

Plans to withold from public disclosure? Yeah, and we need to destroy this villiage in order to save it, right?

2002-05-08T21:56:00.000-04:00

Availability. Linda and I are now available for consulting assignments, either as a team or individually. Marcia Hopkins will be available in early June. A summary of our experience and qualifications is available on the TEAM Zarate-Tarrani page.

2002-05-08T15:07:00.000-04:00

Dimming Light. Kate Hartshorn has taken an indefinite leave of absence from contributing her insights and thoughts here. Her time and efforts have been redirected towards a difficult, but surmountable, challenge. Until her return this weblog and its Postcards from the Revolution sister will be bereft of rare points of view and a touch of humor and class that is missing from most technical resources. When she does return it will be on a permanent basis.

Shedding Light. What are web services, and why is there so much debate about a definition? I subscribe to a large number of news services and this question arises, debate ensues, issues become murky and the process repeats itself. I go with the definition that is set forth in the W3C Web Services Architecture Requirements that states:

A Web service is a software application identified by a URI, whose interfaces and binding are capable of being defined, described and discovered by XML artifacts and supports direct interactions with other software applications using XML based messages via internet-based protocols.

That wasn't too difficult. We have a definition that is sanctioned by an internationally respected body, and until a better definition comes along why not go with it? It certainly cuts through the hype spewing forth from Microsoft, Sun and the industry experts.

If you're interested in web services architecture the following resources are essential reading:

W3C Web Services Architecture Working Group. Yes, the W3C is a politically-charged organization, but they are respected and set standards to which the squabbling factions (a.k.a., Oracle, Microsoft, Sun, etc.) pay close attention. Ignore their standards and what is happening within their working groups at your peril. It's also interesting to note that the W3C cites the Architecture Trade-off Analysis (ATAM) approach supported by the Software Engineering Institute as an influence. I have a few papers on ATAM in the December 2000 issue of my old Information Technology Newsletter. If you want solid information about ATAM and related approaches read Evaluating Software Architectures: Methods and Case Studies, which I reviewed on Amazon.
IBM is another reliable source of information. I have long admired their objectivity, which I've witnessed firsthand in numerous consulting engagements where they have played a role (they have no problem recommending products that compete with what IBM sells, and will not hesitate to provide professional support for those products as well). In the web services domain they publish some of the best information that is available from a commercial vendor. One such document is Web Services Architecture Overview, which is entirely consistent with the W3C views cited above. I also like their PDF document titled Web Services Conceptual Architecture, which is packed with information and describes architecture in both abstract and practical terms. Introduction to Web Services Architecture is a more generic paper published by IBM, and is well illustrated (a picture is worth a thousand words in this case). Web Services and UDDI look beneath the architecture at some of the moving parts, and related whitepapers complete the picture.
Web Services Architectures: How they stack up, also available as a PDF document, is an interesting comparison of different approaches to web services architectures.
Yet another source of information (and viewpoint) is the O'Reilly Web Services FAQs, which address the technical underpinnings more than the architecture. Their book titled Web Services Essentials, and another book (published by Addison Wesley) titled XML, Web Services, and the Data Revolution are worth reading.
Architecting Web Services by William L. Oellermann Jr. is a still valid early work that attempts to do the right thing: define an architecture that is traceable to business requirements. Although this book goes into technical details, it remains at a high enough level of abstraction to be a book about architecture. I especially like the book's web site, which provides a test environment that allows you to test your web services, and other resources. While this book is not strictly about architecture, it comes the closest to addressing web services architecture in the real world than any other I've read (or read about).
Doug Kaye's Web Services Strategies weblog, which contains news, opinions and trends.

I've by no means exhausted my thoughts on this topic, and you can be sure that it will resurface again in the near future.

Bright Light. When Kate does return I promise that I'll make sure she stays around, and her place will never be filled until that time.

2002-05-07T03:30:00.000-04:00

Correction. In my last entry I left out one of the true Oracle gems off the beaten path on the web: Thomas B. Cox's home page. This little known page contains some of the most impressive whitepapers I've found, including a DBA capability maturity model, DBA checklist and Oracle security information that you won't find elsewhere.

XML Update. One of the themes I've started this month has been web services, with a focus on some of the common building blocks such as VoiceXML, and specifications such as the Web Services Flow Language. I'm going to provide a few updated links on ebXML, which is in a constant state of change and is emerging as an important standard.

Technical specifications, white papers and reference materials are available at ebXML.org's specification page. This is a primary source of up-to-date information, work in progress documents and deliverables related to ebXML. If you're unclear about what ebXML is and why you should be paying attention to it, the site's FAQ will answer any basic question and provide the business and technical reasons for ebXML.

Another source of information is Sun's online whitepaper titled Overview of ebXML Specifications. This paper sorts our the specifications and their relationships to one another.

2002-05-06T11:19:00.000-04:00

Off the Beaten Path in Search of an Oracle. Actually, I am not seeking a source of wisdom - I'm updating my primary Oracle links and want to share the lesser known ones and some of my frequently visited favorites:

Los Angeles Oracle User Group has always been a great source of information, especially since I live nearby. Their site has an extensive library of presentations from past meetings and other useful info.
Ari Kaplan's page is one of those content-rick pages off the beaten path. Highlights are the extensive collection of Oracle tips and an equally extensive collection of links. In addition, he has six informative PowerPoint presentations that you'll want to download:
Steve Rea has an impressive collection of tips and scripts
Oracle Power is a portal dedicated to Oracle, and contains an impressive amount of information and content.
DBA Support is another Oracle-oriented portal that is worth bookmarking.

Oracle Base

If you're looking for free Oracle and UNIX scripts and/or free and inexpensive tools, you'll like Oriole Corporation.
DB Domain has a large listing of Oracle freeware and shareware utilities that are worth checking.
If you're learning Oracle, do bookmark Teach Yourself Oracle 8 in 21 Days. This is the online version of the popular paper book of the same title.
Two commercial sites that sell innovative and/or inexpensive utilities that DBAs will love are:
1. Expand Beyond which sells DBA and admin tools that run on PDAs (both WIN CE and PalmOS), that allow DBAs to reach their instances over wireless connections. This is an excellent approach for Tier 2 and 3 DBAs, and the ROI can be significant for mission-critical databases.
2. Benthic Software, which sells some of the best, cost-effective tools I've used. When I was roped into DBA chores a few years ago I purchased the full suite of tools, most of them in the USD 20.00-35.00 range. If you write SQL queries I highly recommend Golden, and if you write a lot of PL/SQL scripts you'll find the $35.00 USD cost of PLEdit to be a bargain.

2002-05-06T00:45:00.000-04:00

More on Web Services. Two documents that neatly tie up my last entry on web services flow language are Web Services Architecture Directions and Web Services Flow Language Specification 1.0. Both files are in PowerPoint format.

Loose Ends. A few other documents and presentations tie any loose ends left from last week's entries. My descriptions are terse, but each is interesting and worth downloading and reading:

Software Engineering Processes at Start-Ups (interesting presentation to say the least!)
System Success Models
High Dependability Computing in a Competitive Environment

Enjoy, and have a wonderful workweek.

2002-05-04T21:52:00.000-04:00

Eric Knorr's 30 April article in ZDNet Tech Update titled Web Services Meet Process Management made me think about the many different directions we are going. Yes, we need to integrate process design and management into the architecture of systems we're designing and building. However, is yet another process notation or methodology needed? Given the activity surrounding Web Services Flow Language (WSFL) my question is moot. Personally, the best approach I've seen so far is that proposed by Nick V. Flor in Web Business Engineering. Bemoaning the fact that this well thought out approach is being ignored accomplishes nothing. I can console myself that at least the importance of process as a foundation is recognized and standards are being developed. I've collected a number of articles and documents about Web Services Flow Language and encourage anyone who is involved in the design and development of web-based systems to become familiar with them:

A good starting point is Web Services Flow Language (WSFL) by Robin Cover
IBM's five part series on web services: Part 1, Part 2, Part 3, Part 4 and Part 5 cover WSFL and related aspects and is essential reading. In fact I consider IBM to be leading the way in web services, posturing and hype from other factions aside, and invite your attention to the wealth of articles and journal articles they have published on the subject.
ebPML.org, which is an organization dedicated to architectures and technologies of business process management systems. This site has an excellent description of WSFL, among other related resources.
The archive of documents provided by Web Services Architect, and especially the article titled Business Process Standards for Web Services: The candidates.

2002-05-04T11:39:00.000-04:00

If you're developing a business case for e-commerce, or are exploring the business and technical impacts of implementing a major initiative I strongly recommend reading Handbook of E-Business.This is an expensive book that will be a sound investment for the right audience and a disappointment to others. The right audience consists of high-level management in business process domains, IT executive management, marketing and strategic planners.

I'll start with what this book is not, which will help you determine if it's right for you. It is NOT:

a technical book, although technology is discussed, compared and contrasted within the context of e-commerce
a methodology, however the information provided is a straightforward examination of business issues and how e-commerce processes and associated technology can be leveraged for competitive advantage
highly detailed, although there is sufficient information with which to develop business strategies around e-commerce

What this book does provide is a high-level, succinct discussion of the major issues and factors that will be of interest to its target audience as I've defined it above. Although Jessica Keyes is credited as the author she is really the editor who has pulled together articles from experts and those in the trenches and one of then more frequent contributors. Ms. Keye's selection of content and her skills as an editor are showcased in this book, which consists of 6 sections (A through F), that address specific aspects of e-business as follows:

Section A: Introduction. Although one would think that all businesses have thought this through, most are still reacting to the phenomena of the web and its possibilities, with no realistic idea about the opportunities and pitfalls that are inherent. Highlights that I like are: selling and value propositions from a business perspective, learning from mistakes, partnering and alliances, implementation strategies, personalization, and a strategic framework for e-commerce.
Section B: E-Commerce. This section covers customer retention, e-commerce testing, driving revenue and customer satisfaction, e-merchandising, and strategic models.
Section C: E-Business. How to recast your thinking from bricks and mortar to e-business. Highlights include: integrated B2B, selling hard goods and info to businesses (business models and product development life cycles), ASPs, transforming your business into e-business-best practices, budgeting & reporting.
Section D: Financials. This is the most business-focused section, and one that is in line with Ms. Keye's extensive background in business and financial analysis. It includes: valuing an internet business, financial model for CFOs, e-procurement, taxation, e-service, infrastructure investment decisions, finance dept role in e-biz development, developing e-business plan, raising money for internet venture, web revenue models, measures for e-business, outsourcing and initial costs to build e-business, procurement savings.
Section E: Social Aspects, including legal issues, advertising, trust management, and e-culture and change.
Section F: Technology. This collection of articles is a high-level overview that is aimed at upper management and decision makers to reveal the technical issues. Included are: content as cornerstone, testing, underlying technology, security and the impact of e-business on IT organizations.

Each chapter is an easy read and is packed with only the essentials. In fact, I marveled at the way the information is condensed and presented because most chapters were less than 10 pages, yet captured everything a decision maker needs to know. In many respects this book is similar to a highly focused collection of Gartner or Meta Group reports, and therein lies the value - busy executives can quickly get the information they need to make strategic and tactical decisions without getting bogged down in unnecessary details.

2002-05-03T17:05:00.000-04:00

Last week I briefly discussed reliability and quality in a few entries. Both of these topics are heavily grounded in probability and statistics, as are most of of the activities in which IT professionals engage. I use three basic tools, depending on the type of work I'm doing: Excel for business and simple computational problems and analysis, MathCAD for more complex work, such as queuing and linear programming/optimization, and risk analysis, and STATVIEW for heavy statistics.

Each tool has its place. If you're using Excel and want to learn how to tap into its power I recommend Management Decision Making: Spreadsheet Modeling, Analysis, and Applications . This college-level text is also useful to business and IT professionals because it provides a refresher for decision techniques that are the foundation of a number of disciplines. The book is divided into two parts:

Deterministic methods, mainly focused on linear programming and optimization
Probability and queuing.

What makes this book valuable to the practicing professional is that it uses one of the most common business tools, Microsoft Excel, and shows how to apply this tool to real world problems. The accompanying CD ROM comes with TreePlan for developing decision trees and CrystalBall for Monte Carlo simulation, as well as workbooks that are used to support the plethora of realistic examples used throughout the book.

Although the book is business-oriented and better suited for operations analysis and MBA students and practitioners, I've used it as a reference for project planning, computer system capacity planning and performance analysis, and IT security risk management - these practical uses of the material show the value of the book in the real world. The supporting web site that the author maintains has materials for lesson plans, errata and additional resources that make this book particularly valuable for the academic and business environments.

For more intense computations the best tool is MAthCAD 2001 Professional. This progam is valuable because there are limitations to spreadsheets for performing advanced statistics, differential equations and graphing. Yes, if you're clever with common spreadsheet applications, such as Excel, you can work wonders. However it's time consuming, clumsy after a certain point, and often requires third-party add-ins. MathCAD, on the other hand, allows you to perform complex operations with a simple drag and drop from its extensive library of built n operators and functions.

I use it for computer systems capacity planning and performance analysis, general statistical analysis and probability in project planning and control. In that respect I haven't begun to tap into the power of this program because, especially calculus and matrix operations. However, what I do use it for gives me an idea of the time savings that results from building equations by dragging the symbols onto the screen, adding the variables and seeing the results immediately. The graphing function is as easy (and powerful). What I can do in MathCAD in less than a minute would take hours to set up in Excel, for example.

What I particularly like about MathCAD is the document management capabilities that are built in, the fact that it seamlessly integrates with Microsoft Office applications (you can drag your equations and graphs into a Word document, for example, with the same ease as an Excel table or graphic), and ability to save your documents as HTML.

Another strong point about MathCAD is the large collection of files and electronic books that are freely available from the publisher's website. They serve as a clearinghouse and solution sharing point for MathCAD users and the solutions that are available cover every business, scientific and technical discipline. An example that is in my technical area of expertise is the Closed queuing network analysis solution that came in handy when I was analyzing batch processing optimization.

If you work with equations and have reached the limits of your spreadsheet application you may find MathCAD to be a great value. You'll certainly become more efficient and productive with it. You'll also find that the learning curve is relatively flat because the user interface is similar to Microsoft's Office family of products. You'll probably wonder how you got along without the ability to build equations with drag and drop shortly after you begin using it. Technical support is responsive, the documentation is clear and complete, and the publisher's web site provides a wealth of add-ons and other tools.

When it comes to probability and statistics one of the best programs is Statview 5.0, which is one of the more popular statistical programs used in business and scientific applications. Amazon sells a student version, and the only difference between it and the professional version is the licensing. The student version has all of the features and capabilities, but you are restricted by legal terms and conditions of the license from using it outside of the academic environment. This is also an ethical issue.

What it contains: a comprehensive suite of descriptive statistical, statistical process control capabilities, regression, analysis of variance, factor analysis and non-parametric test functions are built in. The power and ease of use comes from the innovative user interface, data management and reporting features. In particular, the user interface stands out as my favorite feature because of its simplicity and power. It contains two types of windows, dataset and view, which accounts for its simplicity, and interactive browsers that allow you to access and data and apply analytical functions that account for the power. The dataset window is similar to a spreadsheet, and the plethora of functions allow you to perform any common (and many less common) analyses. You can also analyze more than one dataset in a single analysis, and you can save the work as a template to save time for similar analyses. Results can either be displayed in tabular or graphical format at literally a click of your mouse. The preview feature allows you play 'what if' in the same manner as spreadsheets, by changing data or parameters, seeing the changes. Page layout is powerful and flexible, which is something one expects from a professional tool.

If you are a student and qualify for the license terms and conditions STATVIEW is a bargain and a time saver. In addition to getting a tool that will make short work of statistical analyses regardless of whether you're majoring in social sciences, business or technology, you'll be learning the same software that you'll probably use after graduation because SAS Institute, the publisher, is one of the most respected names in statistical software.

If you are not a student and want a more focused statistical program I recommend JMP Statistical Discovery 4.0. Unlike STATVIEW, which is for general statistical analysis for a number of business and technical disciplines, this application is focused on operations analysis, statistical process control and design of experiments.

What makes this an industrial-strength tool is the fact that it works with mainstream applications, such as Microsoft Excel (open tables can directly access Excel files), and with any database that can be accessed via ODBC (MS Access, Oracle, SQL Server, etc.). Further ease of use is provided by the column browser that combines a familiar spreadsheet view with powerful navigation capabilities. Additional flexibility is given by extensive reporting features (easy layout, save as HTML for web publishing, and editing data while in the report function). If you want to automate repetitive tasks JMP also includes a scripting language that is reasonably easy to learn and is integrated with the formula editor.

One of the more powerful functions is design of experiments, which sets this application apart from general statistics programs - if you use DOE or Taguchi methods then you have ample justification for investing in JMP because you're be significantly more productive.

In addition to DOE/Taguchi methods JMP does descriptive statistics (eliminating the need for a separate statistics program), linear models, correlations and multivariate computations, statistical process control charts, and time series analysis. These capabilities make it ideal for anyone involved with quality assurance, R&D, operations analysis and reliability modeling. This is a professional tool that will save more time than more general packages such as the company's other product, STATVIEW, or applications such as MathCAD.

2002-05-02T09:04:00.000-04:00

VoiceXML is a topic that I am currently researching in support of developing a business strategy for Unmesh Laddha's company Thinking Minds, Inc. and our team's resources for end-to-end support for VoiceXML systems. Among the best resources I've found are:

Additional resources of interest include IBM's AlphaWorks VoiceXML resources (IBM is one of the major contributors to W3C's VoiceXML specification), Websphere's Voice Server page and World of VoiceXML, which is a personal page maintained by Ken Rehor.

One of the most highly regarded books on the subject is VoiceXML: Professional Developer's Guide with CDROM by Chetan Sharma and Jeff Kunins. This book has received consistent praise and is up-to-date (it uses the VoiceXML 2.0 specification as reference).

2002-05-01T20:46:00.000-04:00

Loose Ends. A new month is here and that means new themes, unplanned entries that reflect whatever we are individually and/or collectively doing, and the occasional rants about pet peeves. I want to share a few files that I've accumulated, but didn't have an opportunity to work into an entry during April. Sans rhyme or reason, here are the ones that didn't fit but I found interesting:

2002-04-30T17:04:00.000-04:00

The Role of Business Case Analysis in Software Engineering is an excellent 81-slide PowerPoint presentation on an important topic. The presentation's author, Donald J. Reifer, wrote Making the Software Business Case, which Linda reviewed on Amazon on 22 September 2001.

In my 21 April entry I wrote about a book titled Requirements by Collaboration: Workshops for Defining Needs. This book synthesizes three approaches to collaboration, including joint application development (JAD). The PowerPoint presentation on JAD shows how one collaborative approach works. I've also have a collection of documents that support collaborative workshops. Collaborative requirements, like business case analysis, are keys to bridging the gap that exists between the technology focus of IT and the bottom line focus of the business. That gap needs to be bridged.

2002-04-29T17:16:00.000-04:00

Arc of Quality is an interesting paper on measuring the effectiveness of the testing process. If you're involved in testing this paper offers a sane, cost-effective approach to assuring quality.

Although unit testing is a developer activity it's important because it's the foundation of software assurance and integrity. The three MS Word documents in the Zip archive containing unit test artifacts provide unit testing guidelines, a developer checklist and unit test plan.

Rounding out the test theme of this entry is a PowerPoint presentation on security testing fundamentals.

2002-04-28T15:16:00.000-04:00

In my 23 April entry I waxed enthusiastic about A Practical Guide to Feature-Driven Development. I have a few additional documents that support the book's approach and FDD in general:

Feature-Driven Development Overview
Feature-Driven Development Presentation (PowerPoint format)

On a different topic I read an interesting paper by Ed Bryce titled Failure is Not an Option. It discusses the costs associated with maintaining 24x7 systems, and the costs of those systems failing. This paper is closely aligned to Linda's Recovery Management whitepaper that she discussed in her 26 April entry.

2002-04-27T14:01:00.000-04:00

More on Oracle: I just discovered a cache of Oracle presentations that cover the full spectrum of Oracle-specific and general database knowledge domains. Enjoy.

2002-04-26T17:39:00.000-04:00

I am stil in the midst of my Oracle Certified Professional training, and the topic of the week has been back-up and recovery. While the Oracle-specific information is new to me, the process isn't. I wrote a recovery management whitepaper over a year ago, and much of the material remains valid. There are two recent articles that wish were available when I was writing the whitepaper. They are certainly useful as references in my current class:

2002-04-25T10:23:00.000-04:00

Brave New World? I just discovered a growing movement that centers on digital presence. What is it? According to a Primer on Digital Presence by Sean Gallagher it's defined as:

[T]he digital existence of a user—that is, a person, device or application—on a network. Being present ranges from simply being registered to actively participating with others.

It's being legitimized by the Internet Engineering Task Force in the form of an Instant Messaging and Presence Protocol work group charter, an independent, nonprofit consortium called the Presence and Availability Management (PAM) Forum, and a growing body of work. More information about the PAM forum can be found in PAM Forum Overview, and additional documents from various sources, including:

This is not some obscure movement - at stake is our privacy and this movement may add some sanity to the Liberty/Passport services that are emerging as both competing web services and potential intrusions on privacy.

2002-04-25T07:26:00.000-04:00

Planning Smarter: Creating Blueprint Quality Software Specifications is a new book that fills that unique niche between the dozens (or more) books on requirements, and the thousands of books about development.

Read this book with an open mind because it is going to expose specification and planning shortcomings in the major methodologies, such as the Microsoft Solutions Framework, Unified Process, Unified Modeling Language. In fact the author states in the preface that he does not expect readers to agree with everything in this book.

What I like about this book is that it's independent of methodologies and development environments. More importantly, it's not another methodology, but a short, focused book that will teach you how to make your existing methodology workable. It's also focused on the planning process and does not stray from it. Among my favorite parts are:

Pathology of bad plans and how to recognize them.
A best practices comparison of the CMM, Microsoft Solution Framework, UML and Rational Unified Process. Note that I disagree (as predicted by the author in his preface) that the CMM belongs in the discussion since it's not a methodology but an indicator of process maturity based on key practices.
The emphasis on communications during the planning process. This is a common failure point and the fact that an entire chapter is devoted makes this book all the more valuable.

The book is engaging because the author has an active writing style and uses anecdotes from real life to reinforce points. It's also filled with common sense (something that appears to be uncommon during the planning phases of many of the hundreds of projects in which I've been involved). If you take the time to carefully read through this book you'll come away with some solid principles that support effective planning, and a process-oriented approach that will fit within any methodology. Do not expect to find procedures for performing quantitative planning activities - those can be found in most books on project management. Do expect, however, to learn how to approach the planning process the right way. I think every software project manager, requirements analyst and specification developer sho/wwwread this book before taking on their next project or assignment.

2002-04-24T03:57:00.000-04:00

Back to Reliability. Software quality and reliability are two topics that I discuss frequently. I have a collection of new articles on these important subjects for those of you who are actively involved with reliability and/or quality:

Holistic Engineering for Software Reliability (46 pages)
Software Reliability Growth Model (10 pages)
Software Reliability
Module Size Distribution and Defect Density

In addition, you may find IEEE Standard 1220-1998, Application and Management of Systems Engineering Process, useful because it adds process to the techniques in the above papers.

2002-04-23T09:49:00.000-04:00

A new book titled A Practical Guide to Feature-Driven Development proposes a method that I think is on the right track.

What is proposed and described in this book is elegant in that it combines simplicity and power, and effective because it will deliver applications that support business requirements.

Although the approach is based on object-oriented development, and the book is focused on that approach, it can be refactored into function- and procedure-oriented programming environments. Moreover, while the book is written to fit within agile methods, it be fit to any development life cycle approach. This is because the focus is on features, which translate into what the business needs from an application. This is where elegance and simplicity comes in. By focusing on the features needed applications are less apt to be gold-plated with unnecessary features that developers may think is nice, but add little business value. In this respect the time to deliver is shortened and what is delivered is going to reflect genuine business requirements.

The power of FDD comes from the highly structured approach based on the ETVX (entry-task-validation-exit) framework. Entry criteria is typical: requirements, authority to proceed and other quality gates that must be passed before a development project is initiated. The tasks follow a five-step process as follows:

Develop the model, including scope, validation in the form of walkthroughs, and peer reviews. The approach described in the book assumes an object model, but in a non-OO setting this can be realigned to first cut system diagramming in the form of block- and data flow-diagrams,and first-cut design.
Build the features list. The OO approach is domain partitioning based on the model; in a non-OO setting this is where the team maps functional requirements to features.
Plan by feature. This step, in my opinion, shows FDD to be a legitimate software engineering method. Feature prioritization, dependency analysis and effort estimation occur here. Done properly this step will make the difference between success or failure. I do have one issue with the book at this point: the prioritization is done by the technical team - it should be done with the business stakeholders.
Design by feature. This is an iterative step that feeds back into step 1 (build the model) wherein class ownership is determined and the original model is refined based on the design approach. In non-OO environments this would loop back into the first-cut design and trigger trade-off analysis and design refinement.
Build by feature. This is where the application is actually developed on a feature-by-feature basis within the context of the defined architecture (model).

Verification is accomplished using traditional methods. The authors introduce what they call feature-based testing which is no different than product test (also called functional qualification testing, and in some circles, acceptance testing). Verification procedures are thoroughly covered in the book, further adding to the software engineering approach that is incorporated into FDD. Exit criteria is when the sponsors accept the system.

What makes this book important is that is gives a straightforward approach that is based on deliverables (features) within a process context (ETVX). This approach is consistent with best practices in software project management and has the additional benefit of assuring that what gets designed and built is what the customer needs. Bolt FDD onto your favorite methodology and you'll probably see quality increase, and costs and time to deliver decrease.

See the collection of Feature-Driven Development articles for more detail.

2002-04-23T00:47:00.000-04:00

In Linda's 20 April entry she discussed John Dvorak's encounter with Windows XP in his article titled The Good, The Bad and Microsoft. There is a follow-on to that article dated 22 April titled The Good, the Bad, and Microsoft, Part Two. If you're thinking of moving to Microsoft's XP you may want to take the time to read these articles.

2002-04-21T23:50:00.000-04:00

If you frequently read this page or its sister, Postcards from the Revolution, you'll quickly discover that we are strong proponents of requirement management. Get the requirements wrong and your project will either fail or, at best, exceed your budget. There are a number of methods for eliciting, documenting and managing requirements, but the best ones involve workshops where the major stakeholders are involved. There are three methods that amploy workshops and stakeholder involvement:

Participatory Design (PD)
Rapid Development (RD), sometimes called rapid application development (RAD)
Joint Application Development (JAD)

I recently read a groundbreaking book titled Requirements by Collaboration that synthesizes the best of PD, RD and JAD. To this synthesis it adds modern elements such as business rules.

To understand why this book is a ground breaking work a little history is in order:

Participatory design (PD) began in England by Enid Mumford and was refined in Scandinavia by Pelle Ehn and Morten Kyng in the late 1970s.
RD (Rapid Development) was first formalized by DuPont in mid 1980s and was then known as Rapid Iterative Production Prototyping (RIPP).
JAD was first developed by Toby Crawford and Chuck Morris at IBM in 1977.

Each of these approaches have one thing in common: participatory requirements elicitation accomplished in a workshop setting.

Most of the previous documents about these approaches focused on general aspects of workshop management and requirements. Although this book certainly addresses these two aspects, it goes beyond.

This book is structured in three parts and 12 chapters. Part I covers the basics of constructing a workshop and provides a comprehensive list of deliverables. The author's web site that supports this book provides checklists and templates in Word and PDF format, which will save you time. The web site also has links to other resources that will prove extremely useful. Part II provides the workshop framework, covering logistics, managing roles and ground rules and the workshop process itself. Part III addresses the strategies for conducting the workshop. What I particularly like about this book are:

It defines a process with inputs, tasks and defined outputs (deliverables).
Adds structure by aligning business problems to model views, and by defining the deliverables that need to be produced to develop the model. The models views are: behavior, structural, dynamic and control. These cover the four basic business problem domains.
Does not lock you into any single model (you can use multiple model types), and provides criteria for selecting the best model(s) to employ for capturing requirements.
Introduces business rules, which is (in my opinion) one of the most powerful and effective means of capturing requirements.

The approach set forth is effective and thoroughly modernizes the approaches that were synthesized. More importantly it provides a structure in which to conduct participatory workshops, and clearly defines the types of goals you should be setting based on the business problem, and clear definitions of the deliverables that the workshop should produce. This book goes into my short list of best books read in 2002, and I suspect it will remain on my short list of recommended books for years to come.

2002-04-20T17:09:00.000-04:00

After more than my fair share of challenges that I faced when I upgraded one of my systems from Windows 98 to Windows 2000 (which I needed in order to run Oracle), I thought I was plagued by bad luck. One of the dumbest problems I encountered was the fact that Microsoft's Windows 2000 would not recognize my Microsoft keyboard. But I digress. In his 15 April column in PC Magazine titled The Good, The Bad and Microsoft, John Dvorak recites the problems he had when he installed Windows XP. I am usually neutral about operating systems, but I'm beginning to develop a genuine mistrust of Microsoft.

2002-04-19T03:15:00.000-04:00

SureTrak is a Sure Thing. In my 16 April entry in Postcards from the Revolution I briefly described the strengths of my favorite project management application, SureTrak Project Manager 3.0. In my opinion it's the best single-user PM software bar none.

SureTrak was designed with features that practicing project managers need, not glitzy fluff. Among its features are:

Multiple calendars - you can have up to 31 base calanders per project, giving you absolute control that is not possible with other PM applications in this price range. This feature allows you to model different resource baselines, which is powerful. Also, unlike MS Project, SureTrak does not assume it knows better than you and change the project in strange and mysterious ways after you've made an adjustment. This alone makes SureTrak worth using.
Earned Value project management is built in and works correctly. If you're a PMP you'll not only appreciate the solid implementation of earned value, but should also know that the earned value portions of the PMBOK were developed by members of the Primavera team--Quentin Fleming and Joel Koppelman--who also authored Earned Value Project Management, second edition (see my 18 March 2001 review on Amazon for details). This adds a high level of trust in the way SureTrak works.
Project resource leveling works (it's somewhat challenged in MS Project), and the ability to automatically forecast resource shortages, trace PERT logic, and use precedence diagramming method if you so choose. It also gives you the ability to jump from WBS, resource, activity or PERT views with a mouse click shows your project from any perspective. Another nice feature is the cosmic view of the PERT view that shows the entire network in one window and details in another.
The reports, profiling and analysis options are too many to list. Suffice it to say that if there is a view or report that isn't shipped with SureTrak (and I cannot think of any), you can easily create one.

Although it has serious features, it also has glitz: you can publish in HTML, add graphics to your schedule and customize bar legends. It also has team features, such as email management, the ability to manage multiple related projects simultaneously, and the ability to exchange files with MS Project via MPX files. Note that there are some losses when you exchange MPX files because SureTrak has features that Project doesn't have and they will not import correctly into MS Project.

If you make the leap from MS Project to SureTrak I strongly recommend investing in Planning Using Primavera SureTrak Project Manager Version 3.0 by Paul E. Harris, which will get you quickly started.

2002-04-18T17:23:00.000-04:00

ISO 9001:2000. Among Linda's recent topics are ISO 9001 and 900-3. There is a single sentence in the new ISO 9001:2000 requirements that's a bombshell: Customer perception, as to whether customer requirements have been met, shall be monitored. There is a book on this topic, Customer Satisfaction Measurement Simplified: A Step-by-Step Guide for ISO 9001:2000 Certification, that has as its sole purpose to provide you with ISO 9001-friendly techniques for meeting the requirements in that sentence. The author provides a clear, 7-step process for tackling that daunting task:

Identify your customers.
Identify their requirements. (Maps to ISO requirements 5.2, 7.2.1).
Determine what you're going to measure, and how.
Measure satisfaction based on step 3. (Maps to ISO requirement 8.2.1).
Analyze the data. (Maps to ISO requirement 8.4).
Report the results.
Communicate the results and employ continuous improvement methods. This complies with the change from the 1994 version in that continual improvement is now required, where it was only implied in the 1994 version.

What makes this book so valuable is that it reduces the complexities for meeting each of the requirements using the process to a series of steps in each process stage. Each chapter contains a summary of the goals, then gives step-by-step procedures needed to attain the goals, and identifies the deliverables that must be produced. This sounds simple on the surface. In reality implementing customer satisfaction requirements management, measurement and continuous improvement is a complex undertaking that not only touches virtually all parts of an enterprise, but also mandates a change in corporate culture.

Additional value in the form of worksheets and checklists covered in the appendices (and provided in electronic format on the CD ROM) make this book absolutely essential to any company that is pursuing certification (or are re certifying under the 2000 version).

Other factors that make this book invaluable include:

The author's extensive experience in customer satisfaction management is condensed into this reasonably short book
Layout of the book makes it easy to follow and find information
The straightforward manner in which necessary information is presented.

This is the only book, to the best of my knowledge, that solely focuses on this aspect of ISO 9001:2000. Fortunately, it covers all of the essentials and leads you step-by-step through the process of meeting this important set of requirements. I personally believe that it's the key to getting certified under the 2000 requirements because of the scope and magnitude of effort that is required to comply with a seemingly innocuous requirement that can be a major barrier to achieving certification.

2002-04-17T18:56:00.000-04:00

When Will They Stop? Are you using Microsoft's XP family of products? If so you should know that it may be doing things behind your back. A 12 April article titled Win-XP Search Assistant silently downloads files is yet another of the growing reports of how the tagline, Where do you want to go today? is starting to look like I'll take you where I damn well please.

Microsoft isn't the only culprit. Consider the ramifications of Data Mine—Or Yours? by Diane Savage, then read World Without Secrets that Linda discussed in her last entry. That book has an associated web page from which you can download a sample chapter and read related articles.

The only reassuring news in the past week is an Associated Press article titled Web Group OKs Privacy Standards.

2002-04-17T16:41:00.000-04:00

ISO 9001 & CRM. Mike's is preparing an entry about the ISO 9001:2000 requirement to manage and measure customer requirements. This requirement, as he will show, will make attaining (or maintaining) certification a challenge. At some point customer relationship management is going to become a hot topic. The best book on the topic that I've found is Jill Dyché's The CRM Handbook: A Business Guide to Customer Relationship Management.

This book is thorough, clear and filled with useful information. It's organized in two parts. Part 1 defines CRM in chapter 1 and in the next six chapters covers the reasons and issues for implementing CRM from five perspectives: (1) Marketing, (2) Customer Service/Call Centers, (3) Sales Force Automation, (4) E-business and (5) Data Analysis. The case studies, all based on real clients and situations, add life to the well written chapters on marketing, customer service and sales force automation. In addition each chapter contains nuggets of insight, clear discussion of the topic and numerous checklists and tables that you can use for your own projects.

Part 2 covers delivering CRM and is structured in the logical sequence of planning, tool selection and CRM project management. Like the first part of the book the four chapters in Part 2 contain case studies, checklists and excellent advice. It is in this part of the book where you'll benefit from Jill's experience because she reveals common traps and pitfalls, and gives advice on how to deal with them or bypass them altogether.

What I like about this book is that it covers the business and technical parameters, requirements and issues. Jill's writing style makes it not only readable, but engrossing as well. She goes into considerable detail about how and why CRM is important to meeting business requirements and gives business metrics, explains differences between CRM and business intelligence, and the pro's and con's of all issues and factors. Because she covers the subject from the five perspectives I listed above this book is valuable to all possible stakeholders in a CRM project. I especially liked her use of the Porter value chain and how she leads you through the development of a business case for CRM.

If you're involved in CRM, or are in a company that is implementing ISO9001:2000 (which requires that organizations have an effective method of measuring customer satisfaction to achieve ISO certification), then this book will be your most valuable source of information.

The Dark Side of CRM. It's ironic that after finishing Jill's The CRM Handbook that the next book I pick up is World Without Secrets. This book is chilling for a number of reasons, but the top ones (in my opinion) are:

As an IT professional I am involved in CRM (customer relationship management), which has a goal of knowing your customer and providing individualized service. This requires knowing your customers and collecting data. After reading this book I had to step back and think about the impact on privacy and customer rights. This is a Catch-22 situation wherein providing high levels of service requires a great deal of data, but the same data eats away at privacy.
The array of technologies to gather information, including those that have migrated from the intelligence community into business and/or law enforcement, further chip away at privacy. This is exacerbated by laws passed and national attitudes since September 11. Privacy and freedoms are interrelated, so these technologies, combined with laws and attitudes pose a threat to our freedom as well.
Attitudes, business imperatives and social evolution are merging to change the entire social fabric of our way of life - and we are active participants in some aspects, and in other aspects we are facilitating this change. The ways we are doing that is through willingness to accept changes that are detrimental to privacy, and/or the pursuit of meeting business imperatives and competitive advantage without fully examining the long term ramifications.

What I like is the way the author thoroughly and systematically addresses the threats to our privacy, freedom and well being. The discussion in "Rise of the Mentat", aside from catering to fans of Frank Herbert's Sci-Fi masterpiece, Dune, will open your eyes about how information is processed and fed to us. After reading this chapter you'll wonder how much you really know, and how much of what you think you know is based on all available facts and data.

However, the real eye-opener is the way that virtual communities are coming together in ways that could not have been predicted ten years ago. The Internet has enabled people of like interests, both benevolent and malevolent, to find one another on this planet, band together and begin exerting influence. In the same manner that maps drawn with political borders do not display cultural borders, these groups called "Network Armies" in the book go beyond cultural or national interests and are changing our social fabric in ways that the author only touches upon.

This book is well written, filled with examples and facts, and arrives at thought-provoking conclusions. It does not matter if you work in IT or another technology-focused industry, law, business or non-profit organizations, what this book has to say and the facts and conclusions that are presented are important. If the author is correct (and I think he is), our lives are changing in dramatic ways and this book is a rough roadmap to where we're headed.

2002-04-16T14:04:00.000-04:00

Book Review. Cyber Forensics: A Field Manual for Collecting, Examining, and Preserving Evidence of Computer Crimes by by Albert J. Marcella Jr (Editor) and Robert S. Greenfield (Editor). Thorough and suitable for the experienced professional.

This book is an excellent follow-on book to Computer Forensics: Incident Response Essentials by Kruse and Heiser, which introduces the fundamentals. See my 14 April entry in Postcards from the Revolution for details. This book goes much deeper and is more technical than the Kruse and Heise, therefore the ideal audience is practicing professionals who have prior experience in forensics and a wide range of hardware, software and network knowledge.

Tools and techniques are presented in painstaking detail. I was unable to find a single gap or omission, which speaks highly of the editorial and review process behind this book's 464 pages. While most technical disciplines can dispense with finer details, the nature of forensics is to overlook nothing. If you find the step-by-step thoroughness boring that is an indication that forensics may not be your forte; if you're an experienced professional you'll appreciate the coverage of every technique or use of tools.

While the discussion of tools and techniques will satisfy even the most experienced practitioner, I found the detailed discussion of legal aspects, HR considerations and overall security and incident response processes to be the book's strongest points. This area is what sets forensics experts apart from technicians, and it is here that the book (in my opinion) adds the most value. Procedures ranging from how to properly gather, preserve and control evidence, to legal considerations for designing processes are covered in clear language, as are US and international legal guidelines.

Parts that I especially like include: intrusion management and profiling, up-to-date information on electronic commerce legal issues, the numerous checklists and cited resources, and the clearly delineated process for dealing with incidents.

If you're new to forensics you will probably get more from this book by first reading Computer Forensics: Incident Response Essentials by Kruse and Heiser. If, however, you have previous computer forensics experience or are currently serving in that role this book is probably one of the best investments you can make.

The book's accompanying web site keeps it up-to-date and provides additional material and links on forensics and other security-related information.

2002-04-15T18:17:00.000-04:00

Mike's last entry in Postcards from the Revolution about CMM inspired me to thumb through Ken Dymond's excellent A Guide to the CMM: Understanding the Capability Maturity Model for Software. That book and Kim Caupto's CMM Implementation Guide: Choreographing Software Process Improvement are two of the most effective books for anyone who needs to understand and implement the capability maturity model.

Last summer Mike and I were playing around with Paintshop Pro (see my 29 May 2001 review) and created a graphic that depicts the evolution of process maturity. We had fun creating the graphic, and made sure that it was consistent with the capability maturity model levels. We also made sure that it was aligned to our professional focus, service delivery.

As I was pondering Dymond's books, another book came to mind: Jill Dyché's The CRM Handbook: A Business Guide to Customer Relationship Management. Was it the 3-letter initials, CMM and CRM? Both authors' last names, Dymond and Dyché, starting with the letter 'D'? Or the excellent writing? Minds work in mysterious ways.

However, if CRM is a topic that interests you you'll like the MS Word document titled Customer Relationship Management: Successful Implementation and Innovative Practice. This 17-page document, in presentation format, captures the essence of CRM.

I'm a loyal fan of Jill Dyché. She is smart, personable and straight-talking. I first discovered her when Mike lent me a copy of her first book, e-Data: Turning Data into Information with Data Warehousing. As luck would have it, she was checking her book standings on Amazon and noticed my 30 June 2001 review, then spotted Mike's 28 June 2001 review. She contacted me, and sent both Mike and I copies of The CRM Handbook: A Business Guide to Customer Relationship Management. My goal this month is to write an Amazon review, and a glowing one at that. Both of Jill's books are outstanding and have my highest recommendation.

Now it's time to return to my studies so I can complete my requirements and pass the tests for Oracle Certified Professional. Believe me, it's not an easy certification to earn.

2002-04-15T04:30:00.000-04:00

Administrative Note. Over the next few days my ISP will be doing maintenance. Most of the documents we provide here reside on the server that hosts tarrani.net. You may experience Document not found errors during the next 48 hours. If there are any documents that you absolutely need during this period let me know and I'll e-mail them to you.

2002-04-14T03:33:00.000-04:00

Scalability and Performance + Yet More About Architecture. In my 8 April entry I mentioned Greg Barish's excellent book, Building Scalable and High-Performance Java Web Applications Using J2EE Technology. I was so impressed with the common sense approach that Mr. Barish proposed, and his clear writing, that I did a little investigating. As it turns out, Mr. Barish isn't your run-of-the-mill developer who wrote a book, but is a Ph.D candidate in the prestigious USC Computer Science Program. Two additional papers authored or coauthored by Mr. Barish that I found interesting are:

Using Tcl to Rapidly Develop a Scalable Engine for Processing Dynamic Application Logic. I recently cited the findings and conclusions from this 11-page PDF document to support the use of tcl in a proposed project.
World Wide Web Caching: Trends and Techniques. This 8-page PDF document is one of the clearest discussions of caching as a scalability technique that I've read. It's lavishly illustrated and masterfully explained.

An additional document that serves as a nice capstone on my previous entries about architecture is Conflicts Among Architecture Evaluation Criteria, which sorts out some of issues related to architecture evaluation that I've been discussing.

2002-04-13T03:36:00.000-04:00

More About Architecture. As a follow-on to my previous entry I have additional documents that are of interest:

A short PowerPoint presentation on using the Software Architecture Analysis Method as a simple, scenario-based review technique, and a related, 80-page PDF document titled Software Design Reviews Using Software Architecture Analysis Method: A Case Study.
5-page PDF document titled Economic Modeling of Software Architectures
17-page PDF presentation titled Evaluating the Performance of Software Architectures
8-page PDF document titled Assessing Optimal Software Architecture Maintainability
28-page PDF document titled Analyzing Software Architectures for Modifiability

2002-04-12T10:36:00.000-04:00

On Architecture. A new book that adds to the software architecture body of knowledge is Evaluating Software Architectures: Methods and Case Studies by Paul Clements, Rick Kazman and Mark Klein.

The authors provide an in-depth treatment of three methods for evaluating software architectures, all of which were developed at the Software Engineering Institute with involvement by the authors. The methods examined are:

ATAM (Architecture Tradeoff Analysis Method)
SAAM (Software Architecture Analysis Method)
ARID (Active Reviews for Intermediate Designs)

Each of the above address software evaluations in increasing levels of detail, with the book's main emphasis on ATAM.

What makes this book so valuable is the fact that you can learn much about developing software architectures from the criteria with which they are evaluated. For example, the discussion on quality attributes is eye-opening because what architects consider to be well formed quality attributes are usually too vague to properly evaluate, resulting in ill defined architectures in the first place. Knowing how to evaluate the architecture will provide the keys for defining a solid architecture. More important is the way the authors define the outputs of the architecture evaluation, which gives the practicing architect a framework for design that fully meets the evaluation criteria. The net result is that a defined architecture will unambiguously communicate the design to the development team, as well as to the QA team.

I especially like the business oriented approach that addresses the costs and benefits of evaluation, the three approaches from which to choose that best meets technical and business goals, and the case studies that support each of the approaches. Another strong point about this book is architecture is also evaluated with production in mind. Too many books only consider architecture from the development point of view, or in rare cases, from development and QA points of view. The evaluation techniques in this book extend to support and maintenance. The authors make selection of the best technique easy by comparing them in Chapter 9, and provide an approach to implement evaluations in Chapter 10.

If you're an architect I also recommend augmenting the excellent material in this book with Design and Use of Software Architectures by Jan Bosch , which gives an alternate method to ATAM that is more complete in many respects. Even if you espouse Bosch's approach, however, the approach and techniques given in Evaluating Software Architectures: Methods and Case Studies are complementary. I personally recommend both books and assign equal value to them.

Additional Resources:

SEI's ATAM page
SEI's SAAM page
SEI's ARID page
Jan Bosch's page (see articles and book page for additional documents and information about Design and Use of Software Architectures.)

2002-04-12T07:57:00.000-04:00

Items of Interest. In Postcards from the Revolution I've been discussing the organization and core processes in the foundation layer of the Tarrani-Zarate Model. Some of the work product and supporting material that I've amassed do not fit well into that discussion, so I am going to share them here:

Cost Control through Asset Management
GartnerGroup's View of ITIL (we've discussed the ITIL in previous entries)

IT Value Can be Determined
British Standard for IT Service Management

Also, since I've previously been discussing ISO 9001 and TickIT, I'm sharing a graphic depiction of ISO 9001 called the ISO 9001 Roadmap. Enjoy and have a wonderful weekend.

2002-04-11T10:38:00.000-04:00

Are We Winning Yet? Mark Twain once quipped, I refused to attend his funeral. But I wrote a very nice letter explaining that I approved of it. I refuse to use Hailstorm, but I certainly approve of the following news article: MS pulls the plugs on Hailstorm, pending rethink.

The demise of Hailstorm (however temporary while they're engaged in rethinking in Redmond) caused me to do some thinking about e-commerce risks. The fruits of my research into some of the top issues yielded the following documents:

The PowerPoint presentation titled Business Process Data Activity Analysis is related to risks and controls, and to the process thread that Mike and Linda are maintaining in this weblog.

2002-04-11T04:18:00.000-04:00

More on Metrics, Processes and Systems Integration. This entry will cover a range of topics, with an emphasis on metrics. One of the most important books on IT metrics was just published: IT Measurement: Practical Advice from the Experts. This book is a panoramic view of metrics across the enterprise. Although the book is written by members of the International Function Point Users Group it goes well beyond software estimating. It encompasses measurement techniques that are consistent with function points, but are also useful when applied to other methods.

As expected, the book starts with a discussion of function points, its evolution as a methodology, and how it has evolved as a means of measuring a full spectrum of attributes, such as quality, productivity, time and effort. In addition to generic attribute metrics this book shows how function points can be applied to earned value project management, developing a balanced scorecard that views the enterprise holisitcally, business and e-commerce metrics and evaluations and benchmarking.

Parts that I especially like include:

The complete data collection, analysis and action process that is embodied in the book. This can be used in any setting, such as the Constructive Cost Model (CoCoMo), as well as FP.
IT work units, which are applicable to production services and support. This dispells the notion that function points are only useful for software estimating. This is also augmented by a later section in the book that addresses IT and business measures that is sure to change the way you approach measuring the overall value of IT.
Demonstrated use of function points as a viable project estimating technique that extends to projects other than software development.
Clearly written explanation of statistical process controls.

I've only highlighted the parts of the book in which I have personal and professional interests. The book contains much more material that covers the entire spectrum of enterprise metrics, including case studies and reflecting the views of each individual author who contributed chapter(s). In my opinion this book is, and will remain for years to come, one of the most important texts on IT measurement. Time will tell, of course, but I can assure you that it's the best book on the subject that is currently available.

Traffic Engineering. Network traffic engineering is a science that can be applied to not only circuit capacity, but any activity or process where queuing is involved. This includes help desk staffing and similar uses. The basics are explained in Traffic Engineering, which is an outstanding 29-page overview that starts gently and goes into the details. If you are currently struggling with capacity planning for Voice over IP, the VOIP calculator, which is an Excel application, will help you arrive at capacity plans that are traced to quantitative analysis instead of the usual method (throwing money at the problem). You'll also want to read our previous entries that cover capacity planning, as well as the PowerPoint presentation about measurement capability.

Processes. Much of what I cover in this weblog is about software engineering. The MS Word document titled Integrating Iterative Processes examines life cycle approaches and is something every architect, project management and software engineer will find interesting.

Systems Integration. If you are faced with an enterprise integration project you'll undoubtably be using XML (if not now, you can be sure that you will be in the future). Connecting E-Commerce to XML is a good starting point for understanding the issues.

An excellent book on the topic is XML, Web Services, and the Data Revolution. In many respects this book extends David Linthicum's B2B Application Integration by focusing solely on the data aspects, and explaining the web services approach that has matured after Mr. Linthicum's book was published.

This book defines the tools, cuts through the hype and sorts out the pieces needed to design and deploy enterprise-wide solutions. What makes it particularly valuable is that it doesn't side with the two major factions espousing web services - the Microsoft .NET and Sun-sponsored J2EE approaches are presented without bias (refreshing in itself considering the hype and industry posturing). The same objective treatment of approaches by IBM, BEA, HP Oracle is given, which ensures that you have ample insights into the available approaches to developing web services. Of course, SOAP, the XML-family of protocols, and UDDI are also covered in depth using clear writing and excellent illustrations.

What I particularly like about this book are:

The way Chapter 1, Extending the Enterprise, presents a coherent picture of the complexities of web services and enterprise integration. This is done in less than 30 pages and packs an amazing amount of information into those pages.
Chapters 3 (XML in Practice), 4 (SOAP) and 5 (Web Services) drill down into the guts and sort out the complexities - especially the discussion of web services, which doesn't [yet] seem to have a standard definition.
Chapter 7's discussion of XML security, which is a nice and needed touch that rounds out the information provided in the book.

You won't find specific development information in this book, and that makes it more valuable in my opinion. If that is what you're seeking there are other books that address that topic. I do believe that Linthicum's B2B Application Integration and William L. Oellermann's Architecting Web Services will complement this book - Linthicum's for the big picture (especially for legacy system integration) and Oellermann's for the process-oriented approach. I strongly recommend this book to anyone who is involved in architecture, specifications or development.

2002-04-11T00:10:00.000-04:00

Problems in Paradise. Although it should come as no surprise to anyone who is involved in security, A trio of MS-Office security vulnerabilities have been reported. What would be a surprise is if we could go an entire week without a reported security flaw in Microsoft products.

Did Microsoft acquire Yahoo while nobody was looking? Yahoo apparently wants to compete with Microsoft through the use of a mechanism called a Web Beacon. This piece of code will track your activities long after you've departed Yahoo sites and services. See their explanation (at least they've disclosed the existence of web beacons). Also note that about halfway down the page in the body text there is a way to opt out (see Please click here to opt-out.). If you don't want to be stalked you may want to do just that. Just don't click the button marked Cancel Opt-Out at the bottom of the window, else you'll be back where you started: stalked.

2002-04-10T03:45:00.000-04:00

Capstone. In my previous two entries I discussed performance, capacity and scalability. I want to end this thread (for now) with three documents that are related, and also cross into QA:

Want more? Not to worry - these topics are among the foremost in my professional interest and you'll see much more on these topics as time goes on. You may want to read earlier entries here and in Postcards from the Revolution for related material that I've already posted.

2002-04-09T12:39:00.000-04:00

Performance Processes. In my last entry I discussed a number of performance and capacity planning books that I especially like. I covered the established books from the most prolific and known book authors. There is another book by Connie U. Smith and Lloyd Williams that is one of the most important recent works to emerge: Performance Solutions: A Practical Guide to Creating Responsive, Scalable Software. The books I cited in my previous entry were focused on techniques, while this one is about process. Moreover, while Jain, Menasce and Almeida are prolific book authors, Connie U. Smith and Lloyd Williams are also prolific writers who have made an impressive contribution to the body of knowledge in the way of whitepapers, journal articles and seminars.

I've collected a number of documents by these lesser known, but equally important, practitioners and wish to share them:

The above are but a sampling of the work that Smith and Williams have published, but the sampling captures their approach and adds wrinkles to the foundation of knowledge published by Jain, Menasce and Almeida in books. More important, what Smith and Williams bring to the practice area is process. If you are interested in performance, capacity and scalability, then you should read Performance Solutions: A Practical Guide to Creating Responsive, Scalable Software.

2002-04-08T16:38:00.000-04:00

Performance & Scalability. I've been corresponding with Greg Barish, the author of Building Scalable and High-Performance Java Web Applications Using J2EE Technology (see my 4 April and Linda's 3 April reviews on Amazon), and have the highest regard for that book. I won't bore you with my entire review, but do want to highlight what I like about it:

[W]hile the performance and scalability techniques presented in this book don't approach those embodied in books by Daniel A. Menasce and Virgilio A. F. Almeida, or Raj Jain, they are more than sufficient for software engineers and architects ... The value of this book is that it does make scalability and performance techniques accessible to most developers, even those who are math-challenged (and there are quite a few of them out there)...

Who are Menasce, Almeida and Jain? They are among the foremost experts on capacity planning and performance/scalability. Raj Jain is probably the father of performance analysis. His seminal The Art of Computer Systems Performance Analysis Techniques for Experimental Design, Measurement, Simulation, and Modeling is one of the most comprehensive books on the subject. It's also not easy to read unless you have up-to-date math skills. I use MathCad to work through examples in this and other books, making learning much easier. Mr. Jain also coauthored Practical Performance Analyst with Neil J. Gunther - I have this book, but got it in the same timeframe that I discovered the body of work by Daniel A. Menasce and Virgilio A. F. Almeida. These two writers have taken the foundation laid by Raj Jain and have built upon it through a series of excellent books. While their work does not supersede Jain's first book, it does keep it alive in spirit and currency. The books they published, in chronological order, are:

Capacity Planning and Performance Modeling: From Mainframes to Client-Server Systems (still valuable despite its age)
Capacity Planning for Web Performance: Metrics, Models, and Methods (I frequently refer to this one)
Scaling for E-Business: Technologies, Models, Performance, and Capacity Planning (my favorite among their books to date)
Capacity Planning for Web Services: Metrics, Models, and Methods (their latest work and topical given the activity in web services)

There are valuable spreadsheets and other material on the Scaling for E-Business website, as well as supporting materials for the other books by Menasce and Almeida.

2002-04-07T23:36:00.000-04:00

Busy ... Business. We're all busy these days. Mike, Kate and I are developing a proposed solution requirements set forth by Media Lab, Asia (we're working this as members of the Thinking Minds, Inc. team). I am immersed in my Oracle Certified Professional Training, and Mike and Kate are working on a project that will take them to Kuwait at the end of the month.

What's New. Since we are so busy I want to rekindle the thread that Mike is still working about processes and strategy. A PowerPoint presentation on Information Systems Strategy provides excellent information and a structured approach to developing a strategy. The strategy is the root of policies, processes and procedures, and it also ties nicely into Mike's and my entries about the Tarrani-Zarate Model that we're discussing in Postcards from the Revolution. A related document is Models of Quality, which covers the Goal-Question-Metric approach (among others).

Because we are working on a proposed solution that addresses development of a collaborative computing environment, I want to share one of our source documents we're using that discusses the key issues of web engineering. This document is not the same approach as set forth in Nick Flor's excellent book, Web Business Engineering (see Mike's and my reviews dated 16 and 14 September 2001, respectively). Where the book is focused on a business approach, the PowerPoint presentation I'm sharing is more technical in nature.

I want to wrap up with two documents about service management. We usually focus on that subject in Postcards from the Revolution, but many readers here do not read our sister weblog and the topic is too important to our profession. The documents are:

IT Service Management Whitepaper - this document is brief and covers all of the important points.
IT Service Management in eGovernment, which is focused on the IT Service Management Forum's approach, and documents successes achieved by the Government of Ontario. Although the theme is eGovernment, the information applies to commercial organizations as well.

Best wishes from Azusa, California - Linda Zarate.

2002-04-07T20:56:00.000-04:00

Waxing Poetic. Competitive intelligence is all about following news stroies and piecing together trends, moves and counter-moves. To quote from Edna St. Vincent Millay's First Fig:

My candle burns at both ends;
It will not last the night;
But, ah, my foes, and oh, my friends;
It gives a lovely light

Indeed, there are movements afoot and intrigue in the industry:

Special report titled, Liunx in the Limelight shows the growing popularity of Linux, which is [in my opinion] fueled by the ongoing security issues with MS products
Apple and Linux in pincer movement on PC market?. Apple? The worm turns (yes, that was a pun of sorts).
In Windows to Linux Application Migration we find an exit strategy and means to break the bonds of mediocrity.

The point of this is not only the news itself, but the fact that competitive intelligence is useful to all of us.

Late entry by Mike Tarrani - there is lag between the time these entries are written, and when one of us reviews and releases them. This is one case in which I have an additional item to add to what Kate has reported above.
I'll keep this editorial remark in the same spirit as Kate's report by quoting from Edna St. Vincent Millay's Second Fig, which is unerringly appropriate:
Safe upon the solid rock the ugly houses stand
Come and see my shining palace built upon the sand
Yes, the security and reliability traits of certain products do appear to be palaces built upon the less-than-solid foundation of sand. The special report titled, IBM's Return to Dominance shows that systems built upon the solid foundation of reliability, availability and supportability - and security - bodes well for consumers.

2002-04-07T05:48:00.000-04:00

In my 5 April entry I promised to give a more in-depth review of Building Secure Software: How to Avoid Security Problems the Right Way by John Viega and Gary McGraw.

What makes this book so important is that the authors provide an analysis of the major problems with all software, and give a collection of techniques with which to address the recurring problems, such as buffer overflows, access control exposures, randomness flaws and other security-related defects. They do not attempt to provide specific solutions. Instead they raise an awareness of the common problems, discuss the underlying causes, and give a framework with which developers can use as the basis for developing secure software.

Key points of this book that I found especially useful include:

Even treatment of commercial and open source software. I found this refreshing because there are two camps, Microsoft developers and open source advocates, each of which criticize the other. Yes, Microsoft has a bad reputation for security, but the open source faction has its own challenges, and the authors show the strengths and weaknesses of each in an objective manner.
Surprises, such as documented cases of peer reviews that failed. I am an advocate of this technique, yet a case where a flawed, two-line piece of code that was extensively reviewed by literally thousands of reviewers and readers of a technical publication slipped by without notice for a long time.
The ten guiding principles for software security encapsulate the essence of building secure software. This list and the discussion of each principle should be required reading for every architect, developed and QA engineer.

In addition to software security from a developer's point of view, this book also addresses other areas that need to be closely examined in order to achieve a solid security posture. In particular I liked Chapter 14, which covers database security, especially the treatment of statistical attacks. If you're a DBA this alone will make the book worth buying because despite the most careful design of views and access controls you may still be vulnerable in surprising ways. The chapters on Client-side security and firewall issues are also filled with excellent information, as is Appendix A (Cryptography Basics).

The authors have imparted the sum of their extensive experience in this book. It's up to you to take that experience and apply it. The book's accompanying website adds further value.

2002-04-06T15:06:00.000-05:00

My special friend, Muthukumar U sent me an interesting article titled Lemon Law for Software? that is completely in line with my thoughts on the subject. This article proposes the opposite of UCITA (discussed in previous entries). As an aside, I should be in Kuwait in a few weeks, and may have the opportunity to meet Muthukumar in person. He and I have been corresponding for nearly a year, and have collaborated on projects in the past. He's a risk management analyst for HSBC Bank Middle East in the Sharjah, UAE offices, so we'll be close enough to visit.

Kate reported in her 2 April entry that Microsoft's anti-Unix campaign backfires. Here's an update that is sure to bring another smile: Anti-Unix site returns - on MySQL? - at least they managed to move the site to IIS ... of course, they'll probably have to hire two additional bodies to keep up with the security patches, and an additional dozen to monitor security. The question I have is, how did they even become a monoploy? Sounds more like a stand-up comedy routine to me.

2002-04-05T11:36:00.000-05:00

Culture and Process. One of the most interesting articles I've read in a long time is Cultural Obstacles to Measurement and Process Maturity. This article validates the assertions Mike has made here in previous entries, but I am not entirely sure I concur with all of the author's conclusions. In a nutshell, the article posits that,

[I]t's easier to implement CMM in a "prescriptive" culture. Professionals from cultures with a history of British dominance tend to embrace prescriptive models with far less resistance than their American counterparts.

I personally believe the thesis that there is a difference between prescriptive and the ad hoc nature of the U.S. culture. I'm not quick to buy into the history of British dominance part. Is it a coincidence that CMM level 1 is defined as ad hoc and the cultural nature in the United States can be described as such? I think not.

That said, I do agree with the intent of the article, to show that there are cultural gaps and the implied message that we need to become more procedure-oriented. What I see as the root of the problem is that we in the U.S. are more focused on management, when it takes leadership to establish and maintain a culture of process maturity. I believe a closer examination of the problem will reveal insights that this article to another level. Regardless of my disagreement with portions of the article, however, I hope it gets read by a wide audience (which is why I chose it as my topic), and the cultural barriers to implementing process maturity in the U.S. as the rule rather than the exception fall.

2002-04-05T03:21:00.000-05:00

What I'm Reading. One of the reasons I've been keeping such a low profile is because I'm immersed in Building Secure Software: How to Avoid Security Problems the Right Way by John Viega and Gary McGraw. I'll be posting my review of this book on Amazon and here Saturday night, but in the interim I want to mention that this book is absolutely essential reading if you have any role in the software development projects.

Another book that has received unanimous rave reviews is Writing Secure Code by Michael Howard and David Leblanc. Ironically, this book is published by Microsoft Press.

I haven't read it, but judging from comments this is another essential book for anyone who is serious about developing secure software, and is on my list of books to buy and read. Lest you question the credibility of this book because of Microsoft's notoriety for insecure software (as reported by the trade press), bear in mind that Microsoft Press publishes books by authors who have no connection with Microsoft's business other than writing books. Therefore, do not discount this book until you've checked it out - something that I plan to do.

2002-04-04T14:20:00.000-05:00

Run, Forrest, Run. Yes, you can cast off the braces that shackle you and run like the wind. The case study about Life Time Fitness and How to Bid Farewell to Microsoft shows that you can escape. Also worth reading: Bad Software Can "Enronize" Anyone.

Web Services. Nobody seems to agree on the exact definition of web services, but that doesn't stop it from being a hot topic. Imperial Sugar Rebuilds on Web Services is an excellent case study of how to look beyond the buzzwords and muddled definitions and harness technology to meet business requirements (which were dire in this case). Linda and I reviewed two books that look beyond the trendy definitions and go to the heart of practical use(s) of the technology:

Architecting Web Serivces by William L. Oellermann Jr. (Linda's 17 December 2001 review; my 13 December 2001 review)
Building Scalable and High-Performance Java Web Applications Using J2EE Technology by Greg Barish (Linda's 3 April 2002 review; my 4 April 2002 review)