Supply Worx Vol 15.1

It is pref erab env le fo iron r org men anisa ts to tions t ensu o invest re an in standardised test uninte rrupted t est environment.

ss ne ds. n

asswords are preferable for Long p organi sation s to b against password attacks. Users ne etter ed to learn prot from ect the mist ms a e kes e instanc s, a specialist may m elv o s . be bet In es ter ut g e a n e d r n a a l i s r t . e ilised Putting a lead person in th eir p in a m rofe ispla ssio ced role nal can cap cos abi ta com lity th an pa ny mi as a llio b ns usi of Ra

worx SUPPLY THE PLATFORM FOR COLLABORATIVE SUPPLY CHAIN

LEADERSHIP

How Secure is Your Password?

Organisations need a strong password policy to protect against password attacks

Leadership Obsession Losing Firms Millions per Senior Job South African businesses are often too quick to place a specialist in a leadership position

Standardised Test Environments Keeping your test environment running 24/7

KEY FACTORS for successfully

managing test

environments

by Harsha Germellu

1

SUPPLYWORX 2016 Vol 15.1

Testing teams today are challenged with unstable, fragmented environments due to fast changing business needs, and the majority of testers’ time is wasted on fixing environmental issues. In order to provide the necessary glitch-free, standardised test environments organisations must invest in dedicated Test Environment Management (TEM). This will result in test environments up and running 24x7 and also ensure the testing team only does testing.

SUPPLYWORX

T

est Environment Management (TEM) is the process of controlling, steering and managing test environments within the IT space. Services of TEM include release management, service level management, incident management, knowledge management, environment registration and booking.

Today, ineffective management of test environment services coupled with a lack of ownership is leading to a multitude of issues faced by organisations.

The challenges On time test environment readiness and around the clock availability are the key challenges faced by organisations today.

The test environment needs to be stable, so that testing can be conducted effectively, otherwise the quality of solutions will be negatively affected, leading to monetary loss and lack of customer satisfaction. A successful test environment should be agile, catering on demand to the needs of testers to ensure they can take effective products to market quickly, without compromising on quality.

Without adequate ownership of the test environment, and without Service Level Agreements (SLAs) in place, the chances of software problems going unidentified increases. When these bugs make it into the hands of customers, resolution of incidents becomes a major challenge. In addition, if effective processes are not put into place to separate the various levels of testing, inconsistencies and instability may creep into testing. The end result of these challenges is that assets, including hardware and resources, are not optimally utilised, affecting time to market and increasing expenditure.

Ways to optimise the test environment:  Resource Management: Efficient resource management is essential to a successful test environment. This requires complete ownership, and the establishment of a dedicated TEM team at the enterprise level. The team will serve as the single point of contact for all test environment related activities and will be held accountable for the TEM function.  Knowledge management: The TEM team should develop and maintain a library for all TEM activities, including test environment solution documents, schedules, test environment plans, status reports, recovery procedures, incident management and others as defined by governance and audit requirements.  Strategic planning: Defining a test environment strategy that is aligned with enterprise test strategy, IT infrastructure strategy and software release patterns improves the viability of the test environment. It is advisable to build and manage an end-to-end test

environment, rather than testing applications in fragmented environments. The test environment lifecycle and scope also must be defined. At a high level, TEM consists of four activities: design; build; manage; and refresh and reuse. Each activity plays a critical role in ensuring the availability of the right test environment at the right time.  Process Optimisation: Process optimisation and standardisation help to improve efficiency. It is essential to define, implement and adhere to best practices in the test environment, replicating best practices from production environments and measuring the performance of the TEM service by using metrics and enforcing SLAs for continuous improvements and better accountability.

It is essential for organisations to establish best in class test environment management practices at an enterprise level.

Automating test environment activities is the final stage in ensuring effective TEM. Many activities in the test environment lifecycle can be automated, and proven tools are available for auto provisioning, auto deployments and test data management. By automating the provisioning process in the cloud, organisations can easily fulfil ad-hoc environment requests and ensure test environment availability with reduced cost and effort. It is also possible to automate day-to-day activities such as test environment booking, incident management, asset management, knowledge base management and service request fulfilment. Furthermore, automation of design, build, manage and refresh test environments is key to helping organisations manage the test environments effectively.

In conclusion, there are many challenges faced by organisations with regard to the test environment. Given the importance of software in today’s organisation, it is essential for organisations to establish best in class test environment management practices at an enterprise level.

Implementing resource management, strategic planning, process optimisation and automation will help organisations to improve cost effectiveness of solution deployments, while enhancing quality and customer satisfaction. Investing into dedicated test environment management will realise long-term benefits to the overall IT environment and the organisation as a whole.

SUPPLYWORX 2016 Vol 15.1

2

SUPPLYWORX

With the number of high profile data breaches on the rise, users and organisations alike are more concerned than ever before with making sure that the sensitive information they handle remains secure.

One of the simplest means of acquiring this information for an attacker, is to enter an organisation with the key to the door itself, user’s passwords.

3

SUPPLYWORX 2016 Vol 15.1

A

uthentication is the process of proving that you are who you claim to be. There are a number of digital methods that we use to prove that someone is indeed who they claim to be, but the most common form by far today is through using a secret piece of information, such as a password. This secret bit of information is intended to be something that only the user knows or has access to.

However, all too often users choose something that not only isn’t secret to them, but something common that many other users will end up choosing too.

Organisations are responsible for protecting their users’ passwords in motion and at rest. At rest, it is important that the password is hashed using a strong hashing mechanism.

Ashley Madison is an interesting case study, because despite their users choosing weak passwords, they had attempted to protect the password with a strong hashing algorithm, bcrypt.

It was not until the research group CynoSurePrime discovered a weakness in the way that the developers had stored an alternative version of this password that they were able to crack a significant number of the passwords.

In order for organisations to better protect themselves against password attacks, as well as implementing twofactor authentication, a strong password policy needs to be implemented. In addition to research being done around compromises like Ashley Madison, MWR have seen a spate of large breaches that began with a password compromise. The iCloud celebrity breaches rose out of a vulnerability discovered in a mobile API that did not limit the number of login attempts an attacker could make. Accounts that were not protected by strong passwords could be guessed by an attacker by exploiting this vulnerability. The JP Morgan Chase breach is another compromise that was widely reported on, and began with an attack that guessed a single weak password in 2014 (https://securityledger.com/2014/10/hacked_password_ behind_compromise_of_75m_jpmorgan_accounts/).

The CPNI and CESG in the U.K. have recently released a helpful set of guidelines on how organisations and users can better choose passwords (https://www.gov.uk/government/ publications/password-policy-simplifying-your-approach).

Traditional wisdom has often said that the more complex a password is, the better. This wisdom has slowly been replaced with experience and practicality, as users have struggled to remember highly complex passwords and resorted to using predictable patterns to choose them. These patterns, such as capitilising the first character of the password and adding a digit and special character to the end of the password, make the password much easier to guess for an attacker.

Instead, long passphrases are now considered generally more secure and can be easier for a user to remember. The passphrase, “Today I walked my dog” is significantly more secure than “P@$$wORD_1” and easier for users to remember, and organisations should consider choosing length over complexity when they think about password policies.

MWR has spent several years conducting research into how to attack the mind-set of users when they choose passwords. Most recently, MWR collaborated with Carnegie Mellon University in the U.S., where it came out on top in a comparison of attacks against user passwords where they competed against another security firm and independent researchers (https://www.usenix.org/system/files/conference/ usenixsecurity15/sec15-paper-ur.pdf ).

Perhaps the single biggest take away from the breaches that we’ve seen recently, is that users have not learnt from others’ mistakes. We’re still seeing the same, weak, easily guessed passwords being used across accounts on the internet. Furthermore, the second lesson for organisations, is that storing passwords securely makes a significant difference in protecting its users. Storing passwords with a strong algorithm such as bcrypt, goes a long way in protecting users in the event of a compromise.

Long passphrases are now considered generally more secure and can be easier for a user to remember.

SUPPLYWORX 2016 Vol 15.1

4

SUPPLYWORX

LEADERSHIP OBSESSION

by Michelle Moss

losing firms millions per senior job Would you know a business leader if you saw one? The question gathers urgency at numerous organisations as it becomes increasingly apparent that cases of mistaken identity cost South African businesses hundreds of millions of rands every year.

T

he trouble is a top specialist building a career is often a dead ringer for a high potential manager with the capacity for business leadership. The specialist might then be selected for leadership development, move up the management scale and might rapidly take on a leadership role … for which he or she is totally unsuited.

Research by the US executive talent-spotters at Korn Ferry highlights the challenge of differentiating between tomorrow’s leader (a ‘high potential’) and a skilled specialist (a ‘high professional’).

They have lots in common, including …  Intelligence and solid academic qualifications, perhaps backed by communication skills.  Confidence and a desire to be challenged in their work.  The ability to make tough decisions and solve complex problems.  Eagerness to continue learning and add to their skills and qualifications.

However, the potential leader is a generalist while the ‘high professional’ has narrow focus on a specific area of expertise.

The misidentification challenge is compounded by two related phenomena … an obsession with leadership development (often the overwhelming focus of talent management) and the temptation among specialists to become willing accomplices once they have been misidentified as a leader.

5

SUPPLYWORX 2016 Vol 15.1

After all, the notion of leadership is seductive. The pay is good. The status is alluring. The idea of working at the very top with all the attendant perks can be very compelling.

But costs can be substantial once a square specialist tries to fit in that round leadership slot.

The US cost calculation by Korn Ferry is US$47 million per misidentification plus one career.

Even allowing for differences in scale between US and South African scenarios, local corporate costs must run into tens of millions of rands per misstep. The personal cost remains the same: one career that has been derailed through a failed move into mainstream management.

More than one person may feel the effects. Promising subordinates may quit because of the frustration of dealing with a misaligned superior who is not really up to the job.

The organisation then loses precious talent while absorbing the cost of under-performance by the misidentified leader.

Other senior managers may try to assist the square peg in the round hole, adding to costs as their time could be spent more productively elsewhere.

Total cost assessment is difficult. How do you quantify the impact of making a top brain surgeon a below-average hospital administrator? You lose the value-add of precious expertise

while meeting the costs of managerial mediocrity.

Similar considerations apply in a corporate setting.

What’s to be done?

US research has enabled the development of assessment tools and methodologies to assist in correct identification. We see growing demand for these services locally.

Another positive is the realisation that top specialists can be just as valuable as leaders. As a result, we’re seeing better specialist remuneration – a small price to pay when the alternative is millions in wasted time and resources.

The idea of working at the very top with all the attendant perks can be very compelling.

SUPPLYWORX 2016 Vol 15.1

6