Tuesday, October 23, 2012

Hibernate



  • Relational Persistence for Java and .NET


Historically, Hibernate facilitated the storage and retrieval of Java domain objects via Object/Relational Mapping.  Today, Hibernate is a collection of related projects enabling developers to utilize POJO-style domain models in their applications in ways extending well beyond Object/Relational Mapping.
http://www.hibernate.org/


Hibernate is an object-relational mapping (ORM) library for the Java language, providing a framework for mapping an object-oriented domain model to a traditional relational database. Hibernate solves object-relational impedance mismatch problems by replacing direct persistence-related database accesses with high-level object handling functions.

Hibernate is free software that is distributed under the GNU Lesser General Public License.
http://en.wikipedia.org/wiki/Hibernate_%28Java%29





  • Component

Refers to the UML modeling term ofRefers to the UML modeling term of
composition
Commonly referred to as a “has a”
relationshipeato s p
– An AccountOwner has an Address
Does not exist on its own; dependentDoes not exist on its own; dependent
on a parent object

Address’ is a component
• Address  is a component of ‘AccountOwner
– Non-existent without AccountOwner
– No id of its own

Entity
lives on its own
Can be made components
Can be related/associated to other entities

AccountOwner’ is an Entity
– Can lives on its own
– Has its own id


Using Components
1. Determine your domain model
Which objects are best suited to be a component?
2. Create your database tables
Model your components accordingly within entity tables
Create your Java classes
• One for each entity, and one for each component
• Setup your components within the entity classes
Write the Hibernate mapping file for the
entity, using the embedded component tag
ithi it t id tif th t lwithin it to identify the component class


Nested Components
Component  Address  has nested component ‘ZipCode



Inheritance
Commonly referred to as an “is a”Commonly referred to as an  is a
relationship
Polymorphism
– Dynamic realization of subclass behavior while
treating the object as an instance of its superclass


Inheritance Realization
Easy to do in an object oriented language
– Java: Use ‘extends’ or implements’ keyword
Not so easy to do in a relational database
– Tables do not ‘extend’ from each other
– Part of the ‘impedance mismatch’ problem
How do we get around this?
– Four approaches through Hibernate
• Hibernate implicit polymorphism
• Table-per-concrete class
• Table-per-class-hierarchy
• Table-per-subclass


Modeling Inheritance

1.Determine your domain model
What objects have hierarchical relationships?
2. Choose your inheritance strategy
• Hibernate implicit polymorphismHibernate implicit polymorphism
• Table-per-concrete class
• Table-per-class-hierarchy
• Table-per-subclassTable per subclass
3. Create your database tables based on the
chosen strategy
4. Code your Java objects, using extends’ or
implements’
5. Write your Hibernate mapping file using
the appropriate subclass tags



Implicit Polymorphism
Database
– One database table per concrete class

Hibernate Mapping Files
– Separate mapping files for each inherited class
• Like normal, including any inherited properties

Default Behavior
– Out of the box Hibernate will automatically
recognize any Java inheritance associations



Implicit Polymorphism
Advantages
– Get it for free. Hibernate automatically scans classes
on startup (including inheritance); No additional
configuration/mapping neededconfiguration/mapping needed
– Not a lot of nullable columns (good for integrity)
Queries against individual types are fast and simple– Queries against individual types are fast and simple

Disadvantages
– Makes handling relationships difficult
• One-to-many relationships typically require a foreign key, but
inherited associations can’t key to both tables; Databases y
don’t support it  (Example:  AccountOwner:Account)
– Polymorphic queries are process intensive
• For queries against the superclass, Hibernate executes o que es aga s e supe c ass, be a e e ecu es
multiple queries
– SELECT * FROM CHECKING_ACCOUNT WHERE
ACCOUNT_OWNER_ID=?
– SELECT * FROM SAVINGS_ACCOUNT WHERE
ACCOUNT_OWNER_ID=?
– Database schema evolution more complexp
• Need to add the same column to multiple tables
• Integrity constraints might have to span multiple tables





Table-per-concrete class

Database
– One database table per concrete class
Hibernate Mapping
– Single mapping fileg pp g f
• Based on superclass
• Includes union-subclass’ definitions for inherited classes


Table-per-concrete class

• Advantages
Shared mapping of common elements
• Shared database id
– Not a lot of nullable columns (good for integrity)Not a lot of nullable columns (good for integrity)
– Queries against individual types are fast and simple
Less SQL statements generated with use of ‘Union’ for
polymorphic queries
• Disadvantages
– Still have difficulty with relationships
• Foreign keying to two tables not possible
– Database schema evolution still more complexp
• Need to add the same column to multiple tables
• Integrity constraints might have to span multiple tables



Table-per-class-hierarchy

Database
– One database table for all subclasses
Denormalized table has columns for all attributes

Hibernate Mapping
– Single mapping file still based on superclass
– Includes subclass’ definitions for inherited
classes
– Use ‘discriminator’ column/field to identity
concrete type


Table-per-class-hierarchy
• Advantages
– Simple
– Fast reads/writes, even across types
• Disadvantages
– Lots of nullable columns
Possible data integrity concern
Denormalized table generally considered bad
database design


Table-per-subclass
Database
– One database table for the superclass AND
one per subclass
• Shared columns in superclass table
• Subclass tables have their object-specific
columns

Hibernate Mapping File• Hibernate Mapping File
– Single mapping file based on the superclass
Includes joined subclass’ definitions for– Includes  joined-subclass  definitions for
inherited classes



Table-per-subclass
• Advantages
– Normalized schema
• Schema evolution and integrity are straight
fdforward
– Reduced number of SQL statements produced
• Hibernate uses inner joins for subclass queries• Hibernate uses inner joins for subclass queries,
outer joins for polymorphic ones
• Disadvantages
– Can have poor performance for complex systems
• Requires many joins or sequential reads for queries



When to use Which
• Leave implicit polymorphism for queries against interfaces (based on behavior not differentinterfaces (based on behavior, not different
attributes)

• If you rarely require polymorphic queries, lean towards table-per-concrete-class.

• If polymorphic behavior is required, AND subclasses have only a few distinct properties, try table-per-l hi hclass-hierarchy

• If polymorphic AND many distinct properties, look atIf polymorphic AND many distinct properties, look at table-per-subclass or table-per-concrete-class,
weighing the cost of joins versus unions



Summary
Components are different from Entities
Enties have their own IDs
• Component are dependant on Entities

the different methods of modeling inheritance relationships through Java/Database/Hibernate, and where each one is best
suited
Hibernate implicit polymorphism
• Table-per-concrete class
• Table-per-class-hierarchy
• Table-per-subclass


04-hibernate-Component_and_Inheritance_Mapping
http://courses.coreservlets.com/Course-Materials/hibernate.html




  • Relationship Types

Association
– Mapping relationships between two objects
– Example
• Account and AccountOwner
• Collection• Collection
– Collection of values representing individual
pieces of data
– Example
• Map of holidays
• String array of months



Relationship Dimensions

Relationships between entities can p
exist in multiple ways
– Multiplicity
• How many on each side of the
relationship?p
– Directionality
• From which side(s) of the relationship canFrom which side(s) of the relationship can
you access the other?



Relationship Multiplicity


One-to-Many
A il Ath Tti– A single Account has many Transactions
– Reverse of a many-to-one relationship
• Many-to-Oney
– Multiple Transactions belong to a single account
– Reverse of a one-to-many relationship
One to One• One-to-One
– A single AccountOwner has a single HomeAddress
– A single HomeAddress has a single AccountOwnerg g
• Many-to-Many
– Multiple Accounts have multiple AccountOwners
Oft li d th h t t lti hi– Often realized through two one-to-many relationships
• A single Account has multiple AccountOwners
• A single AccountOwner has multiple Accounts



Relationship Directionality
Unidirectional
Cl bjf idfh– Can only traverse objects from one side of the
relationship
– Example: Account : Transaction
• Given an Account object, can obtain related
Transaction objects.
• Given a Transaction object, cannot obtain related
Account object.
• Bidirectional
– Can traverse objects from both sides of the relationshipCan traverse objects from both sides of the relationship
– Example: Account : Transaction
• Given an Account object, can obtain related
Transaction objectsTransaction objects.
• Given a Transaction object, can obtain related
Account object



Java vs. Database
Objects are inherently directional
• An object has a reference/pointer to another
object
– Transition by walking a networked graph of
object references


Database
– Relations are not inherently directional
A t bl bit il j i it l ith• A table can arbitrarily join its columns with
columns of other tables (not just those keyed
to)
– Transition by joining tables together through
joins/foreign keys



Relationships in Database
Denormalized table
• Record repeated in same table each time capturing• Record repeated in same table, each time capturing
different relationship data.
– Foreign keys
• Follow identifiers to related records on other tables
– Join tables
• Tables specifically setup to maintain a relationship pyp p
between two identities (usually for M:M)
Ad hoc joins in a query
• Arbitrary joins between columns relating data


Relationships in Java
For ‘Many’ side, Collections API
– Set
• No duplication allowed• No duplication allowed
• Objects organized with or without order
– Map
• Duplicate values allowed using different keysDuplicate values allowed, using different keys
• Can be organized with or without order
– List
• Duplication allowedDuplication allowed
• Objects expected to be organized in an order
– Arrays
• Duplication allowed
• Objects expected to be organized in an order
• Strongly typed to particular object type, and lacks ability to resize



Relationships in Database
Denormalized Table
P– Pros
Very fast
• Easy to query against
– Cons
• Contains redundant data
• Requires many nullable columns

Foreign Keys
P– Pros
• Reduce redundancy
• Better modeling of data
– Cons
• Slower than denormalized table
• Slightly more complicated to query against

Join Tables
Pros– Pros
• Built on foreign key model, enables many:many relationships
– Cons
• Slower yet and even more complex querying

Joins
– Pros
• Allows for any possible query a user can think of without having
to predefine the requirements in the schema design
C– Cons
• No model enforcement
– Can join ‘age’ and ‘office floor’ columns – but does it make sense?
• Can be complicated/confusing to write; results may not appear
as desired



Java-to-Database Through Hibernate

Association & Collection mapping tags practically identical
Hibernate Collection Types

-<set>
• Unordered/Ordered, requiring value column
– <map>
• Unordered/Ordered, requiring key and value
lcolumns
– <list>
Ordered requiring an index column on the• Ordered, requiring an index column on the
referenced object table
– <array>
• Map to Java Type and Primitive Arrays• Map to Java Type and Primitive Arrays
• Ordered, requiring an index column on the
referenced object table
– <bag>
• No direct implementation available in Java
• Unordered/ordered collection allowing duplicatesUnordered/ordered collection allowing duplicates
• Realized through Collection/List
• Requires value column
idb– <idbag>
• Used for many-to-many relationships
• Same as Bag but with additional identifierSame as Bag, but with additional identifier
column used for surrogate keys
• Requires an ID Generator just like Entity classes



03-hibernate-Association_and_Collection_Mapping
http://courses.coreservlets.com/Course-Materials/hibernate.html



  • Building a Hibernate Application

Define the domain model
2. Setup your Hibernate configuration
– hibernate.cfg.xml
3 C t th d i bj t i fil3. Create the domain object mapping files
– <domain_object>.hbm.xml
4 Make Hibernate aware of the mapping files4. Make Hibernate aware of the mapping files
– Update the hibernate.cfg.xml with list of mapping files
5 Implement a HibernateUtil class5. Implement a HibernateUtil class
– Usually taken from the Hibernate documentation
6. Write your code


02-hibernate-A_Simple_Example
http://courses.coreservlets.com/Course-Materials/hibernate.html




  • N-Tier Architecture


Application is made up of layers or tiers
– Each layer encapsulates specific responsibilities
– Enables changes in one area with minimal impact to other
areas of the applicationareas of the application

• Common tiers
– Presentation
• ‘View’ in model-view-controller
• Responsible for displaying data only.  No business logic
Service– Service
• Responsible for business logic
– Persistence
• Responsible for storing/retrieving data


01-hibernate-Introduction_to_Hibernate
http://courses.coreservlets.com/Course-Materials/hibernate.html




  • impedance mismatch

The object-relational impedance mismatch is a set of conceptual and technical difficulties that are often encountered when a relational database management system (RDBMS) is being used by a program written in an object-oriented programming language or style; particularly when objects or class definitions are mapped in a straightforward way to database tables or relational schema.


Mismatches

Object-oriented concepts
Encapsulation
Object-oriented programs are designed with techniques that result in encapsulated objects whose representation is hidden. Mapping such private object representation to database tables makes such databases fragile according to OOP (object-oriented programming) philosophy, since there are significantly fewer constraints for design of encapsulated private representation of objects compared to a database's use of public data, which must be amenable to upgrade, inspection and queries

Accessibility
In relational thinking, "private" versus "public" access is relative to need rather than being an absolute characteristic of the data's state, as in the OO model. The relational and OO models often have conflicts over relativity versus absolutism of classifications and characteristics.


Interface, class, inheritance and polymorphism
essential OOP concepts for classes of objects, inheritance and polymorphism are not supported by relational database systems


Mapping to relational concepts
Data type differences
A major mismatch between existing relational and OO languages is the type system differences. The relational model strictly prohibits by-reference attributes (or pointers), whereas OO languages embrace and expect by-reference behavior. Scalar types and their operator semantics are also very often subtly to vastly different between the models, causing problems in mapping.

For example, most SQL systems support string types with varying collations and constrained maximum lengths (open-ended text types tend to hinder performance), while most OO languages consider collation only as an argument to sort routines and strings are intrinsically sized to available memory. A more subtle, but related example is that SQL systems often ignore trailing white space in a string for the purposes of comparison, whereas OO string libraries do not. It is typically not possible to construct new data types as a matter of constraining the possible values of other primitive types in an OO language.



Structural and integrity differences
Another mismatch has to do with the differences in the structural and integrity aspects of the contrasted models. In OO languages, objects can be composed of other objects—often to a high degree—or specialize from a more general definition. This may make the mapping to relational schemas less straightforward. This is because relational data tends to be represented in a named set of global, unnested relation variables

Manipulative differences
The relational model has an intrinsic, relatively small and well defined set of primitive operators for usage in the query and manipulation of data, whereas OO languages generally handle query and manipulation through custom-built or lower-level, case and physical access path specific imperative operations


Transactional differences
relational database transactions, as the smallest unit of work performed by databases, are much larger than any operations performed by classes in OO languages




Solving impedance mismatch

Minimization
There have been some attempts at building object-oriented database management systems (OODBMS) that would avoid the impedance mismatch problem. They have been less successful in practice than relational databases however, partly due to the limitations of OO principles as a basis for a data model

Alternative architectures
The rise of XML databases and XML client structures has motivated other alternative architectures to get around the impedance mismatch challenges. These architectures use XML technology in the client (such as XForms) and native XML databases on the server that use the XQuery language for data selection. This allows a single data model and a single data selection language (XPath) to be used in the client, in the rules engines and on the persistence serve



http://en.wikipedia.org/wiki/Objecwt-relational_impedance_mismatch



  • Inheritance is one of the most visible facets of Object-relational mismatch. Object oriented systems can model both “is a” and “has a” relationship. Relational model supports only “has a” relationship between two entities. Hibernate can help you map such Objects with relational tables. But you need to choose certain mapping strategy based on your needs. 



1. Map one table per concrete class. Your mapping ignores the inheritance relationship and maps one table per concrete class. (implicit polymorphism)

2. Map one table per concrete class with union-subclass mapping. You still have one table per concrete class, but you use a “union-subclass” clause in your mapping. This helps mitigate some of the problems we will face in the previous strategy.

3. Map one table per class hierarchy. Here your table will have a row for all the fields in the full class hierarchy. You will have a lot of potential null values and you will have a discriminator column to hold type information.

4. Map one table per subclass. Here you convert the object oriented “is a” relationship into a relational “has a” relationship using foreign keys.


http://simsonlive.wordpress.com/2008/03/09/how-inheritance-works-in-hibernate/




  • inheritance models in Hibernate and describes how they work like vertical inheritance and horizontal



1. Table per concrete class with unions
2. Table per class hierarchy(Single Table Strategy)
3. Table per subclass
(omitting implicit polymorphism which is table per concrete class)


Example:
Let us take the simple example of 3 java classes.
Class TwoWheelerVehicle and FourWheelerVehicle are inherited from Vehicle Abstract class


1. Table per concrete class with unions
In this case there will be 2 tables
Tables: TwoWheelerVehicle, FourWheelerVehicle[all common attributes will be duplicated]

2. Table per class hierarchy
Single Table can be mapped to a class hierarchy
There will be only one table in database called 'Vehicle' that will represent all the attributes required for all 3 classes.
But it needs some discriminating column to differentiate between TwoWheelerVehicle and  FourWheelerVehicle;


3. Table per subclass
In this case there will be 3 tables represent TwoWheelerVehicle , FourWheelerVehicle and Vehicle



There are three possible strategies to use.
    Single Table Strategy,
    With Table Per Class Strategy,
    With Joined Strategy




http://www.dineshonjava.com/p/implementing-inheritance-in-hibernate.html#.UfoIF11jG70





  • There can be three kinds of inheritance mapping in hibernate


1. Table per concrete class with unions
2. Table per class hierarchy
3. Table per subclass

Example:
We can take an example of three Java classes like Vehicle, which is an abstract class and two subclasses of Vehicle as Car and UtilityVan.

1. Table per concrete class with unions
In this scenario there will be 2 tables
Tables: Car, UtilityVan, here in this case all common attributes will be duplicated.

2. Table per class hierarchy
Single Table can be mapped to a class hierarchy
There will be only one table in database named 'Vehicle' which will represent all attributes required for all three classes.
Here it is be taken care of that discriminating columns to differentiate between Car and UtilityVan

3. Table per subclass
Simply there will be three tables representing Vehicle, Car and UtilityVan


http://www.interviewjava.com/2007/10/explain-different-inheritance-mapping.html



  • Hibernate Object Lifecycle


hibernate considers objects it can
tl bi ffmanage to always be in one of four
states
Transient– Transient
– Persistent
– Removed
– Detached


Transient State
All objects start off in the transient
ttstate
– Account account = new Account();
• account is a transient object
Hibernate is not aware of the object
instance


Persistent State
Hibernate is aware of, and managing, the object
This is the only state where objects are saved to the
database


Persistent State
Session session =
SessionFactory getCurrentSession();SessionFactory.getCurrentSession();
// ‘transient’ state – Hibernate is NOT aware that it exists
Account account = new Account();Account account  new Account();
// transition to the ‘persistent’ state. Hibernate is NOW
// aware of the object and will save it to the databasej
session.saveOrUpdate(account);
// modification of the object will automatically bejy
// saved because the object is in the ‘persistent’ state
account.setBalance(500);
// it th t ti// commit the transaction
session.getTransaction().commit();


Removed State
A previously persistent object that is
deleted from the database
– session.delete(account);



Detached State
A persistent object that is still referenced
after closure of the active sessionafter closure of the active session
– session.close() changes object’s state from persisted to
detached


Saving Changes to the Database
Session methods do NOT save changes to
the databasethe database
– save();
– update();p ();
– delete();
These methods actually SCHEDULE
changes to be made to the databasechanges to be made to the database
Hibernate collects SQL statements to be
issued
Statements are later flushed to the database
– Once submitted, modifications to the database are not
permanent until a commit is issuedpermanent until a commit is issued
• session.getTransaction().commit();



Flushing the Context
Submits the stored SQL statements to
th d t bthe database
• Occurs when:
– transaction.commit() is called
– session.flush() is called explicitly
Before a query is executed– Before a query is executed
• If stored statements would affect the results of the quer



Cascading
Hibernate represents domain object
• Propagate the persistence action not only to
the object submitted, but also to any objects
associated with that object



05-hibernate-Object_Lifecycle_Persistence_and_Session_Management
http://courses.coreservlets.com/Course-Materials/hibernate.html




  • Transactions

Represents a single unit-of-work
All or nothing – either all of the actions get committed or the entire effort fails

Other resources can also participate in• Other resources can also participate in
transactions
– Java Messaging Service (JMS)gg ( )
• Roll back a message if something fails
– Legacy Systems
– Anything that leverages JTS (Java Transaction Service)
• TransactionManager Interface



  • Walked through Query by Criteria (QBC) and Query by 
Example (QBE) querying methods, and learned about the 
core Hibernate classes involved in querying
• Criteria
• Criterion
• Restrictions
• Property
• Order
• Projections


07-hibernate-Querying_QBC_and_QBE
http://courses.coreservlets.com/Course-Materials/hibernate.html


  • three ways of handling inheritance
– Single table per class hierarchy 
• InheritanceType.SINGLE_TABLE 
Tbl i l– Table per concrete entity class 
• InheritanceType.TABLE_PER_CLASS 
“join” strategy where fields or properties that are– join  strategy, where fields or properties that are 
specific to a subclass are mapped to a different 
table than the fields or properties that are pp
common to the parent class
• InheritanceType.JOINED 
MiiHib t’Iliit• Missing Hibernate’s Implicit 
Polymorphism

10-hibernate-JPA.pdf
http://courses.coreservlets.com/Course-Materials/hibernate.html



  • What is Connection Pooling? In many of our applications we need to connect to the database for various purposes such as inset, update , delete and retrieve the data from the DB. For each of these activities the application needs to connect to the database which is expensive in terms of resource as well as time. Instead of connecting to the database each time a user makes a request which requires database operation an application should use a pool of connections. Then each application thread that needs to access the database can request a connection from the pool and returns the same to the pool when all the database operations have been executed. This mechanism is called connection pooling.


Hibernate supports various types of connection pooling mechanisms such as C3P0, Apache DBCP, Proxool. C3P0 is an Open source connection pool that comes bundled with hibernate.


http://www.mindfiresolutions.com/How-to-configure-C3P0-connection-pooling-in-Hibernate-1649.php

nHydrate



  • nHydrate

nHydrate is a model driven development tool for Visual Studio. It allows you to create standard Entity Framework code based on a model. Your team can coordinate and use a single model to ensure that many layers of code are coordinated. This is not an ORM that simply creates some data-access code from a table-based model. It is a complete solution for coordinating code and database management in a single modelling tool.
http://www.nhydrate.org/


  • nHydrate

nHydrate is an object-relational mapping (ORM) solution for the Microsoft .NET platform providing a framework for a relational database to be mapped to .NET objects. It is designed to alleviate the drudgery software developers experience writing persistence domains.
nHydrate is free as an open source project on Codeplex.com under the Microsoft Public License (Ms-PL).
http://en.wikipedia.org/wiki/NHydrate

O/R Broke



O/R Broker is a JDBC library for Scala. It hides most of the JDBC api and wraps exceptions into more specific ones to allow for exception control flow
http://code.google.com/p/orbroker/

iBATIS



  • iBATIS

iBATIS is a persistence framework which automates the mapping between SQL databases and objects in Java, .NET, and Ruby on Rails. In Java, the objects are POJOs (Plain Old Java Objects). The mappings are decoupled from the application logic by packaging the SQL statements in XML configuration files. The result is a significant reduction in the amount of code that a developer needs to access a relational database using lower level APIs like JDBC and ODBC.

Other persistence frameworks such as Hibernate allow the creation of an object model (in Java, say) by the user, and create and maintain the relational database automatically. iBATIS takes the reverse approach: the developer starts with an SQL database and iBATIS automates the creation of the Java objects. Both approaches have advantages, and iBATIS is a good choice when the developer does not have full control over the SQL database schema. For example, an application may need to access an existing SQL database used by other software, or access a new database whose schema is not fully under the application developer's control, such as when a specialized database design team has created the schema and carefully optimized it for high performance.

On May 21, 2010 the development team decided to move from ASF to Google Code, changing the project name to MyBatis and making new releases there. As a consequence the Apache iBATIS project became inactive and was moved to the Apache Attic in June 2010
http://en.wikipedia.org/wiki/IBATIS



  • iBATIS Project Team Moving to Google Code

Eight years ago in 2002, I created the iBATIS Data Mapper and introduced SQL Mapping as an approach to persistence layer development.
http://ibatis.apache.org/

Where is deployment descriptor file located?



  • Deployment descriptor

For web applications, the deployment descriptor must be called web.xml and must reside in the WEB-INF directory in the web application root.

For Java EE applications, the deployment descriptor must be named application.xml and must be placed directly in the META-INF directory at the top level of the application .ear file.
http://en.wikipedia.org/wiki/Deployment_descriptor

Monday, October 22, 2012

Project Scope Statement



  • What to Include in a Project Scope Statement

The Scope Statement is an essential element of any project. Project managers use a Scope Statement to outline the results their project will produce and the terms and conditions under which they will perform their work. The people who requested the project and the project team should agree to all terms in the Scope Statement before actual project work begins.

Your Scope Statement should include the following information:



    Justification: How and why your project came to be, the business need(s) it addresses, the scope of work to be performed, and how it will affect and be affected by other related activities

    Objectives: The products, services, and/or results your project will produce (also referred to as deliverables)

    Product scope description: The features and functions of the products, services, and/or results your project will produce

    Product acceptance criteria: The process and criteria for accepting completed products, services, or results

    Constraints: Restrictions that limit what you can achieve, how and when you can achieve it, and how much achieving it can cost

    Assumptions: Statements about how you will address uncertain information as you conceive, plan, and perform your project


http://www.dummies.com/how-to/content/what-to-include-in-a-project-scope-statement.html


  • Project Scope Statement Example

http://onlinelibrary.wiley.com/doi/10.1002/9780470432723.app2/pdf



  • EXAMPLE OF PROJECT SCOPE STATEMENT



PROJECT OBJECTIVE
To construct a high-quality, custom home within five months at cost not to exceed $150,000.

DELIVERABLES
• A 2,200-square-foot, 2½-bath, 3-bedroom, finished home.
• A finished garage, insulated and sheetrocked.
• Kitchen appliances to include range, oven, microwave, and dishwasher.
• High-efficiency gas furnace with programmable thermostat.

MILESTONES
1. Permits approved—March 5
2. Foundation poured—March 14
3. Dry in. Framing, sheathing, plumbing, electrical, and mechanical inspections passed—May 25
4. Final inspection—June 7

TECHNICAL REQUIREMENTS
1. Home must meet local building codes.
2. All windows and doors must pass NFRC class 40 energy ratings.
3. Exterior wall insulation must meet an “A” factor of 21.
4. Ceiling insulation must meet an “R” factor of 38.
5. Floor insulation must meet an “R” factor of 25.
6. Garage will accommodate two large-size cars and one 20-foot Winnebago.
7. Structure must pass seismic stability codes.

LIMITS AND EXCLUSIONS
1. The home will be built to the specifications and design of the original blueprints provided by the customer.
2. Owner responsible for landscaping.
3. Refrigerator is not included among kitchen appliances.
4. Air conditioning is not included but prewiring is included.
5. Contractor reserves the right to contract out services.
6. Contractor responsible for subcontracted work.
7. Site work limited to Monday through Friday, 8:00 A.M. to 6:00 P.M.

CUSTOMER REVIEW
John and Joan Smith

exercises

  • you are hired to evaluate software project.you have got CPI and EV but not AC. CPI is  0.90 and EV is 170.000$ . How much money is spent on the project?


CPI=EV/AC then AC=EV/CPI = 188.888 $



  • Calculating the NPV and BCR for these alternatives gives the following results.



Project Alternative 1

Costs = £70m

Benefits = £104m

NPV = £100m - £70m = £34m

BCR = 100m/70m = 1.43



Project Alternative 2

Costs = £7m

Benefits = £12m

NPV = £12m - £7m = £5m

BCR = 12m/7m = 1.7

From this simple example it can be seen that while both alternatives provide a net positive outcome, the NPV and BCR methods of obtaining results provide slightly different outcomes. Using NPV suggests project alternative 1 provides the better outcome as the NPV of £34m is greater than the NPV of alternative 2 (£5m). However, using the BCR method alternative 2 would be chosen as a BCR of 1.7 is greater than the BCR of 1.43.

http://www.cbabuilder.co.uk/Results3.html

CMMI Maturity Levels


Here is a list of all the corresponding process areas defined for a S/W organization. These process areas may be different for different organization.


LevelFocusKey Process AreaResult
5
Optimizing
Continuous Process Improvement
  • Organizational Innovation and Deployment
  • Causal Analysis and Resolution
Highest Quality /
Lowest Risk
4
Quantitatively Managed
Quantitatively Managed
  • Organizational Process Performance
  • Quantitative Project Management
Higher Quality /
Lower Risk
3
Defined
Process Standardization
  • Requirements Development
  • Technical Solution
  • Product Integration
  • Verification
  • Validation
  • Organizational Process Focus
  • Organizational Process Definition
  • Organizational Training
  • Integrated Project Mgmt (with IPPD extras)
  • Risk Management
  • Decision Analysis and Resolution
  • Integrated Teaming (IPPD only)
  • Org. Environment for Integration (IPPD only)
  • Integrated Supplier Management (SS only)
Medium Quality /
Medium Risk
2
Managed
Basic Project Management
  • Requirements Management
  • Project Planning
  • Project Monitoring and Control
  • Supplier Agreement Management
  • Measurement and Analysis
  • Process and Product Quality Assurance
  • Configuration Management
Low Quality /
High Risk
1
Initial
Process is informal and Adhoc Lowest Quality /
Highest Risk


http://www.tutorialspoint.com/cmmi/cmmi-maturity-levels.htm

  • Process Area Organization

In CMMI models, the process areas are organized in alphabetical order according to their acronym. However, process areas can be grouped according to maturity levels or process area categories.

Maturity Levels: CMMI for Development

There are Five maturity levels. However, maturity level ratings are awarded for levels 2 through 5. The process areas below and their maturity levels are listed for the CMMI for Development model:
Maturity Level 2 - Managed
  • CM - Configuration Management
  • MA - Measurement and Analysis
  • PMC - Project Monitoring and Control
  • PP - Project Planning
  • PPQA - Process and Product Quality Assurance
  • REQM - Requirements Management
  • SAM - Supplier Agreement Management
Maturity Level 3 - Defined
  • DAR - Decision Analysis and Resolution
  • IPM - Integrated Project Management
  • OPD - Organizational Process Definition
  • OPF - Organizational Process Focus
  • OT - Organizational Training
  • PI - Product Integration
  • RD - Requirements Development
  • RSKM - Risk Management
  • TS - Technical Solution
  • VAL - Validation
  • VER - Verification
Maturity Level 4 - Quantitatively Managed
  • OPP - Organizational Process Performance
  • QPM - Quantitative Project Management
Maturity Level 5 - Optimizing
  • CAR - Causal Analysis and Resolution
  • OPM - Organizational Performance Management

Maturity Levels: CMMI for Services

The process areas below and their maturity levels are listed for the CMMI for Services model:
Maturity Level 2 - Managed
  • CM - Configuration Management
  • MA - Measurement and Analysis
  • PPQA - Process and Product Quality Assurance
  • REQM - Requirements Management
  • SAM - Supplier Agreement Management
  • SD - Service Delivery
  • WMC - Work Monitoring and Control
  • WP - Work Planning
Maturity Level 3 - Defined
  • CAM - Capacity and Availability Management
  • DAR - Decision Analysis and Resolution
  • IRP - Incident Resolution and Prevention
  • IWM - Integrated Work Management
  • OPD - Organizational Process Definition
  • OPF - Organizational Process Focus
  • OT - Organizational Training
  • RSKM - Risk Management
  • SCON - Service Continuity
  • SSD - Service System Development
  • SST - Service System Transition
  • STSM - Strategic Service Management
Maturity Level 4 - Quantitatively Managed
  • OPP - Organizational Process Performance
  • QPM - Quantitative Project Management
Maturity Level 5 - Optimizing
  • CAR - Causal Analysis and Resolution
  • OPM - Organizational Performance Management

Maturity Levels: CMMI for Acquisition

The process areas below and their maturity levels are listed for the CMMI for Acquisition model:
Maturity Level 2 - Managed
  • AM - Agreement Management
  • ARD - Acquisition Requirements Development
  • CM - Configuration Management
  • MA - Measurement and Analysis
  • PMC - Project Monitoring and Control
  • PP - Project Planning
  • PPQA - Process and Product Quality Assurance
  • REQM - Requirements Management
  • SSAD - Solicitation and Supplier Agreement Development
Maturity Level 3 - Defined
  • ATM - Acquisition Technical Management
  • AVAL - Acquisition Validation
  • AVER - Acquisition Verification
  • DAR - Decision Analysis and Resolution
  • IPM - Integrated Project Management
  • OPD - Organizational Process Definition
  • OPF - Organizational Process Focus
  • OT - Organizational Training
  • RSKM - Risk Management
Maturity Level 4 - Quantitatively Managed
  • OPP - Organizational Process Performance
  • QPM - Quantitative Project Management
Maturity Level 5 - Optimizing
  • CAR - Causal Analysis and Resolution
  • OPM - Organizational Performance Management

http://en.wikipedia.org/wiki/Process_area_%28CMMI%29




  • What is CMMI and what's the advantage of implementing it in an organization?

 It is a process improvement approach that provides companies with the essential elements of an effective process. CMMI can serve as a good guide for process improvement across a project, organization, or division.

 the areas which CMMI addresses:
 Systems engineering: This covers development of total systems. System engineers concentrate on converting customer needs to product solutions and supports them throughout the product lifecycle.

Software engineering: Software engineers concentrate on the application of systematic, disciplined, and quantifiable approaches to the development, operation, and maintenance of software.

Integrated Product and Process Development (IPPD): Integrated Product and Process Development (IPPD) is a systematic approach that achieves a timely collaboration of relevant stakeholders throughout the life of the product to better satisfy customer needs, expectations, and requirements. This section mostly concentrates on the integration part of the project for different processes. For instance, it's possible that your project is using services of some other third party component. In such situations the integration is a big task itself, and if approached in a systematic manner, can be handled with ease.

Software acquisition: Many times an organization has to acquire products from other organizations. Acquisition is itself a big step for any organization and if not handled in a proper manner means a disaster is sure to happen.

What's the difference between implementation and institutionalization?
Institutionalization is the output of implementing the process again and again. The difference between implementation and institutionalization is in implementation if the person who implemented the process leaves the company the process is not followed, but if the process is institutionalized then even if the person leaves the organization, the process is still followed.

http://www.indiabix.com/technical/software-testing/cmmi/


  • A maturity model is a business tool used to assess people/culture, processes/structures, and objects/technology.[1] Two approaches for designing maturity models exist. With a top-down approach, such as proposed by Becker et al.,[2] a fixed number of maturity stages or levels is specified first and further corroborated with characteristics (typically in form of specific assessment items) that support the initial assumptions about how maturity evolves. When using a bottom-up approach, such as suggested by Lahrmann et al.,[3] distinct characteristics or assessment items are determined first and clustered in a second step into maturity levels to induce a more general view of the different steps of maturity evolution. Topics that are covered in maturity models include
https://en.wikipedia.org/wiki/Maturity_model#PLM

  • What is a Maturity Model, and why use one?
The use of a maturity model allows an organization to have its methods and processes assessed according to management best practice, against a clear set of external benchmarks. Maturity is indicated by the award of a particular "Maturity Level"
http://www.apmg-international.com/en/consulting/what-maturity-model.aspx

  • A maturity model is a tool that helps people assess the current effectiveness of a person or group and supports figuring out what capabilities they need to acquire next in order to improve their performance. 
http://martinfowler.com/bliki/MaturityModel.html
 

work breakdown structure (WBS)



  • Work breakdown structure

A work breakdown structure (WBS), in project management and systems engineering, is a deliverable oriented decomposition of a project into smaller components
It defines and groups a project's discrete work elements in a way that helps organize and define the total work scope of the project.[

WBS is a hierarchical decomposition of the project into phases, deliverables and work packages. It is a tree structure, which shows a subdivision of effort required to achieve an objective
http://en.wikipedia.org/wiki/Work_breakdown_structure



  • Work Breakdown Structure (WBS)

The Work Breakdown Structure (WBS) provides a structural view into the project. It is an essential tool for planning and executing the project. Use the WBS to define the work for the project and to develop the project's schedule.


  • WBS Dictionary

The WBS Dictionary contains all the details of the Work Breakdown Structure which are necessary to successfully complete the project. Most importantly it contains a definition of each Work Package which can be thought of as a mini scope statement.
http://www.projectmanagementdocs.com/project-planning-templates/work-breakdown-structure-wbs.html

Risk Monitoring and Control



  • Tools and techniques to Risk Monitoring and Control

These are the five tools and techniques to Risk Monitoring and Control:

    Project risk response audits: Throughout the life cycle of the project, risk auditors examine and document the effectiveness of your risk response in avoiding, transferring, or mitigating risk occurrence, as well as the effectiveness of the risk owner.

    Periodic project risk reviews: Such reviews should be regularly scheduled to monitor the progress and any changes to the project.

    Earned value analysis: EVA is used for monitoring overall project performance against a baseline plan. If a project deviates significantly from the baseline, update your risk identification and analysis. See Appendix A for EVA formulas, charts, and examples.

    Technical performance measurement: This compares technical accomplishments during execution to the plan's schedule of technical achievement. For example, omitting a milestone introduces scope risks.

    Additional risk response planning: If an unanticipated risk emerges, or if its impact on objectives is greater than expected, the planned response may not be adequate. You may require additional response planning to control risk. This provides a feedback loop.
 
http://www.dummies.com/how-to/content/pmp-certification-controlling-risk.html



  • Monitor and Control Risks Tools and Techniques

http://www.youtube.com/watch?v=LLHduKVJhfo

risk assessment
risk audit
trend analysis
variance analysis
technical performance measurement
status meetings

Project charter


Project charter
In project management, a project charter, project definition or project statement is a statement of the scope, objectives and participants in a project
It provides a preliminary delineation of roles and responsibilities, outlines the project objectives, identifies the main stakeholders, and defines the authorityof the project manager. It serves as a reference of authority for the future of the project.
http://en.wikipedia.org/wiki/Project_charter



What is a project charter?

The project charter is a “document issued by the project initiator or sponsor that formally
authorizes the existence of a project, and provides the project manager with the authority to
apply organizational resources to project activities.”1

In addition to its contract purpose, the project charter includes most elements of a preliminary
project scope statement, which describes what is and what is not included in the project. It also
helps to control changes to the scope of the project throughout its duration or life cycle.
http://www.tbs-sct.gc.ca/emf-cag/project-projet/documentation-documentation/guide-guide/guide-guide-eng.pdf

Sunday, October 21, 2012

Singleton Pattern

  • Singleton Class in java

Singleton class is used when we want to restrict the creation of object outside the class, By keeping the constructor private. In singleton class object is created only once and we use single instance throughout the other classes ie only one instance.

Singleton class allows us to create object only once and allows global point of access to that instance.
http://www.linkedin.com/groupItem?view=&srchtype=discussedNews&gid=118012&item=174721706&type=member&trk=eml-anet_dig-b_pd-ttl-cn&ut=04hL0rGxGJyls1


  • Simply Singleton

Sometimes it's appropriate to have exactly one instance of a class: window managers, print spoolers, and filesystems are prototypical examples. Typically, those types of objects—known as singletons—are accessed by disparate objects throughout a software system, and therefore require a global point of access

The Singleton design pattern addresses all of the previous paragraph's concerns. With the Singleton design pattern you can:

    Ensure that only one instance of a class is created
    Provide a global point of access to the object
    Allow multiple instances in the future without affecting a singleton class's clients


http://www.javaworld.com/javaworld/jw-04-2003/jw-0425-designpatterns.html




  • How do I implement a Singleton pattern?

Singleton pattern used when we want to allow only a single instance of a class can be created inside our application. Using this pattern ensures that a class only have a single instance by protecting the class creation process, by setting the class constructor into private access modifier.
http://www.kodejava.org/examples/12.html




  • Singleton Pattern


Motivation
Sometimes it's important to have only one instance for a class. For example, in a system there should be only one window manager (or only a file system or only a print spooler).

Intent
Ensure that only one instance of a class is created.
Provide a global point of access to the object.

Implementation
The implementation involves a static member in the "Singleton" class, a private constructor and a static public method that returns a reference to the static member

Applicability & Examples
Example 1 - Logger Classes
Example 2 - Configuration Classes
Example 3 - Accesing resources in shared mode
Example 4 - Factories implemented as Singletons

http://www.oodesign.com/singleton-pattern.html





  • How many ways you can write Singleton Class in Java?


1) Singleton by synchronizing getInstance() method
2) Singleton with public static final field initialized during class loading.
3) Singleton generated by static nested class, also referred as Singleton holder pattern.
4) From Java 5 on-wards using Enums

more questions
14) Singleton vs Static Class?
15) When to choose Singleton over Static Class?
16) Can you replace Singleton with Static Class in Java?
17) Difference between Singleton and Static Class in java?
18) Advantage of Singleton over Static Class?

http://javarevisited.blogspot.com/2011/03/10-interview-questions-on-singleton.html#ixzz2HxMh1zPr

Oracle Communications ASAP


Converged Activation of Network and IT Services
Utilize a configurable, extensible converged activation system to rapidly activate consumer and business services in an automated manner on network and IT applications across multiple fixed and mobile domains.

http://www.oracle.com/us/products/applications/communications/service-fulfillment/asap/overview/index.html

Friday, October 19, 2012

How to Respond to Positive Risks


How to Respond to Positive Risks

On projects, risks can be identified through various project activities, such as during an Iteration Planning Meeting. Whatever the source, there are four ways to deal with positive risks:

    Exploit
    Share
    Enhance
    Accept


Exploit
Exploiting a positive risk is about ensuring everything is in place to increase the probability of the occurrence of the risk.

Share
Sometimes exploiting a positive risk is not possible without collaboration. Sharing a positive risk is when you collaborate with another department or organization to exploit a positive risk

Enhance
Enhancing a risk involves identifying the root cause of a positive risk so that you can influence it for a greater likelihood of the opportunity occurrin

Accept
At times, opportunities simply fall on your lap and you choose to accept them. This is called accepting a positive risk. It also means you AcceptPositive are acknowledging that you’d rather not Exploit, Share, or Enhance the risk.

http://www.brighthubpm.com/risk-management/48400-how-to-respond-to-positive-risks/

Risk breakdown structure


Risk breakdown structure
Risk Breakdown Structure (RBS) - A hierarchically organised depiction of the identified project risks arranged by category

When planning a project to meet targets for cost, schedule, or quality, it is useful to identify likely risks to the success of the project. A risk is any possible situation that is not planned for, but that, if it occurs, is likely to divert the project from its planned result. For example, an established project team plans for the work to be done by its staff, but there is the risk that an employee may unexpectedly leave the team.

In Project Management, the Risk Management Process has the objectives of identifying, assessing, and managing risks, both positive and negative. All too often, project managers focus only on negative risk, however, good things can happen in a project, "things" that were foreseen, but not expressly planned.

The objective of Risk Management is to predict risks, assess their likelihood and impact, and to actively plan what should be done ahead of time to best deal with situations when they occur.

The RBS can also help the project manager and the risk manager to better understand recurring risks and concentrations of risk that could lead to issues that affect the status of the project

http://en.wikipedia.org/wiki/Risk_breakdown_structure

The PMI Code of Ethics and Professional Conduct


The PMI Code of Ethics and Professional Conduct
Interpersonal project team conflicts. Challenges with project sponsors. Vendor negotiations. Cultural differences. Government regulations. Project professionals interact with many different types of people, and often are faced with various ethical dilemmas throughout their careers.

Deciding what is ethical can be challenging, and the answers may differ depending on your organization and culture.

To provide some guidance, PMI volunteers helped to develop the PMI Code of Ethics and Professional Conduct. All PMI members and credential holders must sign the code, agreeing to adhere to a high standard of ethical behavior.

http://www.pmi.org/en/About-Us/Ethics/~/media/PDF/Ethics/ap_pmicodeofethics.ashx

Contingency reserve vs. management reserve



  • Contingency reserve vs. management reserve 


both refer to money used to account for a risk that has triggered, there is a difference.

    Contingency reserve - This is your fund for “known-unknowns“. That means you’ve already identified the risk; you just don’t know how much it will impact your project. This can be estimated based on the sum of all of your risks’ expected values.
    Management reserve - This is for the “unknown-unknowns“. Basically, you didn’t even identify the risk until it has occurred. This may be derived from using percentage of the overall project budget.
   
http://pmsecrets.blogspot.com/2008/01/contingency-reserve-vs-management.html




  • Contingency Reserve vs Management Reserve


Contingency Reserves: Contingency Reserve is the cost, or time reserve that is used to manage the identified risks or “known-unknowns” (known=identified, unknowns=risks). Contingency Reserve is not a random reserve, it is a properly estimated reserve t based on Expected Monitory Value (EMV), or Decision Tree Method.

Contingency Reserve is controlled by the project manager. He has the authority to use it when any identified risk occurs, or he can delegate this authority to risk owner, who will use it at appropriate time and informs the project manager at later stage.

Management Reserve: Management Reserve is the cost, or time reserve that is used to manage unidentified risks or “unknown-unknowns” (unknown=unknown, unknowns=risks). Management Reserve is not an estimated reserve, it is defined as per organization’s policy. For some organization, it is 5% of total cost, or time of the project and for some others – 10%.

Management Reserve is controlled by someone outside the project team, usually from the management. Every time, when an unidentified risk occurs, project manager has to take approval from the management to use this reserve.

Here discussion about the contingency reserve and management reserve finishes, but before we leave let us summarized all key points once again:

Contingency Reserve:

    used to manage identified risks
    estimated based on Expected Monitory Value (EMV), or decision tree method
    project manager has authority to use this reserve.

Management Reserve:

    used to manage unidentified risks
    calculated as a percentage of cost, or time of project
    required management approval to use this reserve.

http://pmstudycircle.com/2012/02/contingency-reserve-vs-management-reserve/#axzz29h4Sxbij

Risk Register


Risk Register
A Risk Register is a Risk Management tool commonly used in Project Management and organisational risk assessments. It acts as a central repository for all risks identified by the project or organisation and, for each risk, includes information such as risk probability, impact, counter-measures, risk owner and so on. It can sometimes be referred to as a Risk Log (for example in PRINCE2).
http://en.wikipedia.org/wiki/Risk_register

Manage Stakeholder Expectations Process


The process of communicating and working with stakeholders to meet their needs and addressing issues as they occur.


  • Inputs


Stakeholder register

Stakeholder management strategy

Project management plan

Issue log

Change log

Organizational process assets




  • Tools and Techniques


Communication methods

Interpersonal tools

Management tools




  • Outputs


Organizational process assets updates

Change requests

Project management plan updates

Project document updates


http://leadinganswers.typepad.com/leading_answers/104-manage-stakeholder-expectations.html

Thursday, October 18, 2012

Conflict Resolution Techniques



  • Techniques for Conflict Resolution


• Behavioral Techniques
o Don’t negotiate when angry.
o Forget the past and stay in the present.
o Focus on the problem not the person.
o Communicate feelings assertively, NOT aggressively. Express
concerns without blaming the other side.
o Expect and accept another’s right to disagree. Don’t push or
force compliance; work to develop common agreement.
o Don’t view the situation as a competition where one has to win
and the other has to lose. Work toward a solution where both
parties have some of their needs met.
o Build ‘power with’ NOT ‘power over’ others.
o Thank the person for listening.



• Negotiation Techniques

o Identify and define the conflict in specific terms.
o Focus on areas of common interest and potential areas for
agreement.
o NEVER jump to conclusions or make assumptions about what
another is feeling or thinking.
o Listen without interrupting; ask for feedback if needed to assure
a clear understanding of the issue.
o Generate alternative solutions.
o Discuss the pros and cons of the alternatives. Listen as well as
state your case.
o Select the best course of action that all can agree upon.
o Implement only the parts of the plan that are in agreement.
Remember, when only one person’s needs are satisfied in a
conflict, it is NOT resolved and will continue.
o Follow-up to evaluate the effectiveness of the plan and make
any adjustments necessary.

http://www.pbs.org/newshour/extra/teachers/lessonplans/world/july-dec09/techniques_for_conflict_resolution.pdf





  • When conflicts go unaddressed, they can have a negative impact on productivity and teamwork. Using conflict resolution strategies in the workplace will help maintain a healthy work environment. Conflict resolution requires specific leadership skills, problem solving abilities and decision making skills. Consider the following conflict resolution techniques to help resolve issues in your office


http://www.notredameonline.com/conflict-resolution-in-the-workplace/




  • Conflict Management Techniques


Conflict situations are an important aspect of the workplace. A conflict is a situation when the interests, needs, goals or values of involved parties interfere with one another. A conflict is a common phenomenon in the workplace. Different stakeholders may have different priorities; conflicts may involve team members, departments, projects, organization and client, boss and subordinate, organization needs vs. personal needs. Often, a conflict is a result of perception. Is conflict a bad thing? Not necessarily. Often, a conflict presents opportunities for improvement. Therefore, it is important to understand (and apply) various conflict resolution techniques.


Forcing

Also known as competing. An individual firmly pursues his or her own concerns despite the resistance of the other person. This may involve pushing one viewpoint at the expense of another or maintaining firm resistance to another person’s actions.

Win-Win (Collaborating)

Also known as problem confronting or problem solving. Collaboration involves an attempt to work with the other person to find a win-win solution to the problem in hand - the one that most satisfies the concerns of both parties. The win-win approach sees conflict resolution as an opportunity to come to a mutually beneficial result. It includes identifying the underlying concerns of the opponents and finding an alternative which meets each party's concerns.


Compromising

Compromising looks for an expedient and mutually acceptable solution which partially satisfies both parties.


Withdrawing

Also known as avoiding. This is when a person does not pursue her/his own concerns or those of the opponent. He/she does not address the conflict, sidesteps, postpones or simply withdraws


Smoothing

Also known as accommodating. Smoothing is accommodating the concerns of other people first of all, rather than one's own concerns.


http://www.hrpersonality.com/Resources/ConflictManagementTechniques.aspx




  • Conflict Resolution Techniques


Avoidance Approach
Stay out of conflict; remain neutral on issues.  Employed by individuals that do not have enough invested in the issue to see value in the conflict.  Often used when the conflict is not critical or is perceived to be beyond their capacity to manage.


Domination Approach
Remain singularly focused on one resolution to a conflict.  These individuals will not readily yield and often fail to recognize the value of alternatives.


Accommodation Approach
Entirely yielding to the conflicting point of view.  Seeking to preserve personal relationships even when it does benefit project tasks and objectives

Compromise Approach
Assumes that no solution can be achieved that will yield complete satisfaction for all participants involves. Attempts to balance personal relationships and project success when one or both may be compromised in the conflict.

Consensus Approach
Mutual agreement and understanding between all conflicting parties.  Leads to project success while simultaneously reinforcing personal relationships.  Is often the lengthiest resolution to a conflict, but produces the most favorable results.

http://projectmechanics.com/conflict-management/conflict-resolution-techniques

Wednesday, October 17, 2012

course pages



BM348 -Tasarim Kaliplari
http://members.comu.edu.tr/msahin/

Advanced Object-Oriented Systems
http://people.engr.ncsu.edu/efg/591O/s98/lectures/javaDesignPatterns/ppframe.htm


CMSC446 Introduction To Design Patterns
http://userpages.umbc.edu/~tarr/dp/spr06/cs446.html

Design Patterns in Java

http://alumnus.caltech.edu/~croft/research/java/pattern/

CSC407H Lectures: Summer 2006

http://www.cdf.utoronto.ca/~csc407h/summer/lectures.shtml


  • Design pattern online tests

http://www.interqiew.com/tests?type=dp


Project Cost Management


  • Project Cost Processes

ProcessProject PhaseKey Deliverables
Estimate CostsPlanningActivity Cost Estimates,Basis of estimates
Determine BudgetPlanningCost performance baseline
Control CostsMonitoring and ControllingWork performance measurements





4-The Estimate Costs process takes the following inputs -

    Scope baseline
    Project schedule
    Human resource plan
    Risk register
    Enterprise environmental factors
    Organizational process assets


5-Depreciation is technique used to compute the estimated value of any object after few years. There are three type of depreciation techniques. These are
    Straight line depreciation The same amount is deprecated (reduced) from the cost each year.
    Double-declining balance - In the first year there is a higher deduction in the value - twice the amount of straight line. Each year after that the deduction is 40% less than the previous year.
    Sum of year depreciation - Lets say the life of an object is five years. The total of one to five is fifteen. In first year we deduce 5/15 from the cost, in second year we deduce 4/15, and so on.

6-Analogous Estimating is an estimating technique with the following characteristics -

    Estimates are based on past projects (historical information)
    It is less accurate when compared to bottom-up estimation
    It is a top-down approach
    It takes less time when compared to bottom-up estimation
    It is a form of an expert judgment


7-In Parametric Modeling Estimation, you use a mathematical model to make an estimate. It is of two types.

    Regression Analysis
    is a mathematical model based upon historical information.
    Learning Curve model is based upon the principal that the cost per unit decreases as more work gets completed.


8-Bottom up estimation is same as WBS estimation. It involves estimating each work item and adding the estimates to get the total project estimate.


Planned Value (PV) refers to what the project should be worth at this point in the schedule. It is also referred as BCWS (Budgeted Cost of Work Scheduled).

Earned Value (EV) is the physical work completed to date and the authorized budget for that. It is also referred as BCWP (Budgeted Cost of Work Performed).

Actual Cost (AC) is the actual amount of money spent so far. It is also referred as ACWP (Actual Cost of Work Performed)

Estimate At Completion (EAC) refers to the estimated total cost of the project at completion.


CPI refers to Cost Performance Index. It is defined as
  CPI = EV/AC
If CPI is less than 1, this means that the project is over budget.


BAC refers to Budget at Completion. It is related to EAC.
  EAC = BAC/CPI


ETC refers to Estimate to Completion. It is defined as
  ETC = EAC - AC

CV refers to Cost Variance. It is defined as
  CV = EV - AC


SV refers to Schedule Variance. It is defined as
  SV = EV - PV
  Negative cost or schedule variance means that project is behind in cost or schedule.


  VAC refers to Variance At Completion. It is defined as
  VAC = BAC - EAC


   For example, in the first month the project will require $10,000. Cost estimating involves defining cost estimates for tasks. Cost budgeting defines cost estimates across time.
 
 
   The tools and techniques used for Estimate Costs are -

    Expert judgment
    Analogous estimating
    Parametric estimating
    Bottom-up estimating
    Three-point estimates
    Reserve analysis
    Cost of quality
    Project Management estimating software
    Vendor bid analysis


The after project costs are called life cycle costs.

http://www.preparepm.com/notes/cost.html




  • Project Management Formulas

http://69.13.149.40/Students/Formulas.htm



Earned Value Management - EVM

Budget At Completion (BAC)


    Budget At Completion (BAC) is the total budget allocated to the project.

    Budget At Completion (BAC) is generally plotted over time. Say like periods of reporting ( Monthly, Weekly etc. )

    BAC is used to compute the Estimate At Completion ( EAC ), explained in next section.

    BAC is also used to compute the TCPI and TSPI

BAC is calculated using the following formula

BAC = Baselined Effort-hours * Hourly Rate



Estimate To Complete (ETC)

    Estimate To Complete (ETC) is the estimated cost required to complete the remainder of the project.
 
    Estimate To Complete (ETC) is calculated and applied when the past estimating assumptions become invalid and a need for fresh estimates arises.

ETC is used to compute the Estimation at Completion (EAC).




Estimate At Completion (EAC)

    Estimate At Completion (EAC) is the estimated cost of the project at the end of the project.

    There are three methods to calcualte EAC

        Variances are Typical - This method is used when the variances at the current stage are typical and are not expected to occure in the future.

        Past Estimating Assumptions are not valid - This method is used when the past estimating assumptions are not valid and fresh estimates are applied to the project.

        Variances will be present in the future - This method is used when the assumption is that the current variances will be continue to be present in the future.

    The formula for calculation of the three methods are as given below:

        AC + ( BAC -EV )

        AC + ETC ( Estimate to complete )

        AC + ( BAC- EV ) / CPI



  http://www.tutorialspoint.com/earn_value_management/evm_formula.htm





  • How to Calculate Earned Value Analysis


Earned value analysis (EVA) is a project evaluation tool.
It evaluates how much work should have been done, how much money has been spent and the value of work done.
EVA gives an assessment of the project -- its efficiency and problem areas, if any.

You must compute three performance metrics --
cost performance index (CPI),
schedule performance index (SPI)
cost schedule index (CSI)
--to perform a valid analysis.

the budget at completion (BAC), which is basically the budget for your project. For instance, if you have budgeted $500,000 to finish project "A" your BAC is $500,000

the budgeted cost of work scheduled (BCWS). Suppose you planned to complete project A in five months, accomplishing 20 percent of the project every month. BCWS is the percent of planned completion, converted to decimal form and then multiplied by BAC.
Using our example, BCWS = 0.2 * $500,000 = $100,000.

your actual cost of work performed (ACWP), or cost of work completed. For instance, if you've spent $150,000 in the first month and have accomplished 10 percent of the project, your ACWP is $150,000.

budgeted cost of work performed (BCWP). BCWP is the percent of actual work performed converted to decimal form and then multiplied by BAC.
Using our example, BCWP = 0.1 * $500,000 = $50,000.


cost performance index (CPI). CPI is BCWP divided by ACWP.
In our example, CPI = $50,000 / $150,000 = 0.33.
This means that for every dollar spent, the project is generating only 33 cents worth of work. You are over your budget. Ideally, $1 spent should generate $1 of work. This should prompt an investigation of the project


schedule performance index (SPI). SPI is BCWP divided by BCWS.

Using our example, SPI = $50,000 / $100,000 = 0.50.
This indicates that the project team is completing only 30 minutes of work for what is supposedly one hour of work. You are behind schedule.


your cost schedule index (CSI). CSI is CPI multiplied by SPI.

Using our example, CSI = 0.33 x 0.50 = 0.16.
This implies that our sample project is behind schedule and over budget. The farther CSI is from 1.0, the less likely the project will be able to financially recover. It will be the responsibility of the project sponsor and project manager to seriously consider abandoning the project to limit financial losses.

http://www.ehow.com/how_8446348_calculate-earned-value-analysis.html





  • Calculate Cost Performance Index (CPI) and Schedule Performance Index (SPI)



    Cost Performance Index (CPI index): Represents the amount of work is being completed on a project for every unit of cost spent. CPI is computed by EV / AC. A value of above 1 means that the project is doing well against the budget.
    Schedule Performance Index (SPI index): Represents how close actual work is being completed compared to the schedule. SPI is computed by EV / PV. A value of above one means that the project is doing well against the schedule.


Earned Value Analysis Example 1
Suppose you have a budgeted cost of a project at $900,000. The project is to be completed in 9 months. After a month, you have completed 10 % of the project at a total expense of $100,000. The planned completion should have been 15 %.
Now, let’s see how healthy the project by computing the CPI index and SPI index.


Earned Value Analysis - Example 2
Suppose you are managing a software development project. The project is expected to be completed in 8 months at a cost of $10000 per month. After 2 months, you realize that the project is 30 % completed at a cost of $40,000. You need to determine whether the project is on-time and on-budget after 2 months.

http://www.brighthubpm.com/monitoring-projects/57944-calculating-cost-performance-index-and-schedule-performance-index/





  • Example:


Two projects have their cost performance index calculated. Both projects are 10 percent over budget at the time of the calculation. Project One has a budget of $1,000,000, and Project Two has a budget of $10,000. These budget figures are the amounts that should have been spent as of today’s date. We will assume that the project is on schedule at this point in time. What is the cost performance index for each?

Project One is over budget by 10 percent of its budget or $100,000.

Project Two is also over budget by 10 percent of its budget or $1,000.

CPI = BCWP / ACWP

The BCWP is $1,000,000 for Project One.

The ACWP is $1,100,000 for Project One ($1,000,000 + $100,000).

The BCWP is $10,000 for Project Two.

The ACWP is $11,000 for Project Two ($10,000 + $1,000).

CV = BCWP – ACWP

The cost variance for Project One is $1,000,000 ? $1,100,000 or ? $100,000. The cost variance for Project Two is $10,000 ? $11,000 or $1,000 The CPI for Project One is $1,000,000 / $1,100,000 or 0.909. The CPI for Project Two is $10,000 / $11,000 or 0.909.

Notice that the size of the project does not make any difference in the calculation of the index. Projects that are each behind 10 percent have the same value for their cost performance index. This makes assessing the health or sickness of projects of different sizes much easier.

http://pmtips.net/earned-reporting-cost-performance-index/






  • CPI


The cost performance index is a ratio that measures the financial effectiveness of a project by dividing the budgeted cost of work performed by the actual cost of work performed. If the result is more than 1, as in 1.25, then the project is under budget, which is the best result. A CPI of 1 means the project is on budget, which is also a good result. A CPI of less than 1 means the project is over budget. This represents a risk in that the project may run out of money before it is completed.

CPI Example

For example, assume a project has a budgeted cost of $10,000 but actually cost only $8,000. Dividing $10,000 by $8,000 produces a CPI of 1.25, which means the project is 25 percent under budget.
SPI

The CPI is only one aspect of determining the progress of a project. The other is the schedule performance index, or SPI. This is also a ratio that divides the budgeted cost of work performed by the budgeted cost of work scheduled.


SPI Example

For example, assume a project has two people working full time, and that each person costs the company $1,250 a week. A project is one week behind at the time of the calculation. One week times two people at $1,250 a week equals $2,500, which represents the amount by which the schedule is behind. If the budgeted cost of worked scheduled at that time is $6,000, you subtract the $2,500 from that cost to come up with the budgeted cost of work performed at $3,500. Dividing $3,500 by $6,000 produces an SPI of 0.53. As with the CPI, SPI values under 1 are not good because they mean the project is behind schedule. A value of 1 means the project is on schedule, and a value more than 1 means the project is ahead of schedule.
EVA

Earned value analysis, or EVA, looks at the relationship between the CPI and SPI, including such factors as the schedule and cost variances, to judge how a project is doing. It often involves graphing CPI and SPI over the life of a project. In a nutshell, the closer these numbers are to 1, the more likely it is that a project will be completed on time and on budget. While keeping one or both values over 1 is a worthwhile goal, it may indicate original assumptions were unrealistically rosy. The worst situation is to have one or both numbers under 1 over an extended period of time. The lower those numbers are under 1 and the longer the time, the less likely it is that the project can recover from such the deficit. It may also mean that not enough money and time were originally scheduled.


http://smallbusiness.chron.com/project-management-cpi-numbers-mean-35541.html




  • EXAMPLE


project total budget is 80000 $
CPI is 0.95
project has spent 25000$
how much money do you need to spend more??

BAC=80000
CPI=0.95
EAC(estimation at completion)

EAC = BAC/CPI=80000/0.95=84210

ETC refers to Estimate to Completion.
AC=25000
EAC=84210

  ETC = EAC - AC=84210-25000=59210

  you need 59210 $ more to complete project



JSP Expression Language



  • JSP Expression Language


JSP Expression Language (EL) makes it possible to easily access application data stored in JavaBeans components. JSP EL allows you to create expressions both (a) arithmetic and (b) logical. Within a JSP EL expression, you can use integers, floating point numbers, strings, the built-in constants true and false for boolean values, and null.

http://www.tutorialspoint.com/jsp/jsp_expression_language.htm


  • Expression Language


A primary feature of JSP technology version 2.0 is its support for an expression language (EL). An expression language makes it possible to easily access application data stored in JavaBeans components. For example, the JSP expression language allows a page author to access a bean using simple syntax such as ${name} for a simple variable or ${name.foo.bar} for a nested property.
http://docs.oracle.com/javaee/1.4/tutorial/doc/JSPIntro7.html



  • Expression Language in JSP 2.0

Expression Language was first introduced in JSTL 1.0 (JSP Standard Tag Library ). Before the introduction of JSTL, scriptlets were used to manipulate application data.JSTL introduced the concept of an expression language (EL) which simplified the page development by providing standerd tag libraries. These tag libraries provide support for common, structural tasks, such as: iteration and conditionals,
processing XML documents, internationalization and database access using the Structured Query Language (SQL).

The Expression Language introduced in JSTL 1.0 is now incorporated in JavaServer Pages specification(JSP 2.0).

http://www.javabeat.net/2007/08/expression-language-in-jsp-2-0/

Monday, October 15, 2012

Interrupt



  • Interrupts

Defn: an event external to the currently executing process that causes a change in the normal flow of instruction execution; usually generated by hardware devices external to the CPU
Typically indicate that some device needs service
http://www.cs.toronto.edu/~demke/469F.06/Lectures/Lecture6.pdf



  • Interrupts

An interrupt is an exception, a change of the normal progression, or interruption
in the normal flow of program execution.
An interrupt is essentially a hardware generated function call.
Interrupts are caused by both internal and external sources.
An interrupt causes the normal program execution to halt and for the interrupt
service routine (ISR) to be executed.
At the conclusion of the ISR, normal program execution is resumed at the point
where it was last.
http://web.engr.oregonstate.edu/~traylor/ece473/lectures/interrupts.pdf

Interrupt vector


Interrupt vector
An interrupt vector is the memory address of an interrupt handler, or an index into an array called an interrupt vector table that contains the memory addresses of interrupt handlers. When an interrupt is generated, the Operating System saves its execution state via a context switch, and begins execution of the interrupt handler at the interrupt vector.
http://en.wikipedia.org/wiki/Interrupt_vector


interrupt vector
An interrupt vector is the memory location of an interrupt handler, which prioritizes interrupts and saves them in a queue if more than one interrupt is waiting to be handled.
http://whatis.techtarget.com/definition/interrupt-vector

Hardware Interrupt Handling
interrupt vector associates handlers with interrupts
http://www.cs.toronto.edu/~demke/469F.06/Lectures/Lecture6.pdf


Operating Systems
In memory (specified by the hardware) the OS stores an interrupt vector, which contains the address of the interrupt handler
http://www.cs.nyu.edu/courses/spring09/V22.0202-002/lectures/lecture-06.html

Firewall


Firewall
A firewall can either be software-based or hardware-based and is used to help keep a network secure. Its primary objective is to control the incoming and outgoing network traffic by analyzing the data packets and determining whether it should be allowed through or not, based on a predetermined rule set
http://en.wikipedia.org/wiki/Firewall_(computing)

Firewall Stateful versus Stateless
state
snapshot, freeze frame in memory
context-sensitive

9.3 Understanding Stateful vs Stateless Inspection
statefull firewalls, OSI layer 3,4,5
keeps track of the state of the connection
UDP connectionless
state references TCP state 
most common deployed firewalls
state table; source,destination,port,sequencing,flag
state table processed by ACL
limitations; udp,icmp etc protocols do not contain state information 
  • STATELESS Firewalls
A stateless firewall filter, also known as an access control list (ACL), does not statefully inspect traffic. Instead, it evaluates packet contents statically and does not keep track of the state of network connections.The basic purpose of a stateless firewall filter is to enhance security through the use of packet filtering. The typical use of a stateless firewall filter is to protect the Routing Engine processes and resources from malicious or untrusted packets.

STATEFUL Firewall

Stateful firewalls can watch traffic streams from end to end. They are aware of communication paths and can implement various IP Security (IPsec) functions such as tunnels and encryption. In technical terms, this means that stateful firewalls can tell what stage a TCP connection is in (open, open sent, synchronized, synchronization acknowledge or established). It can tell if the MTU has changed and whether packets have fragmented. etc.
https://www.cybrary.it/0p3n/stateful-vs-stateless-firewalls/

  • A stateful firewall is capable of tracking connection states, it is better equipped to allow or deny traffic based on such knowledge.  A TCP connection for example goes through the handshake (SYN-SYN+ACK-SYN), to EASTABLISHED state, and finally is CLOSED. A stateful firewall can detect these states.  If a packet belongs to an already running flow it can be allowed, while a new connection form the untrusted host can be dropped.

When to use Stateless firewall?

A stateless firewall can be a faster and less resource intensive alternative in the following cases

    Server side firewall: If you are running a purely server application with well-known ports on a machine. In this case firewall can be explicitly programmed to allow connection to and from the server port. As the server ports are well known to the firewall and the server expects new connection anyway, stateless firewalls can handle this use case.
    Client side firewall: A client program which strictly connect to a small set of trusted hosts (internal) can be protected using stateless firewalls with specific rules
https://chandanduttachowdhury.wordpress.com/2018/03/25/stateful-vs-stateless-firewalls-which-one-to-use-when/

  • When an IP session, for instance on the TCP protocol, is initiated, and the connection is authorised - let's assume, an HTTP connection from an internal network towards an external web site on port 80 - the firewall will keep track of who has started the connection and to which destination, will inspect and understand the information exchanged inside the communication, and will open other ports accordingly to allow the connection to be instantiated and maintained  - for instance, the firewall has to accept the acknowledge packet from the server, and to do that, it has to allow the reply happening on a certain port from the server back to the client, maybe perform the NAT/P (Network and Port Address Translation) down to the client (if it was placed for instance in a private range addressing).  This network opening happens "on the fly" in the firewall, as normally the same packet would not be allowed from external to internal, if the session was not initiated from the internal

As opposed to stateful firewalls, stateless have no such capabilities.  They only basically keep a list of ports that are allowed or not, and are not able to adjust them dynamically depending on the protocol involved.  This means for instance that in the case of a client on an internal network connecting to an FTP server on an outside network, you would need to allow the outgoing FTP port from client to server, and then a range of high ports (for "high" ports it is meant any port > 1024) connecting between the client and the server; the stateless firewall cannot open the high port on the fly, and therefore you need to keep all the ports that can be possibly negotiated open all the time, which of course exposes your surface to many more risks

Stateless firewalls are basically ACL (Access Control List) based, that is, they are the software that often provides ACLs on routers.
Stateless filtering is still used in certain cases, especially in WAN networking

For instance, let's assume you need to allow a third party to connect to your corporate network via VPN, and you are using router as a site-to-site VPN terminator; this router does not support stateful filtering, and you cannot afford for any reason to install a proper stateful firewall, but you still want to somehow limit the access this external company has to your network - I am aware it is not really a secure filtering, but ACLs can be better than nothing.

let's assume you have Cisco routers which do not support stateful filters, but you still want to apply some security - for instance on WAN or links.  Routers and other equipment are used as WAN network hops or BGP routers to direct Internet traffic; generally, you cannot afford installing a firewall in front of every Internet-exposed router, and therefore you would limit filtering to simple ACLs (for instance allowing ICMP packets on the public interface and management only to the internal interface)

https://www.quora.com/What-is-the-difference-between-stateful-and-stateless-firewalls-Are-there-different-applications-for-each

  • A Next-Generation Firewall (NGFW) is an integrated network platform that is a part of the third generation of firewall technology, combining a traditional firewall with other network device filtering functionalities, such as an application firewall using in-line deep packet inspection (DPI), an intrusion prevention system (IPS). Other techniques might also be employed, such as TLS/SSL encrypted traffic inspection, website filtering, QoS/bandwidth management, antivirus inspection and third-party identity management integration
https://en.wikipedia.org/wiki/Next-Generation_Firewall

  • Next-Generation IPS
However, because IPS’s alone lack the processing power they need to handle the overwhelming amount of traffic, as well as encrypted traffic, the technology is often deployed in a passive detection mode only. Through intelligent traffic management and SSL offloading, our BIG-IP platform works in unison with IPS, enabling the infrastructure to focus on identifying and mitigating threats to your network.
https://f5.com/solutions/enterprise/reference-architectures/next-generation-ips

  • Cisco Firepower Next-Generation IPS (NGIPS) threat appliances combine superior visibility, embedded security intelligence, automated analysis, and industry-leading threat effectiveness
http://www.cisco.com/c/en/us/products/security/ngips/index.html
Two important terms used in Cisco IOS Zone Based Firewall terminology are Zones and Zone Pairs
A Zone can be defined as a logical grouping of one or more networks
zones can be created in IOS and then the router interfaces can be assigned to specific zones. Network traffic between zone interfaces is controlled by zone policy. 
http://www.omnisecu.com/ccna-security/what-are-zones-and-zone-pairs.php
the basic config and options of Cisco IOS zone based firewall using the Topology below Grab the initial configs and GNS3
https://www.m00nie.com/2011/03/simple-zone-based-ios-firewall-gns3-lab/
Configuring the Zone-Based Firewall
A Zone-Based Firewall assigns each interface to a specific zone. The firewall zones will be used to define what traffic is allowed to flow between the interfaces. The traffic that originates in the EdgeRouter itself will also be assigned to a zone: the local zone.
https://help.ubnt.com/hc/en-us/articles/204952154-EdgeRouter-Zone-Based-Firewall
Zone Based Firewall Configuration Example
Zone Based Firewall is the most advanced method of a stateful firewall that is available on Cisco IOS routers. The idea behind ZBF is that we don’t assign access-lists to interfaces but we will create different zones. Interfaces will be assigned to the different zones and security policies will be assigned to traffic between zones. 
https://networklessons.com/cisco/ccie-routing-switching/zone-based-firewall-configuration-example
  • Next-Generation Intrusion
Prevention System - NGIPS Pre-emptive threat prevention against known,unknown, and undisclosed threats.
https://www.trendmicro.com/en_us/business/products/network/integrated-atp/next-gen-intrusion-prevention-system.html

  • Forefront Unified Access Gateway (UAG)
Forefront Unified Access Gateway (UAG) provides remote client endpoints with access to corporate applications, networks, and internal resources via a Web portal or site.
https://technet.microsoft.com/en-us/library/ff358694.aspx


  • Unified threat management (UTM) or unified security management (USM), is a solution in the network security industry, and since 2004 it has gained currency as a primary network gateway defense solution for organizations.[1] In theory, UTM is the evolution of the traditional firewall into an all-inclusive security product able to perform multiple security functions within one single system: network firewalling, network intrusion prevention and gateway antivirus (AV), gateway anti-spam, VPN, content filtering, load balancing, data loss prevention, and on-appliance reporting.

https://en.wikipedia.org/wiki/Unified_threat_management

  • First, BIG-IP AFM offers high-speed, application-aware firewall rules that allow security personnel to manage their layer 4 network. Second, BIG-IP AFM is aware of 38 types of DDoS attacks and automatically alerts and mitigates them (organizations can further define their own DDoS scenarios). Finally, BIG-IP AFM offers, for the first time, granular visibility and logging at the application level, allowing organizations to slowly begin to deprecate their zone abstractions and provide instrumentation directly to the individual application teams
https://f5.com/zh/resources/white-papers/the-application-delivery-firewall-paradigm

  • What is a UTM Firewall?
In the early days of network security, a firewall merely filtered traffic based on ports & IP addresses. Over time, firewalls continued to evolve by keeping track of the state of network connections passing through the appliance, which we call "stateful."

organizations deployed multiple appliances, each with differing roles to defend against different classes of attacks

    A stateful packet inspection firewall allowed inbound & outbound traffic on the network
    An additional web proxy filtered content & URLs while scanning with antivirus services
    A separate Intrusion Prevention System (IPS) was often deployed to detect & block malicious traffic
    An appliance was needed for spam filtering to filter junk emails & phishing attempts
    VPN servers connected remote offices or allowed remote users to access company resources
UTM firewalls could now collocate multiple security services into one appliance, providing robust network protection against a plurality of attack types
Benefits that UTM provided

    UTM firewalls protected inbound & outbound traffic from a multitude of threats & attack types
    Antivirus, anti-malware, & anti-spyware services could run concurrently to prevent attacks at the gateway
    Integrated Intrusion Prevention blocked the exploit of vulnerabilities
    Email filtering blocked unwanted emails like spam & email-borne threats
    Web sites & web content could be filtered & monitored from the same central command dashboard
    Control & visibility over traffic flows improved with Quality of Service enhancements & bandwidth management
    Working remotely became more convenient with the ability to connect easily to remote locations with a site-to-site VPN
    Simplification of complex networks allowed for dynamic routing, policy-based routing, & multiple Internet connections on a single secure network

On to the Next Generation

The most current iteration of firewall appliances are referred to as Next Generation Firewalls, or NGFWs. 
This current generation saw major improvements in the coordination & communication between the multiple services that UTM firewalls consolidated. Artificial intelligence, machine learning, & automation began to feature in these cutting-edge services, allowing for improvements in threat intelligence & response times that a human administrator alone could not reach.manufacturers heavily emphasized "Single-Pane-Of-Glass" (SPOG) management platforms in which all relevant dashboards & interfaces could be viewed & interacted with through a single portal or page, removing the need to bounce around multiple tabs while managing a network

Benefits that NGFWs provide

    Real-time, automated communication between services allows for devices to be isolated & quarantined after an incident until IT can respond
    Cloud-based sandboxing technology allows for the quarantine & detonation of potentially harmful files
    Everything from NAT policies, content filtering, user groups, access control lists, Wi-Fi, & more can be managed through a single screen
    Emphasis is placed on maintaining network performance even with multiple complex security services operating in tandem
    Integrated Intrusion Prevention with deep packet scanning
    Ability to identity & control hosted & cloud-based applications


https://www.firewalls.com/what_is_utm_firewall

  • How does a firewall work?
 It can permit or block any port number, web application, and network-layer protocols based on configuration.

Common ports:

    80  HTTP
    443  HTTPS
    20 & 21  FTP
    23  Telnet
    22  SSH
    25  SMTP

  • What are the types of firewalls?
The National Institute of Standards and Technology (NIST), an organization from the US, divides firewalls into three basic types: Packet filters, Stateful inspection, and Proxy.

Packet filters permit or block packets based on port number, protocols source, and destination address.

Stateful inspection works on the principle of the state of active connections between client and server. It uses state information to allow or block network traffic.

Proxy firewall combines stateful inspection technology to enable deep packet inspection. Here, the firewall act as a proxy; a client makes a connection with the firewall, and then the firewall makes a separate connection to the server on behalf of the client.

  • What is source-routed traffic and why is it a threat?
It allows a sender of a packet to partially or completely specify the route the packet takes through the network.
Generally, the router decides the route from destination to source.
If source-routed traffic allows through the firewall, an attacker can generate traffic claiming to be from a system "inside'' the firewall. In general, such traffic wouldn’t route to the firewall properly, but with the source routing option, all the routers between the attacker's machine and the target will return traffic along the source route's reverse path


 Most commercial routers incorporate the ability to block source routing specifically, and many versions of Unix that might be used to build firewall bastion hosts have the ability to disable or to ignore source routed traffic. 

 
 Source Routed Packets
 
Drop Source Routed IP Packets - (Enabled by default.) Clear this checkbox if you are testing traffic between two specific hosts and you are using source routing.
IP Source Routing is a standard option in IP that allows the sender of a packet to specify some or all of the routers that should be used to get the packet to its destination.
This IP option is typically blocked from use as it can be used by an eavesdropper to receive packets by inserting an option to send packets from A to B via router C. The routing table should control the path that a packet takes, so that it is not overridden by the sender or a downstream router.

How Does Source Routing Work?

In the Internet Protocol (IPv4), there are built-in header options for a sender of a packet to force the path instead of taking the normal best possible routing implemented by every routing protocol. Specifically, the rarely used Strict Source Route (SSR) and Loose Source Route (LSR) header options are what enables source routing mechanism. In the IPv6, the header that allows for source routing is called Type o Routing (RHo).

In the IPv4, a partial or complete list of nodes on the network can be determined by using the LSR and SSR fields respectively. In this case, node address list can not be greater than 40 bytes long, that is the size maximum size of IPv4 option part of header. This allows for defining 9 routing nodes at most for IPv4 networks.

In IPv6 on the other hand, source routing is implemented in an extension header which is not limited in size. Assuming packet fragmentation is not allowed, IPv6 extension header size will be limited only by the maximum size of a packet defined by TCP MTU (Maximum Transmission Unit). In this case 90 routing nodes can be defined inside a packet where the MTU is 1500 bytes.

source routing is not considered secure and as suggested by IETF, it needs to be disabled by default on networking devices and on operating system

Attack 1: Information Gathering
Even if source routing is not allowed on a network, an attacker can send an IP packet and use the ICMP (Internet Control Message Protocol) response to get information (E.g., operating system) about the target computer or network device. For this reason, the default configuration should be to drop IP source route packets in order to prevent leaking information about the network devices and their configuration.

Attack 2: Network Topology Discovery
Source routing can be used by attackers to probe the network by forcing packets into specific parts of the network.

Attack 3: IP Spoofing

LSR can allow an attacker to spoof an address and successfully receive response packets by forcing return traffic for spoofed packets to pass through the attacker’s device. For this reason, packets marked as LSR are usually blocked on the Internet.

Attack 4: Bypass Security Measures

Attack 5: Network Congestion (DoS)
 in IPv6, source routing is implemented in an extension header which is not limited in size. Depending on the the IPv6 configuration, this can allow an attacker to define 90 nodes or more to force packets to pass through on the network. This could lead an attacker with limited upload link to congest the network significantly, resulting in DoS (Denial of Service).

https://cybersophia.net/articles/what-is/what-is-source-routing/
 http://dev.fyicenter.com/Interview-Questions/Computer-Security-2/What_is_source_routed_traffic_and_why_is_it_a_th.html
http://help.sonicwall.com/help/sw/eng/9510/26/2/3/content/Firewall_Advanced.070.3.htm