Forums
Sep 07Secure This
by in Feature Articles on 2007-10-30It's common knowledge that a security system is only as effective as its weakest point. You can install a reinforced steel door with a two-phase palm-print/retinal-scan entry to protect your home, but if you leave a first-floor window open, you're more vulnerable than your neighbor with a simple deadbolt. One of Nate's clients learned this lesson first hand with its e-commerce Web site. The operation didn't involve terribly sensitive data: there were no bank accounts, no Social Security numbers, nor even any credit card numbers. Pre-approved customers would simply sign in and place their orders. Accounts payable and fulfillment would take it from there.
Yet the Web site painted a different picture, featuring two-factor authentication, encrypted databases and a giant padlock graphic advertising "secure."
Fresh out of college, and used to being the only woman in my engineering and computer science classes, I wasn't quite sure what to expect in the real world. I happily ended up finding a development job in a company which was nowhere near as unbalanced as my college classes had been. The company was EXTREMELY small and the entire staff, except the CEO, was in one office. I ended up sitting at a desk next to the office admin, another woman who was hired a month or two after me.
Many years back, Vinay's company phased out Form 11.18-B, or, as it was more commonly known, the vacation request form. Along with it went Form 11.18-M (sick day request form), Form 11.12-B (absence cancellation form) and Form 12.11-B (absence exceed form). They were all rolled into the new Absence Processing System (APS) as part of the company's Process Improvement Process, a far-reaching initiative to technologize all things bureaucratic. Most employees didn't care for the new APS. Before going electronic, applying for vacation was simple: Have your manager sign Form 11.18-B, send the yellow copy to HR and keep the pink one. Using the APS meant opening up the application, trying to remember your APS password, clicking to the vacation request form, filling it out and then telling your manager to follow the same steps in order to approve it. 
As most development managers know, the FBI's Virtual Case File (VCF) system has become the epitome of the software industry's most expensive failed project. Running taxpayers between $100 and $200 million dollars over four years, the VCF delivered little more than a mountain of useless documentation, nearly a million lines of code that will never run in production and a whole lot of costly lessons. Worse still, the lessons offered from this multi-million dollar failure could have just as easily been found in a $50 software engineering textbook. In fact, the major factors behind VCF's failure read much like such a book's table of contents: 
When Eric C. arrived at his new job, it was with a huge sense of relief. His old workplace had been a haven for cowboy coders and anarchic hackers, where the only semblance of consistency was in everyone's preference to modify code directly in production.