Monday, April 30, 2007

Bravo Sri Lanka

As I was thinking before the big game; if SL win the toss there will be 75-25 chance of winning but if Aussies did it will be just 10-90 chance. Nevertheless we started well and Aussies couldn't do much - they only managed to score their lowest score in first 10 overs albeit the match is reduced to 38 over. Malinga did exceptionally well but Mahela had to pull Vass early 'coz of Gilchrist started aggressive pick up. We were targeting big Hayden but less focus went to Gilchrist who hasn't done much in the WC.
When play finally did start my eyes were on Vaas, who bowled the first over, It became quickly apparent that one of the finest bowler of swing could not find a shade of movement due to prevailing conditions, I was highly disappointed knowing that a high-scoring match looked on the cards; When a batsman like Gilchrist start scoring with 150% rate in the final is more than enough to add extra pressure despite the fact that rest of the batting did only average. I heard about Clive Lloyd's first WC century and Viv's in Second WC but Aravinda's '96 century is still the best for me. It was the only century made in the second innings of a WC final. Nevertheless in reply, Jayasuriya and Sangakkara gave us a glimmer of hope with a stand of 116, but the Kangaroos eventually sealed their World Cup hatrick win after rain delayed, reduced overs, dramatic encounter. They were the only two batsmen who attacked all Aussie bowlers and gave bit of hope and pride to me.
Today morning one of my work mate (Ausie) - Julian came to my desk and told me that "I don't like McGrath much but it was amazing the way Gillie hammered; Kumar and Sanath also hammered all our bowlers -it was unbelievable - I thought we're going to loose the grip" I was really proud about Sri Lankan team - they didn't let us down. In reply I told him that "we had a chance but luck was with Gillie". I added, SL's plan was to get in to semis and work from there - eventually we did that but I really wanted them to prove Aussies are beatable (we've done that many times even in Australia). Being runner-up is more than something for our little country. In an encounter like this we gotta be really sharp and should be able to make half-chances to our side. Dilhara did have a chance to end Gilchrist's innings on 31 but could not take an awkward return catch off his own bowling. These are crucial if a team wants to beat powerful teams like Aussies. We have seen in the past when Jayasuriya start hammering around not any bowler wanted to ball. Batsman like him can take away everything from opponents however they don't perform that often. Same goes to Gilchrist - powerful big hitter who can grab the match away from any team. Unfortunately it happened on 28th after winning the toss. It was a colossal damage nevertheless we responded strongly yet nothing came our way. Not even little bit of luck nor weather was sympathetic.

I thought we played really good cricket up to now, but that was a very special innings from Gillie. "The way he batted in a World Cup final was brilliant and totally took the game away from us." Chivalrous Mahela said at the end.

I'm very proud of SL team performance throughout the WC. We did exceptionally well to reach finals. Well Done Sri Lanka!

Friday, April 27, 2007

Application Firewalls - Pragmatic way to fend emerging attacks?

Reason for me to write this blog entry is two fold, firstly typical Gartner statistics cited that by the year of 2009, 80% of enterprises will fall victim of application layer attacks (another handy marketing phrase for typical InfoSec consultants) secondly to discuss practicality and effective deployment to avoid possible false positive.

Why these application layer attacks are becoming prominent and successful? Simple answer is: application layer attacks are fundamentally designed to circumvent or bypass network centric controls that we have implemented over the past decade, such as port blocking using ACLs. Classic example to describe how attackers getting smarter than earlier; unlike those days attackers use "malicious propagating" rather than "botting" and planning a DDoS (yet most destructive attacks method). Most of emerging worms propagate by using security vulnerabilities in the HTTP protocol suit. Most leading Application layer FWs (such as Checkpoint Power with SmartDefence) allows detecting and blocking worms based pre-defined patterns.

Consider typical web application attacks, conventional firewalls protecting a web server by placing it in the DMZ and blocking all sort of ports but allowing tcp port 80 and 443. So what's wrong with it? Sadly, traditional firewall can not distinguish desirable port 80 traffic from undesirable - malicious port 80 traffic. Imagine a SQL injection or long URL/Large header to overrun the buffer of a web server (many buffer-overflow attacks require a very large header to be sent to the web server). Arguably it's a good security practice to limit the sizes of in HTTP request and response, this helps to reduce the chance for buffer overruns and limits the size of `code` that can be inserted into the header.

Application firewalls has the ability to perform upper-layer inspection of web traffic before it reaches the Web server. The devices are able to deep inspect request packets and analyze the nature and type of commands are complies with relevant RFC standard. For example, The HTTP RFC allows a restricted set of HTTP methods. However, even some of the standard methods are unsafe, because they can be used to exploit vulnerabilities on a web server. HTTP methods can be break into three sets: Standard safe (GET, HEAD and POST), standard unsafe and WebDAV. In Checkpoint NGx FWs with Smart defense technology by default, all methods are blocked other than the standard safe methods.

Sounds very complex and slow to deploy but application FWs have great potential. Even in the test environment I had to adopt a cautious approach, conducting careful analysis and extensive testing. It is amazing how easily would end up blocking legitimate traffic. It's still painful and need careful consent with our web application developers and also to convince them that the technology will help the company more than it will hinder their day to day lives.

Finally and important strategy that can be adopted in deploying application layer FWs is to start with passive mode. Begin with monitoring without actually blocking any traffic. This will help you to get a better view. Before FW is actually put into active mode, lots of monitoring is a must. I'm sure you don't want you e-comm server sending TCP reset packets to customers. We still have problems with new CISCO ASA FWs with AIP-SSM IPS module, which needs extensive testing in a fully loaded lab. These FWs acting as the border FWs and sit on top of CheckPoints. More importantly once the FW is deployed in the active mode, it should be watched very carefully with greater patient. Logs needs to be carefully scrutinized because that will tell you an interesting story. Record all blocked attacks and you could use them to justify ROI of company's security investment. There will be always false-positive, and they need to be further analyzed perhaps with web developers to balance the security and the usability.

Compared to packet filters/statefull FWs, application FWs are not a panacea. You may have to use web/application vulnerability tools test your web/application servers exposures. Effective yet continuous web vulnerability management strategy and finely tuned application FW would definitely complement each other.

Thursday, April 26, 2007

Bravura Performance

Sri Lankan skipper Mahela Jayawardene's last night impeccable innings of pure class and rare inning, when it was most needed as we claimed the rightful place in the final of the 2007 World Cup, second time in the history of the big game. Opening batsman Tharanga played his part, as did Murali, who picked up 4 wickets and spun Kiwis out for only 208, who have reached the semi finals five times and never moved ahead.

I still can remember Mahela's miserable (previous) '03 world Cup, which failed to reach double figures in the tournament, everyone was furious about his contribution. After four years, he bounced back and led the country with utmost confident to the final with a carefully crafted inning. (Reminds me Aravinds's '96 semi final inning when team was in trouble) Mahela cool headedly absorbed pressure and made his unbeaten maiden century (equaled the highest world cup semi final score ever - Gooch's 115 against India in '87) with such perfection. It was an unforgettable world cup inning played under preasure. At the lunch break, Nick Night was asked by David Gover (in Sky Sports) regarding SL 289 score and his response was "Plenty" - I looked at the statistics after the match and realized it was the second highest score in a World Cup semi final.

Tharanga gave a confident answer to selectors with his 73 of 74 balls. Arguably Marven is (was) a better batsman than Upul but didn't play a single game in the tournament. Surely it wasn't the right time to gamble and Tharanga deserves an opportunity in the big game to prove his potential. Splendid Murali did the miracle again; Kiwis couldn't read him at all. Kiwis needed a sound start and a magnificent spell from enigmatic Malinga ensured they did not get one. Flemming decided to step down from his captaincy after he played the wrong line to Malinga's sling swinger which came back in to the left hander.

Sri Lankan teams target was to reach Semis and work forward from there. Now we are in big finals, what's next? At the time of writing, Ausies have dismissed South Africa for just 149 and batting for a quick finish. Nevertheless pumped up Sri Lankan team is ready to surprise any team with greater confidence. Our team is a well balanced with rare talent to overpower strong teams. Hopefully selectors will address "Dilhara" issue; perhaps Maharoof might get the game of his life. As Mahela said at the press conference "though Sanath missed out here but hopefully he can get a big one in the final." If not still we have many players to make bigies.

Off you go Lions - Bring back that pride again. It means a lot for our Cricket.

Monday, April 23, 2007

Lara – the great contender

Even exceptional will have to work hard to fill his shoes, his statistics are just phenomenal!
West Indies captain, arguably best batsman in the modern era, Brian Lara has retired from all international cricket after Saturday's thrilling World Cup match against England.

As an ardent fan of the game I have a huge respect for West Indies not only because they play humbly but they are a team who enjoys and respects opponents’ cricket. Most Carbines comes to watch “game of cricket” not necessarily to see home team winning. They really know how to respect and enjoy the game. I always enjoyed watching Lara batting as same as great Lloyd and Viv. The Irony is that I enjoy watching Lara batting (especially in Test matches) rather than Jayasuriya.

For me most memorable moments of Lara’s cricketing career are (obviously) breaking of the 36-year-old mark with his 375 against England in Antigua in 1994 and Unbeaten 400 against England after 10 years in the same ground and ironically against same team – England. Next was Lara’s 4, 6, 6, 4, 4, and 4 off a Robin Pietersen over in 2003 to break the world record of most runs in an over and his epic double century, to pass the Allan Border's world record total of 11,174, against Australia at the Adelaide Oval.

At the end of his great cricketing career, sudden fame turned him into a confused and conflicting figure. Lara's headship style has been called into question by West Indies past players including Michael Holding, who called for him to be replaced as captain even before they were knocked out of the competition. However former West Indies captain, cricket legent Sir Garfield Sobers insisted Lara was not responsible for the team's under-performance. He captained his side in 47 Tests, winning 10, but under his captaincy West Indies won the 2004 ICC Champions Trophy by beating England at The Oval. I think deteriorating West Indies cricket management is more responsible for the catastrophe of the team. After Ambrose-Walsh retirement they couldn’t find right replacement (or haven’t groomed anyone) to continue the West Indies fierce pace attack nor steady opening pair to replace Haynes-Greenidge.

LARA Facts :
Born: Cantaro, Trinidad 2.5.69
131 Tests
11,953 runs, average 52.88, 34x100, 48x50, highest score 400no
299 ODIs
10,405 runs, average 40.48, 19x100, 63x50, highest score 169
First class cricket
21, 993 runs, average 51.38, 64x100, 87x50, highest score 501no

"I want to be remembered as a batsman who provided entertainment to the fans," - Brian Charles Lara

Sunday, April 22, 2007

Beyonce Experience

I am not a huge fan of western music but I can literally enjoy anything. The "Beyonce Experience" is a 2007 worldwide concert tour by singer, songwriter, and actress Beyonce Knowles which kicked off on 10th April in Tokyo, Japan and tonights it is scheduled for Ausie fans. I wasn't a fan nor ever listen to her music but I have enjoyed her latest musical movie "Dream Girls" which won three Golden Globe Awards ceremony in 2007, including Best Picture - Musical or Comedy, and won two Oscars at the last Academy Awards. Beyonce's performance catches anyone off guard with her beautifully subtle performance.

Avi thinks she is best female singer in the modern world and she doesn't want to miss the big opportunity but she thought I'm not going to enjoy it. Initially I thought it's gonna be packed with thousands of teens and I would find it extremely bore. We boked our seats from Ticketek three months before knowing that it wil be a sell out. By the way we watched `Dream Girls` month ago and I was highly impressed by her performance and thought I would be able to stay alive in the show.

We drove to the Acer Arena (Sydney Olympic Park) hour before the start. It's only 10 minutes drive from where we live. Chris Brown who started the show with his acrobatic dancing and with some good POP and R&B stuff. He kept the crowd alive till the big moment. Super Dorm was packed with a record crowd. (17,000 fans) and everyone started screaming for Beyonce…I started scanning all over to see anyone besides teens, there were more than few.. at least 15 percent of the crowd. I felt bit young afterwards.…Luckily ourseats were in front of the stage with a straight view. Last time when we were here (for the "Walking with the Dinosaurs") our seats were more to the right side of the stage and not the ones with best view but this time we got the best 'coz I managed to book tickets within the first 15 minutes of the on-line release. It was a dog fight!

Anyways Avi was so happy jumping up and down…. Show started at a rapturous pace that leaves everyone breathless and delivered performances that are both subtle and fittingly over the top. I have never seen such high quality stage set-up, lighting was implausible and superbly done. She was awesome and blew everyone away with her striking voice and impeccable performance.

Avi enjoyed till the end and so did I, at least I wasn't petulant.

Tuesday, April 17, 2007

Cunning Tactic

2007 ICC world cup telecast time is a nightmare for people living in Down Under due to GMT +10 but I didn't miss many from last 45+ encounters. Being an ardent fan that supports Lankans always find verbal skirmish with Ausies very stimulating. Mingling with them for couple of years I'm amused to see them, with struts out with a chip on their shoulder, talks about unmatchable Cricketability of the crick-roos.

I'm not surprised of the tactics used by Lankan's but didn't like when Mahela tried to defend resting stars. Nevertheless, we have the sole right to pick our team and that is neither ICC nor commentators job. Some commentators suffer with athazagoraphobia or some variant of acarophobia...they gotta get treated soon otherwise soon there will be a need for an alternative for cricket commentary. We expect bit of professionalism from these Gents...Did anybody argued when Ausies picked a lousy team for Chappell-Hadley tournament last February? In fact Kiwis made a mockery of them by winning all three and adding another 2 worst world records for Ausies. (After loosing to SA in 2006 scoring mammoth 434-4) So where was the great Chappell at that time? You're right….. he was in the commentary box without any comments.

With a positive atttude,
Sri Lankan selector Asantha de Mel said, SL is already in Semis and pretty confident that they will beat Kiwis again and determined that big moment should come in the final in 12 days. He added "Last time we (full team) met Ausies 2 years ago - but cricket has changed now" adding to that they have never faced Mainga in ODIs. I think Vaas and Murali factor is more perilous than two years... so obviously resting Lankans top guns means unexpected to be expected at the final level. (If Lankan go through)

Channel 9 (free to air in Ausie) telecasting only Ausie playing matches, haughty Ian Healy also furious on TV with Lankan team card. Ausies never expected this and obviously they wanted to boost team moral by beating SL full team…when unexpected happened they got panic attacks. Rather than talking about strategy that opponents worked out they started criticizing the SL captain and selectors. I just remembered a handy Latin word for all this - "Ad Hominem"

It seems iniquitous Michael Holding lost some big money due to Lankan's cunning tactic, He believes the current format is open to corruption..! (Instead of talking about abysmal WI performance) he said this morning "I have an account with Betfair (betting giant) and I watch a lot of different markets. "Before the game started, Australia was 1-2. "As soon as the toss went to air, when (Betfair) found out, Australia went to 1-5 because Muralitharan wasn't playing, Malinga wasn't playing, Vaas wasn't playing."

No wonder he was so disturbed…

Even Chappell's suggestions "It was ridiculous, disgraceful, and the ICC has got to ask some questions." dropped without considering by match referee Mike Procter who had no problems with Sri Lanka's decision and said he would not take action.

Whenever I start write about Cricket will end-up not doing any till dawn, Shall post this now.

Good Luck to Sri Lankan team!

IPv6? When?

4.3 Billion Internet address space is being heavily utilized and Internet Corporation for Assigned Names and Numbers (ICANN) contends that a "revolution has just started; you ain't seen nothing yet" The advent of Internet protocol Version 6 (IPv6) means the current capacity of the Internet will be expanded to 340 trillion trillion trillion addresses. For us (Australia), the advent of IPv6 should mean a clear revolution in how the Internet is used for business but alas speed is still a major issue. Australia lags behind other developed countries in introducing high-speed Internet services despite the fact that ADSL 2.0 has just been rolled out by major telecoms. However, we remain left behind as developed giants like China, takes far more innovative approaches to Internet delivery and use. For instance, China has recognized the need for fast internet services in rural provinces by connecting villages with fibre-optic cable and access to high-speed Internet services. Their purpose was to offer locals the opportunity to build online businesses and stop the flow of rural Chinese to the coastal economic zones. In Australia, Telstra owns nearly 80% of all the major long-haul fibre and microwave points of presence across the country but, fibre-to-the-node (FTTN) network project is still a political debate.

IPv6 is coming whether you like it or not - Australia is losing ground to Europe and Asia, where Europe already has 37% of all IPv6 addresses and Asia has 21%. Many major Japanese companies are already IPv6 compliant.

China has already formed the IPv6 industrial chain. The Global IPv6 Summit (which was held on 12-13 April '07) is the most influential IPv6 summit worldwide. This years IPv6 forum Policy statement says "Set the date for termination of (IPv4) allocations and the date of announcement" Simultaneously with the adoption of IPv6 in 2008 for the Olympic Games, large scale IPv6 commercial use will be implemented by China's four major carriers.

When I first heard about IPv6, in 2002 at a ISP/IXP workshop, CISCO house in Bangalore, India my first impression was that it was a "premature baby" primarily because there were many areas still to be addressed at that time. According to the IPv6 Forum CTO, PKI for IPsec issues are still not completely resolved in the market place and key to wide deployment of end-to-end. So basically after five years we are still at the same place. Should say Australia is that ignorant.

The question remains, will there be a monopoly of IPv4 addresses by 2009-10? While current IPv6/IPv4 traffic ratio at Internet Exchanges is only 0.1% and DNS queries show 10% IPv6 support, rapid deployment expected in 2007/2008 as Windows Vista has IPv6 enabled the default and Linux deploys of it's miredo(teredo implementation)

There are many benefits of IPv6 roll-out even for the end-users; including restoration of the end-to-end Internet model, larger number of addresses, new Node Discovery Architecture, Stateless Auto-configuration, and the enhancements to Mobile IPv6 routing.

A little bit on the architecture…

According to RFC 4291 (IP Version 6 Addressing Architecture) IPv6 addresses are 128 bits long and typically comprised of two logical parts: a 64-bit (sub-) network prefix, and a 64-bit host part, which is either automatically generated from the interface's MAC address or assigned sequentially.

Furthermore, a global view into the IPv6 routing tables, which displays ISPs are deploying IPv6, can be found by looking at the SixXS Ghost Route Hunter pages: these pages display a list of all allocated IPv6 prefixes and give colors to the ones that are actually being announced in BGP. ISPs that provide IPv6 connectivity to their customers can be found in the Where can I get native IPv6 FAQ

As an Architect of a Telecom company I cannot wait for this transition, but must therefore contribute to this Internets massive revolution.

Value the Customer

When networking with peers, especially product managers we always argue on the right balance of five P's regardless of the product (diverse effect on off-the-shelf to search engine marketing). We are confronted with the mantra of enhancing shareholder value as the reason for being in business. In other words, the reason to exist in business is to increase the wealth of its owners. Regrettably, preoccupation of this rationale has led to several corporate disasters according to Marketing top guns.
If I put my MBA hat on, the real reason for being in any sort of business is to bring value to the customer. The customer has to fork out money if the transaction does not represent value to the customer; the business fails and shareholder value goes down. But that's not the end of it. More pre-sales engineers want to be involved in an ethical exchange with the customer. They want to feel that what they are doing gives more meaning to their lives at an ethical level, and that the customer is the beneficiary. Moreover, they want to take the ownership of the solution and obviously they will be accountable. In my experience, architects, designers and pre-sales engineers are frequently prevented from achieving this level of fulfillment because of the dictates of their peers and the lack of alignment between senior management and behind the scene staff. Does this arise due to the fact that most senior management comes from sales/finance backgrounds? or could it be because they are not up to date and tech savvy? This is often depicted in the failure to build organizational effectiveness to ensure customer satisfaction due to poor post-sale execution. Some argue this could be frequently compounded by the preoccupation of management with incentives to secure managerial goals.