Build agile is not about hiring few technically good team members, placing some process in place and expecting everything works as desired. Many of this trails have seen dark side of agile mismanagement in the industry.

Creating agile teams is all about team dynamics & values development for sustaining the success and most importantly retain it for consistently repeating it. Let us try and understand if we can carry back common things to do for creating agile teams.

Irrespective of development methodologies if we can build some basic traits in the people we can always build great teams. A successful agile software development team is mix of skilled developers , with established team values, has good communication, and is always looking to improve. While having every one of these components isn’t absolutely critical for success, having all of them will make the road to success much shorter. To make organizations agile vision true one has to establish couple of things at org level to reap better benefits:

1) Establish core principles (eg: culture you want to build which internal yields to lot of things like learning, collaboration, openness etc)

* Learning

* Collaboration

* Building Mutual Trust

* Self Managing

2) Continuous & consistent Communication model

3) Zeal for improvement

* Technology

* Process

Drawing the org level agile team building road map requires the leadership to make the core principles as DNA of the company. Conduct the fore field analysis to understand the dynamics of the change and introduce the structural changes. Build a dash board to track the program with criteria metrics mapped for success. There are special leadership models/styles to be put in place, what are those & how to do that has to wait of some other post

Share your comments, thoughts, experiences & challenges with creating agile teams.

Why pilots are successful?

·         It is organized/staged event to prove point

·         Best of the people are put together a great show

·         Agile looked as best cost driving factor for company

·         Collaboration which is the key for success is more evident in team

Why agility fails at enterprise level?

·         Problems we are trying to fix is more complex than the pilot

·         Driving the change in team is different from enterprise-wide change

·         Team problems are different than enterprise problems

·         Deviation in implementation of strategy & tactics for success

·         One point agenda of being cost hungry

Are we sounding that there are no ways to achieve the enterprise agility, no we do have ray of hope i.e. evaluate the enterprise needs to plan the agility. The core things enterprises needs to do is how to drive and bring change in an organization may be most of the enterprises needs to what Toyota did with its TPS (Toyota Production System) & GE did with its Six Sigma focus to leverage their internalization of process customized for their success in external world.

How to achieve this for every enterprise might vary as each enterprise is unique in its own existence, scaling agile to enterprise has its roots in its own strengths to learn & grow. How to innovate on those lines is probably a good discussion for other post till then keep innovating for enterprise success.

Please share your views & experiences, if you want to discuss do reach me directly.

EA evolves for organization if it has the clear “IT Strategy” and where it wants to go using it, this requires both efficient planning & steady actions.

IT rEvolution has always raised the hope of better world for future generations and to some extent it has been a great force to change the life in this world. But there are some misconceptions in todays world that we are using the technologies in best possible ways to keep evolving or progressing towards technology growth. Let us see this from watch glass, IT is the culmination of both “Information” &”Technology”. World has been always interested in information because thats what sells in the market and technology has always been a modest facilitator undergoing abuse of wrong application. Let us see the phases we have seen evolving till now in IT world:

Now we are in third rEvolution which only believes in using the “information” and we hog on it by creating a huge mesh of applications around the world also connecting them on the internet. Today’s business only believes in putting up new infrastructure increase database, application, web. mail servers..etc just in hurry to manage the information & win the market race. I am no person against “information” but since the rEvolution of IT we have been only struggling to manage data and information for our needs, internet has only added fuel to the fire to spread the madness or hunger for “information”. We are at a stage where we don’t know how to control, maintain these systems & applications as the cost of owing these systems/applications is going high day-by-day. Big enterprises have grown leaps n bounds in past decades and are still growing at a rapid pace expecting the huge growth potentials in near future but off late they have started facing the music of high cost maintenance of systems and applications, also they are worried about the rapid progress of technology. There are few questions which bother current n future enterprises:

These questions are the pointers that we are still creating legacy , legacy …legacy systems/applications for future generations, It is time to innovate & apply the technology in right ways to meet the challenges of dynamic business needs of the changing economies.

These are the couple of questions & there are many hidden that will surface if we don’t seek right answers to above questions. We need answers to shape the future of IT…Letz discuss the way out of this mess and hope IT continues to add value to everyones life…as it has always been doing.

Map sampleMap = Collections.synchronizedMap (sampleMap);

List sampleList = Collections.synchronizedList (sampleList);

Note : Collections is utility class different from Collection Inerface.

Set the initial capacity of a collection appropriately (e.g. ArrayList, HashMap etc). This is because collection classes like ArrayList, HashMap etc must grow periodically to accommodate new elements. But if you have a very large array, and you know the size in advance then you can speed things up by setting the initial size appropriately.

For Eg: HashMaps/Hashtables need to be created with sufficiently large capacity to minimize rehashing (which happens every time the table grows). HashMap has two parameters initial capacity & load factor that affect its performance and space requirements. Higher load factor values (default load factor of 0.75 provides a good trade off between performance and space) will reduce the space cost but will increase the lookup cost of sampleMap.get(…) & sampleMap.put(…) methods. When the number of entries in the HashMap exceeds the current capacity * loadfactor then the capacity of the HasMap is roughly doubled by calling the rehash function. It is also very important not to set the initial capacity too high or load factor too low if iteration performance or reduction in space is important.

Program in terms of interface not implementation: For eg you might decide a LinkedList is the best choice for some application, but then later decide ArrayList might be a better choice for performance reason.

Please use:

List sampleList = new ArrayList(100); //program in terms of interface & set the initial size.

In the place of (avoid this):

ArrayList sampleArrlist = new ArrayList();

Avoid storing unrelated or different types of objects into same collection: This is analogous to storing items in pigeonholes without any labeling. To store items use value objects or data objects (as oppose to storing every attribute in an ArrayList or HashMap). Provide wrapper classes around your collection API classes like ArrayList, Hashmap etc as shown in better approach column. Also where ever applicable consider using composite design pattern, where an object may represent a single object or a collection of objects.

This brings us to discuss to the details of composite design pattern…I will take it up some time later for now lets keep koding…:-)

Good alternative for handling user related information in web programming is HttpSession, it is secure :

User data can be kept in “session scope” and it exists on the server not in the client browser. Server side is the better place to handle the sensitive data. In our(developer) control allows to dump the data once usage is completed.

Session should be very carefully handled as :

• It deals with sensitive data.
• They demand server resources.

Here are few tips to handle sessions : 

• Always use a <%@ page session=”false” %> directive at the top of every JSP that doesn’t use a session.
• Disable URL rewriting.
• Create new sessions only when the user login and remember to invalidate it once user logs out.
• Timeout value in web.xml is set to reasonable value..not too high or low.
• Validate all the requests to defend against dupe attacks.

Happy Programming

I face this question more often these days, everyone is working on something or other for PCI. To answer the question it is a set of comprehensive 12 requirements (256 sub requirements to be precise) for payment card data security standards (Transaction cards like credit, debit & gifts etc), these are developed by the founding payment brands of the PCI Security Standards Council, including AMEX, Discover, JCB, MasterCard and VISA etc, to help facilitate the broad adoption of consistent data security measures on a global basis.

The PCI DSS is a multifaceted security standard that includes requirements for

• Security Management
• Policies
• Procedures
• Network Architecture 
• Software design and other critical protective measures.

This comprehensive standard is intended to help organizations proactively protect customer account data and be compliant with common standards laid down. PCI Security Standards Council keeps enhancing these PCI DSS standards to accommodate the new security learning’s that will help world mitigate risks i.e. get some learning from hackers .

The core of the PCI DSS is a group of principles and accompanying requirements, around which the specific elements of the DSS are organized:

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data.

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.

Protect Cardholder Data

Requirement 3: Protect stored cardholder data.

Requirement 4: Encrypt transmission of cardholder data across open, public networks.

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software.

Requirement 6: Develop and maintain secure systems and applications.

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know.

Requirement 8: Assign a unique ID to each person with computer access.

Requirement 9: Restrict physical access to cardholder data.

Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data.

Requirement 11: Regularly test security systems and processes.

Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security.

How do we start?

•  Identify your PCI uses in your business at various level ( application, architecture etc).
•  PCI Discovery ( GAP assessment) [Includes anything & everything on enterprise network ]
• Baseline [Where do we stand?]

Where are the opportunities for technical teams?

• Network : Network Segmentation (Enterprise Arch).
• Data : Database (what data comes in, goes out, how do you store it & access it etc).
• Applications : Interfacing (Application/Solutions Arch: App/web servers, legacy code etc).

 Who all need to be certified?

Merchants doing credit card transactions need to get PCI compliant but there are levels defined based on the amount of transactions done. For more information you can visit www.pciassessment.org

What does PCI non-compliance mean for business?

• Heavy fines, legal complications etc.
• Barred from accepting/processing credit cards.
• Data Security Compromises resulting in security attacks and
• Many more …….

Myth about PCI DSS : PCI DSS is a technology or framework that would gaurd us from external threats.

In reality PCI DSS is not a technology or famework instead they are governed standards driven to build the compliance environments across the globe to collaborate in secure ways to handle payment cards. Watch out we still need the robost vulenerability(SCABBA) tests to ensure the code is cleaned before putting it into real use

Where is PCI now and where is it going?

Current PCI is 2.0, yes it also evolved through versions & will keep evolving…

Where it is heading, probably we will see the new PCI standards to certify specific clouds that will deal with PCI & all of us talk to those secure clouds. At this moment things are too cloudy for cloud computing…letz park this for next time may be those will be cloud certification dayz

Happy PCI dayz N years to come (It is never last time for PCI, always ongoing….)!!!

Organizations have their own tailored SDLC’s that worked for them in past and they harp on it for future success. Each company has their own PAL (Process Assest Library) and those SDLC’s support PDR (Plan, Do, Review) model to execute the lifecycle, it is really important that how well and differently we do the last part (Review) to do a better job on plan n review next time.

Agile methodology religiously recommends “Retrospection” to support continuous improvement in project execution, to reap best benefits of it, Organizations need to implement this process very innovatively. Building a retrospective framework for organization amend it continuously as and when required.

For strong e-process base like ours have a good scope to build/change the existing framework to accommodate few ideas.

Conducting the retrospectives is an art can be slowly mastered as the learning’s grow, while building a new framework you need ask few basic questions like:

• What retrospectives you want to have i.e. types of retrospectives? (Release Retrospective, Phase Retrospective, Event (design, coding, testing) Retrospective etc).
• At what frequency you want to have retrospectives? (Study the SDLC implemented and arrive at the acceptable frequency, point to note here is that frequency can different for different projects).
• Do we have retrospective template in PAL? (Retrospective Template).
• Who all needs to be part of retrospective? (Treat the session as feedback for improvement for everyone).
• Where to do retrospective? (It is good to do it away from work place, we can be innovative in this ).
• What all do you need to conduct a retrospective? (Use creative ideas to make it interesting).
• How you want conduct retrospective? (This depends on type of retrospective we are having so that you can choosy to what to include & exclude).

Some sample questions for retrospections are:

• What was done & done well?
• What went bad? (No pointing of fingers, try to evolve ideas to correct next time. Strike balance in history of things and future implementation.)
• Where can we be more creative? (Very important document them and share).
• What are we taking back from here? (We = PMO, PL, Architects, Execution Team, Reviewers etc).
• What challenges we faced? (Helps in generating ideas around these).

Now I am sure you will ask me when/where these will be used, here PMO can take the ownership of creating PERL (Project Execution Retrospective Library) and make it available to everyone for references and post the changes it is bringing in PAL. Above is a little summary to facilitate continuous learning to bring excellence in project execution. Finally we need build the retrospective framework for having retrospective for retrospectives we conduct that makes it evolving framework. Please allow me to retrospect with your feedback do share your comments, ideas & suggestions here or am also reachable on cnu.tsr@gmail.com.

Happy Retrospections

Zero defects might sound good but in real world bugs do exist post production rollout. How can we expect zero defects in software development? It is harder to test, harder to define in details, harder to predict. Software development is a complex adaptive system, we can’t predict all effects. Bugs in production are normal thing, and by “normal” I mean we can’t bring them to zero. We can (and should) minimize them using all possible ways, but “The Last Bug” is an eyewash.

Though there is no way to live upto this goal, there are couple of things we can do to minimize the bugs or keep a check on the quality of system:

• Test Driven Development.
• Continuous Integration.
• Automated regression functional tests suite.
• Root cause analysis. (Fix with proper impact analysis to save yourself & team from future bugs)
• Continuous Refactoring. (Keeps the codebase healthy).

The above discussion by no means encourages us to be complacent during coding infact it points us to the direction where we need to take more responsibility to find creative means to bug(s) avoidance. Stitch in time saves nine.

Feel free to share your ideas or reach me on cnu.tsr@gmail.com

Happy Project Management