Tuesday, August 19, 2008
"You're not the boss of me"
I'm losing all my patience with how things are done in IT. So much so that I am looking forward to the outsourcing which should make some positive changes (I could be delusional here).
The Claims application went through an audit last year. There was a finding that the MQ client connection needed to be authenticated. MQ native client connections are basically point & shoot. If you know where you're going, you can get there. It also means that someone with sufficient knowledge and access could spoof a production connection. Not sure if they could submit a legitimate claim, but they definitely could connect from a desktop or a sub-production server since there is no firewall protection in this regard.
I figured we would use a client certificate for authentication. This required SSL encryption being turned on. A proof-of-concept was done in the acceptance environment. I figured that it would be implemented in one other environment before production. Since SSL adds overhead, it made sense to do it in the performance testing environment. My apprentice has gotten it working, no thanks to me.
I expected that the next step would be a performance test. Wrong! The application system manager is absolutely adamant that we implement in all five testing environments starting with development. His argument is consistency and adherence to process. I'm not used to working in a shop where development requires the same security as production. We could do all this work to have it be completely throwaway if it doesn't perform sufficiently. In fact, he's saying that it has to be turned off now in the performance environment to avoid interfering with performance testing for new application. He says that he has an audit requirement that his environments be built consistently. Except that they aren't. Most are virtual except production which is physical. Most have their own configuration manager but not all (two environments share another's). I left this morning's meeting just livid. A definitely career limiting activity on my part.
D.
The Claims application went through an audit last year. There was a finding that the MQ client connection needed to be authenticated. MQ native client connections are basically point & shoot. If you know where you're going, you can get there. It also means that someone with sufficient knowledge and access could spoof a production connection. Not sure if they could submit a legitimate claim, but they definitely could connect from a desktop or a sub-production server since there is no firewall protection in this regard.
I figured we would use a client certificate for authentication. This required SSL encryption being turned on. A proof-of-concept was done in the acceptance environment. I figured that it would be implemented in one other environment before production. Since SSL adds overhead, it made sense to do it in the performance testing environment. My apprentice has gotten it working, no thanks to me.
I expected that the next step would be a performance test. Wrong! The application system manager is absolutely adamant that we implement in all five testing environments starting with development. His argument is consistency and adherence to process. I'm not used to working in a shop where development requires the same security as production. We could do all this work to have it be completely throwaway if it doesn't perform sufficiently. In fact, he's saying that it has to be turned off now in the performance environment to avoid interfering with performance testing for new application. He says that he has an audit requirement that his environments be built consistently. Except that they aren't. Most are virtual except production which is physical. Most have their own configuration manager but not all (two environments share another's). I left this morning's meeting just livid. A definitely career limiting activity on my part.
D.
Labels: Work
