Ecommerce Implementation - A case study

by: Sam Harnett

Technical Report

The e-commerce implementation at CanCric

Sam Harnett

Document Introduction

This document presents the analysis of an e-commerce implementation in the CanCric, a Canterbury based company that sells cricket products to sports stores around the UK. This document will aim to give a more inside picture of the e-commerce implementation the management has envisaged and will provide a basis for the feasibility analysis of the project.

Document Audience

This document has been prepared primarily for the senior management. However, as there are no current employees who have sufficient in-depth expertise to develop the application ‘in-house’, it is likely that a commercial service provider will be contracted for the job. This document will provide the basic understanding of “what to do” for the contractor.

Document Contents

This document contains analysis of the CanCric e-commerce implementation and following artefacts will be included in the overall report.

· Project Introduction

· Project Benefits

· System Requirements

· Implementation Plan

· Risk Assessment

· Conclusion

Project Introduction

CanCric is a Canterbury based company that sells cricket products to sports stores around the UK. Their products include crickets equipment (gloves, helmets, balls, bats, pads, shocks etc.) and memorabilia (flags, T-Shirts, prints etc.)

CanCric is a market leader because of its high quality products and listening to its customers. The company wants to further improve the quality of its products and create a stronger relationship with its customers by implementing an e-commerce system.

Project Benefits

The project will bring following envisaged benefits to the company:

1. The new website will provide a better marketing place for the company to capture much more business by publicizing their products on internet.

2. The company will be able to increase its profit by the increasing sales. Increase in sales is part and parcel with the e-commerce implementation.

3. The company will be able to expand the size of the market from regional to national or national to international. Currently the company is only selling its products within the UK.

4. The company will be able to decrease costs in different areas elicited below:

a. Costs of creating the product

b. Cost of Marketing since online marketing is cheaper than other print media

c. Costs of distribution in few cases, like providing online brochures will reduce cost of printing and shipping information to prospective clients

d. Costs of processing orders from the customers are the most important cost reduction the project will achieve. The online application will ease the repeating activities and information processing for the overall order processing.

e. The cost of handling customer phone calls will also be reduced by providing online discussion forums and suggestion boxes which most of the customers will willfully accept.

f. Online presence of information will decrease the manual handling of sales inquiries, thus reducing a lot of cost in terms of time and resources.

g. E-commerce project implementations can be enhanced to perform thousands of other operations to provide the user with very rich information. One is the inventory forecast. E-commerce systems can be enhanced to forecast the sales in the upcoming months by analyzing the past trends. This can greatly reduce the cost of extra inventory management.

5. Electronic content management services will be provided to reduce the cost of content retrieval and provide security and controlled access rights features.

6. Websites provide easy change management. The point here is that with a web site, you can have the prices listed, and change them - you simply edit the web page - whereas in a printed catalogue you are stuck with the expense of printing a new version if you need to change many of the prices.

7. Websites enables customization of products if CanCric ever want to support it.

8. The project will enable CanCric to build more collaborative and stronger relationships with its suppliers. This includes streamlining and automating the underlying business processes, enabling areas such as

a. Online procurement of material

b. Replenishment

c. Information Management

d. Reduced inventories due to efficient information exchange

e. Reduced delivery delays.

System Requirements

Given below are the requirements of the system, listed with respect to the modules in the system

Web Site

1. The website of the system should be very user friendly

2. The website should show the overall mission statement and vision of the company

3. The website should clearly give a complete catalogue of all products the company is manufacturing, along with the pictures of the product.

4. The website should also highlight the future plans of CanCric about the product expansions.

5. The search functionality should be provided on the website

6. The website search should be to display the closest results to the search strings

7. The search functionality should support input of multiple search criteria.

8. The functionality to display the whole site map of the website should be provided.

9. The website should also be maintaining the sponsored players’ information

10. The sponsored players’ information should be shown in the column form

Discussion Boards

11. The website should also have functionality of online discussion boards

12. The registered users should be able to participate in the discussions

13. Any visitor can see the discussions

14. The system should be able to maintain discussions in the form of tree and chronological order

15. User should be able to delete the post from discussion boards

16. User should not be able to edit the discussion posts

17. Administrator should be able to administer the discussion boards.

Online Order Processing

18. The website should allow users to maintain their user profiles.

19. The website should make sure that the user information will not be misused.

20. The website should provide the facility to the user to pre-enter the credit card information of the user for the future use by the user

21. The website should allow the user to maintain a shopping cart along with its profile

22. The user should be able to add cricket products in its shopping cart.

23. The user should be shown the overall cost of the current selection in the shopping cart

24. The user should be able to delete entries from the shopping cart

25. The user should be able to preview the shopping cart any time it want to

26. The user should be able to save the current shopping cart for future use

27. The facility to buy the items in the shopping cart should be provided with complete security measures.

28. The shopping cart should be empty after the transaction

29. The delivery options should be shown to the user.

30. The user should be given option to choose a courier company of its choice.

31. The user should be able to change the billing details any time during the whole procedure of online order processing.

32. The payment options available should include:

* Payment through personal credit card
* Payment through company credit card
* Payment through the monthly billing option

Research and development

33. The option to host a online survey should be provided

34. The data collected from surveys should be available for reporting and analysis purposes

35. Support to generate reports on given criteria should be provided in the system

36. Multiple types of reports should be available in the system

37. The sales data, the visit history on the websites and the survey results; all should be available for the analysis purposes.

38. For the analysis purposes, application should support technologies like data mining and data warehousing.

Implementation Plan

The iteration from current business to new computerized system will take following steps to be completed:

1. Training of resources who will be using the new application

2. Development of confidence for the new system among the CanCric employees

3. Web Hosting Plan


Web Hosting

E-Commerce Web hosting is adding an e-commerce application to a Web hosting package, which is what allows you to have a store on the Internet. To have a Web site or store on the Internet we will need a Web server. Unfortunately, owning a Web server can be very costly and requires technical expertise that CanCric lacks. So, we will have to outsource this management and hosting to some Web Hosting Company. Web hosting companies will provide the equipment and other technical resources.

I have identified these ecommerce packages and hosting plans as suitable for CanCric’s needs.

Hosting:

1. http://www.bluehost.com – This site offers 10 GB of storage and 250GB of transfer each month as well as SSL, PHP and MySQL, which are commonly required for a lot of ecommerce applications. It also has an excellent account administration system that incorporates management of databases and private server settings. The package also comes with free wiki and forum software that can be easily integrated. Bluehost is available from £30 per year.

2. http://www.newnet.co.uk – Newnet offers hosing packages from £57 per year and collocation from £150. Although our needs don’t require co-location yet, having the option to upgrade to co-location on the same premises will be an asset. The host offers scripting and SSL services necessary for ecommerce and a managed back up timetable to secure our businesses data.

3. http://www.ukip.co.uk – UKIP is a broadband provider that also offers hosting services. They offer the same hosting scripting services as Bluehost and Newnet, they also offer support for active server pages and java server pages which will allow us to consider a wider range of ecommerce applications.

Ecommerce:

1. http://www.actinic.co.uk – Actinic is one of the most popular systems currently available with over 10,000 users in 40 countries. Actinic can integrate with dreamweaver MX and has a range of features not just suitable to the ecommerce but also to many other facets of business management such as stock monitoring. Actinic Business is suitable for our level of development as cost £799 per license. Actinic is also capable of both B2B and B2C practises.

2. http://www.storefront.net – Storefront is an API that can be integrated into dreamweaver or front page or used independently. It provides mechanisms form displaying products and managing a shopping cart. It is designed to allow maximum creativity for the designer while still taking part of the technicalities such as shopping and paying.

Risk Assessment

There are also a few risks associated with the e-commerce system implementation at CanCric, which must be mitigated to make the project successful.

1. The hardware and network infrastructure should be sufficient to run and access the system

2. A level of confidence must be built within the company for the usage of the new system. The employees are expected to resist to such change in the organizations.

3. Customer fear of personal information being used wrongly. Such issues should be catered in the system.

4. Rules and regulations must be redefined according the new system.

5. Security and privacy must be handled carefully since the CanCric system involves online transaction support.

Conclusion

The e-commerce implementation will definitely provide CanCric an excellent opportunity to capture the international markets of cricket goods. However, there are few things we should take care of; first of all we must avoid over-expecting e-commerce lest we create a backlash when its promises are not fulfilled. E-commerce will not, in and of itself, correct all the businesses problems. Secondly, the benefits of e-commerce will be restricted if we do not recognize its full system implications, and instead implement it in limited ways that only partially meet its requirements.

About The Author

Sam Harnett MSc mBCS

Pixeko Studio – Web Developers in Kent

http://www.pixeko.com

Operating Systems: File Systems

by: Sam Harnett

File systems are an integral part of any operating systems with the capacity for long term storage. There are two distinct parts of a file system, the mechanism for storing files and the directory structure into which they are organised. In mordern operating systems where it is possibe for several user to access the same files simultaneously it has also become necessary for such features as access control and different forms of file protection to be implemented.

A file is a collection of binary data. A file could represent a program, a document or in some cases part of the file system itself. In modern computing it is quite common for their to be several different storage devices attached to the same computer. A common data structure such as a file system allows the computer to access many different storage devices in the same way, for example, when you look at the contents of a hard drive or a cd you view it through the same interface even though they are completely different mediums with data mapped on them in completely different ways. Files can have very different data structures within them but can all be accessed by the same methods built into the file system. The arrangment of data within the file is then decided by the program creating it. The file systems also stores a number of attributes for the files within it.

All files have a name by which they can be accessed by the user. In most modern file systems the name consists of of three parts, its unique name, a period and an extension. For example the file 'bob.jpg' is uniquely identified by the first word 'bob', the extension jpg indicates that it is a jpeg image file. The file extension allows the operating system to decide what to do with the file if someone tries to open it. The operating system maintains a list of file extension associations. Should a user try to access 'bob.jpg' then it would most likely be opened in whatever the systems default image viewer is.

The system also stores the location of a file. In some file systems files can only be stored as one contigious block. This has simplifies storage and access to the file as the system then only needs to know where the file begins on the disk and how large it is. It does however lead to complications if the file is to be extended or removed as there may not be enough space available to fit the larger version of the file. Most modern file systems overcome this problem by using linked file allocation. This allows the file to be stored in any number of segments. The file system then has to store where every block of the file is and how large they are. This greatly simplifies file space allocation but is slower than contigious allocation as it is possible for the file to be spread out all over the disk. Modern oparating systems overome this flaw by providing a disk defragmenter. This is a utility that rearranges all the files on the disk so that thay are all in contigious blocks.

Information about the files protection is also integrated into the file system. Protection can range from the simple systems implemented in the FAT system of early windows where files could be marked as read-only or hidden to the more secure systems implemented in NTFS where the file system administrator can set up separate read and write access rights for different users or user groups. Although file protection adds a great deal of complexity and potential difficulties it is essential in an enviroment where many different computers or user can have access to the same drives via a network or time shared system such as raptor.

Some file systems also store data about which user created a file and at what time they created it. Although this is not essential to the running of the file system it is useful to the users of the system.

In order for a file system to function properly they need a number of defined operations for creating, opening and editing a file. Almost all file systems provide the same basic set of methods for manipulating files.

A file system must be able to create a file. To do this there must be enough space left on the drive to fit the file. There must also be no other file in the directory it is to be placed with the same name. Once the file is created the system will make a record of all the attributes noted above.

Once a file has been created we may need to edit it. This may be simply appending some data to the end of it or removing or replacing data already stored within it. When doing this the system keeps a write pointer marking where the next write oparation to the file should take place.

In order for a file to be useful it must of course be readable. To do this all you need to know the name and path of the file. From this the file system can ascertain where on the drive the file is stored. While reading a file the system keeps a read pointer. This stores which part of the drive is to be read next.

In some cases it is not possible to simply read all of the file into memory. File systems also allow you to reposition the read pointer within a file. To perform this operation the system needs to know how far into the file you want the read pointer to jump. An example of where this would be useful is a database system. When a query is made on the database it is obviously ineficient to read the whole file up to the point where the reuired data is, instead the application managing the database would determine where in the file the required bit of data is and jump to it. This operation is often known as a file seek.

File systems also allow you to delete files. To do this it needs to know the name and path of the file. To delete a file the systems simply removes its entry from the directory structure and adds all the space it previously occupied to the free space list (or whatever other free space management system it uses).

These are the most basic operations required by a file system to function properly. They are present in all modern computer file systems but the way they function may vary. For example, to perform the delete file operation in a modern file system like NTFS that has file protection built into it would be more complicated than the same operation in an older file system like FAT. Both systems would first check to see whether the file was in use before continuing, NTFS would then have to check whether the user currently deleting the file has permission to do so. Some file systems also allow multiple people to open the same file simultaneously and have to decide whether users have permission to write a file back to the disk if other users currently have it open. If two users have read and write permission to file should one be allowed to overwrite it while the other still has it open? Or if one user has read-write permission and another only has read permission on a file should the user with write permission be allowed to overwrite it if theres no chance of the other user also trying to do so?

Different file systems also support different access methods. The simplest method of accessing information in a file is sequential access. This is where the information in a file is accessed from the beginning one record at a time. To change the position in a file it can be rewound or forwarded a number of records or reset to the beginning of the file. This access method is based on file storage systems for tape drive but works as well on sequential access devices (like mordern DAT tape drives) as it does on random-access ones (like hard drives). Although this method is very simple in its operation and ideally suited for certain tasks such as playing media it is very inneficient for more complex tasks such as database management. A more modern approach that better facilitates reading tasks that arent likely to be sequential is direct access. direct access allows records to be read or written over in any order the application requires. This method of allowing any part of the file to be read in any order is better suited to modern hard drives as they too allow any part of the drive to be read in any order with little reduction in transfer rate. Direct access is better suited to to most applications than sequential access as it is designed around the most common storage medium in use today as opposed to one that isnt used very much anymore except for large offline back-ups. Given the way direct access works it is also possible to build other access methods on top of direct access such as sequential access or creating an index of all the records of the file speeding to speed up finding data in a file.

On top of storing and managing files on a drive the file system also maintains a system of directories in which the files are referenced. Modern hard drives store hundreds of gigabytes. The file system helps organise this data by dividing it up into directories. A directory can contain files or more directories. Like files there are several basic operation that a file system needs to a be able to perform on its directory structure to function properly.

It needs to be able to create a file. This is also covered by the overview of peration on a file but as well as creating the file it needs to be added to the directory structure.

When a file is deleted the space taken up by the file needs to be marked as free space. The file itself also needs to be removed from the directory structure.

Files may need to be renamed. This requires an alteration to the directory structure but the file itself remains un-changed.

List a directory. In order to use the disk properly the user will require to know whats in all the diretories stored on it. On top of this the user needs to be able to browse through the directories on the hard drive.

Since the first directory structures were designed they have gone through several large evolutions. Before directory structures were applied to file systems all files were stored on the same level. This is basically a system with one directory in which all the files are kept. The next advancement on this which would be considered the first directory structure is the two level directory. In this There is a singe list of directories which are all on the same level. The files are then stored in these directories. This allows different users and applications to store there files separately. After this came the first directory structures as we know them today, directory trees. Tree structure directories improves on two level directories by allowing directories as well as files to be stored in directories. All modern file systems use tree structore directories, but many have additional features such as security built on top of them.

Protection can be implemented in many ways. Some file systems allow you to have password protected directories. In this system. The file system wont allow you to access a directory before it is given a username and password for it. Others extend this system by given different users or groups access permissions. The operating system requires the user to log in before using the computer and then restrict their access to areas they dont have permission for. The system used by the computer science department for storage space and coursework submission on raptor is a good example of this. In a file system like NTFS all type of storage space, network access and use of device such as printers can be controlled in this way. Other types of access control can also be implemented outside of the file system. For example applications such as win zip allow you to password protect files.

There are many different file systems currently available to us on many different platforms and depending on the type of application and size of drive different situations suit different file system. If you were to design a file system for a tape backup system then a sequential access method would be better suited than a direct access method given the constraints of the hardware. Also if you had a small hard drive on a home computer then there would be no real advantage of using a more complex file system with features such as protection as it isn't likely to be needed. If i were to design a file system for a 10 gigabyte drive i would use linked allocation over contigious to make the most efficient use the drive space and limit the time needed to maintain the drive. I would also design a direct access method over a sequential access one to make the most use of the strengths of the hardware. The directory structure would be tree based to allow better organisation of information on the drive and would allow for acyclic directories to make it easier for several users to work on the same project. It would also have a file protection system that allowed for different access rights for different groups of users and password protection on directories and individual files.Several file systems that already implement the features ive decribed above as ideal for a 10gig hard drive are currently available, these include NTFS for the Windows NT and XP operating systems and ext2 which is used in linux.

About The Author

Sam Harnett MSc mBCS

Pixeko Studio – Web Developers in Kent

http://www.pixeko.com

Understanding The Specifications Puzzle

by: Tim Bryce

"You like potato and I like potahto
You like tomato and I like tomahto
Potato, potahto, Tomato, tomahto."
Let's call the whole thing off."
- Lyrics by Ira Gershwin; Music by George Gershwin

Defining specifications for the design and development of systems and software is a lot like this classic Gershwin song and what I personally regard as the biggest cause of confusion in the Information Technology field for as long as I can remember, which is over 30 years in the industry. Some people say specifications should be based on the inherent properties of information, others believe it is based on a screen/report or file layout, yet others adamantly believe it should be based on process and data specifications. Interestingly, all are absolutely correct. The difference lies in the perspective of the person and the work to be performed. For example, how we define specifications for the design of an automobile is certainly different than how we specify a skyscraper. The same is true in the I.T. field where we have different things to be produced by different people; for example:

1. THE PROGRAMMER (aka, Software Engineer) requires precise specifications in order to develop program code (source and object). This normally takes the form of processing requirements (e.g., hardware configuration, types of transactions to be processed, volume, timing, messages, etc.) and physical data requirements (input/output/file layouts).

2. DBA (Data Base Administrator) requires precise specifications in order to select a suitable file management technique (e.g., DBMS) and produce the necessary Data Definition Language (DDL) for it. This normally takes the form of a logical data base model representing relationships between data entities.

3. THE ANALYST (aka, Systems Analyst, Systems Engineer, Systems Architect, Business Analyst) - requires specifications about the end-User's information requirements in order to design a system solution. This is normally based on a definition of the user's business actions and/or decisions to be supported. Following the system design, the Analyst produces the specifications required by the Programmer and DBA to fulfill their part of the puzzle. From this perspective, the Analyst is the translator between the end-User and the Programmers and DBAs.

Each party has his own unique perspective of the puzzle and, as such, requires different "specifications." To compound the problem though, the role of the Analyst sharply diminished over the years, leaving it to the Programmers to try and determine what the end-User needs, a skill they are typically not trained or suited for. To illustrate, I am reminded of the story of the IT Director at a shoe manufacturing company who received a call from the corporate Sales Manager asking for some help on a pressing problem. The IT Director sent over one of his programmers to meet with the Sales Manager and discuss the problem. Basically, the manager wanted a printout of all shoe sales sorted by model, volume, type, color, etc. The programmer immediately knew how to access the necessary data and sorted it accordingly thereby producing a voluminous printout (three feet high) which he dutifully delivered to the user.

The IT Director stopped by the Sales Manager's office a few days later to inquire if the programmer had adequately serviced the user. The sales manager afforded the programmer accolades on his performance and proudly pointed at the impressively thick printout sitting on his desk. The IT Director then asked how the manager used the printout. He explained he took it home over the weekend, slowly sifted through the data, and built a report from it showing sales trends.

"Did you explain to the programmer you were going to do this?" asked the IT Director.

"No," replied the Sales Manager.

"Aren't you aware we could have produced your report for you and saved you a lot of time and effort?"

"No."

This is a classic example of the blind leading the blind. The user did not know how to adequately describe the business problem, and the programmer asked the wrong questions. Remarkably, both the Sales Manager and programmer were delighted with the results. The IT Director simply shook his head in disbelief.

There are substantial differences between specifying information requirements and specifying software. Both have their place, but both serve different purposes. Whereas a true Analyst investigates the underlying business rationale of the information, the Programmer lives in the physical world and is only concerned with how the software will work.

It is not uncommon to hear programmers lament, "Users do not know what they want." They may not know how it should physically look or how it should best be delivered, but Users most definitely know what they want from an information point of view. Most programmers simply are not asking the right questions. Then again, they were not trained for this and are trying to compensate for the lack of true Analysts.

Remarkably, the Analyst function is experiencing a resurgence in the industry as companies are realizing that a higher level person is needed to understand the business and have a more global perspective of a company's systems and software. To illustrate, the process should fundamentally work like this:

1. Working with the User, the Analyst studies the business and helps the User specify information requirements.

2. From the requirements, the Analyst produces a system design which includes either a new system and/or modification of an existing system. As part of the design, the Analyst defines:

* The logical processing of data in terms of how it is to be collected, stored, and retrieved.
* The business processes affected, including the parts implemented by the computer.
* The design of the inputs and outputs.
* The design of the logical data base model.

In considering the computer processing, the Analyst determines which portions can be implemented by a commercial package or requires programming.

3. The design specifications are conveyed to the Programmer and the DBA for implementation.

4. From the logical data base model, the DBA designs a physical solution and produces the necessary Data Definition Language. The DBA passes on the physical file layouts to the Programmer for implementation.

5. The Programmer studies the software specifications and determines a suitable method of implementation, e.g., languages to be used, along with suitable tools and techniques for design.

For graphic, see:
http://www.phmainstreet.com/mba/blog/ss080225.jpg

The real beneficiary of such an approach is the programmer as the "guess work" has been eliminated for him. This may be an oversimplification of the overall process, but it is intended to show the vital role the Analyst plays and how it contrasts with the other participants. In the absence of such a person, the Programmer inevitably defaults to the role of Analyst and here is where specification problems begin to emerge.

This also hints at the limitations of "agile" methods. To their credit, the proponents of such methodologies recognize they are limited to software and, in particular, a single program. In doing so, they are trying to expedite the overall process of specification gathering in order to get to the job of programming.

In addition to defining the relationships between the various development functions, there is also the problem of developing a standard and consistent approach for recording specifications. This can be performed orally, but more likely it is recorded using a documentation technique to communicate the work to be performed and as a means to check the finished product to see if it does indeed satisfy the specifications. In the fields of engineering and construction, standards have been developed over the years to record specifications, such as blueprinting. But in the I.T. field, a myriad of techniques have been introduced with little or no standardization. For example, there are several different types of graphical and textural techniques, as well as repositories and data dictionaries to record and track specifications. Regardless, very few companies have adopted standards for recording specifications.

CONCLUSION

The problem with specifications in the design and development of systems and software is primarily due to a lack of standardization in the industry. There are a lack of standards in the areas of:

* Different types of deliverables resulting from the development process and how to format them (including specifications).

* Different development functions participating in the process, along with their interrelationships, and duties and responsibilities.

* Different perspectives of development in terms of the inherent properties of systems and software.

* Different methods, tools and techniques for performing design and development.

As long as there remains a lack of standardization in the I.T. industry, there will always remain a different interpretation of what specifications are and how to best document them. In other words, we'll go on saying "You like tomato and I like tomahto." So when do we call the whole thing off?

If you would like to discuss this with me in more depth, please do not hesitate to send me an e-mail at timb001@phmainstreet.com

"Good specifications will always improve programmer productivity far better than any programming tool or technique."
- Bryce's Law

About The Author

Tim Bryce is a writer and management consultant located in Palm Harbor, Florida.
http://www.phmainstreet.com/timbryce.htm

He can be contacted at: timb001@phmainstreet.com

Copyright © 2008 Tim Bryce. All rights reserved.

SSH Tunneling In Your Application

by: Tom Davidge

Introduction

This article is dedicated to the task of securing MySQL client-server connection using functionality provided by the Secure Shell (SSH) protocol. To be exact, the SSH tunneling concept is utilized. We will review the steps needed to build secure MySQL client applications and implement a sample one ourselves.

MySQL traffic is not the only kind of data that can be tunneled by the Secure Shell. SSH can be used to secure any application-layer TCP-based protocol, such as HTTP, SMTP and POP3. If your application needs to secure such a protocol by tunneling it through a protected SSH connection, this article will be useful to you.

Background

Let's imagine that we are developing an enterprise application that needs to send requests to a number of SQL servers all over the world and get responses from them (let's imagine that it's a super-powerful bank system that stores information about millions of accounts).

All the data between the application and SQL servers are transferred via the Internet "as is". As most protocols used by SQL servers do not provide data integrity and confidentiality (and those that do, do it in a quite nontransparent way), all the transferred requests and responses may (and be sure, they will!) become visible to a passive adversary. An active adversary can cause much more serious problems - he can alter the data and no one will detect it.

SSH (Secure Shell) is a protocol that may help in solving this problem. One of its outstanding features is its ability to tunnel different types of connections through a single, confident and integrity-protected connection.

Now you do not have to worry about securing the data transferred over the Internet - SSH will handle this for you. In particular, SSH will take care of the following security aspects:

Strong data encryption according to the latest industry-standard algorithms (AES, Twofish)
Authentication of both client and server computers
Data integrity protection
Stability with regard to different kinds of network attacks
Compression of the data being tunneled
Complete independence of the operating system and network specifics

Tunneling (or forwarding) works in the following way:

SSH client opens a listening port on some local network interface and tells the SSH server that he wishes to forward all connections accepted on this port to some remote host.

When another connection is accepted on the listening port, the SSH client informs the SSH server about this fact and they together establish a logical tunnel for it. At the same time, the SSH server establishes a new TCP connection to the remote host agreed upon in step 1.

The SSH client encrypts all the data it receives from the accepted connection and sends it to the SSH server. The SSH server decrypts the data received from the SSH client and sends it to the remote host.

Please note, that the SSH client acts as a TCP server for the connections it accepts, and the SSH server acts as a TCP client for the connections it establishes to the remote host.


A single SSH connection can tunnel as many application layer connections as needed. This means that you can defend your server by moving all the listening ports (e.g., database and application server ports) to a local network, leaving only the SSH port open. It is much easier to take care of a single port, rather than a dozen different listening ports.

Into the Fire
Let's develop a small application that illustrates the use of SSH forwarding capabilities. We will consider an important task of securing a connection between a MySQL client application and a MySQL server. Imagine that we need to get information from the database server, which is located a thousand miles away from us, in a secure way.

SecureMySQLClient is the application we are planning to implement. It includes the following modules:

SSH client-side module with forwarding capabilities
MySQL client-side module
User interface for configuring application settings and displaying query results.

The SSH server runs in a remote network and is visible from the Internet. The database (MySQL) server runs in the same network as the SSH server and may not be visible from the Internet.

The process of performing secure data exchange between SecureMySQLClient and the Database server goes as follows:

The SSH client module negotiates a secure connection to the SSH server and establishes forwarding from some local port to the remote MySQL server.
The MySQL client module connects to the listening port opened by the SSH client module.
The SSH client and server set up a logical tunnel for the accepted connection.
The MySQL client sends SELECT to the port opened by the SSH client module, which encrypts it and sends it to the SSH server. The SSH server decrypts the request and sends it to the MySQL server.
The SSH server receives a response from the MySQL server, encrypts it and sends it back to the SSH client, which decrypts it and passes it to the MySQL client module.

Looks too complex? Implementing this is easier than you think.So, let's go and do it.

We will need the following products installed on the computer before creating the application:

Microsoft Visual Studio .NET 2003, 2005 or 2008.
EldoS SecureBlackbox (.NET edition). Can be downloaded from
http://www.eldos.com/sbbdev/download.php.
MySQL .NET Connector. Can be downloaded from
http://www.mysql.com/products/connector/net/.

Let's now open Microsoft Visual Studio .NET (we will use the 2005 version) and try to build such an application from scratch.

After the GUI design has been finished, we can go on with the business logic code itself. First, adding references to the following assemblies to our project:

SecureBlackbox
SecureBlackbox.PKI (only in SecureBlackbox 5. SecureBlackbox 6 doesn't have this assembly)
SecureBlackbox.SSHClient
SecureBlackbox.SSHCommon
MySql.Data

SSHForwarding notifies us about certain situations via its events, so we need to create handlers for some of them:

OnAuthenticationSuccess - Is fired when the client authentication process has been completed.

OnAuthenticationFailed - Is fired if the client was unable to authenticate using particular authentication method. In general, this does not mean that the authentication process completely failed – the client may try several authentication methods consequently and one of them may succeed.

OnError - Is fired if some protocol error occurs during the session. Usually this leads to a connection closure. The exact error can be detected via the error code passed to it.

OnKeyValidate - Is used to pass the received server key to the application. Please note that incorrect handling of this event may result in a serious security breach. The handler of this event should verify that the passed key corresponds to the remote server (and warn the user if it does not). If the key is valid, the handler should set the Validate parameter to true. The sample does not perform key checkup for the sake of simplicity.

OnOpen - Is fired when the SSH connection is established and the component is ready to tunnel data. We will use the handler of this event to kick the MySQL client component.

OnClose - Is fired when the SSH connection is closed.

OnConnectionOpen - Is fired when a new tunnel is created. The corresponding tunneled connection object is passed as parameter.

OnConnectionClose - Is fired when an existing tunnel is closed.

Implementing two core methods, SetupSSHConnection() and RunQuery(). The first one initializes the SSHForwarding object and establishes an SSH session to the remote server by calling its Open() method, and the second one sends the query to the MySQL server.

The code of the SetupSSHConnection() method is pretty simple:


private void SetupSSHConnection()



{


// Specifying address and port of SSH server


Forwarding.Address = tbSSHAddress.Text;



Forwarding.Port = Convert.ToInt32(tbSSHPort.Text);


// Setting credentials for authentication on SSH server


Forwarding.Username = tbUsername.Text;



Forwarding.Password = tbPassword.Text;





// Specifying network interface and port number to be opened locally



Forwarding.ForwardedHost = "";


Forwarding.ForwardedPort = Convert.ToInt32(tbFwdPort.Text);






// Specifying destination host where the server should forward the data to.


// Please note, that the destination should be specified according to


// SSH servers point of view. E.g., 127.0.0.1 will stand for



// SSH servers localhost, not SSH clients one.


Forwarding.DestHost = tbDBAddress.Text;


Forwarding.DestPort = Convert.ToInt32(tbDBPort.Text);






// Opening SSH connection


Forwarding.Open();



}


A bit more complex is the code of the RunQuery() method (to be exact, the code of RunQueryThreadFunc() method, which is invoked in a separate thread by the RunQuery() method):




private void RunQueryThreadFunc()


{


MySqlConnection MySQLConnection = new MySqlConnection();






// forming connection string


string connString = "database=" + tbDBName.Text + ";Connect Timeout=30;user id=" + tbDBUsername.Text + "; pwd=" + tbDBPassword.Text + ";";


if (cbUseTunnelling.Checked)



{


// specifying local destination if forwarding is enabled



connString = connString + "server=127.0.0.1; port=" + tbFwdPort.Text;


}


else


{



// specifying real MySQL server location if forwarding is not used


connString = connString + "server=" + tbDBAddress.Text + "; port=" + tbDBPort.Text;


}



MySQLConnection.ConnectionString = connString;


try


{



// opening MySQL connection


MySqlCommand cmd = new MySqlCommand(tbQuery.Text, MySQLConnection);


Log("Connecting to MySQL server...");



MySQLConnection.Open();


Log("Connection to MySQL server established. Version: " + MySQLConnection.ServerVersion + ".");





// reading query results



MySqlDataReader reader = cmd.ExecuteReader();


try


{



for (int i = 0; i < reader.FieldCount; i++)


{


AddQueryColumn(reader.GetName(i));



}


while (reader.Read())


{



string[] values = new string[reader.FieldCount];


for (int i = 0; i < reader.FieldCount; i++)


{



values[i] = reader.GetString(i);


}


AddQueryValues(values);


}



}


finally


{



// closing both MySQL and SSH connections


Log("Closing MySQL connection");


reader.Close();



MySQLConnection.Close();


Forwarding.Close();


}


}



catch (Exception ex)


{


Log("MySQL connection failed (" + ex.Message + ")");



}


}








And, that's all But there is one more thing I need to draw your attention to. As both SSH and MySQL protocols run in separate threads and access GUI controls from those threads, we need to handle the GUI access in a special way to prevent a cross-thread problems. I will illustrate this with the example of the Log() method:









delegate void LogFunc(string S);






private void Log(string S)


{


if (lvLog.InvokeRequired)


{



LogFunc d = new LogFunc(Log);


Invoke(d, new object[] { S });


}



else


{


ListViewItem item = new ListViewItem();


item.Text = DateTime.Now.ToShortTimeString();



item.SubItems.Add(S);


lvLog.Items.Add(item);


}



}



Finally, the application is finished, and we may try it in work. So clicking F5 and specifying the following settings in the text fields of the application form:


SSH server location, username and password used to authenticate to it.
Database server address, port, username, password, database name and query. Remember that database server address should be specified as it is visible from the SSH server.
Turning on the "Use tunneling" checkbox.

Now click the Start button and wait for the query results. If all the parameters have been specified correctly, we should get something like this:

Features and requirements

SSH protocol provides (and SecureBlackbox implements) the following features:

Strong data encryption using AES, Twofish, Triple DES, Serpent and many other symmetric algorithms with key lengths up to 256 bits
Client authentication using one or multiple authentication types (password-based, public key-based, X.509 certificate-based, interactive challenge-response authentication)
Server authentication
Strong key exchange based on DH or RSA public key algorithms
Data integrity protection
Compression of tunneled data
Multiplexing several tunneled connections through a single SSH connection

SecureBlackbox provides the following functionality as well:

Comprehensive standards-compliant implementation of the SSH protocol (both client and server sides)
Support for cryptographic tokens as storage for keys and certificates
Windows system certificate stores support
Professional and fast customer support

SecureBlackbox is available in .NET, VCL and ActiveX editions. This means that you can use the components in projects implemented in C#, VB.NET, Object Pascal (Delphi and Kylix), FreePascal, VB6 and C++ languages.

SecureBlackbox (.NET edition) is available for Microsoft .NET Framework 1.1, 2.0, 3.0 and 3.5, and .NET Compact Framework.

About The Author

Tom Davidge is a senior SFTP NET Compnents developer that has proven experience in .net coding.

Creating A Software Library

by: Jane Smith

Every business uses computer software. But not every business realises the importance of having a user friendly software library for cataloging all their software.

While sharing software and using it on more than one computer is against the law, making a copy to keep in your software library in case it is ever needed is not only allowed, it is strongly advised.

In this sense a company’s software library is the computer equivalent of the box that says ‘break glass in emergency’; it grants you access to the vital software your company uses to run its day to day business. If anything goes wrong or the original software is corrupted in any way, you have the back up you need to get you out of trouble.

It’s obvious then that the library needs to be properly catalogued and kept fully up to date, to ensure that everything is where it should be in the event that it’s ever needed. Consider it as a fire extinguisher to help put out the flames caused by malfunctioning computer equipment. If you don’t know where that extinguisher is – or even worse, you haven’t got one at all – the flames could spread out and affect your whole business. Use the fire extinguisher however and everything is back to normal in no time.

The process of creating a software library can ironically be made much easier by purchasing software that is designed to make the task easy to perform and control. The companies that specialise in this kind of software also offer support services to help you get your own library up and running.

The most important aspect is to consider your needs and the best way of organising your own business software library. It needs to be easy to access and update, while remaining secure at all times.

For this reason it’s advisable to make sure that only a few key members of staff can access the software library. It’s not necessary for everyone to have access to it, and the more people are able to do so, the more likely it is that it will be compromised.

Once the library has been created it will be necessary to update it every time a new piece of software is integrated into the current computer system. Making a particular person responsible for seeing that this is done will ensure the integrity of the software library remains secure.

About The Author

Jane Smith shares practical business IT solutions for medium to large sized organisations. To activate your business with the power of IT, please visit http://www.bmc.com/en_HK/

Do You Have Access To Enough IT Staff?

by: Jane Smith

No matter how well a business is run and how efficient its computer system is, employees will always run into problems now and again. Whether it’s a simple computer glitch or a major error, it’s good to know you have the right staff on hand to solve the problem in the shortest amount of time possible.

The problem is that you need to know this ahead of time – not when your computers crash and you suddenly realise you don’t have the staff or the resources to cope with it and get things back up and running again.

Not only can this have a detrimental effect on your business, it can also mean that when problems do occur it takes longer for your business to recover. That’s why it pays to review your IT infrastructure and your current needs in order to make sure you are fully prepared and able to take the necessary actions if or when they are ever needed.

In small companies there is often no need to have a specific IT department to call on in the event of any problems. In this case it is often better to hire multi-skilled employees for certain roles, so you have people in place at all times that you can call on to rectify any problems or issues as they arise. Part of their job role in this situation may be to identify possible issues before they arise, and take the necessary steps to prevent them occurring in the first place.

Of course the size of a company can have a big effect at the other end of the scale as well. If a company grows quickly and experiences a sustained period of success, resulting in the need to take on more employees in a short period of time, the current IT department may no longer be able to meet the needs of the larger business.

In this case it’s essential to quickly identify how the department should be expanded, what its new brief should be and how many new staff members are required to meet the needs of the larger business.

The key point is to remember that what works now may not work in the future. Your IT staff members play a key role in ensuring the computer infrastructure is able to cope with the growing needs and demands of the company. If these two aspects don’t match up, the company could be heading for problems it won’t be able to cope with.

About The Author

Jane Smith shares practical business IT solutions for medium to large sized organisations. To activate your business with the power of IT, please visit http://www.bmc.com/en_IN/

Could Your IT Department Be More Streamlined?

by: Jane Smith

Many companies take on extra staff when business is good, ensuring they have enough people on board to cope with all the tasks that need to be done.

But ‘enough people’ does not always correspond to ‘the right number of people’. Moreover it’s easy for job roles to become blurred, creating an overspill of talent in one area and a shortfall in another.

It’s particularly important for the IT department to be well organised, as so many other areas of a business rely on that department to keep the computer system running at peak performance on a day to day basis. This is why streamlining your IT department is vital to ensure that the right people are always in the right place at the right time.

The first step in the streamlining process is to identify the strengths of the people in the team. Are some people wasted in their job roles? Do others do too little? Finding out what each person does can also highlight any areas of potential weakness which could be exploited if the IT infrastructure were to run into any major problems at any point.

Some companies are reluctant to alter or lose any particular job roles, but sometimes it’s necessary to ensure maximum productivity and make the department more streamlined. After all it has a responsibility to keep the IT infrastructure operating at peak performance, and if the current state of the department is putting that in jeopardy then it’s obvious that certain changes will need to be made.

It does happen that some companies employ too many IT specialists during peaks in trading, and then find they are left with too many at other times of the year when it tends to be quieter by nature. A good solution to streamlining the department in this case would be to keep a skeleton staff at all times, and outsource to an external company to provide the extra assistance needed during busier times. This would ensure the company still has enough workers to make sure the IT infrastructure can cope during the peaks in business.

Every business will have different ideas and needs for streamlining their IT department. But whatever those needs are, it’s important they are met in the most cost effective way possible.

About The Author

Jane Smith shares practical business IT solutions for medium to large sized organisations. To activate your business with the power of IT, please visit http://www.bmc.com/en_AU/