Cwjobs.co.uk > Careers advice > IT explained

Data protection act calls for skills upgrade

Tue, 25 Oct 2011 09:39:44 +0100

Reported data breaches affect everything from brand reputation to the bottom line. IT managers and staff are often wrongly held responsible for other colleagues’ gaffes. The UK government and the EU are expected to issue much tougher reporting and compliance guidelines in January next year and will demand proof of encryption. IT managers, information security and compliance officers should gen up now to avoid being the fall guy.

Data breach gaffes

The kind of gaffes that the Information Commissioner is determined to sniff out are typically well-intentioned bungles:

• Emailing data to a home email address, so you can work on a document to meet a deadline

• Copying data onto a USB drive

• Sending out the wrong information in response to a Freedom of Information request

• Emailing requested information to the wrong person

IT managers

Unfortunately, data security is often mistakenly seen as the sole responsibility of you and your department. You technically secure all data that comes into the organisation and that’s where the responsibility ends, right? Wrong; you are the custodian and you need to get the business involved and to appoint data owners. There’s a new acronym going around for this role - information asset owner. Certainly, colleagues will tend to sit up and pay attention if the buck stops with them when their data goes adrift.

Tip: Call a meeting with the top brass and ask for data in order to protest company’s reputation and bottom line.

Compliance Officers

Compliance and governance can be a thankless task, especially in a recession when money is short. Because your work does not lead to any business outcomes, you may be denied the resources you need to train staff and comply with the Data Protection Act. Your job is viewed as back office and even a bit of a backwater. However your role will turn from backwater to big attention for all the wrong reasons if there’s a serious data breach, especially if this is picked up by the media.

Tip: Put data requests through the customer complaints department, that way there will be a procedure and audit log.

Information security officers

The complex task of managing network defence, reporting and compliance falls to information security officers. You have the high octane job of thwarting the global hacking culture, which has morphed from the lone individual seeking status and notoriety to sophisticated cyber gangs. Plus you have to appease business demand for ‘anytime, anywhere’ access and the proliferation of mobile devices, from laptops and notebooks to tablets and smart phones. Adopting open industry standard of Trusted Computing for devices and drives will bring them into a proven and trusted management system at the network layer.

Tip: Use embedded security chip – the Trusted Platform Module (TPM) and self encrypting drives (SEDs) and ensure emails are protected by approval systems.

Search and apply for information security jobs, IT manager jobs and compliance jobs

Telecoms: jobs, skills and qualifications

Tue, 25 Oct 2011 09:38:37 +0100

Broadband, mobile and wireless technology has changed the face of both business and home life – with major telecommunications companies such as BT, Virgin Media, Orange and O2 integrating services to provide a range of communications products (TV, radio, telephone, broadband) through one access portal.

Driven by these enormous advances in communications technology, the telecoms industry offers a huge wealth of IT job opportunities, in terms of the skills required and the roles within it.

Opportunities
There are approximately 8,500 businesses in the UK manufacturing telecoms products and providing telecoms services.

With the pace of growth in the telecoms sector, companies are continually looking to develop and improve their services to stay ahead of competitors. And to do that, they require skilled programmers to develop new systems.

Trained IT maintenance experts are equally as essential, particularly to ensure a good ‘always-on’ service for customers.

Work environment
As a technology-focused industry, if you become involved in cutting edge telecoms developments there is ample opportunity to learn advanced skills and put them to the test in a dynamic working environment.

Ranging from mobile phone to internet providers, telecommunication companies often rely on IT systems for their marketing, information management, service maintenance and more.

Many frequently require technicians with a strong knowledge of systems like voice over internet protocols, interactive voice recognition or call centre technology for such activities as conference calling and instant messaging.

Skills
Frequently, qualifications and/or a degree will be required by employers and new programming skills such as PHP are increasingly sought after – in particular, to help realise commercial opportunities through new and improved products and services.

The telecoms industry includes the work of engineers and IT-trained professionals on a technical side. The constantly evolving equipment requires skilled IT technicians to install, test and maintain the products and their systems. And, as telecommunications is all about connecting people quickly, efficiently and reliably, advancements in technology need to be met with unparalleled service levels and up time.

Having an awareness of current trends in the telecoms industry is important as it's a fast paced and ever-changing area. Being so similar to the IT sector, an aptitude for problem solving and thinking logically is vital, as are strong communication and team working skills

Search for telecoms IT jobs

Public sector: IT jobs, skills and qualifications

Tue, 25 Oct 2011 09:38:37 +0100

Delivering IT services for the public sector presents huge and unique challenges. Now more than ever, IT spend has to be justified - and prove how it makes for a more effective or efficient government. And there’s the added pressure to protect systems, networks and data with the privacy of citizens at stake.

As one of the largest employers in the country, the public sector provides good opportunities for IT graduates and trained professionals alike, with added benefits such as flexible hours and structured training and development.

Opportunities
The public sector, including the NHS, is one of the largest employers in the UK, accounting for 19.5% of the UK workforce (public sector Employment First Release - Q1 2008 Office for National Statistics.)

As the public sector includes such a wide range of services, it’s possible to work within an area that interests you - such as education, law enforcement, health or local councils. Each relies on IT in different ways.

For example, schools may require a secure database system to log student details; the police may need an IT specialist to work in computer forensics and a doctor’s surgery may need robust data management for patient records.

Maintenance is also a key aspect. As well as general IT support, technical services are required by all areas of the public sector, particularly for IT professionals with knowledge of networks such as LAN and WAN.

Work environment
Opportunities to work for the national government exist in many places in the UK: Only 1 in 5 civil servants are based in London. The Scottish Government, Welsh Assembly Government and Northern Ireland Office also employ over 24,000 staff, mainly in Edinburgh, Glasgow, Cardiff and Belfast.

Opportunities to work in local government exist everywhere within the 468 local authorities throughout the UK.

The public sector also offers a strong continuous professional development ethos and the knowledge that the work has a significant influence on the quality of people’s lives. The length of time it takes to get things approved can be frustrating, and changes in legislation or funding often lead to unforeseen obstacles as well as new opportunities.

Skills
With IT integrated into every aspect of modern life, the need for trained specialists in the public sector is ongoing.

From business architects and software engineers, to systems officers, programmers, helpdesk technicians and data managers, public services such as the police, the NHS, schools and local government all require technical support, and are keen to attract skilled people.

Search for public sector IT jobs

The 10 things you need to know about augmented reality

Tue, 25 Oct 2011 09:38:37 +0100

1. What is augmented reality?

Augmented reality is a way of fusing the real and the virtual world by overlaying digital data on to real-world analogue views. Augmented reality applications are appearing in products as diverse as T-shirts on fashion cat walks, interactive games, CVs designed literally to speak to the future employer and jobseeking tools.

And what’s more, anyone with a mobile phone or laptop with built-in video capability can augment and extend their reality with easy-to-use applications.

2. How does it work?

Applications generally use one of two approaches: marker-based and location-based.

Markers work by having software recognise a particular pattern, such as a barcode or symbol, when a camera points at it, and overlaying a digital image at that point on the screen. If the image is three-dimensional or animated, the effect is of a digital experience unfolding on the surface upon which the pattern is printed.

Location-based applications use the ability of a particular device to record its position in the world and then offer data that’s relevant to that location: finding your way around a city, remembering where you parked the car, naming the mountains around you or the stars in the sky.

3. What’s different about developing augmented reality applications?

Most augmented reality applications rely on superimposing either 3D-generated computer imagery or some form of descriptive knowledge over the real-time images obtained through a camera, webcam or phone. This requires a good understanding of image processing and computer vision techniques, mainly for tracking either markers or the natural features on which this imagery is superimposed.

Computer-generated imagery has to look realistic and be properly aligned with the real environment in order to create an authentic impression. Most of the applications are designed for the general public so a good understanding of intuitive user interfaces is also required to provide a seamless experience.

4. What other skills do you need?

AR developers chiefly need a mixture of advanced computer vision skills, 3D modelling and desktop, web or mobile programming. A grasp of 3D modelling should include texturing, shading and rendering.

Preferred programming languages can vary according to the platform but are usually C++ and C#.

Last, but not least, the bleeding-edge nature of the field means that would-be AR developers should have a passion for pushing the boundaries of new technologies. Keeping abreast of new research in the field is a must - a lot of the technologies come from university-based R&D projects.

Search for C++ jobs
Search for C# jobs

5. Are there any AR platforms to work with?

The Dutch-based company Layar has a platform, or augmented reality browser, that runs on the iPhone 3G and Google’s Android. Layar works by using a combination of the mobile phone’s camera, compass and GPS data to identify the user’s location and field of view, retrieve data based on those geographical coordinates, and overlay that data over the camera view.

Qualcomm has also unveiled a new software development kit for the Google Android operating system that will make it easier for developers to create new augmented reality apps for devices running Google’s mobile operating system.

6. How can you get into AR?

One of the simplest ways is to develop for an existing platform such as Layar is to join the thriving community of developers busy utilising the browser to deliver functionality.

C2K is one such developer with its Conquar game, which handles most of the game engine - usernames and logins etc - on the C2K server. Developers code in JavaScript Object Notation (JSON) to the platform and Layar is then responsible for making it display on the iPhone and Android phones.

Through the API of Layar and JSON, developers can make use of the triggers such as a web view and also place action buttons such as watch video, listen to audio and call a phone number. This kind of data is provided with PHP.

Search for Java developer jobs

7. Where’s AR going to be big?

The world of retail is one sector with myriad opportunities for augmented reality applications, especially online. Here, the lack of the ‘try-on’ phase before buying for many products including fashion, jewellery, watches, glasses and home products is an incentive for companies to try out augmented reality applications.

Holition is one augmented reality retailer offering these real-time try on opportunities. This can be combined with providing extra information for the products being displayed.

8. What about education?

The technology offers many opportunities to support experiential and location-based learning by layering data and information on top of the real-world.

Adding historical context to a particular place, highlighting geometric shapes and hidden angles in buildings are just a couple of examples of ways that lessons could be brought to life.

The explosion in popularity of mobile phone apps offers hundreds of possibilities for educators to bring AR into the classroom with relative ease. Apps like Pocket Universe provide star maps relative to your location and offer educators the opportunity to bring objects that are traditionally seen 'out there' right into the classroom.

9. What’s the future for augmented reality?

Perhaps the biggest innovations will come when we step away from the screen. At the moment the majority of AR applications use a camera and screen of some kind, and while the effects are often spectacular, the screen still acts as a barrier.

10. Any other uses?

AR has been around for a long time. One of the oldest examples is the double exposure technique by which the impression of a ghost can be created on stage. The military also equips pilots with goggles that provide a layer of radar data over the real-world view to enable them to target missile attacks.

And finally...

For your chance to WIN your own AR CV plus £500 worth of Amazon vouchers, simply tell us in no more than 100 words why you should have your CV converted into augmented reality.

With thanks to:

Jonathan Chippindale, CEO, Holition; Fred van Rijswijk, founder C2K; Kieron Kirkland, researcher at at Futurelab, an education R&D charity

Search CWJobs for developer roles

Tester Jobs

Tue, 25 Oct 2011 09:38:36 +0100

Testing is an integral part of software development. Experts are required to check all aspects of a product, in order to iron out bugs and to ensure the final product is faultless.

Work environment
Most tester careers start out with a role as a test analyst, moving up to become test manager. From there, it’s possible to go sideways and become a business analyst or move into another area of IT.

Salaries are similar to development roles, depending on each specific role, which includes performance testing and automated testing. And the great thing about testing - besides being in demand - is that the hours tend to be in line with most offices. The only time you might have to give up your weekend is before the launch of a new product.

Qualifications
There are two main routes to getting a testing job. The first involves gaining a technical degree in a field such as computer science, getting experience as a programmer within a software house and then moving across into a quality assurance role.

The second is to work your way up within a business and look out for an opportunity to help test some of its IT projects.

However it’s important to note that to move upwards and onwards employers now expect to see an ISEB Foundation Certificate in Software Testing on candidates CVs before they will even consider offering an interview.

Experience
Tester jobs tend to attract professionals looking to break into new developments and enjoy the buzz of liaising between business analysts on one side and technical people on the other.

It’s also a magnet for IT professionals who have a good attention to detail and who can identify a small problem before it develops into a big one.

Solaris Jobs

Tue, 25 Oct 2011 09:38:36 +0100

The Solaris Unix-based operating system became one of the most widely used servers for websites during the internet boom.

Due to its complexity, organisations utilising the system require Solaris experts to help with ongoing maintenance as well as initial system design.

Work environment
Many Solaris experts move towards administration jobs. This can involve a wide range of tasks from building and installing software and infrastructure to commissioning Solaris hardware and software.

Qualifications
Good communications skills are required if the specific role requires the provision of technical advice on Solaris systems - and additional skills like an understanding of ITIL support processes are an asset.

Experience
You may work directly for Solaris or a related company as a consultant or technical specialist, helping clients to find the best solution. This will require in-depth knowledge of all Solaris products, and possibly additional programming knowledge in Java, for example.

Search for Solaris jobs.

What is security clearance?

Tue, 25 Oct 2011 09:38:36 +0100

Security Cleared IT jobs are found in many government organisations such as the Ministry of Defence and the Armed Forces as well as selected private organisations handling highly sensitive information – from aerospace to energy, IT and engineering.

We've put together a guide for IT professionals, graduates and contractors who want to find out more about security clearance and how to obtain it:

Vetting provides a certain level of assurance as to an individual's suitability to have trusted access to that sensitive information. Essentially this means background checks and a vetting process, where the more restricted the information/area the deeper and more rigorous the checks.

In general IT professionals with Security Clearance accreditations are in demand across the board – especially with a current shortage in the UK. The rewards include excellent salary levels, job security, the increased advantage of being considered for a position, and greater job opportunity – being Security Cleared can open doors to many employment options that may not have been opened otherwise.

What jobs need security clearance?
The security clearance system applies to IT workers in the following categories whose employment involves:

Access to sensitive Government assets, Crown servants, members of the security and intelligence agencies;
Members of the armed forces;
The police;
Employees of certain other non-government organisations that are obliged to comply with the Government’s security procedures;
Employees of contractors providing goods and services to the Government

A number of government departments and organisations routinely require Security Clearance.

Central Government
Ministry of Defence
Home Office
Foreign & Commonwealth Office
Ministry of Justice
Office of National Statistics
NATO
Metropolitan Police Service

Who carries out security clearance checks?
The main industry bodies carrying out security clearance checks include:

The Defence Vetting Agency (DVA)
Foreign and Commonwealth Office (FCO)
Metropolitan Police Service (MPS)
National Security Vetting

Security Clearance is granted for a specific period of time depending on the employment term or for a particular project – it is not granted indefinitely, however typically standard clearance will last for approximately 12 months after the project. If you re-join a security cleared post within 12 months there is usually no need to go through the process again.

All security clearances are kept under review to ensure that the necessary level of assurance is maintained. This review is carried out by Government Departments and Government-sponsored contractors, who are responsible for the oversight and aftercare of individuals granted a security clearance.

Registering your CV on CWJobs.co.uk will make your details available via our CV database to the hundreds of companies who are actively seeking candidates with Security Cleared status. Log on today and see what Security Cleared opportunities in IT are out there.

Next: How do I obtain security clearance? >>

SAP Jobs

Tue, 25 Oct 2011 09:38:36 +0100

As the world's leading provider of business software, SAP delivers products and services that help accelerate business innovation. Today, customers in more than 120 countries run SAP applications – from small to mid-size companies up to suite offerings for global organisations.

Work environment
SAP, an IT company like Microsoft, is one of the biggest and best-paid areas of IT that you can specialise in. It focuses on developing business software in areas such as systems integration, eBusiness and supply chain solutions. As a SAP expert, you could work in a number of roles – but you will only advise customers about, and install, SAP software. Roles include SAP consultant jobs, project manager jobs, analyst jobs, technician jobs or trainer jobs - the same roles as in the wider IT environment but only focusing on one technology.

Qualifications
With a lot of competition for job vacancies, you will of course be expected to be qualified in SAP technologies. SAP runs a huge range of training courses covering introductions to technical business configuration.You can choose the courses that suit your area of expertise and career ambitions - for example financial software installations, customer management or general business applications.

Experience
As well as systems maintenance and development, SAP specialists will also be heavily involved in managing both their team and the relationship with clients and customers. This means that as well as possessing specialised technical abilities, SAP professionals need wide-ranging communication skills to deal with a variety of people quickly and efficiently.

Search for SAP jobs.

PHP Jobs

Tue, 25 Oct 2011 09:38:35 +0100

PHP is a scripting language that was designed for web development and can be embedded into HTML. It’s free software and is currently used on over 20 million domains for both front-end and back-end web development.

PHP programmer jobs involve the design, develop, code and improve software applications; while PHP web and server developers jobs design, develop and improve front-end and back-end web applications and servers.

Work environment
Because the range of industries looking for strong PHP Developers is so varied, there are opportunities to work within an area of specific interest to you.

Experienced PHP specialists can choose to work freelance, offering increased work flexibility, but more frequently IT staff with PHP skills will work within an agency developing websites for a range of clients.

Qualifications
Most employers will require knowledge of PHP development tools and scripting for web and software development jobs. Most positions require a bachelor's degree in computer sciences or a related discipline

The role can require the individual to develop entire web pages, update, maintain and edit existing pages or to develop applications. Some roles may require a number of skills, such as Java and SQL, depending on the level of programming involved.

Experience
As well as using HTML, a PHP developer will often need experience with the specific systems used by the employer, such as UNIX. These types of positions also require understanding of basic development principles such as the software development life cycle and object-oriented design and programming.

Search for PHP jobs.

Oracle jobs

Tue, 25 Oct 2011 09:38:35 +0100

Top UK companies and IT consultancies need experienced Oracle specialists across a wide variety of projects and systems.

From database analysis jobs, production jobs and security jobs to server administration jobs, data modelling jobs and development jobs – the choice of roles and sectors is far-reaching.

Work environment
As an Oracle expert, you’ll be working in a team to identify faults, as well as deliver improvements.

Database specialists are trained in various skills, including using Oracle systems, which can make them a highly sought-after member of the technical team. Oracle experts could find themselves working in database administration or system development jobs.

In a financial institution, for example, an Oracle specialist might administer and support a range of relational databases servicing critical, high availability applications

Qualifications
To be an Oracle specialist, you’ll need to be equipped with the relevant skills and qualifications. This includes experience in various applications UNIX, DD1 and Dataguard as well as the main database packages and triggers.

Furthermore, a degree in a technical discipline can prove an asset, along with qualifications that are recognised by the wider IT industry, such as an MCP, MSCE or CCNA.

Depending on the technical level demanded by the specific role, it may be necessary to have experience in one or more other languages such as PHP or SQL.

Experience
As with most areas of technical R&D, specialist knowledge and experience can lead to good career progression with a large number of companies.

Search for Oracle jobs.

.NET jobs

Tue, 25 Oct 2011 09:38:33 +0100

Since its launch in 2002, the .NET framework has been adopted by most companies who rely on Microsoft to provide their IT systems. Due to its popularity, opportunities for .NET developers have increased – and so have the expectations of recruiters, who increasingly now seek a higher level of technical know-how.

Work environment
The career progression for .NET software developer jobs begins at junior level, rising up to mid-level and then senior developer within around a five year timeframe.

The most successful .NET developers are able to demonstrate that they have more than just technical ability. Being able to work as part of a project team, under pressure and to tight deadlines across multiple tasks are sought-after qualities. Good verbal and written communication skills are also essential.

Qualifications
Often companies using the .NET platform require developers to have experience in related technologies such as ASP.NET, VB.NET, Winforms, and C #. Knowledge of the latest Microsoft technologies, such as .NET 2.0, Atlas and LINQ, is also a useful asset; and likely to set you apart.

Employers consider a degree related to computing as the most essential route to become a .NET developer; or a science-related degree, with conversion to a computer science qualification. A strong object-oriented programming background and a Microsoft accreditation may also be helpful.

Experience
To work in a company using the .NET platform you will need to show solid experience in using existing.NET technologies, as well as the very latest releases. You’ll also need to demonstrate commercial experience in developing internet systems, including testing, configuration and support, alone or as part of a team.

Search for .NET jobs

Linux jobs

Tue, 25 Oct 2011 09:38:33 +0100

Demand for Linux, an operating system similar to Unix, has dramatically risen in the past few years. Companies have embraced the technology, including the BBC and various government departments, creating more demand for specialists in this field.

Work environment
Open source software, including Linux, allows users and developers access to its source code in order to promote innovation and invention. Due to its many mainstream benefits, Linux is the operating system used by Google search and also President Obama's campaign website.

Linux programmer jobs will require you to customise, modify and enhance Linux to meet the specific needs of employers and clients - removing the cost of upgrades, platform compatibility issues and errors.

Linux trained professionals often work in a variety of roles, including software engineer jobs, web developer jobs, database administrator jobs, or in technical support jobs and system maintenance looking after networks and Linux servers.

Qualifications
As in much of the IT sector, Linux opportunities are open to candidates with degrees in a relevant discipline - although sections of the profession are responding to the increased take-up of Linux based systems by supplying their own training and qualifications.

Since relatively few IT staff have Linux qualifications, they have proven to be industry-recognised certifications of competence in the field – and catch the attention of any prospective employer. Experience Knowledge of different applications, such as HTML, JavaScript, CSS, OOP, SQL and PHP are extremely beneficial.

Search for Linux jobs.

Java / J2EE jobs

Tue, 25 Oct 2011 09:38:33 +0100

Java technology is popular with virtually every business sector. It’s created a strong demand for software programmers to develop a whole range of products, from gaming to business applications and beyond - making Java and J2EE one of the most popular skills within the IT industry.

Work environment
Specialists in Java and J2EE frequently design, develop and implement new internet-based applications used by companies in many sectors. You may work in-house for a software developer or freelance on a project by project basis – sometimes remotely.

As you progress in a chosen sector or product area, a wide range of opportunities become available beyond programming. It’s worth considering research and development, technical support jobs, sales and even IT management jobs for a later stage in your career.

Qualifications
A relevant university degree is an essential requirement for Java/J2EE developer jobs, with employers largely looking for a computer science, engineering or business-related discipline heavily weighted towards IT.

You’ll need to have knowledge of systems such as HTML, XML, WebLogic and RUP, as well as strong troubleshooting and analytical skills.

Experience
Working in a Java or J2EE programming role does not restrict employees to research and development. Opportunities also exist in technical support, sales or even managing the developing team.

Although several years’ experience is required to get the top jobs, some companies offer high starting salaries to secure the best and the brightest recent graduates.

Search for Java/J2EE jobs.

Cisco jobs

Tue, 25 Oct 2011 09:38:33 +0100

Cisco is the worldwide leader in networking equipment and management for the internet. Cisco systems dominate almost two-thirds of the global market for routers and switches that link networks and power the Internet, creating a whole range of Cisco roles.

Work environment
In recent years, Cisco developments have included new products and key technologies that make the Internet more useful and dynamic. These include advanced routing and switching, voice and video over IP (VOIP), optical networking, wireless and content networking.

Common positions for a Cisco CCNP certified individual include network administrator jobs, Level 2 support engineer jobs, network technician jobs and deployment engineer jobs. Support roles are also essential within all organisations working on a network, as downtime can be costly and disruptive to business.

Qualifications
For those seeking Cisco careers, CCIE is Cisco’s highest level and most respected professional IT certification. Cisco also offers a networking academy that offers a range of skills to IT professionals from complete network design to troubleshooting processes.

Experience
Good communication skills are often desired as it may be necessary to explain technical aspects of a Cisco system to individuals with limited technological understanding.

Search for Cisco jobs.

C, C++, C#

Tue, 25 Oct 2011 09:38:33 +0100

Software development is a dynamic working environment where the ‘family of C’ programming skills (C, C++ and C#) are widely sought after.

Considered a middle level language, C++ and its counterparts are widely used throughout the software industry, giving programmers the opportunity to work within almost any area of interest - from finance to the public sector.

Work environment
After the computer software engineers and systems analysts design software programmes, as a C, C++ or C# programmer you’ll convert that design into a logical series of instructions that the computer can follow. Working as part of project team like this in a commercial environment, most likely from inception through to completion, will enable you to get involved in the entire process.

You may work in an office or laboratory setting; or even telecommute, which is becoming more common as technological advances allow programming work to be done from remote locations

Qualifications
Employers consider a university education a necessary pre-requisite for C programmers, ideally in a computer science or IT-based subject. Those who have earned a PhD are also highly sought after candidates

Disciplines and skills include strong interpersonal and communications, as well as more specific attributes. For example, employers may be drawn to candidates with maths qualifications as well as technical skills if they are recruiting to develop a financial business application.

Experience
Employers often look for programmers who have experience in more than one of the C languages – so, both C and C++ or the Microsoft developed C#.

As software design has continued to advance, and some programming functions have become automated, programmers have begun to take on some of the responsibilities once performed only by software engineers.

As a result, some computer programmers now assist software engineers in identifying user needs and designing certain parts of computer programs, as well as other functions.

Search for C, C++, C# jobs.

Banking and finance: IT jobs, skills and qualifications

Tue, 25 Oct 2011 09:38:33 +0100

Within the banking and finance sector, you’ll find a wide range of opportunities for IT specialists. From programming financial software and applications, to website development and maintenance, this diverse industry relies heavily upon new technology in all facets of its business – and employs more computing experts than virtually any other.

Opportunities
There are over one million people currently working in the UK financial services industry in more than 35,000 companies (UK international financial services - the future, HM Treasury, 2009). These include retail and online banks, pension providers, insurance and actuarial firms, and organisations such as supermarkets that have diversified into providing financial services and products.

Technology enables each of these organisations to run their business efficiently. IT is used on a massive scale to support all data management, interactions and transactions and is central to providing services through a range of channels, including internet and telephone banking, cash machines and over the counter in high street branches.

Work environment
Although London is the focal point of the UK financial services industry, it accounts for just under one-third of overall industry jobs. There are also thriving financial districts in other large cities: search for jobs in Manchester, jobs in Leeds, jobs in Bristol, jobs in Edinburgh, jobs in Glasgow, jobs in Cardiff and jobs in Belfast.

Many of the organisations in the UK financial services industry are part of international groups or have clients based outside of the UK. Opportunities to work overseas may be available to those who make their careers with global firms.

The work environment in the banking and finance sector is very fast-paced and dynamic, often with long hours and crucial deadlines. To balance this out, you’ll also find attractive salaries and bonus structures, as well as opportunities to work on multi-national projects.

Skills
IT specialists with a flair for development and with a strong technical knowledge of languages such as PHP, .NET, Java or similar codes, could look at developing and programming financial software and applications, for example.

Individuals with an interest in IT support may prefer to explore infrastructure, such as the provision and maintenance of servers, networks, data storage, disaster recovery and desktop terminals.

Even the various financial institutions are themselves consumers, purchasing the latest applications from financial software houses. These software houses employ IT specialists to regularly develop new programmes and applications, as well as liaising with clients and selling the product.

And an IT specialist with business or marketing experience and qualifications can also diversify into managing and implementing aspects such as e-promotions, e-brochures and direct marketing solutions.

Search for banking and finance IT jobs

ASP .NET Jobs

Tue, 25 Oct 2011 09:38:32 +0100

ASP.NET is a programming framework designed to improve the process of website development. Unlike ASP, it doesn’t limit the specialist to VBScript and Jscript, but in fact supports over 25 .NET languages.

Work environment
Jobs requiring ASP.NET specialists have risen significantly in recent times as companies begin to appreciate the flexibility and power of the framework.

As web presence has become so critical to businesses of all sizes, IT specialists with ASP.NET knowledge may find roles in a huge variety of organisations - from social networking to large corporates.

Qualifications
Because of its diversity, ASP.NET programmers are given the flexibility to choose from a wide range of languages to suit their own knowledge, bearing in mind the requirements of each specific project.

ASP.NET can be utilised with virtually any text editor, including Notepad, giving the IT specialist more freedom compared to ASP.

Experience
To work in a company using the .NET platform you will need to show solid experience in using existing .NET technologies, as well as the very latest releases. You’ll also need to demonstrate commercial experience in developing internet systems, including testing, configuration and support, alone or as part of a team.

Search for ASP .NET jobs

10 things to know about shared IT services

Tue, 25 Oct 2011 09:38:32 +0100

1. Shared services hot again

Shared services are back in the news. Nine out of ten local authorities in England are looking to share front line and back office functions within the next two years. A survey conducted by Ipsos Mori for law firm Browne Jacobson found more local authorities and government agencies are considering pooling resources to deliver services in the austerity era.

2. The vital statistics

Almost two-thirds (65%) will target back office functions and 68% front line services in the next year. Some 85% of local authorities might also consider outsourcing on a service by service basis whilst 78% would also consider setting up a joint venture with the private sector. Environmental and social care services are the two most popular areas where senior managers would consider sharing.

3. Some services more shared than others

True shared services consist of integrating IT departments and infrastructures – but that doesn’t happen often. Instead, there are many permutations of shared services: clubbing together to share procurement and gain the advantages of the economy of scale; multi-agency systems that are built and run by a provider; joint ventures where a local authority teams up with an outsourcing expert and keeps jobs on the local turf. Think Liverpool Direct Limited – a venture between Liverpool City Council and BT.

4. Political in-fighting biggest bugbear

Given that local government is a hotbed of ferocious politics, true sharing of services has not always been successful. Hence the various permutations of sharing that include a lesser degree of collaboration. Nonetheless, political and public opposition is seen by 28% of senior managers interviewed in the Mori poll as the biggest barrier to delivering shared services in the local government sector.

5. Lack of commercial experience

Is also cited as a major obstacle to successful sharing. Most IT managers or leaders of local authorities don’t understand how to measure the real costs of delivering IT services. This can work against them when they do an outsourcing deal as they award a contract to the lowest bidder, but if a supplier cuts corners, the price doesn’t go down.

6. And the drivers are...

Not surprisingly costs savings are the key driver for those mulling over a move to any variant of shared services. According to the Browne Jacobsen survey, 63% of the 150 senior LA managers interviewed, expect to save up to 10% of their total budget savings in the financial year ending April 2012.

7. The evidence is...

A global Benchmark study carried out by the Shared Services & Outsourcing Network (SSON) and Hacketts found that only about a third of all participants generated cost savings of 20% or greater. Companies were more successful at achieving productivity and quality improvement goals through the implementation of shared services.

8. In the pipeline

Westminster Council is halfway towards negotiating a framework agreement to purchase all software as a service (SaaS) and other LAs are expected to join. It’s part of its strategy to be infrastructure-free by 2015. By brokering the deal, the London authority can expect a handsome discount on software services. Hammersmith and Fulham and Westminster have announced their desire to share children’s services.

9. Harmony makes a partnership

Sounds obvious yet many shared services efforts don’t make it past the tender stage because local authority partners can’t agree on a standard way of doing things, whether it’s what applications or devices to put on the desktop, or who will host the servers. Instead, someone wants to be in the driving seat and winkle out the biggest gains. Outsourcing sidesteps some of these conflicts, but even then local authorities need to recognise their partner has to make a cut in order for the project to be viable.

10. Governance is all

Sharing or outsourcing a service or IT function doesn’t pass the buck for governance or responsibility for data. Contracts should specify who is in charge of day-to-day governance, and shared services need shared practices for governance. Steering committees can be set up for participating parties while accounting standards requires a clear audit trail for data. And, in the event of data going missing, remember, it’s unlikely that any tabloid will nuance the headline to reflect contractual obligations.

With thanks to Danny Jones, director of public services at TPI, Robert Mackenzie, business & technology partner at Scott-Moncrieff, and David Grigsby at LiquidLogic.

Browse CWJobs for Helpdesk jobs, Support jobs and Project Managers

Cloud computing clinic: your questions answered

Tue, 25 Oct 2011 09:38:32 +0100

The 2011 small business survey by PPH reveals that many businesses just don’t ‘get’ cloud computing and what it can deliver. We asked our panel to field some common technical and commercial queries.

Q: What is cloud computing?

A: Cloud computing is a model of delivering hardware and software resource as a service, typically offered on a pay-as-you-use basis. Here's the simple fact - if it involves the purchase of hardware, it's NOT cloud computing. This may seem obvious, but it's amazing how many 'false cloud' vendors there are out there!

John Appleby, CEO and chairman of cloud consultancy, Saaspoint

Q: What are the advantages of managing data in the cloud?

A: Cloud computing is highly scalable and agile. At its most basic level, it enables someone to access computing power and applications online via the internet on demand. It provides resource and services to store data and run applications, in any devices, anytime, anywhere, as a service. It can reduce costs, increase scalability and improve service level availability for businesses.

Andy Burton, chairman of the Cloud Industry Forum

Q: Does cloud spell the end of the datacentre?

A: No, although data centres will likely become more specialised and outsourced. The cloud is essentially a platform for sharing and storing data through a distributed computer system and so the importance of the datacentre is actually heightened. Continuing demand for higher performance to serve application better places a greater onus on the network’s physical infrastructure. This in turn will lead to the formation of datacentres specifically designed to manage cloud networks.

Craig Doyle, senior solutions market manager, EMEA, CommScope

Q: How can cloud affect the bottom line?

A: The concept of cloud has more to do with the way a user purchases a service rather than describing a stack of infrastructure. Customers are not keen to make significant capital expenditure only to find that the capacity they have purchased doesn’t match the requirements of their applications or the volumes of data they wish to store. Cloud offers a way of buying IT resources according to need. This is a shift from Capex to Opex a key driver for most business.

Simon Gay, CTO, Adapt

Q: What are the risks in selecting a service provider?

A: The primary concerns raised by businesses centre on data security and privacy, contractual lock-in and network connectivity. These concerns can be mitigated and a good starting point to understand a potential supplier of capability is to see if they have signed up to the Code of Practice: It’s therefore necessary for cloud service providers to back up any public claims that they make about their service, and to certify that they offer a high standard of cloud computing services.

Andy Burton, chairman of the Cloud Industry Forum

Q: Can I mix and match suppliers?

A: Over time, yes, you will be able to. Today, there is not enough standardisation in either the technical or the commercial offerings from vendors. Use a cloud operations platform that can give you a level of independence from the individual hosting providers. Don’t buy both your cloud operations software and your hosting cycles from the same big company. Pay close attention to network performance and reliability.

Rens Troost, chief technology officer, Virtual Clarity

Q: Should I be worried about the lack of standards?

A: Be prepared for a rapidly evolving market; by all means track and even get involved in the standards but don’t expect that to help you in the immediate future. It’s important to have realistic expectations. So, expect to change providers more than once in the coming years. Don’t sign a long-term deal for a large part of your IT infrastructure; try a few providers for projects with a clear return. Finally, pay close attention to security, especially at the storage layer.

Rens Troost, chief technology officer, Virtual Clarity

Q: What are the DPA implications of cloud?

A: Moving all of your services and, more importantly, your data into the cloud does not get rid of your legal obligations under the Data Protection Act. As the registered data controller the information is your responsibility. One of the risks related to moving data into the cloud is that you don’t know where it actually resides. Under the act it has to be housed somewhere within the European Union to comply with the legislation or, if in an overseas location, there needs to be a safe harbour agreement ensuring EU legislation will apply.

Robert Mackenzie, partner, business technology and consulting, Scott-Moncrieff

Q: What management controls should be set up?

A: Like any good service contract your service level agreement should set out some key performance indicators which enable you to monitor the performance of your cloud computer supplier. You should have a contractual commitment from them to keep the data secure. However, you also have to match this with your own security arrangements as you will be using their tools to grant access to the data to your own staff, probably from a range of remote locations, and using an assortment of technologies.

Robert Mackenzie, partner, Business Technology and Consulting, Scott-Moncrieff

Q: Do cloud apps offer the same functionality as on-premise versions?

A: Many web-based applications currently do not offer the same degree of functionality that users are accustomed to with on-premise alternatives. For example, the rich features and functionality of many enterprise-level CRM systems may not be matched by the new generation of web-based counterparts. Organisations will need to ask themselves how much of the functionality of on-premise applications is actually utilised or needed on a routine basis and how much of it they can live without.

Matthew Edwards, chief technology officer at bluesource

Browse IT jobs.

Virtualisation: the facts and the myths

Tue, 25 Oct 2011 09:38:32 +0100

When does virtualisation end and the cloud begin? Read on to find out

Q: What is virtualisation?

A: Traditionally, one dedicated hardware environment is used to deliver one computing ‘instance’, whether it’s a server or a desktop. This is inefficient and expensive because it uses only a small percentage of the hardware’s capacity. Virtualisation uses an additional software layer to allow the delivery of multiple instances from a single hardware environment, thus maximizing the use of the hardware resources. This can be carried out by an in-house IT team looking to save costs and maximize return on investment.

Luke Mansell, director independent sourcing expert, TPI

Q: What’s the difference between virtualisation and cloud computing?

A: Cloud computing takes virtualisation a stage further; the hardware used to deliver the virtualized instances is not owned by the client, but by a third-party provider, and the instances are accessed over the internet. The principal difference between virtualization and cloud computing is the move from capital expenditure to operational expenditure: the cloud provider takes the risk of buying the hardware and the client pays for a service as an operational expense. There are constraints in the cloud model, however, as the buyer will sacrifice their ability to set service levels and face an increased risk in compliance with data regulation.

Luke Mansell, director independent sourcing expert, TPI

Q: Virtual machines don't run all applications do they?

A: With Windows and Linux applications there are very few applications which care whether they are running on virtual or real hardware. Those which don't run depend on some hardware feature not supported by the virtualisation environment, for example, a dongle or a high-performance graphics card. Also, you usually can't run virtualisation software in a virtual machine.

Nick Craig-Wood, co-founder of Memset

Q: Virtual machines are insecure aren't they?

A: The operating system that runs on a virtual machine is no more or less secure than it would be running on a physical machine. There are more layers in the virtualisation solution though, like the hypervisor layer, which could possibly introduce security problems. However since hypervisors are usually well insulated from the outside world, small and well-audited bits of software, problems with them have been minimal in practice.

Nick Craig-Wood, co-founder of Memset

Q: Server virtualisation is expensive isn't it?

A: Actually there are some very good high quality free server virtualisation platforms available. For example the commercial Xen has an open source edition, which has been made into packages for popular open source operating systems like Ubuntu and Debian, making Xen just an aptitude install away! A Linux Xen host can quite happily run Windows virtual machines provided you have the right licences.

Nick Craig-Wood, co-founder of Memset

Q: What are the pros of virtual desktops?

A: Workers can access their full desktop from anywhere, on any type of device, offering flexibility and mobility to an organisation’s workforce. It can also simplify desktop management and reduce the total cost of ownership for organisations. Through desktop virtualisation, IT administrators can centralise desktop lifecycle management in the data centre so that application updates are automatically installed from a central “master” operating system and streamed to each PC across the network. This ultimately, helps to eliminate application conflicts, optimise system performance, improve data security and keep desktops updated.

Patrick Irwin, product manager of EMEA at Citrix

Q: Are there any performance drawbacks?

Virtualisation software can add additional requirements to IT infrastructure that can lead to poor performance and difficulty working with other bandwidth-intensive applications, such as multimedia experience. This is usually because of degradation in performance over wide area networks. The number of additional infrastructure components between the worker and their desktops, applications and data may also hinder performance. By understanding these challenges in more detail, a solution can be implemented that utilises existing infrastructure and analyses specific user need to deliver a seamless offering for both users and IT administrators alike.

Patrick Irwin, product manager of EMEA at Citrix

Search CWJobs for Software Engineer jobs, Virtualisation jobs, and 1000’s of IT vacancies

10 facts about business intelligence

Tue, 25 Oct 2011 09:38:31 +0100

1. Why is business intelligence a good place to be?

Businesses and IT managers are hungry for business intelligence jobs (BI) with the worldwide market for BI software forecast to grow 10% in 2011, according to analyst giant Gartner Group. The analyst group has ranked BI number five on the list of the top 10 technology priorities for chief information officers (CIOs) in 2011. BI has remained healthy because it is seen as an important tool for organisations.

Ian Bertram, managing vice-president, Gartner

2. What does BI do?

IBM defined the phrase back in 1958 as: "The ability to apprehend the interrelationships of presented facts in such a way as to guide action towards a desired goal". A practical example is the retailer who wishes to know what time of day particular groceries are purchased and in which combinations, for example. This knowledge makes it’s possible to lay out supermarkets to better match consumer buying patterns.

3. What are the tech origins of BI?

It evolved out of decision support systems of the 1960s that tried to provide accurate and timely information to support business decisions. With origins in Cobol-based, green-line reports, these evolved though executive information systems (EIS) in the 70s and 80s to become sophisticated tools for report design, ad hoc query, and online analytical processing (OLAP). Modern BI platforms combine these tools with databases, integration technology, and portals to deliver sophisticated BI applications.

Kevin R. Quinn, vice president of product marketing, Information Builders

4. And the necessary IT skills are...

Languages, in a nutshell. Products such as SAS divide BI process into three steps: The first data step of a SAS program uses a database-oriented fourth-generation programming languages, similar to SQL or Focus. This allows the programmer to concentrate on the details of working with the data within each record. Other procedural tasks are then accomplished using SQL to interrogate data. Third, macros can be written on top using imperative and procedural programming. With the move to integrating BI with portals and offering it as a web service, XML plays a bigger part in making it accessible over IP networks.

SAS Insitute

5. What’s this ‘back end’ and ‘front end’ business?

BI used to be an expensive and mammoth undertaking requiring huge, dedicated data warehouses – or marts- that stored data exclusively used for ‘data mining’ purposes. Data warehouses formed the back-end of the operations and needed armies of database administrators to maintain, synch and populate from production databases. The front-end BI tools analyse the reams of data involved, and these analytical tools have become more and more user-friendly over time.

6. What’s the future use for BI?

The growth of BI and analytics as a service has changed the way BI is offered: organisations can instead provide front-end tools to those that actually need to use them, whilst back-end analytics are taken care of by the service provider. As a result, the skills needed are changing: for an organisation using BI as a service, it can be as simple as knowing what questions to ask; and so business analysts are playing a more prominent role in extracting value out of BI.

John Coppins, product director, Kognitio

7. Who’s using it?

Favoured in marketing, retail and financial sectors for understanding customers better, BI is spreading across all markets. BT uses BI to review customer use of its price plans, creating price plans to suit need and ensuring that customers choose the optimum price plan. Online retail portal Kelkoo uses BI to track the experience of visitors to its site, enabling it to ensure the visit is as smooth as possible and that customers see the products and offers that are most relevant to them.

John Coppins, product director, Kognitio

8. How are pubs using BI?

Tattershall Castle Group uses BI to measure whether a drinks promotion attracted enough sales, how a price rise hit sales and whether a bar is overstaffed. The Kognitio package presents data in a traffic-light system; all profitable hours are shown in green, areas that may need attention are displayed in amber whilst all hours that make a negative contribution are displayed in red. Bar managers now decide whether their pub has got the food and drink mix right according to objective and real time data, rather than going on gut instinct.

9. What’s the bad news for BI?

Around 70-80% of corporate business intelligence projects fail. The problem stems from communication between IT and the business, and the failure to ask the right questions or to think about the real needs of the business. IT departments make the mistake of looking at BI as an engineering problem that requires a specific package solution. BI is not a crystal ball that pops out the answer. People in IT need to understand what business they are in. They are in the information and communication business.

Patrick Meehan, president and research director, Gartner's CIO Research group.

10. The four worst BI practices are..

Assuming the average business user has the know-how or the time to use BI tools
Allowing Excel to become the default BI “platform”
Assuming a data warehouse will solve all information access and delivery requirements
Selecting a BI tool without a specific business need

Information Builders: Worst Practices in Business Intelligence

Search CWJobs for Business intelligence jobs, Business analyst roles, Data warehouse vacancies and Developer jobs.

Cloud computing clinic part 2

Tue, 25 Oct 2011 09:38:31 +0100

CWJobs.co.uk's cloud computing panel answers your questions

Q: Which IT roles are on the up because of cloud?

A: There's a lot of talk about ‘devops’, a term that means operations personnel and requirements are factored into the application development cycle. The trend could see a devops hybrid pro materialise, too. The model of ‘deperimeterised’ computing means that security can no longer focus on implementing measures at the boundary of the datacentre. Security engineers need to develop a new strategy and get involved early so that the appropriate security measures and processes are automatically injected into every instantiated computing endpoint.

Bernard Golden, CEO HyperStratus

Q: Which roles are going down?

Technical support and maintenance – these tasks can be automated. In the past, growth in computing capacity was mirrored by a linear growth in headcount. It's clear that this phenomenon is unsustainable for big scale data, more (virtual) servers, more applications, much larger applications, and many more highly elastic applications. Companies can't -and won't - support this scale growth with headcount as in the past.

Bernard Golden, CEO, HyperStratus

Q: What's a good service level agreement?

A: Most reputable cloud suppliers will offer a standard service level agreement. Unfortunately, this is likely to be restricted to what they can easily and cheaply deliver without too many onerous demands on them. Key requirements to look for are: availability; business applications available and their capability to meet your business requirements; a commitment to meet security requirements and compliance obligations such as the Data Protection Act.

Robert Mackenzie, partner, business technology and consulting, Scott-Moncrieff

Q: How do I to put my own IT house in order?

A: Moving critical applications to the cloud without a strong and flexible network in place is like building a house with no foundations. And if enterprises don’t ensure their own corporate networks have the right levels of bandwidth, flexibility, latency and security then they will at best never see the benefits, and at worst, open up their business to significant operational risk.

Craig Wellman, Azzurri Communications

Q: How do I know which cloud apps will suit my business?

A:It depends, of course, on what you need. The cloud is just a different way of delivering services you already use. You still access applications and data on remote servers – it’s the way those servers are run that makes the difference. Ask providers about resilience and failover, self-provisioning, bursting and utility billing options. Check for accreditation programmes that make it easier to identify reputable cloud service providers.

Carlos Rego, chief architect and MD, OnApp

Q: Is cloud lock-in a danger?

A: Most cloud offerings entail moving data to a single platform which can be as proprietary as any on-premise system. Integration complexities and costs need to be considered, both cloud-to-cloud and cloud-to-on-premise. Most providers boast that it’s easy to move data to their cloud. In reality few disclose, at the time of signing a contract, the technological complexities and associated costs of migrating the same data at the contract’s completion.

Matthew Edwards, Chief Technology Officer at blue source

Q: What security questions should I ask?

A: What measures does the provider take to reduce the risk of a data breach? For example, is the data encrypted? Do you know who within your company and the cloud service provider can access your data and are they security cleared? Is end-of-life data erased and degaussed (magnetically wiped) from all hardware, who certifies that it has been deleted, and has it been erased to your country specific erase standards?

Robert Winter, chief engineer, Ontrack Data Recovery, Kroll Ontrack

Q: How to ensure sufficient capacity in the private cloud?

A: A datacentre must be built with significant bandwidth growth potential, such as 10g copper and 40/100g fibre technologies. The idea is to build now for the future and build the best affordable solution. The alternate approach is to build the datacentre pre-terminated, in a modular or Performance Optimized Datacenter (POD) fashion, as this will enable fast introduction of capacity with the correct performance. Also, if required the physical infrastructure can be removed and replaced in the oldest POD’s and then replaced with the next technology.

Craig Doyle, senior solutions market manager, EMEA, CommScope

Q: What are the data recovery considerations?

A: Are there robust back-up systems and protocols in place in case of a data loss? Do these systems and protocols meet your own in-house back-up standards? Is your data stored on reliable disk? Is your data regularly defragmented? Are the different types of data and applications managed appropriately? Does your cloud vendor have a data recovery provider identified in its disaster recovery plan? In instances of data loss, it is imperative that a rapid response procedure is adhered to.

Robert Winter, chief engineer, Ontrack Data Recovery, Kroll Ontrack

Q: Are you ready for the cloud?

A: For some organisations, a full scale move to the cloud now, will be suitable, for others such a move might never be appropriate. For the overwhelming majority, a considered, phased move to the cloud - with a mixture of hybrid or blended on/off -premise solutions, is likely to prove the best solution. Conduct a maturity assessment of the cloud offerings to see if their needs can be met in the short to medium term.

Matthew Edwards, Chief Technology Officer at blue source

Search for Project Management IT jobs

Virtualisation Clinic part II

Tue, 25 Oct 2011 09:38:31 +0100

Virtualisation is one of those technologies that will always shine on a CV, as it’s increasingly relevant. Our panel of expert advises on common questions relating to skills.

Q: Remind me, what is virtualisation?

A: Virtualisation has been the method of choice for server consolidation over the past five years or so. A set of physical servers can be virtualised into a series of ‘virtual images’ - or data only. Several of these can then be hosted simultaneously on a single physical server using a hypervisor layer, such as VMware’s ESX Server, which allows more efficient use of hardware resources including processor and memory. These virtual images are also portable, easy to migrate from one physical platform to the next.

David McLeman, managing director of Ancoris

Q: What IT skills can be transferred to virtualisation?

A: Any competent systems administrator should be able to set up virtualisation. Most of the skills involved are the same as those needed for a full server, such as installing the operating system, and getting networking going. The virtualisation technology is not that different from a lot of things that systems administrators manage on a daily basis.

Nick Craig-Wood, co-founder of Memset

Q: What skills are needed when working with virtual severs?

A: If you don’t understand storage technologies such as fibre channel, capacity and backup systems when working with server virtualisation, you’ll likely run into trouble. Likewise you’ll need decent networking skills. At the very least be sure that you understand the fundamentals of your chosen protocol, such as fibre channel over Ethernet (FCOE). Performance troubleshooting skills are of the utmost importance when working with server virtualisation as bottlenecks can quickly build up.

Robert Rutherford, CEO of QuoStar Solutions

Q: What security pitfalls do I need to beware?

A: If you plan to add virtual machines to physical servers you need to carefully consider how that affects network security. The key message is to look before you leap. Virtual local area networks are used to segregate traffic on traditional networks, but when it comes to virtual networks, people often forget to apply the same methodology. A virtual switch is required to control how applications and files interact with one another to ensure the network is correctly segmented and access to data is restricted as appropriate.

Lewis Honour, Security Practice Director at Intergence Systems

Q: How do I optimise application performance?

A: To maintain excellent application performance in a virtualised environment, it is crucial to have the right management tools in place. By monitoring the real-response time of applications, performance can be benchmarked against service level agreements and problems can be addressed as soon as they arise. The IT department also needs to manage how individual requests are optimised, routed and transformed. Intelligent traffic management policies can evolve over time as user demands and needs of the business change. Directing traffic to data centres in either San Jose or Amsterdam, depending on the location of the request, can reduce application delivery time by two seconds.

Owen Garrett, cloud computing and virtualisation specialist, Zeus Technology

Q: How is network capacity affected by virtualisation?

A: Once companies ‘go virtual’ the number of virtual servers tends to increase beyond expectations because they’re easy to deploy and businesses wish to keep applications separate. If the network has not been sized correctly or insufficient bandwidth has been commissioned to supply the physical servers, congestion can ensue and cause delay. It's an issue that's glossed over by vendors when they push the move to virtual networks.

Lewis Honour, security practice director at Intergence Systems

Q: How do I cost virtualisation?

A: Virtual resources can be harder to price. This is because the IT department has to calculate how to apportion chargeback to the departments who are using that server as a part of a shared resource. The fact that user requirements change over a fixed accounting period also complicates things. The spiralling cost of power is an incentive for IT and facility management departments to get together to understand unit costs of office space, server rooms, equipment and utilities. A rising tide of savvy cloud-based IT providers, including Amazon, EC2 and Salesforce, that charges on usage, will only add to the momentum for IT staff to understand costs.

Robin Webster, infrastructure consultant, Centiq

Read Part I of the Virtualisation Clinic.

Browse CWJobs for VMware vacancies, network jobs, system administrator jobs, storage jobs and Cisco roles.

Security specialists take centre stage at Infosec

Tue, 25 Oct 2011 09:38:30 +0100

The growing stature of IT security professionals was confirmed at the recent Infosecurity Europe 2011. Tools and techniques for the modern professional were discussed at the cyber security convention as was the necessarily dynamic role of the security specialist. The following messages, announcements and trends emerged for our specialist band of IT professionals during the expo.

Prioritise – or die

Organisations must accept change, embrace consumerisation of IT, and enforce security by focusing on the most sensitive data. The most important task for information security representatives in all organisations is to decide what data needs to be secure and put multi-layered defences around that.

Lord Erroll cross-bench peer

Sandboxing skills

Organisations should be looking for ways of using all the latest devices while retaining control over sensitive data such as sandboxing it within any device. Strategy should not be about locking down devices to such an extent that they cannot be used: the whole point of employees bringing their own kit to work is to be more flexible and efficient by being able to work anywhere.

Lord Erroll cross-bench peer

Hardening guides

The most common threat organisations face is data leakage through the copying and distribution of unauthorised documents. Nearly a quarter of security breaches are paper-based. Canon has launched the first in its series of 'hardening guides' advising on best practice security configuration for printers to help lower the risk of exposure to potential threats.

Canon: Hardening guide

Centrally control mobile devices

The challenge of managing disparate personal devices that are flooding the corporate world is very taxing for the IT administrator. Cisco has solved the ‘any device’ security challenge by building context-aware access security policies into a single tool. This distinguishes between organisation-owned devices and personal user devices and automates security across the organisation with network-enforced access policies and encryption.

Standard reduces breaches

Organisations that comply with the payment card industry data security standard (PCI DSS) have far fewer data breaches, according to a study by security firms, Imperva and the Ponemon Institute. The study found that in 2010, 99% of compliant organisations suffered no more than a single credit card related breach compared with 85% of non-compliant organisations. while 64% of compliant organisations had no breach at all compared with 38% of non-compliant organisations.

Secure web gateways

London-based Institute of Directors (IoD) has cut security administration by 75% by deploying a secure web gateway to protect users of its UK-wide network. Cutting cost was also an important driver for the not-for-profit organisation that provides 65,000 Wi-Fi logins for members each month, he told Infosecurity Europe 2011 attendees in London.

With thanks to Computer Weekly.

Search CWJobs for security jobs

Open source continues to drive innovation

Tue, 25 Oct 2011 09:38:30 +0100

Where did open source come from?

It is 20 years since Linux, the cornerstone of the open source revolution, was conceived by its creator, Linus Torvalds. The free version of operating system Unix was designed to be transportable across different computer platforms and has been developed by a community of enthusiasts. Today, in 2011, Linux has quietly permeated most sectors and IT departments: Google, Facebook, Twitter or Android are based on Linux user while it’s embedded in many a mission-critical system too.

Why it is in the news?

As well as being the twentieth anniversary of Linux, the computer giant Oracle has handed its office productivity software to the open-source community for future development. In the public sector, open source is getting a fillip, too. OS products struggle to get official clearance from security gatekeeper, GCHQ, but the Cabinet Office recently urged all departments to make greater use of open standard products. Government determination to see public sector projects broken down into smaller, more manageable chunks should also see the introduction of more OS-based components.

What are the main skills?

Linux is the signature open source operating system kernel. Apache, an HTTP or web server is another keynote product developed and maintained by an open community of developers. It runs on a Unix-like operating system and since 1996 has been the busiest web server software on the planet. Eclipse is another open source towering presence in many software development projects. The multi-language software development environment is written mostly in Java, but a plug-in means it can be used with other languages including Perl, Cobol, ADA and many others.

How is open source radical?

"The open source movement mandates free redistribution of software and subsequent amendments, plus access to source code. Initially, when I got involved it seemed counter-intuitive. I was trained in a developer role to write a specification, which we then built and tested against. Development of Linux was much more iterative and collaborative. The methodology depends on expert peer review as once code is published in the public domain, everyone can view it. The ethos of developers receiving and offering feedback leads to a virtuous circle of constant quality improvement."

Adam Jollans, program director, software strategy, IBM

Is open source software secure?

"The community believes that because code can be viewed by everyone, it is easier to spot holes and to fix them. Governments are also asking for certification and we are working to provide those. An initiative by the US National Security Agency resulted in the release of a security-enhanced Linux system back to the community in 2002. This version of Linux has a strong, flexible mandatory access control architecture incorporated into the major subsystems of the kernel. The enhancement provides a mechanism to enforce the separation of information based on confidentiality and integrity."

Adam Jollans, program director, software strategy, IBM

Business intelligence

"The Open Source community, harnessed by Jaspersoft has just evolved business intelligence into three layers, architecture, data and interface. This separation is into three layers is ahead of the mainstream developers to finesse their piece of functionality without being hindered by the code or constraints of the other two. The business intelligence builder, who is responsible for the interfaces - dashboards and data analytics - part, can get on with that without worrying about the code in the architecture piece, or the getting bogged down in data. "

Tom Cahill vice president EMEA at Jaspersoft

What are the limitations of OS products?

"Their relative lack of maturity compared to the more robust, proprietary products that have been around much longer. This usually manifests in a lack of functionality. In the business intelligence field, for example, market leaders such as Business Objects and SAS have heavier-duty analytics such as balanced scorecards. The beauty of the OS versions is that they can be produced at a lower price point and can be made available to a broad population, rather than reserved for the information elite. "

Tom Cahill vice president EMEA at Jaspersoft

Why should developers and system managers get involved?

"As a developer, you are a dinosaur if you’re not involved in open source. Innovation in information technology is in the open source community, period. The pace of innovation is chiefly being driven by demographic reasons. Globally, for every person that retires from the workforce, several more are joining it and these newcomers are huge consumers of IT both at home and in their business lives. Satisfying consumer appetite for IT can only realistically be done in a collaborative, open source style because the cost of development per capita is much lower."

Tom Cahill vice president EMEA at Jaspersoft

How can you get involved?

"Working alongside the core maintainers of key software projects can make you far more effective in your day job. If you use Apache Wicket in your company and you have a specific issue you need to address, being a ‘committer’ on Wicket means you have access to the best minds and the tools. Participation can thus make your requirements a reality. But we mustn't forget that our communities are fun communities. Enhancing your career potential, learning new skills and strengthening your CV are all great. But to have fun whilst doing it is the real joy."

Ross Gardler, vice president of community development, Apache Software Foundation

How can students get involved?

The Apache Software Foundation Mentoring Programme is open to anyone, who can join a project and get a taste of coding documentation, translations, design and testing. Work done at the ASF is public and potential employers can see this work, too, and evaluate the mentee’s ability to work in a team and to contribute. It can be a big plus point in an interview situation. To work alongside some of the best software developers in the world is huge an opportunity and I've certainly learned far more through being involved with the ASF than I have in anything else I have done.

Ross Gardler, vice president of community development, Apache Software Foundation

Search CWJobs for Linux jobs and Apache jobs and Eclipse jobs

Jobs on the cyber security career ladder

Tue, 25 Oct 2011 09:38:30 +0100

If you want to work in cyber security, what jobs are availiable to you? Find out here.

Help desk and support

Career rung: Help desk support is a starter job for many IT careers including security jobs.

Job description: Resolving basic hardware, software and network problems for users. As you progress, they may start working on operating system installations, server builds and ongoing analysis and troubleshooting.

Experience: You’ll need to demonstrate a flair for handling customers as well as technical aptitude and capacity for logical thinking. You might have gained this in a previous job, or be a keen hobbyist who wants to take this further.

Job prospects: There’s always demand for good support people. It’s one of CWJobs’ most prolific vacancies

Systems administrator

Career rung: A typical second or third job and a good foundation for a career in security.

Job description: Systems administrators possess strong problem-solving, analytical and communication skills and in-depth technical knowledge in order to manage their employer’s systems hardware and software.

Qualifications and experience: Some employers require a bachelor’s degree in computer science or related field; others may accept an associate’s degree or technical training certificate. Three to five years of experience working with the specific types of hardware and software systems used by the company are generally required. Professional certifications such as the Microsoft Certified Systems Administrator (MCSA), Microsoft Certified IT Professional (MCITP) or The Sun Certified System Administrator (SCSA) are commonly sought by employers.

Job prospects: Their broad base of technical knowledge combined with management skills makes them strong and employable candidates.

Security analyst

Career rung: A possible first job for those with a specialist qualification.

Job description: Security analysts monitor and advise on all aspects of computer and network security, including firewall administration, encryption technologies and network protocols. Analysts need strong communication skills and are able to multitask and work well under pressure. Keeping abreast of industry trends, security developments, and government regulation is a given.

Qualifications and experience: A degree in cyber security could parachute you straight into this role. Otherwise, employers generally seek a bachelor’s degree in a computer-related field along with three to five or more years of practical data security experience. Professional certification such as the Certified Information Systems Security Professional (CISSP) qualification also is a valuable asset.

Job prospects: As cloud computing gains ground, there will be increased demand for these professionals as many companies are concerned about their security and data confidentiality.

Ethical hacker

Career rung: Another recent option for graduates, following the arrival of cyber security degrees. Otherwise, it’s a role to suit someone with a minimum of five years’ experience of managing computer networks.

Job description: They have a specific task: to seek down and remedy vulnerabilities in computer networks. More often you will work for an external client although some large corporations may employ in-house teams. Also known as penetration testers, ethical hackers need analytical and problem-solving skills, as well as excellent judgment and self-motivation.

Qualifications and experience: A high IQ, an enquiring mind, persistence and integrity are as vital as any formal qualification. A track record of solving security problems is also a pre-requisite. More industry qualifications are emerging in this fast-growing profession. A week’s course you can acquire the certified ethical hacker (CEH) badge. However the emerging gold plate of ethical hacking is the Council of Registered Ethical Security Testers (CREST), which is allied to the government-approved CHECK scheme.

Job prospects: There’s a shortage of cyber security skills in the UK, according to the national sector council, e-skills. The future is very bright for this specialist breed, especially in financial services, energy and government sectors.

Chief information security officer

Career rung: This is the endgame, the pinnacle of achievement for some.

Job description: The modern CISO is business savvy and the job enormously varied – ultimately it is about making good calls on all security-related matters. An ability to think methodically, attention to detail and a healthy paranoia are vital attributes.

Qualifications and experience: Security knowledge is gained from on-the-job experience and university degrees in information security, plus training leading to qualifications such as CISSP and CISM. Accreditation is crucial in order to acquire the necessary breadth of knowledge and accompanying peer recognition.

Job prospects: It’s a relatively new market, and will enjoy a steep growth curve as companies wake up to the extent of cyber threats. Government assets are the most highly prized in society and so, unusually, government offers the top jobs.

With thanks to

Jason Giller, Senior Manager, Robert Half Technology

Peter Wood, founder , First Base Technologies

Marcus Ranum, inventor of the proxy firewall, holder of the ISSA Lifetime Achievement Award

How to build more secure apps for the cloud

Tue, 25 Oct 2011 09:38:30 +0100

The founder of the World Wide Web, Tim Berners Lee, has called for applications in the cloud to be built more securely. We take a look at how to build more secure apps for the cloud.

Karl Doody, managing director of App Developer, 27stars says:

Don't ask for information you don't need
Many applications attempt to gather information in case of a rainy day. The more places a user has to enter sensitive information, the less secure it is.

Use HTTPS
This setting forces your communications through an encrypted channel, greatly increasing the security of your application. See Firesheep for what happens if you don't have it.

Encrypt your passwords
It's shocking that in 2011 we have web applications that can email you your password. If your passwords are encrypted, even if the worst happens and you do get breached, at least your users won't have to change their passwords everywhere else they use them. With encryption, risk of password leaks on a hack is greatly reduced.

Use strong passwords
Better password security includes: minimum accepted password strengths (number of characters, use of symbols, numbers); restricted words (ban words from the dictionary, names of the company, their personal names); enforcing policies where passwords expire after a period of time (one week, one month, or three months); plus prevent users from reusing previous passwords on expiry.

Use standard security libraries
Every time you 'roll your own' security solution, you ignore 50 years of research into the most secure way to do it. Don't take a chance - you will miss something important. Reuse, don't reinvent the wheel, and when the industry discovers flaws in previous widely-used solutions (such as SHA-1 in 2005), move on accordingly.

Assume one of your users will try and break it
In fact assume every user is trying to break into your application and plant malicious code; some day, one of them will be. Never trust any input — hire a 3rd-party company, use the IT security department of a large corporate, and/or have a dedicated set of separate developers in house to do a security audit on your system.

Make sure users are logged in
...and can only see their own data. Just because the only place that you can see a URL to an item is when you are logged in, doesn't mean that it can't be found. If I know the URL when I'm logging in, by changing a few characters, I shouldn't be able to see other people's accounts.

Curtis Franklin Jr., independent software authority, says:

Test, and test again
Don’t just test for functionality — get someone who knows what they're doing to try to break into the application. Try again and again. There's no guarantee that you'll find every possible security hole (in fact, in a complex application it's closer to a guarantee that you won't), but you will find many of the problems and be able to fix them before they get into the wild.

Use a framework
So many problems occur just because different members of a team use their own personal methods for securing applications and definitions of what security even means. A common framework, used by every developer, will help to make sure that team members are at least speaking the same language when it comes time to build security into the app.

Search CWJobs for Developer jobs, Security jobs, Cloud Computing jobs

Cyber security trends in 2011

Tue, 25 Oct 2011 09:38:30 +0100

The underground world of cyber crime moves fast but we brief IT professionals on the latest trends.

Business the biggest victim

The cost of cyber crime to the UK could rise to £27bn per annum. A significant proportion of this cost comes from the theft of intellectual property from UK businesses, which we estimate at £9.2bn per annum. In all probability, and in line with our worst-case scenarios, the real impact of cyber crime is likely to be much greater.

Although our study shows that cyber crime has a considerable impact on citizens and the Government, the main loser – at a total estimated cost of £21bn – is UK business, which suffers from high levels of intellectual property theft and espionage. Businesses bearing the brunt of cyber crime are providers of software and computer services, financial services, the pharmaceutical and biotech industry, and electronic and electrical equipment suppliers.

The cost of cybercrime

Passwords getting weaker, not stronger

The problem of weak, guessable passwords isn’t going away - in fact, it’s getting worse. Users have to create several passwords for different systems and to change them every 60 days. Alternatively, passwords are randomly generated by the software solutions, which are difficult for users to remember.

Researchers, suggest an external password creation policy that changes a password after it is created to add a guaranteed amount of randomness—for example, adding two random digits to the end of a password. Another tactic is to reject a password instantly, based on its estimated strength, and instead suggest a similar, stronger one.

Cisco 2010 annual security report

Java’s strengths are its vulnerabilities

Flaws in Java have made it a promising target for criminals. The latest exploits based on Java have certain characteristics that make them worrisome from a security standpoint. These exploits are:

Pervasive: Java works in the background and users are often not aware that it is running or whether they’ve updated it recently. Therefore, it’s not difficult for scammers to configure malware to check for older versions of Java.
Invasive: Multiplatform interoperability is a hallmark of Java. While this is largely a benefit, it also makes it easy to distribute malware across several platforms, as well as any devices that run Java.

Cisco 2010 annual security report

Ubiquity makes PDFs a target

Organisations rely heavily on PDFs to conduct business, so the idea of limiting their use within corporate networks is seen as impossible. Yet Adobe Reader and Acrobat continue to be strong threat vectors online: it’s a rare business or personal computer that doesn’t have the Adobe Reader software for viewing PDFs, and computer users continue to place an undue amount of trust in these documents.

Cisco 2010 annual security report

Spam increases in UK

In the global spam update in the Cisco 2009 annual security report, emerging economies showed the sharpest increases in spam production. In 2010, the problem spots were developed nations, with France, Germany, and the United Kingdom displaying markedly higher rates of spam volume.

In the United Kingdom, for example, spam volume rose almost 99% from 2009 to 2010, according to Cisco research. One likely reason for this spam growth is the spread of broadband Internet in these countries. As in other developed nations, the faster the Internet pipeline, the easier it is to launch botnet-driven spam campaigns.

Cisco 2010 annual security report

How big business copped it...

62% (21% in 2008) of respondents were infected by a virus or malicious software in the last year.
25% (11% in 2008) of large respondents have suffered a denial of service attack in the last year.
92% (72% in 2008) of large respondents had a security incident in the last year.

Information security breaches 2010

... And the small company

£27.5k - £55k (£10k - £20k 7% in 2008) is the average cost of a small respondent’s worst incident of the year.
10% (7% in 2008) of IT budget is spent by small respondents on their security, on average.
83% (45% in 2008) of small respondents had a security incident in the last year.

Information security breaches 2010

Social networking surfaces

The medium is not going away anytime soon and presents security challenges, which the computer security industry is only just beginning to understand and address. Chiefly:

Malware propagation: attackers are able to spread malware more quickly across a wide range of users. An instance of malware spread through Twitter took two and a half hours to infect the same number of users that would normally take a day or two through non-social networking attacks.
Exposure of personal and corporate information
Data mining
Brand destruction

Proper education and awareness can help all social network users realise the simple fact that ‘a friend of my friend is not necessarily my friend.’

Global security report 2011

The future threat is mobile

As with any legitimate business, cybercrime is driven by a return on investment. All of the requirements for an active threat landscape already existed in 2010: the installed base of smart phones and other mobile devices had grown to an attractive size; the devices ran sophisticated operating systems that come with the inevitable vulnerabilities.

In addition, Trojans hiding in legitimate applications sold on app stores provided a simple and effective propagation method.

Gaining as much control over the configurations of mobile devices as there is for desktop and service environments will help organisations begin to reduce risk.

Internet security threat report 2011

Search CWJobs for vacancies in information security

Cyber crime timeline

Tue, 25 Oct 2011 09:38:30 +0100

Cyber crime has become a well known security risk in recent years, but hackers have been breaching IT security since the 1970s. Don't believe us? Read the cyber crime timeline to find out more.

1970s: Rootkits

Came out of the UNIX era in the 70’s but the most famous episode was in 2005 it was discovered that Sony BMG Music Entertainment had used rootkit techniques to disguise digital rights management software that installed itself on consumers' computers when they played a Sony CD.

Rootkits are software that enables continuous, privileged access to a computer while actively hiding its presence from administrators. Typically, an attacker installs a rootkit on a computer after first obtaining root-level access, either by exploiting a known vulnerability or by obtaining a password

1978: Spam

The first spam e-mail was sent in 1978 over the ARPAnet, the US Defense Department network by a Digital Equipment Corp. marketing executive. Today mass mailings are sent via a vast array of channels - email, newsgroups, instant messaging, mobile phones - to recipients who have not requested them and cannot remove themselves from the mailing list. Spam has grown more malevolent, as criminals have made it the carrier for a host of scams.

1982: Viruses

A high school student named Rich Skrenta wrote Elk Cloner for Apple II computers. Hidden on a floppy disk necessary to load the operating system on the computer, it spread when users unknowingly used an infected disk to boot up.

A computer virus is a computer program that can copy itself and infect a computer. A true virus can spread from one computer to another (in some form of executable code) when its host is taken to the target computer. Thus, viruses are spread when a user sends it over a network or the Internet, or carries it on a removable medium such as a floppy disk, CD, DVD, or USB drive.

1988: Worms

Robert T. Morris, a graduate student at Cornell University, created software that would automatically replicate itself on computers hooked up to the government's ARPAnet (the precursor to the Internet).

A computer worm is a self-replicating computer program, which sends copies of itself to other nodes over a network. Unlike a computer virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

1989: Trojan horse software

In 1989 (or ’87, depending who you speak to), a diskette claiming to be a database of AIDS information was mailed to thousands of AIDS researchers and subscribers to a UK computer magazine.

A Trojan is a destructive program that masquerades as a benign application and is named after the Trojan Horse of Greek mythology. The software initially appears to perform a desirable function for the user prior to installation and/or execution, but steals information or harms the system. Unlike viruses or worms, Trojans do not replicate themselves.

1990s Crimeware

This evolved from prankware, the kind of software that would install a daft message on your computer screen if you opened an infected email. Demand from organised online criminals has created a supply of easily downloadable malware packages.

1996: Phishing

The term is coined although activity predates this. Phishing attempts to trick Internet users into divulging their personal information for use or resale by criminals. Also known as social engineering, phishing typically cons users through authentic-looking emails, which link to websites that mimic those of respected financial institutions or retailers.

Spear-phishing was coined a decade later and refers to a more sophisticated online con act that targets an individual or an organisation

1998: Man-in-the-middle attack

A man in the middle attack was reported by the National Security Agency in 1998, but more famous attacks occurred in October 2005, when global banks were targeted.

Man-in-the-middle depends on interception and has been around since espionage began. However technology has given it a whole new momentum. It can be a as simple as snooping on someone’s emails over unencrypted wi-fi in an Internet cafe. More malicious attacks use sophisticated Trojans to interrupt banking deals in order to siphon off billions of dollars.

MITM has recently morphed into the more invidious man–in-the-browser. The pernicious malware lurks within the victim’s browser, waits until authenticated procedures have been successfully negotiated, before redirecting funds into an illicit bank account. Zeus is the most notorious MITB used to circumvent banks’ multi-factor

The 00’s: Social networking sites take off

My Space launches in 2003 and Facebook in 2004, heralding a new era of social networking. The medium is also rapidly colonised by criminals and is now a primary conduit for the proliferation of malware, and also of social engineering attacks.

2000: Denial-of-service and distributed denial-of-service attacks

Canadian hacker MafiaBoy launched a distributed denial-of-service attack that took down several high-profile Web sites, including Amazon, CNN and Yahoo!

A D(D)oS attack makes a computer resource, often a website, unavailable to its intended users. A common method of attack involves saturating the target machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be rendered effectively unavailable

2003: Botnets

The SoBig email worm is thought to be the first organised attempt to create large-scale botnets.

A botnet is a collection of infected computers or bots that have been taken over by hackers and are used to perform malicious tasks or functions. A computer becomes a bot when it downloads a file that has bot software embedded in it. A botnet takes action without the hackers having to log in to the client's computer.

July 2010: Stuxnet

A Microsoft Windows computer worm was discovered in July 2010 that targets industrial software and equipment. It is the first discovered malware that spies on and subverts industrial systems.

2011: Advanced persistent threat (APT)

Is the acronym on every cyber security professional’s lips. APT usually refers to a group, such as a foreign nation state government, with both the capability and the intent to persistently and effectively target a specific entity. The aggressor uses every kind of malware at their disposal in a sustained attack on a target that can last months in order to achieve their criminal ends.

Sources:

A brief history of Malware

Wikipedia

First Base Technologies

Invincea

Marcus Ranum

Life at the cutting edge of research and development

Tue, 25 Oct 2011 09:38:29 +0100

More generous tax credits for product research and the government's creation of Enterprise Zones stand to encourage IT research and development activity. We spoke to some IT pros working at the bleeding edge to find out what a career in R&D is like from the inside.

The iPhone gamer

Mark Allen is technical director at Neon Play, a gaming company.

How do you test whether a product is technically viable?

If we are unsure, we will sometimes create a little prototype to help answer the question. We’re hands on so we don’t sit around theorising – instead we pull our sleeves up and try it out.

What technical skills do you need?

Objective C is the primary iPhone programming language. Objective C was created by Next Computing, the company set-up and run by Steve Jobs. It is similar to Java. This is the key technical skill for any iPhone games programmer. In fact there is a bit of a shortage. We’ve worked with our local Cirencester College to design an iPhone programming module for the ICT course, which is proving successful. Search for Objective C jobs and Java jobs.

What other qualities are desirable?

Neon Play is a games studio, so we’re after people who can have fun. It helps bring the technical skills alive and make them relevant. Creativity is clearly important and we expect it in anyone we recruit. There is no science in creating fun. It can be the difference between an OK app and a really addictive app.

What’s the best thing about product research?

A well-stocked beer fridge, some switched on creative people and a willingness to work out the detail. iPhone games and apps are two a penny at the moment so producing something that can stand out needs people who understand the true nature of iPhone gaming.

And the worst?

Blank faces and tumbleweed.

The master inventor

Bharat Bedi, master inventor and Dave Braines, project champion, work at IBM Hursley, the biggest software lab in Europe.

What was your first job?

We both arrived at research programmes via consultancy and services respectively. You don’t have to be a boffin or have a PhD to work in research for a blue chip company.

What’s the different between research and product development?

The blue sky research people tend to have doctorates and are pushing the boundaries of science, such as quantum physics and technologies. At the development end you’re working out new ways to apply new technologies, such as mobile, sensors and artificial intelligence, to build customer solutions. We work somewhere in the middle.

What sort of projects do you work on?

There are some wonderful examples, especially those under the Smarter Planet programme, such as an intelligent system that helps care for the elderly. Or it might be a mobile dashboard for a large customer, plus we collaborate on international initiatives.

How can you move into research?

The most important thing is a strong track record of exposure to many ‘first of a kind’ projects, such as prototypes. The ability to deal with an environment of uncertainty and to build solid components from that is crucial too.

What are the highlights of corporate research?

The sheer variety of projects, plus we have the opportunity to work on things that are unique and can have a beneficial impact on the environment.

What are the lowlights?

There are so many interesting things to learn and participate it, it can be hard to learn to say no and to get technology delivery done. Balancing the research and the development components can be difficult.

IBM :

• Employs over 3,000 scientists and engineers in eight research labs in six countries.

• Has more than 25,000 technology developers in more than 60 major development labs around the world.

• Invested $5.8 billion in R&D in 2009 and has increased its R&D investment by 21% since 2002

Search for IBM jobs.

The app developer

Giacomo Biggiero, is chief product officer at Masabi, developer of the personal train ticket machine app.

Why did you choose to work in a start-up?

I was attracted to the dynamic environment and possibilities for getting involved in a whole range of different business areas beyond just programming. Since joining Masabi, I’ve been involved in everything from R&D to assisting with the development of corporate strategy.

What technical skills/languages do you use?

XHTML, XML, JavaScript, Java, Objective C.

What other skills do you need?

I come from a traditional programming background and as the company and development team have grown, I’ve had to learn about managing teams, projects and relationships with customers.

What’s good about product development?

Technology is constantly evolving, particularly in mobile, so you are constantly working with new products and facing new challenges. This means that the job is always fresh and exciting. You also get to develop interesting new things.

What’s the worst bit?

Sometimes it can be challenging working in a fast-paced and continuously evolving environment, but it’s always fun and exciting!

The research fellow

Dr Frank Stajano, senior lecturer, University of Cambridge, was a research fellow for two years in a Toshiba R&D laboratory in Japan.

Why did you choose a fellowship programme?

I had always been interested in Japan so I attended a presentation in London to find out more. Former fellows were very enthusiastic about their experiences and the salary on offer was generous. I was a mature student at Cambridge, having returned to academia after an electronic engineering degree followed by several years in industrial research. I had just started the third year of my PhD in computer science.

What research did you work on?

I worked on security for ubiquitous computing, applying the research work of my doctorate to the industrial reality of Toshiba. Among other things, I worked on short-range connectivity with Bluetooth for a programme about contactless payment systems. I produced two patent applications, one about a personalised wireless reminder service and another about secure remote software upgrades.

What was the highlight?

The highlight of my experience was living in Japan. I learned some Japanese, got to know the fascinating culture and made many lifelong friends. I also had the opportunity to train every day in Japanese swordsmanship (kendo), which was a fantastic experience.

The Toshiba Fellowship Programme was set up 27 years ago and is based at the R&D Centre (RDC) is based in Kawasaki, Japan's prosperous 'Silicon Valley',

Read more about the Toshiba Fellowship Programme.

Browse IT jobs on CWJobs.co.uk.

System administrators in the spotlight

Tue, 25 Oct 2011 09:38:29 +0100

The dedication and skill of system administrator heroes and heroines often goes unsung. But this Tuesday, they'll be under the microscope. Microsoft is to release 17 security bulletins to address 64 vulnerabilities in the monthly Patch Tuesday security update on 12 April.

Nine bulletins are rated as critical and the remaining eight are rated as important. The vulnerabilities affect Microsoft Windows, Microsoft Office, Internet Explorer, Visual Studio, the .NET Framework and GDI+.

Backstage gurus

Sysadmins toil away in the background to ensure that network connections remain open, safe and working. They worry about not only spam, viruses, spyware, but also power outages, fires and floods.

When the email server goes down at 2am on a Sunday, it’s the sysadmin who is paged, wakes up, and goes to work. Check more insights:

• A sysadmin installs the routers, lays the cables, configures the networks, sets up the firewalls, and watches and guides the traffic for each hop of the network that runs over copper, fibre optic glass, and even the air itself to bring the internet to your computer. All to make sure the webpage found its way from the server to your computer.

• A sysadmin makes sure your computer is working in a healthy way on a healthy network.

• A sysadmin takes backups to guard against disaster both human and otherwise, holds the gates against security threats and crackers, and keeps the printers going no matter how many copies of the tax code someone from accounting prints out.

• A sysadmin is a professional, who plans, worries, hacks, fixes, pushes, advocates, protects and creates good computer networks, to get your data, to help you do work -- to bring the potential of computing ever closer to reality.

• A sysadmin installs updates to software, and keeps backups in case anything goes wrong.

Don’t believe the logs

The League of Professional System Administrators (LOPSA) is lobbying for better recognition and to spread best practice in all IT departments, and has the following words of wisdom for fellow professionals including this anecdote about treating logs with a pinch of salt.

“I had a problem where our gateway mail server couldn’t deliver mail to a peer. The receiving mail server kept bouncing the email address with a 550 even though the mailbox being delivered to was real and active. Gmail, Yahoo, and MSN would all accept email from our gateway, but this one provider would not accept email.

“The first thing I did was go to the logs. The problem was the logs were wrong!” You can read the full story here. But the moral of the story is, only trust your logs so much: they are only an approximation of reality.

Appreciate administrators!

For these reasons, and many more, the System Administration Appreciation Day has been established. On the last Friday in July, sysadmins around the world will take a collective bow – and maybe even leave work early – but don’t hold your breath.

For system administrator jobs plus hundreds of administration jobs, check CWJobs.

The IT skills dominating hiring in 2011

Tue, 25 Oct 2011 09:38:28 +0100

With worldwide IT spend poised to grow a whopping 7% in 2011, according to Gartner, we asked our expert panel for their predictions of hiring trends in 201- and the hot skills:

IT sector in the sweet spot
The IT sector as a whole has shown some of the strongest growth for both permanent and temporary jobs, ranking in the top two sectors in every month of 2011. We agree with Gartner that IT will probably be one of the strongest areas for job growth in the UK economy in the coming years.

Business analysts are hot
The REC’s monthly Report on Jobs shoes consistent demand for business analysts throughout 2011, suggesting that companies are looking to boost their efficiency in preparation for rapid growth. July’s Report on Jobs found demand running high for workers with knowledge of .NET, PHP, SAP and Oracle. Designers with CAD skills were also sought.

Andrew Tomlinson, technology policy adviser to the Recruitment and Employment Confederation

Data miners are gold dust
“The move towards online business models is driving a huge spike in demand for data analysis skills around business analytics. There just aren’t enough people available with the skills needed to analyse the data. We’re not just talking about numeracy and computer science – tomorrow’s analysts will need other skills to be able to extract insights from their existing data.

Enter natural language processing
Social media and the gathering of consumer behaviour through text-based data rather than purely numeric information is the future. - IBM for example has just launched the SPSS Modeler data mining and text analytics workbench, which will use natural language processing (NLP) to analyse everything from product names and industry jargon to slang and emoticons.

Move over .NET
Across the wider commercial market, we are expecting to see the decommissioning of .Net 2.0 in major blue chips who will be moving towards .Net 3.5 and .Net 4 with emphasis on WCF and WPF, specifically focused on Silverlight technologies and increasing functionality of the GIU driving demand for skill sets in these areas.

Dustin Smith, Senior Consultant – Twenty Technology:

Swift move to SOA
“We will see a continued and rapid transition to service orientated architectures (SOA), web-based applications along with investment in grid computing and remote access capabilities. This is aimed at giving the user a richer experience and the ability to work flexibly by accessing IT systems over the web.

SOA support act

• Silverlight, Windows Presentation Foundation (WPF), C# and Windows Communication Foundation (WCF) from Microsoft
• Flex, Spring, EJB 3.0, Hibernate and Java from Oracle and the open source community
• Developers, technical engineers and infrastructure engineers will be other popular roles to address these changes.

Charlie Luckhoo, associate director at McGregor Boyall

Refresh programmes dominate
“Look out for continued growth of ecommerce, large refresh programmes to automate clients’ processes and streamline internal processes. We also expect to see a continued growth in mobile, interactive and digital technology. This is line with our clients’ need to compete in a highly competitive, dynamic and ever-changing market place.

Cloud momentum builds
“Our clients are looking for candidates with experience of Agile methodologies. Demand for candidates to fulfil project delivery roles remains high, including project managers, business analysts, developers, testers and quality assurance. With the momentum towards cloud technologies we are witnessing an increase in demand for candidates with these skills, or alternatively skills in hosting and outsourcing.
Financial services focus

Client demand is in the following areas:

• Improving efficiency for straight through processing and real time trading
• Projects around single data hubs for straight through processing
• Improving market data feeds

Simon Taylor, director, Venn Group

Search CWJobs for 1000ss of Internet jobs, business analyst and Silverlight jobs

How to write a successful IT proposal

Tue, 25 Oct 2011 09:38:28 +0100

IT is viewed in many quarters as the engine of recovery from a long and lingering recession. With research showing more companies spending on IT to rev up their business, drafting a successful proposal becomes a must for many IT professionals.

Think business, not IT
Counterintuitively, the biggest error is to think of your proposal as an IT proposal. To do so would make your proposal all about a technology, not a business solution..

Describe the problem to be solved
More and more often, IT is being deployed in smaller, discrete chunks to meet a business need or solve a problem.

Perhaps the need is for a piece of technology that will improve a process and enhance customer service. Less frequently it may be a major IT technology upgrade required to stay viable as a business. Describe this kind of project in business terms. Either way, give factual evidence of how the proposed project will solve the problem.

Offer options
You’ll need to have researched different scenarios and solutions to fix the problem or meet the need. The proposal should outline the costs, business benefits and business or technology risks of each. Make sure the figures stack up; otherwise the entire proposal will be immediately discredited. Always state your preferred option.

Less is more
Many proposals fail because they are too wordy and the business audience loses interest or focus. Business people are too busy to read long proposals. The danger for tech professionals is to make the mistake of thinking the business is interested in reading about how technology works, or that if you miss the one point out, it will be the one that swings the argument your way.

Do an executive summary
It’s a good way of keeping things concise and getting the main points of the proposal across. Always include a management summary of one page with your proposal, no matter how long or short the document. This can be presented in bullet points and should include the purpose of the project, the costs, measurement of success used and estimated business outcomes.

Make sure the sums add up
Busy IT departments that have lots of IT projects on the go often keep a financial analyst as a permanent part of the team. Their job is to make sure that the cost calculations are accurate for proposals and stay on track as projects progress. If you don’t have a financial analyst – this is your job!

With thanks to Dr Ben Booth, Chief Information Officer of research giant, Ipsos MORI

Search CWJobs for management jobs and 1000s of IT vacancies

How to survive a tech takeover

Tue, 25 Oct 2011 09:38:27 +0100

News that HP is to buy UK search engine superstar Autonomy follows hard on the heels of Google’s proposed purchase of Motorola Mobility.

Mergers and acquisitions were thick on the ground in the IT boom and weren’t always sugar-coated for tech personnel. The worst scenario was to be bought by a certain systems integrator: tech staff were simply summoned to room and handed a ‘you’re fired’ slip.

It’s common for a successful and innovative UK tech company to be swallowed up by a more commercially successful outfit.

Whether you’re on the winning or losing side of the buyout, the following tactics should come in handy.

Get real

There’s no such thing as a merger – only a buyout - and there is always a winning and losing side.

Assess the situation candidly: if there is a big overlap of skills, rationalisation will inevitably follow and you should take steps to evaluate your own chances of survival.

Even if you are on the winning side – the purchasing company — do not be complacent as the event may be used to settle scores.

Ian Ryder, deputy CEO, BCS, the Chartered Institute for IT

Redo your CV

A merger or acquisition is a cue to update your CV. It’s helpful for you to rethink your proposition anyway so that you are prepared to communicate it to new management.

You may also want to upload your refreshed CV or send it to valued contacts. It may even be that the M&A may even provide some valuable experience of ‘change management’ that would be an asset to a new employer.

Don't align too strongly with one group

While an alliance may seen advantageous at first, new leadership will surround itself with a new team, sweeping aside existing coalitions. Bridging factions may be a more effective strategy for long-term success if you wish to stay in your current organisation for some time.

Louellen Essex, author of People Problems that Keep You Awake at Night

Learn the new rules

New power holders will shape new agendas. Continue to do your job and pay your dues but build a network with the new half of the company, too. Use your trusted network to explore and test out assumptions and suspicions without earning a reputation of being a gossip or excessive worrier.

Officepolitics.com

Be an asset

Perceptions play a vital role in this, so keep talking to people, welcome new staff and take an interest in company activities. Do not hesitate to put forth your ideas and views. Be ready to take on additional responsibilities. Make sure current and potential managers know you’re willing to take on more tasks and even a role change, as per the evolving needs of the company.

Don’t go mad, get out clean

Plan your change rationally, before the situation becomes unbearable and you risk doing something rash. Keep your risk-evaluation antennae switched on and have a Plan B at the ready in any case, because no one knows what will happen next month. It always pays to be looking around at what jobs are on offer.

Check CWJobs for 1000s of IT jobs and Upload your CV

10 things to know about system integration

Tue, 25 Oct 2011 09:38:27 +0100

Achieving slick systems integration has been a headache for IT since applications were first built. Now the rise of cloud computing means more pain – and fresh demand for integration skills, according to K2 research.

The number of CIOs seeking help to integrate software as a service with legacy systems will grow over the next two years as cloud usage increases. A third of organisations believe the real challenge for them could kick in by 2013, while a further 12% expect 2012 to be the year they reach out for help. Our panel offers it thoughts:

Grand designs; infrastructure a must

Whilst cloud removes much of the management of services from the enterprise, it does require competency in architecture - in particular integration architecture. Specifically, organisations will benefit greatly from an understanding and experience of the creation of strategies around data, security and messaging integration between on premise and off premise platforms to ensure the different services can be integrated into an enterprise environment.

Nic Merriman, head of Cloud Computing, Avanade

Strategy needs security and data people, too

I believe the key to conducting a successful system integration project is to create strategies for integration which consider all aspects including data, security, messaging and networks. If these aren’t created proactively then integration could become point-to-point and potentially problematic in the medium term. It also leads to long term operational problems.

Nic Merriman, head of Cloud Computing, Avanade

Systems analysts on the march

Good integration is all about process and workflow – and that calls for system analysts. They play a big part in any system integration exercise and there’s more and more call for them. Routes into this work include development, support and infrastructure design. There’s no certification or handy training because each project is unique. Experience is everything.

Robert Rutherford, CEO of QuoStar Solutions

Beware cloud upgrade – have a plan B

You may be pleased when your cloud supplier announces that they are due to upgrade their platform. More reliability and availability, you think. However it could also imply a necessary upgrade to all the application interfaces (APIs) to stay integrated with your own back-end data. That’s a big job, and you’ll need the necessary development skills in-house. If you don’t have these, make sure you’ve got a third party on-hand to help you with any ‘upgrades’.

Robert Rutherford, CEO of QuoStar Solutions

Beware point-to-point nightmare

Common integration practice is to achieve short-term ad-hoc objectives by creating dedicated point-to-point links between the systems or applications everywhere it is necessary. At the next stage of system maturity, new links are created between systems on the business management and control layers. These chaotic point-to-point links make common resources impossible to be used by many potential client systems.

Four Strategies for legacy integration

Takeover and merger is often the context for heavy-duty integration projects. There are four main strategies for legacy systems integration that project managers may consider.

• Keep both systems, and develop them to have the same functionality. Keeping both systems has the advantage of continuity, with little cost required to retrain people in using a new system. However there are several problems with the approach. The main one is having two lots of support staff; meaning no reduction in costs. However if any attempt is being made to merge the brand, or other aspects of the business the problems are increased, as the two sets of systems are adjusted to be similar to each other.

• Replace both systems with a new one. The merged company will operate as two separate companies for considerable time, with the benefits of merging not coming through. The developers will mainly be concentrating on the new system, but this still take a long time to appear.

• Select the best systems from each company and combine them. This approach is often technically flawed because systems have overlapping functionality. In the example if you integrated Company A's Ordering system with Company B's Invoicing system there would be a great deal of overlap which would have to be dealt with. Plus there are the gaps to plug.

• Select one company's systems and drop the other company’s. There can be "political" problems about which to select, though this is easier in a hostile takeover - the winners systems rule. Old systems are not well understood by their existing users, so it is difficult to see what changes have to be made to grow them, and how to train the new users.

Search and apply for integration jobs, API developer jobs and system analyst jobs

A beginners guide to social CRM

Tue, 25 Oct 2011 09:38:27 +0100

Social CRM is the black art of mashing up the blogshere with corporate data and seeing what comes out. Happily for IT pros, especially integrators, it’s not a plug ‘n’ play world yet. Their skills are needed to mine social data and then knit it together with a patchwork quilt of corporate systems.

XML is a hot integration skill, as data is often offered as a web service. But IT pros with esoteric skills in data semantics and mining are the real winners.

Why is data disconnected at present?

Lots of customers are asking questions about social networking data and what to do to take advantage of this flow of knowledge. People sit in their different offices and teams and access data in different ways. The CRM and analytics department and the head of social marketing have built up their own silos of data, for example, which would be more useful if connected.

Bjarte Vosseteig, product director, QuestBack

Where are we at with social CRM?

Most customers have experimented with social media such as Twitter or a with a Facebook page, but the data and experience is kept separately. They may have a community, but if all their users are on Facebook, what are they to do? Likewise, they may have a lot of hard customer data stashed away in their in-house CRM system. The next stage is to connect it up with other sources of in-house data.

Bjarte Vosseteig, product director, Questback

How to do the integration?

In-house tech teams have to web-enable social media data which can then be called up by the back office system as a web service. This calls for web standards such as SOAP and XML. Writing apps which can parachute tools into the social networking biggies is invariably done using t de facto language and frameworks of the web, C# and.Net

What the problem with Facebook?

The problem with Facebook is that you are playing in Mark Zuckerman’s garden so the party – and data - is somewhere else. The objective with social CRM has to be to get a 360 degree perspective on the customer experience. For example, how do you know if all - or any - of your Facebook friends are the same as the contacts in your CRM system?

Bjarte Vosseteig, product director, QuestBack

What’s good about Facebook?

The good thing about Facebook is that its APIs, routines and procedures are very well documented. Developers with the right knowledge are going to be in huge demand as business switches onto the new opportunities of mining and manipulating social networking data.

Bjarte Vosseteig, product director, QuestBack

What are the new opportunities?

To social media data from survey, events and forms used to be collated by dropping a link into Facebook, but tools have just got a little smarter. Developers are writing apps that are dropped into sites such as Facebook, so the returned data is extracted and stored and manipulated outside the Facebook walled garden. Even better, the data can be married and exchanged with back office data, enabling a fuller profile of customers and their activities.

Bjarte Vosseteig, product director, QuestBack

What’s tricky integrating social data with CRMs?

The sheer variety of CRM systems in use out there – the number of products is colossal. Questback did a survey of the European market and found no market leader. The lack of leader meant they couldn’t develop one vanilla plug ‘n’ play interface that would link CRMs to their latest EFM tools.

Bjarte Vosseteig, product director, QuestBack

What can you do with social CRM?

There’s the ability to track, monitor and mine thousands of sources of social data out there in the blogsphere, Twitterdom and other communities. Business users are looking for a mention of their product, a lead, or customer reviews: rather than a keyword match, they’ll probably want to look at the surrounding text and see whether this is a relevant conversation, so it’s pretty sophisticated stuff.

Andrew Yates, CEO of Artesian Solutions

What are the specific IT tasks?

Accurate blog and forum processing calls upon web search technology - crawling, spam detection, ad stripping, and ‘real’ content extraction. It also calls for structural metadata extraction - identifying individual postings, dates and authors. Then there’s semantic technology - identifying industry terminology, brand names, brand attributes, people, organisations, and domain-specific opinion/sentiment attached to this terminology. All clever stuff.

Gregory Grefenstette, chief science officer, Exalead

How is mined data made accessible?

Once semantic information has been extracted, then information unification platforms such as CloudView can link this social data to formal product data. The latter is extracted by connectors into enterprise data sources such as databases, emails and customer data. This last step requires a large engineering effort in creating connectors that seamlessly interface into Exalead’s indexing software.

Gregory Grefenstette, chief science officer, Exalead

Are there extra data protection considerations?

Once identified, we can strip out the information concerning the author of the blog post or the twitter post. We do not gather information about individual posters to the community, because our clients are more interested in what people are saying about their products.

Gregory Grefenstette, chief science officer, Exalead

What are the common integration mistakes to avoid?

Common errors are not recognizing spam and duplicate or mirrored postings; and thinking that simple string matching is sufficient for opinion mining. Another common error is to think that structured and unstructured data sources are unconnected.

Gregory Grefenstette, chief science officer, Exalead

What’s the next step in making data useful?

Rather than treating it as static data, the resource becomes more useful when it’s linked to activities such as sending an email or a survey questionnaire. Programming-wise, this means integrating it with workflow objects in the back-end CRM system. Rather than do this engineering in-house, vendors such as Artesian, have integrated with popular offerings such as Salesforce.com to provide ready-to-go tools as a web-services.

Search and apply for Integration jobs, XML jobs, CRM jobs and Migration jobs