In this global arena websites are mushrooming and its analysis and monitoring would be a burning issue if technology and WWW had not gifted us with free online web analytics tools.

Web Analytics is a measuring tool, a metric that measures all the activities on a website, tracks visitors and monitors them. Getting a figure and statistics of your web site will help you promote your online business.

The two main technologies accepted these days are: Web server log file analysis and Page-tagging. Irrespective of technologies used the web statistics serves the same, difference lies in some extra added flexibility and rich interactivity.

In general, web log file analysis lets you generate statistics report in your desirable format, import the report and save on your system. We can view the complete website stats from the first day of visit to last day website is accessed. These stats will include number of unique visitors, number of visits, clicks, pages, hits and bandwidth.

First understand what log analysis is?? Web Log analyzer parses web server (apache, IIS) log files (web transactions i.e. when visitors are on your site) and generates report of how and when websites are accessed by the unique visitors.

Starting from website history which may span from an hour record to years record, you can view these statistics record in different graphical form. The stat also gives you information about the geographical locations from where visitors are coming to your website. Not only visits but visit duration can also be measured. For which keyword your website is searched the most, website bandwidth consumed, web browser through which visitors are coming, referring sites, HTTP status code are various statistical segments covered. You can filter this report for specific country, region or cities. You can also check from which IP address clicks are coming, filter out traffic from your own IP. You can give access to different users; can filter result by eliminating user from specific IP address.

Web server log file analysis technology produces detail stats in ASCII or HTML format. Web log files are generated on the server where your site hosts, these log file may be in plain text format or in zip format, user can download it on local host and with the help of analytics tool it can be converted in form of organized report and can be easily readable. With the help of these tools log reports can be generated offline also if you have web log files. Various tools are used to convert log files into organized reports, few of them are:

123 Log Analyzer: this does not require any set for configuration, supports logs from server farms; visitor’s geographical statistics, powerful data mining filter are its important features.

Absolute Log Analyzer: This tool is most suited for large websites with unlimited domains. This tool helps you generate 160 detailed reports, instant customization filter, parsing filter and combine several log files into single log file are its important features.

Affinium NetInsight: This log analysis tool is used in large enterprises across channels supported by hosting solutions.

AlterWind Log Analyzer: This tool analyzes web log files of any format and can produce separate report for SEO, Web Promotion and PPC by gathering information from its extensive database covering almost all countries and these reports can also be customized.

Analog: This tool can analyze files from major servers. It is one of the most widely used web log file analyzer because of its several unique features; it can work on any operating system, report can be generated in 32 languages and is highly scalable.

AWFFull: This is also a free web log file analysis tool and mostly used to generate simple reports. No additional set is required but requires additional libraries.

AWStats: This log analysis tool can be used to analyze log files and generate web stats, FTP and email statistics reports in graphical format.

ClickTracks: This tool also uses web log files to visually analyze website visitor’s behavior. You can see instant stats of ROI, PPC, SEO and campaigns.

FastStats: This tool is basically used for health websites.

Sawmill: Sawmill is very old and most reliable universal web log file analyzer that analysis web server, mail server and monitors security and provides most scalable and flexible solutions.

Visitors: Very fast web log file analyzer tool that is designed to be executed by the command line, output html and text reports and can process more than lakhs of lines per second.

WebAbacus: This tool provides detailed analysis of visitor’s behavior and browser usage.

Webalizer: This software also generates analysis report based on web log files generated by web servers. The stats can be viewed at different time frames geographically.

WebTrends: It is used to provide web statistics and leading web analytics solutions. This tool lets you improve your conversion rate and maximize your ROI.

W3Perl: This is also free tool for website analysis, ftp and mail analysis and record statistics.

Xlogan: Website statistics and analysis is done using web log files.

SurfStats: If you are looking for web server, proxy server or media logs analysis tools – surfStats can generate web statistics and web analytics reports.

But these tools have their own limitation: you can only check but cannot track or monitor these stats figure. Emergence of search engine spiders, dynamic IP addresses, web proxies, web caches made it very difficult to identify unique visitors. Log file accuracy was topic of concern with page cache running in parallel. Example, if you wish to see the landing page, complete path from where and how visitors reached your website it is not possible with web log file analysis technology.

Web Analytics tool based on Page-tagging technology:

MatrixStats: Online web analyzer that is based on page-tagging technique. It is a comprehensive approach to generate a graphical web analysis report. This tool tries to minimize traffic volume just by accounting for sessions not hits and monitor your website performance.

Tracking will help to see who is currently on your website and track visitor’s behavior. A complete report based on the history of sessions, page usage, browser usage, OS usage can be generated.

PHP Web Statistik: Again, this is online web analytics tool based on page-tagging technology and uses php script with other modular web stats. The log function works with java script image or native php. This tool can cache file pages, can handle cookie, review code, protect password. This is free online tool and can supports linux, windows, freebsd, osx, sun.

Urchin: Urchin analyzes traffic to your website from various other websites and generates reports that are very easy to understand and tracks and extracts contents behind the firewall. But Urchin 6 that will be soon released will be paid.

[http://www.onestatfree.com:] Password protected web analytic tool that analyzes, tracks and generates analytics reports, just inserting a piece of code is added in the source code that tracks website activities.

clickbench.com: This is one of the most reliable web traffic measuring tool that provides demographic metrics and statistics, hosted web analytics, online site analytics, visitor click analysis, of your website.
The need to monitor, track activities and filter statistics result lead to adoption of new technology of Page-Tagging.

By: Rakhee Chowdhary

About the Author:

Developing applications with PHP has become the most popular method of app development on the market today, with PHP being extremely versatile and powerful. Web developers are always on the lookout for faster PHP techniques and this guide will suggest 5 methods for increasing your efficiency and decreasing the amount of time to develop a quality application.

Reuse PHP Strings and Script

Modifying existing PHP scripts for your app development project will save you tons of time and money, spent otherwise on creating a framework or skeleton from scratch. Reuse of your perfected scripts with minor changes will allow you to take existing PHP script skeletons and make the necessary changes to work with your app development guidelines. Not only will this save time, but you will better understand PHP coding and become more versatile in your ability to create strings that work for specific applications.

Less is Always More

Since the beginning of computers and application programming languages, less clutter and more functionality has always been key. The simpler you keep your PHP MySQL code, the easier it is to fix glitches and errors, and the less likely you will make those errors in the first place. If it seems necessary to re-do your coding structure, the time spent to simplify your scripts will prevent frustration and confusion later on. Keep things simple and don’t let your time and money go to waste, especially if you hired one of those expensive offshore programmers.

Back Everything Up

This method for saving time while developing a PHP application is slightly more obvious than the others. If you spend 3 hours working on a PHP script and you accidentally delete the data or MySQL has errors, you lost 3 hours of work. Backing up your code can save time wasted on re-doing your hard work.

Upgrade your Text-Editor

We all know that coding PHP in Notepad is impressive, but when you’re trying to save time, upgrading to a more efficient text-editor is a wise choice. EditPlus2 or PHPEdit are highly recommended and are similar to editors like Dreamweaver, color coding important commands so they are easy to find. You will save time from preventing yourself from searching walls of confusing, colorless text and fixing errors that Notepad cannot detect. Upgrading is usually satisfying as well, right?

Label Code and Document Properly

Above your code, document and put hints or explanations of your strings to make editing easier for you and other coders alike. You will save tremendous amounts of time during complicated troubleshooting by giving your PHP code proper documentation.

Follow these simple steps for PHP app development and you’ll be in the momentum of saving time and developing project after project, while your competitors are stuck, frustrated with their sloppy code, unorganized labels and complicated PHP strings.

By: Justin Bajonda

About the Author:

Like reciprocal linking, inward links to your website can be an effective strategy to increase your website’s visibility. Inward links are links pointing to your websites from other websites without providing a reciprocal link from your website.

There are many techniques to improve inward linking. Many of these have enjoyed success. The most proven technique for inward linking is through Ebooks. You can offer interesting and educative Ebooks for free to other websites and they could install the icons or the Ebooks on their sites. The icon or the Ebook you create would have a link to your website. This will allow a spider to crawl through that link and visit you website. For example, a footer on every alternate page can have a link to your website that would increase the probability of your website being listed with a crawler based Search Engine.

Other techniques include posting newsletters, white papers, news stories and press releases at other websites, particularly industry specific and general portals. The newsletters and press releases would contain a link pointing to your website, thus, promoting your website.

Optimizing your Website

To get listed correctly in the search engines each page of your site that you want listed needs to be optimized to the best of your ability. Since the keywords that you decide to target will be used throughout the optimization process choosing the right keywords is essential. If you choose the wrong keywords you will not be found in the search engines. If you are not found in the search engines how will anyone find your site? Since the keywords you choose to optimize your pages with are so important we have put together some tips to help you make sure that you make the right choices. You should utilize these tips when selecting keywords for each page that you plan to submit to the search engines.

Think “specific keyword phrases” not “keywords”. Due to the extreme amount of competition for general terms in the search engines, if your keyword phrases are too general it is very unlikely you will rank well in the search engines. You stand a far better chance to rank well for specific phrases where there is less competition. The resulting traffic, since it is more highly targeted, should also be much higher quality too.

You should try to come up with as many keyword phrases as you can think of that relate to the page you are optimizing. Try asking a few friends and family what they would search for when searching for a site like yours. Check out your competition for ideas. Do a search using keywords that you already know you want to target and click through on the top sites that come up. Once on the site view the source HTML code and view the keywords they have in their Meta tags – this should give you many more ideas.

Make sure to only use keywords that relate to YOUR site or page. To view the HTML code, simply click the ‘View’ at the top of your web browser then select ‘Source’, or ‘Page Source’. You should develop a list of keyword phrases, following the tips on this page, for each page that you optimize for the search engines.

Apart from these, there are certain aspects that should be avoided. These are:

Dead Links – As search engines index your entire site by crawling through hypertext links, you must make sure you check for dead links before submitting.

Graphics and Image Maps – Search engines cannot read images, be sure to include Alternative Text tags.

Frames – Many Search engines aren’t frames compatible. Meta tags and the tags are important in this instance.

Spamming – Avoid resubmitting your pages repeatedly to search engines if your site does not get listed in the first few weeks. Allow at least 6 weeks before resubmission. Continual resubmission (such as those caused by automatic submission software) can cause your site to be penalized.

By: Tim Yu

About the Author:

Is a computer consultant or IT consultant just a contract programmer or software engineer who uses a fancy title and charges a higher rate?

The short answer is no. Each is valuable for the right type of engagement. But putting one into an engagement where you really need the other is a mistake–and you can’t always tell who is who by the titles on their business cards.

Find out what they do. That will tell you what category is the true one, and in turn will tell you what roles are appropriate to consider them for.

What Contract Technical Workers Do

Contract technical workers focus on exactly that–the technical skills in which they specialize. It’s up to you to tell them what to implement. For a software designer, you say what the software has to do. For a programmer, you provide specifications for the software.

A good contractor is a self-starter with superb technical skill, and can produce excellent technical work with less need for supervision and motivation than most regular employees. When your project is done, the contractor leaves without fuss. Your employees carry on with maintenance of whatever the project built.

Here is an example of using contract technical workers wisely. Let’s say that you have decided to build a new XYZ system to fit in with a radical change in business procedures. You’ve done the business analysis in-house and have specified exactly what you want to build. Your IT team is competent in most of the programming skills needed. However, they have not designed and built a major database before. In fact, all of their previous design and programming projects have been small. The tools and techniques needed to build and maintain a large system cost effectively are new to them.

You bring in technical specialists as the team leads for the project. They do the ‘heavy lifting’–the core of the database design and construction, software design, source code control, and quality assurance tools and procedures. Your IT employees work under their guidance, being mentored by the contracted specialists along the way.

Your project is finished faster than if you used only your IT team. The design, implementation, testing and deployment avoid the types of mistakes that happen when everyone on the team is new to the tools and techniques they are using. When the specialists leave, your entire IT team’s expertise has expanded and they are capable of carrying on with maintenance and enhancements.

What IT / Computer Consultants Do

Many contract technical workers focus exclusively on the technical work. One of the best contract programmers who once worked for me said bluntly that he didn’t want to have to understand what the equipment was supposed to do when our software sent commands to it. If I would just tell him what software I wanted, he would write it, but he didn’t want to have to pay attention to anything else. He certainly didn’t want to have to interact with other people to find out what they wanted. He wrote fine software, and I let him concentrate on what he did so well. That’s the big difference between a contractor and a consultant.

Information Technology consultants usually start out as contract technical workers. The consultant has some expert technical skills (design, programming, testing) and is likely to have at least some expertise across a wide range of the skills involved in the entire birth, life and eventual death of a system. But the consultant’s professional growth is not purely addition and refinement of technical skills.

Start with computer capability. Add business acumen, common sense, and ‘soft skills’ and the result is an IT consultant.

A formal computer related project begins with business analysis. This means looking at what the business is doing (Point A), imagining what it needs to do instead (Point B), figuring out what has to be done to go from Point A to Point B, and writing that down (business case, requirements, and so on).

Other tasks in the project grow from the analysis. On the technical side, these include functional specifications and detailed specifications, design, implementation, testing, source code control, training, and technical support. On the human side, changes in what people do have to be planned, and people have to be taught their new procedures.

Each of those tasks is done by people with specific roles, titles and skills. Many of them may labor in their portion of the project without seeing the overall picture clearly. A good IT consultant sees it all–the business objectives to be met, human procedural changes, the ‘big picture’ Information Technology systems involved, and the crucial details necessary to make it all work.

This requires a frame of mind unlike that of a contract programmer. Not everyone can do it. It’s one of the reasons a consultant gets higher rates.

Confusion in Usage of the Terms

In other fields, a consultant provides expert advice and guidance to a client. Implementing the consultant’s recommendations is the client’s responsibility. The line is not so clear in information technology.

Many people say they are computer consultants or IT consultants when their remit is primarily implementation, not guidance. That isn’t consulting in the sense that the word is used elsewhere.

Good ‘computer consultants’ provide a blend of expertise and service that goes beyond fitting computer systems to business needs–in essence, you get a blend of business consultant and IT consultant from the best.

At the highest end of the spectrum, the IT consultant goes beyond the advisory role filled by consultants in other fields. The elite IT consultant interacts with people, digs into issues involving equipment, and pays attention to logistics–even such details as the height of tables or the clearance forklifts will have in a passage. You can engage an IT consultant for expert advice. However, unlike consultants in other fields, a top level IT consultant can be also engaged to make sure the project comes through, ‘from soup to nuts.’

Our firm provides services anywhere along this spectrum. But if you ask me what we do, my answer reveals the mindset of a consultant. Where computers are used to help make money instead of count it, we help our clients make more money. That’s our best offering. Listen for a similar focus on improving business effectiveness, and a lack of emphasis on specific technologies, when you are looking for a top tier IT consultant.

Remember to Use Each Appropriately

As I said at the beginning, contract technical workers and IT consultants are each valuable for the right engagement. Make sure not to use a contract programmer where you need a consultant, because the contractor is oriented to a narrower focus. Also avoid wasting money by miring a consultant in programming chores that could be done by a programmer at a lower rate. Use each for their respective strengths to move your business forward faster, better and more cost effectively.

By: Bonnie Huval

About the Author:

Most of Firefox’s advantages are MSIE’s disadvantages, and vice-versa. This article will look at some of the advantages and disadvantages of Firefox in relation to MSIE.

Advantages

Security

Security is often cited as the primary reason for users switching from MSIE to Firefox. Security is of utmost importance for software that interacts with remote computers, in an era of high security risk activities such as online banking.

Firefox has fewer security holes and a tighter schedule of disclosing them. The enhanced security in Firefox is due to a multitude of factors the system’s inclusion of more source code reviewers and a better bug reporting system and exclusion of VBScript/ActiveX, often the source of vulnerabilities.

Meanwhile, Microsoft has been clamoring for years to try to clamp down on the MSIE security holes. It acquired an anti-spyware product, which it released under the banner of Microsoft AntiSpyware. It also promises its new Windows Vista platform will be more secure. However, Microsoft’s track record to date has done little to boost the confidence of today’s user.
Standards compliance

Firefox has vaulted ahead of MSIE with improved support for standard web protocols, such as its superior stylesheet compatibility.

Since MSIE had a leading marketshare, the company had less interest in conforming to web standards, and instead focused on proprietary protocols, with the goal of maintaining their market position. That is, the focus of Microsoft was to try to convert as much of its userbase to writing webpages and web applications that required a proprietary MSIE-approach, so that down the road, users would be less able to move off a Microsoft platform.
As a result, Microsoft neglected for years to improve support for basic open standards. For example, transparent PNG graphics did not work all the way through to MSIE version 6.

Multiple operating system platforms

Firefox is available for users who runs Windows (Windows 98 through to Windows XP), Mac OS X, all the leading versions of Linux, as well as some lesser-used operating systems. In comparison, Microsoft has dropped development for Mac, and other non-Windows systems. Furthermore, Microsoft has ceased new development even on their own versions of Windows, making the new MSIE only available to users who have a license for Windows XP.
Firefox also has a similar user interface among the different operating platforms. For deployments that have a mix of operating platforms (such as Linux for the techs, Macs for the graphic designers, and Windows for the accounts department), moving to Firefox for everyone thus brings technical support costs down.

Time-saving browser innovations

Internet communication and interaction is a core component for most modern businesses. Efficient use of web browser time translates to increased profits, so innovations to help workers do their tasks faster are welcomed.
Firefox leads MSIE in this regard, with out-of-the-box features such as integrated Google search in the toolbar, placing the find-within-page box at the bottom of the browser window so as not to obscure the text, and so on.

Disadvantages

Retraining

Any switch of software incurs a retraining cost. However, a switch from MSIE to Firefox requires only a mild amount of retraining.

The switch from MSIE to Firefox is designed to be easy, with proper import of bookmarks and other settings.

Browser interfaces are becoming standard, so understanding how to get up and running is not usually a problem. There are some only minor adjustments. For example, “Internet Files” in MSIE is called “Cache” in Firefox. One can use a downloaded MSIE theme so that the Firefox user interface even more closely resembles that of MSIE.

Incomplete migration

In a business with Windows computers, if the switch from MSIE to Firefox is incomplete, it can cost more to offer technical support for both browsers. This argument would only apply to shops whose Windows computers are all Windows XP. Since the new MSIE is only available for Windows XP, if there are different Windows versions (such as Windows NT or 2000), then the technical support team already needs to support different types of MSIE browsers.

Another consideration, however, is that even an incomplete switch from MSIE to Firefox could result in less technical support, since the Firefox users would be less likely to need help with fixing their computer after an MSIE-related security breach.

By: Matt Bacak

About the Author:

Are you planning to venture into domain investments? Have you been confused as to what cost is involved in keeping your domain name business intact? Here are my few tips that will assist you to make profits when buying and selling domain names.

Domain Name Registration Cost

For one year rental period, you will always pay $10 or less when you want to register a brand new domain. The cost of registration depends on which registrar you are using, whether a registrar is doing promotion thereby offering discount, whether there is coupon code that you can use as a registrant to reduce the usual cost and so forth.

For example, if you register ten (10) domain names on the same day for $9.25 each, it means you will pay $92.50 now and $92.50 for renewal fee in a year’s time to keep your portfolio running. However, you may get bulk registration discount on that anyway.

Meanwhile, your cost of acquisition will increase to $30 or more for each successful acquisition from drop services if you are following the route of grabbing expired domain names. As you can see, buying junk domains is not the way to go because it will quickly add up to a hefty sum when the time of renewal comes.

Building Website and Web Hosting

Except you are lucky to register type-in traffic domain, you will need to build a website with quality content and then drive traffic to it in order to increase the commercial value of the site. Building a professional looking website will cost you about $100 when you go to popular web design forums.

Also, taking out web hosting package will cost you about $5 a month, i.e. $60 in a year to keep your site visible online.

What about writing quality articles which you will upload to your blog or website? You will part with $5 per article in outsourcing if you expect high quality content. That will translate to $150 for 30 unique articles you outsource.

Remember too that listing your virtual real estate at auctions will cost you more in terms of listing fee, success fee, escrow fee, etc.

Profit Calculation

From the above analysis, it is not actually cheap flipping domain names considering the cut-throat competition you will face when trying to sell off. Again your website has to be professionally built with brand-able premium name and good content to guarantee quick cash sale.

Otherwise, you will be amused how much bidders will offer you to buy your web property. I have seen bids as low as $10-$30 per fully functional website. That is a potential loss if you ask me considering registration cost, cost of building site and content, web hosting fee and the time spent to ensure everything run smoothly.

The big question you should be asking me is whether or not there is real money to be made in flipping domain names and/or websites? In one word, YES! Definitely! If you understand how domain name business works and with as little as $10 you can start your domain investments profitably.

By: Edward O. Thomas

About the Author:

Your website is ready. Your content is in place, you have optimized your pages. What is the last thing you should do before uploading your hard work? Validate. It is surprising how many people do not validate the source code of their web pages before putting them online.

Search engine robots are automated programs that traverse the web, indexing page content and following links. Robots are basic, and robots are definitely not smart. Robots have the functionality of early generation browsers: they don’t understand frames; they can’t do client-side image maps; many types of dynamic pages are beyond them; they know nothing of JavaScript. Robots can’t really interact with your pages: they can’t click on buttons, and they can’t enter passwords. In fact, they can only do the simplest of things on your website: look at text and follow links. Your human visitors need clear, easy-to-understand content and navigation on your pages; search engine robots need that same kind of clarity.

Looking at what your visitors and the robots need, you can easily see how making your website “search engine friendly”, also makes the website visitor friendly.

For example, one project I worked on had many validation problems. Because of the huge number of errors generated by problems in the source code, the search engine robots were unable to index the web page, and in particular, a section of text with keyword phrases identified specifically for this page. Ironically, human users had problems with the page as well. Since humans are smart, they could work around the problem, but the robots could not. Fixing the source code corrected the situation for human and automated visitors.

There are several tools available to check your HTML code. One of the easiest to use is published by the W3C (http://validator.w3.org/). While you’re there, you can also validate your CSS code at W3C’s page for CSS (http://jigsaw.w3.org/css-validator/). The reports will tell you what source code needs to be fixed on your web page. One extra or unclosed tag can cause problems. With valid code, you make it easier for your human visitors and search engine robots can travel through your website and index your pages without source code errors stopping them in their tracks. How many times have you visited a website, only to find something broken when going through the web pages? Too many too count, I’m sure. Validating your pages makes everything easier for your website to get noticed.

As I said before, what works for your website visitors works for the search engine robots. Usability is the key for both your human visitors and automated robots. Why not provide the best chance for optimum viewing by both?

By: Daria Goetsch

About the Author:

In industry surveys ranging from the Symantec Threat Report to Gartner analyst reports, application security is constantly cited as the most significant area of risk for enterprises and the most prevalent threat vector for cyber crime. It certainly makes sense, why bother to spend time on reconnaissance when the front door is wide open?

Many organizations have begun to spend a great deal of energy and money to secure applications. Popular approaches include code review, threat modeling, source code analysis and black box testing. Often overlooked is the rather fundamental practice of reducing the attack surface of the application.

During development and configuration of a system and the associated application the software must typically expose both customer and business assets through network ports, database access, APIs, web services and the user interface. The entire collection of entry points in a product is called its Attack Surface. These form the ways in which an adversary can attack a system. A big attack surface generally means big security issues, or often more time and budget dollars dedicated to protecting the system. It’s also important to remember that channels to local resources are not the only vectors for attack, remote resources must also be kept in mind.

Generally, when a software system is architected, implemented and configured, the top of mind issue is about providing useful functionality that meets business goals. From a security point of view, however, the design and deployment teams must also think about turning things off as well as on. From a design standpoint this involves reducing the amount of code that is executing by default, running with user privileges rather system, reducing functionality and data accessible to unauthenticated users and limiting the damage if access points are exploited. From a system configuration point of view this involves turning off unnecessary services, providing access only to required authorized users on specific subnets, and using strong ACLs to control access to resources.

The security community has done a relatively good job with respect to understanding which attack vectors are more likely targeted by adversaries. Given that perspective, keep the following in mind:

• Minimize the use of scripting engines and controls such as ActiveX, JavaScript or VBScript.
• Avoid symbolic links as these are likely targets.
• Restrict file permissions to the fullest extent possible.
• Minimize the number of services that must run as root.
• Keep up with vulnerability research and build an effective patch process.

A useful practice is to put together a design guideline for developers suitable to your design environment and the business and security requirements associated with your system. Further, at deployment time, a security configuration guide and checklist of security best practices is recommended. Interestingly, some in the industry such as SAP have invested even more heavily in this area. SAP Labs has developed and begun pilot deployment of an Eclipse extension that uses a more formal process to measure attack surfaces. Their method involves summing the damage and potential-effort ratios (DER) of relevant resources. The relevant resources of an application include its channels, such as TCP ports; methods, such as API calls; and data, whether persistent, in memory, or in transit. The DER of a resource is the ratio of potential damage to the effort required to breach the resource. The SAP tool discovers application resources and combines that data with DER numbers to generate attack surface metrics for software components. While the discovery of resources is fully automated, the tool requires context specific configuration based on experience, judgment, and a threat modeling process.

Given the complex nature of deploying SAP software securely it’s not surprising that they have invested in this area. However, all systems can benefit immediately from simply measuring the potential avenues of attack and understanding the impact. This practice can be particularly beneficial for complex systems with many configuration decisions. In the healthcare sector, where Redspin has done many information security assessment projects, a good example is healthcare information exchange systems. A further example with broad deployment across many sectors is CRM systems.

Whether through design reviews, deployment guides or development tools, the practice of reducing the attack surface associated with an application has the potential to quickly yield a high return on investment.

By: John Reno

About the Author:

Porsche, Daimler, Honda and Audi have one thing in common when it comes to the production processes in their factories; the use of reverse engineering Faro. These automobile manufacturers are however not the only companies that make use of this technology from Faro.

The Faro measurement systems are widely used, with an approximate user base of 10,000 customers all over the world. The term reverse engineering might remind one of espionage thanks to movies that have tackled the uses of it to carefully study the workings of ammunition and devices for military advantage. While it is true that reverse engineering is used for spying not only in the military but also for commercial purposes, that’s maybe the more attracting character of this process.

Actually, this is the process used to analyze in detail the workings of a system or a device. In the case of Faro, it has something to do with the detailed analysis on the operation and function of software programs and company components. It is actually used for more practical reasons by companies that can not get their hands on software documentation, or they may have them but the documentation is incomplete or lacking.

Reverse engineering Faro may be too complex for the laymen but to make it more palatable, think of it as the process of going back to allow the human mind to understand the development cycle of software or a machine. This process is only meant for examination purposes only, and does not include modification of the software.

There are actually several reasons why Faro is used including but not limited to:
Software does not have a source code There is a source code but lacks proper documentation Measurement of prototypes and devices Recreation of missing prehistoric parts

Reverse engineering Faro is constantly used in the first case, when the software does not have a source code, but the concept can actually be used in a variety of industries. Take for example the reconstruction of some skeletal parts of a dinosaur shown at the Sam Noble Oklahoma Museum of Natural History. However, there should always be a diligent effort to avoid infringement of copyright when implementing the process.

Faro, a Nasdaq listed company, has made available 3D measuring devices for companies that require reverse engineering for inventory documentation, historical site digital scanning, production planning and for the analysis of components and their assemblies.

A company that requires the verification or setting-up of systems, components and other measuring tasks can get a helping hand from Faro technologies at anytime.

By: Glen Glasgow

About the Author:

The 2007 California Building Codes took effect January 1st, 2008. Some of the more prominent areas of change in this installment of building codes center on fire safety, equal access for disabled persons and environmentally friendly construction. The new set of codes is based on the latest national and international model building codes.

Rosario Marin, Secretary of the State and Consumer Services Agency and chair of the Building Standards Commission has said, “This will put California back in the forefront as a leader in the use of the latest technology for building safety, fire prevention, safe construction, and code enforcement.”

With California’s 2006 global warming law mandating a cut in carbon emissions to 1990 levels by 2020, the pressure is on to change the way we build. Some California cities, such as Los Angeles, are taking the changes to heart. Los Angeles is doing its part by adopting new building plans that require large new developments to be 15% more energy efficient than in previous years.

California State Fire Marshall, Rueben Grijalva pushed for many of the changes to the 2007 Building Codes in response to the devastation resulting from recent wildfires in the state. The new 2007 California Building Code changes include additional wild land-urban interface fire protection standards for vulnerable structures located in areas prone to wildfires.

However, the new changes are being met with some resistance related to the drastic cost increase required to meet the new codes. One of the proposed changes requires two-hour fire resistant floor ratings for buildings larger than three stories and two-hour fire resistant construction that extend to supporting structural elements to grade. This change affects the cost of a new construction building by adding $6 per square foot, and $250 per square foot for an existing structure.

Compliance with this code requires additional:

oFire proofing materials

oShaft construction

oLengthier penetration protection

oDesign Fees

oPermit and inspection Fees

oAdditional sprinkler heads

Additional code changes include the approval of Chlorinated Polyvinyl Chloride (CPVC) plastic pipe for use in residential water supply systems. Also introduced, is the federal Department of Justice (DOJ) certification requirements for barrier-free entryways for persons with disabilities.

Additional Changes For Residential Buildings:

owood siding and wood-shake roofs are banned in fire-prone areas

oshortened staircases with wider steps

olandscaping near the home must be free of trees, shrubbery, and other fire-fuel sources

olowered heating requirements to 68? F at three feet above the floor

oonly one exit on third story required, regardless of square footage

ominimum kitchen floor area is now 50 square feet with a minimum clearance of 3′ between counters and walls and appliances

ohigher guardrails for stairs

oMinimum attic access opening reduced to 20″ x 30″

owall between garage and living space may now use ?” type-x drywall instead of 5/8″

oreduced size of emergency egress window for grade floor openings

oMinimum clear width for doors clarified as 32″ with a height of 80″

ospiral stairs may be used as a second exit regardless of the size of the home

oreduced light requirements to 8% of the floor space

omechanical ventilation now permitted in place of natural ventilation

ofive foot required minimum distance for un-rated walls and unprotected openings from property line

Notable Changes for Commercial Buildings:

oallowable provisions of them all the story would frame building are less restrictive

owood frame buildings can now be constructed up to 70 feet and height and up to four stories

osprinklers can now be used for both height an area increases and can be used in lieu of rated corridors is the building is equipped with a sprinkler system throughout

Structures in compliance with the 2007 California Building Codes will receive reduced insurance rates and higher resale values, but those promises do little to allay the pressure of additional up-front construction costs.

By: J A Parker

About the Author: