Firewalls: Circuit Level Gateway Firewall

Circuit Relay firewall or Circuit Level Gateway is an approach to configure a firewall that validates connections before allowing data to be exchanged. A circuit relay firewall is a type of security firewall (proxy server) that provides a controlled network connection between internal and external systems (that is, there is no "air gap"). A virtual "circuit" exists between the internal client and the proxy server. Internet requests go through this circuit to the proxy server, and the proxy server delivers those requests to the Internet after changing the IP (Internet Protocol) address.

All traffic is disallowed unless a session is open and every session of data exchange is validated and monitored. Using Circuit level gateway, IP spoofing is particularly much more tedious in comparison to the firewall based only on packet filtering. The Circuit Level Gateway operates at the Transport Layer of OSI Model. Traffic is filtered based on specified session rules and may be restricted to recognized computers only. Circuit-level firewalls hide the network itself from the outside, which is useful for denying access to intruders. But they don't filter individual packets.
Whether a connection is valid may for examples be based upon:
- destination IP address and/or port
- source IP address and/or port
- time of day
- protocol
- user
- password

SOCKS is an example of this type of firewall. This type of proxy is not aware of applications but just cross links your connects to another outside connection.

Firewalls : Network and Application layer firewalls

A firewall is a software program or device that monitors, and sometimes controls, all transmissions between an organization's internal network and the Internet. However large the network, a firewall is typically deployed on the network's edge to prevent inappropriate access to data behind the firewall. The firewall ensures that all communication in both directions conforms to an organization's security policy.

Network layer Firewalls
These generally make their decisions based on the source, destination addresses and ports in individual IP packets. A simple router is the ``traditional'' network layer firewall, since it is not able to make particularly sophisticated decisions about what a packet is actually talking to or where it actually came from. Network-level firewalls are fast, and today you'll find them built into most network appliances, particularly routers. These firewalls, however, don't support sophisticated rule-based models. They don’t understand languages like HTML and XML, and they are capable of decoding SSL-encrypted packets to examine their content. One thing that's an important distinction about many network layer firewalls is that they route traffic directly though them, so to use one you either need to have a validly assigned IP address block or to use a ``private internet'' address block. Network layer firewalls tend to be very fast and tend to be very transparent to users.

Application layer Firewalls

These generally are hosts running proxy servers, which permit no traffic directly between networks, and which perform elaborate logging and auditing of traffic passing through them. They can log user activity too. Application-level filtering may include protection against spam and viruses as well, and be able to block undesirable Web sites based on content rather than just their IP address. The downside to deep packet inspection is that the more closely a firewall examines network data flow, the longer it takes, and the heavier hit your network performance will sustain.

ISO 9001 - The International Standard for Quality Management

The standard covers all aspects of an organization’s activities including: identifying its key processes, defining roles and responsibilities, its policies & objectives, and documentation requirements. It also covers the importance of understanding & meeting customer requirements, communication, resource requirements, training, product & process planning, design processes, purchasing, production & service, monitoring and
measurement of products & processes, customer satisfaction, internal audit, management review, and improvement processes. ISO 9001 is based on the following eight Quality Management Principles, which are incorporated within the requirements of the
standard, and can be applied to improve organizational performance:
- Customer focus,
- Leadership,
- Involvement of people,
- Process approach,
- System approach to management,
- Continual improvement,
- Factual approach to decision making, and
- Mutually beneficial supplier relationships.

Benefits of implementing ISO 9001

- Implementing a Quality Management System will motivate staff by defining their key roles and responsibilities.
- Cost savings can be made through improved efficiency and productivity, as product or service deficiencies will be highlighted.
- From this, improvements can be developed, resulting in less waste, inappropriate or rejected work and fewer complaints.
- Customers will notice that orders are met consistently, on time and to the correct specification. This can open up the market place to increased opportunities.

Differences between Capability Maturity Model(CMM) and Capability Maturity Model Integration(CMMI)

Capability Maturity Model (CMM)

The Capability Maturity Model for Software (CMM) is a framework that describes the key elements of an effective software process. There are CMMs for non software processes as well, such as Business Process Management (BPM).
- The CMM describes an evolutionary improvement path from an ad hoc, immature process to a mature, disciplined process.
- The CMM covers practices for planning, engineering, and managing software development and maintenance.
- When followed, these key practices improve the ability of organizations to meet goals for cost, schedule, functionality, and product quality.
- The CMM establishes a yardstick against which it is possible to judge, in a repeatable way, the maturity of an organization's software process and compare it to the state of the practice of the industry.
- The CMM can also be used by an organization to plan improvements to its software process.
- It also reflects the needs of individuals performing software process, improvement, software process assessments, or software capability evaluations; is documented; and is publicly available.

Capability Maturity Model Integration (CMMI)
- CMMI is a process improvement approach that provides organizations with the essential elements of effective processes.
- It can be used to guide process improvement across a project, a division, or an entire organization.
- CMMI helps integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide a point of reference for appraising current processes.

Misconceptions of the Capability Maturity Model (CMM)

CMM is the most widely used Software Process Improvement model. It was developed by Carnegie Mellon University’s Software Engineering Institute (SEI). A maturity level is a well-defined evolutionary plateau toward achieving a mature software process. Each maturity level provides a layer in the foundation for continuous process improvement.
In CMMI models with a staged representation, there are five maturity levels designated by the numbers 1 through 5.
- Initial
- Managed/Repeatable
- Defined
- Quantitatively Managed
- Optimizing

Misconceptions About Maturity Levels
- If you are at Level 1, you are pond scum.
Being Level 1 does not mean that the members of a software organization are barely breathing. It does mean that the organization's projects are likely to have less predictability, more rework, more defects, and more schedule slippage than those in a higher maturity organization.
- Level 2 is mostly about software engineering activities, such as requirements analysis, design, coding, and testing.
- You have to perform all of the activities and practices defined at some maturity level in order to achieve that level.
- Software measurement is not required until you are approaching Level 4.
- The SEI certifies an organization at a specific maturity level.
- The CMM requires that you use specific software development practices, tools, and methodologies.
- The CMM mandates a waterfall life cycle model.
- The Software Quality Assurance KPA is mostly about testing.
- The CMM requires that you perform software inspections to achieve Level 3.
- Having a "tailorable" process really means that you can do whatever you want.
- Requirements management is the same thing as requirements engineering.
- You cannot work on improving KPAs more than one maturity level higher than your current level.
- The CMM mandates bureaucracy and wasteful paperwork.
- The CMM is a quick fix for short-term problems.
- CMMI is proprietary for the US military use.
- CMMI is the next release of CMM.
- Everyone uses the Staged Representation.
- You cannot use CMMI if you already use some other improvement model.
- CMMI is not suitable for small organizations.
- CMMI is used only to get an appraisal rating.
- CMMI is not suitable for companies using Agile methods.
- CMMI implementation takes long and is expensive and does not pay off.
- CMMI is a process model.

Imperative Programming and differences between Imperative and Functional Programming

Imperative programming is characterized by programming with a state and commands which modify the state.
- Imperative: a command or order.
- Procedure: the act, method or manner of proceeding in some process or course of action a particular course of action or way of doing something.
When imperative programming is combined with subprograms it is called procedural programming.

The imperative programming paradigm is an abstraction of real computers which in turn are based on the Turing machine and the Von Neumann machine with its registers and store (memory). At the heart of these machines is the concept of a modifiable store. Variables and assignments are the programming language analog of the modifiable store. The store is the object that is manipulated by the program. Imperative programming languages provide a variety of commands to provide structure to code and to manipulate the store.
In imperative programming, a name may be assigned to a value and later reassigned to another value. The collection of names and the associated values and the location of control in the program constitute the state. The state is a logical model of storage which is an association between memory locations and values.

Characteristic : Programmer focus
- Imperative approach: How to perform tasks (algorithms) and how to track changes in state.
- Functional approach: What information is desired and what transformations are required.
Characteristic : State changes
- Imperative approach: Important.
- Functional approach: Non-existent.
Characteristic : Order of execution
- Imperative approach: Important.
- Functional approach: Low priority.
Characteristic : Primary flow control
- Imperative approach: Loops, conditionals, and function (method) calls.
- Functional approach: Function calls, including recursion.
Characteristic : Primary manipulation unit
- Imperative approach: Instances of structures or classes.
- Functional approach: Functions as first-class objects and data collections.

Test Automation Framework: What is the Hybrid Test Automation Framework

In previous articles, we learned about the following Automation frameworks:
- Data Driven Testing (link)
- Test Library Architecture Framework (link)
- Keyword-driven/table-driven testing (link)
- Test script modularity (link)
This post covers the 5th such test automation framework, called Hybrid Test Automation Framework. Just like the name suggests, this is what people would ask for, why can't you combine the benefits and strong points of the above test automation frameworks and try to remove their weaknesses, and that is what you get. This is called the Hybrid Test Automation Framework. It is one of the most successful automation frameworks, and is also one of the frameworks that other frameworks eventually mature into.
So, since the keyword driven architecture has some powerful benefits in the form of libraries and utilities, this framework allows the data driven scripts to take advantage of these libraries and utilities; and also make these data driven scripts smaller and reduce the risk of their failure. This framework has many utilities that allow the conversion of currently used scripts into the equivalent of keyword driven (when needed).
Some of the properties of the Hybrid Test Automation Framework are: Core Data Driven Engine, the Component Functions, the Support Libraries, and the Application Map (App Map).