Security as a Service — few words

I am going to write after a long time. Don’t know why I messed up my writing with my talking. In this post I would like to focus on an aspect that looks promising for service providers, that holds alot of thinking for service takers, and that demands alot of creativity when it comes to seperating on-premises security notions to the off-premises security notions. By default, what we assess from the bare term is that Security might not be dealt with weapons that one posses to tackle attacks. Why would someone think of getting security services that are coming entirely from outside? But when thought and provided in a manner that is much more intuitive than the notions of endpoint security or in-network access gateways, this new tool can give benefits to companies in search of a secure off-the-hook solution and new business models for the security service providers.
Costs for such a service should not be considered as benefit, because normally costs adjust themselves to come to a point where it becomes equally costly as compared to buying a solution without a cloud aspect into it. But reliability, and 24/7 access to a service that meets security can be a good starting point. Security assurance being the second parameter will be a good thing to consider. Two reasons which are provided by the security service providers for providing security-as-a-service are economies of scale and streamlined delivery mechanisms. What exaclty that means? Reach to SMBs? pick-your-own-profile type features? or what? In this respect all consumers have to do is to get educated. They have to know what exactly security-as-a-service offering implies, what it caters for, why its beneficial, and why they have to consider it in decision making. This is the responsibility of the service provider to provide needed documentation, demos, etc to educate the consumer. Since economies of scale means it might reach much more consumers, so an emphasis of education is a must have by the service provider.
I will end few words here. I hope to come back with a deeper look into that.
Till then have a nice time.

Some Cloud System-Testing Tools

Hi all,

Its been a while since my last post. Just trying to juggle up my memcapsules to create something of use. Here is a list of Cloud testing and performance measurement tools. Application performance tools and the variation in techniques is the hidden element that I will try to get out of them. Have a nice read.

1- Phoronix Test Suite:
Its an automated open-source (GPL License:)) testing framework, which has php-cli dependencies. It give graphical output of the tests underway. It can test many suites of applications running over amazon EC2. Those who don’t want to use CLI can employ GTK2 GUI over php. The basic idea behind is AUTOMATED TESTING.
It comes with 130 test profiles and 60 test suites. Plus you can create and add your own test profile and suite by using their extensible architecture approach using just XML. It can monitor power consumption, disk-storage, system-memory, CPU utilization, disk-read/write speeds, graphics performance, and motherboard components.
Tests can be scheduled using Phoromatic.com.
You can find regression pattern in application software. Currently those folks have found regression on Linux Kernel using this test suite.
USE CASE: Deploy Phoronix TS on your local machine and then in Cloud. Run both of them and compare the results.

2- SOASTA:
Simply awesome. Used by well-renowned companies like Netflix, Intuit, Chegg, Microsoft, P&G, Cisco, AmericanGirl etc. Its commercial and on-demand. A demo is available.
It provides web-based distributed multi-object multi-threading testbench. It can create multiple objects like browsers, UI elements, AJAX put/gets, http(s) requests on multiple devices like mobile and desktop. More on that is that you can get into the live test and see what are the current bottlenecks.
Check out their Global Test Cloud offering which will give you testmarks on multiple clouds. You can simulate web-traffic on any cloud platform with any amount of load that you want to target. AND remember its TURNKEY. Isn’t that awesome. AND its pay-as-you-service. Isn’t that awesome too.

3- CloudTesting.com:
It provides automated website testing services. Plans for pricing start from 100 Pounds per month. It operates on SAAAS model.

4- PushToTest:
It runs on your test equipment, on cloud, or both. Runs on distributed TestMaker test environment. Its also on-demand. It can run on multiple cloud environments and global user traffic is one dimension of it. It also supports Collabnet Cubit. You can organize tests using simple XML configuration files. Customers include intuit and cisco.

5- SOAPSonar:
Its an offering from CrossCheck Networks providing testing for web-services and ESB. It can indulge itself in software, VMWare, and cloud image. It provides SOAP, XML, and REST testing over HTTP(s), MQ, and JMS protocols. It provides functional, performance, compliance, and security testing in cloud. One can validate SLA rates in terms of throughput, and capacity statistics from the back-end service in cloud, in performance testing mode.
Its a commercial offering, and many feature segregated editions are available along with a trial version. You can compare editions here.

6: Bonnie++ filesystem benchmarking:
In the words of Linus, the founder/maker of linux kernel, it is “reasonable disk performance benchmark”. SUN guys used it all the time. And its been around since 1996. Both 32 and 64-bit versions are available. It measures hard-drive and filesystem performance. If you wish to test different zones of a hard-drive, it would be good to use ZCAV along with bonnie++.

7: Sysbench MySQL benchmarking:
Back in 2006 SUN published Solaris vs REDHAT stuff, based on the output of this tool. Till now its been matured. It allows you to test file I/O performance, schedular performance, memory allocation, and transfer speed, POSIX thread implementation performance, and database server performance. First four are good for platform evaluation. E.g. test these four paramters on your local datacenter and then on public cloud to test both the platforms against your application. It uses LUA as scripting language, so you can write scripts into it for your own ride. Its a very good tool OR infact is for OLTP (OnLine Transaction Processing).

8: ProbeVue:
Those well-versed in knowing/comprehending that probeVue is the best, why I haven’t mentioned it in the first place. Well I don’t wanna answer that question, since I am waiting for it to be ultimate for me and available in other coding stylses also rather just in C. Apart from it, its the best of the best from IBM. It is basically a lightweight dynamic tracing utility, and many people think (ones like William Favorite from The Ergonomic Group), that its the future of system introspection.
When using ProbeVue a developer can select what he/she wants to extract from an event, and still able to make his/her own events using Vue as language. Here is the comparison from William’s Slides

I will be adding more to this post. Please add yours in the comments section.
Cheers