NVH’s Blog

February 27, 2006

カタカナ

Filed under: hoc tap, 日本語

アイコン (icon)
アイコンボタン (icon button)
アイテニアム (Itanium)
アイドル (idle)
アイ・リンク (i.LINK)
アウトソーシング (outsourcing)
アウトバウンド (outbound)
アウトボックス (out-box)
アウトラインフォント (outline font)
アカウント (account)
アカデミックパッケージ (academic package)
アクセス (access)
アクセスチャージ (access charge)
アクセスポイント (access point)
アクセス料金 (access charge)
アクセラレータ (accelerator)
アクティブウィンドウ (active window)
アクティブディレクトリ (Active Directory)
アクティブデスクトップ (Active Desktop)
アクティブマトリクス方式 (active matrix)
アクティベート (activate)
アクノリッジ (acknowledge)
アクロバット (Acrobat)
アサイン (assign)
アサート/ネゲート (assert/negate)
アジリティ (agility)
アスペクト比 (aspect ratio)
アスロン (athlon)
アセンブラ (assembler)
アセンブリ (assembly)
アセンブリ言語 (assembly language)
アセンブル (assemble)
アタッチ (attach)
アタッチファイル (attach file)
アタッチメント (attachment)
アダプタ (adapter)
アップグレード (upgrade)
アップストリーム (upstream)
アップタイム (uptime)
アップローダ (uploader)
アップロード (upload)
宛先 (destination)
アドインソフトウェア (add-in software)
アドウェア (ADware)
アドホック・モード (ad hoc mode)
アドミニストレータ (administrator)
アドレス解決プロトコル (Address Resolution Protocol)
アドレス空間 (address space)
アドレッシング・モード (addressing mode)
アナログ・モデム (analog modem)
アノニマスFTP (anonymous ftp)
アフィリエイト・サービス (affiliate service)
アフィリエイト・プログラム (affiliate program)
アフィリエイト・マーケティング (affiliate marketing)
アプライアンス・サーバ (appliance server)
アプリケーション層 (application layer)
アプリケーション・サービス・プロバイダ (Application Service Provider)
アベイラビリティ (availability)
アボート (abort)
アルゴリズム (algorithm)
アルファテスト (alpha test)
アルファ版 (alpha version)
アルファバージョン (alpha version)
アンインストール (un-install)
暗号化 (encryption/encipherment)
暗号化ファイルシステム (Encrypting File System)
暗号文 (ciphertext/cryptogram)
アンサー・ファイル (answer file)
アンドゥ (un-do)
アンナンバード接続 (unnumbered connection)
アンマウント (unmount)
アンマネージ・コード (unmanaged code)
アンロード (unload)
アーカイバ (archiver)
アーカイブ (archive)
アーキテクチャ (architecture)
移植 (port/porting)
移植性 (portability)
イジェクト (eject)
イジェクトボタン (eject button)
イタリック体 (italic face)
1次キャッシュ (level 1 cache)
一括処理 (batch processing)
一括置換 (replace all)
一括変換
イニシャライズ (initialize)
イニシャルコスト (initial cost)
イネーブル (enable)
イベント (event)
イベント駆動 (event driven)
イベント ドリブン (event driven)
違法コピー (illegal copy)
イメージ スキャナ (image scanner)
イリーガル (illegal)
入れ子 (nest)
インアクティブウィンドウ (inactive window)
インキュベータ (incubator)
インク・カートリッジ (ink cartridge)
インクジェット・プリンタ (ink-jet printer)
インク・リボン (ink ribbon)
インクリメント (increment)
インクルード (include)
印刷装置 (printer)
印刷プレビュー (print preview)
インサーキット・エミュレータ (in-circuit emulator)
インサートモード (insert mode)
インシデント (incident)
インスタントメッセージング (instant messaging)
インストラクションセット (instruction set)
インストラクションセットアーキテクチャ (instruction set architecture)
インストーラ (installer)
インストール (install)
インタラクティブ (interactive)
インタラプト (interrupt)
インターナショナライゼーション/インターナショナリゼーション (Internationalization)
インターネット (Internet)
インターネットVPN (internet Virtual Private Network)
インターネットサービスプロバイダ (Internet Service Provider)
インターネット接続共有 (Internet Connection Sharing(ICS))
インターネット電話 (Internet Telephone)
インターネットデータセンター (Internet Data Center)
インターネットバンキング (Internet banking)
インターネットメール (Internet mail)
インターネット・カフェ (internet cafe)
インターネット・ワーム (internet worm)
インターフェイス (interface)
インタープリタ型言語 (interpretive language)
インチネジ (inch screw threads)
インテリジェント・ハブ (intelligent hub)
インデント (indent)
イントラネット (Intranet)
インバウンド (inbound)
インピーダンス (impedance)
インフラストラクチャ (infrastructure)
インフラストラクチャ・モード (infrastructure mode)
インプリメンテーション (implementation)
インプリメント (implement)
インプレッション (impression)
インボックス (in-box)
インポート (import)
インライン・コード (in-line code)
インライン展開 (in-line expansion)
イーサネット (Ethernet)
ウィザード (wizard)
ウィラメット (Willamette)
ウィンチェスタ・テクノロジ
ウィンチェスター・ディスク (winchester disk)
ウィンドウシステム (window system)
ウイルス (virus)
ウイルス検出ソフトウェア (virus detection software)
ウイルス・チェッカ (virus checker)
ウイルス・チェック・ソフトウェア
ウェアラブル・パソコン (wearable personal computer)
ウエハ (wafer)
ウォッチドッグ・タイマー (watchdog timer)
ウォー・ダイヤラ (war dialer)
ウォー・ダイヤリング (war dialing)
ウォー・ドライビング (war driving)
ウォーホール型ワーム (warhol worm)
ウォームスタート (warm start)
埋め込みプロセッサ (embedded processor)
裏口 (back door)
上書きモード (overwrite mode)
衛星インターネット接続
永続性 (persistence)
エイリアス (alias)
エクストラネット (Extranet)
エクスポート (export)
エスクローサービス (escrow service)
エッジ (edge)
エッジトリガ方式 (edge trigger method)
エディタ (editor)
エミュレーション (emulation)
エミュレータ (emulator)
エモーティコン (emoticon)
エラーハンドリング (error handling)
エリアプラス
エルゴノミクス (ergonomics)
エレクトリック・コマース (electric commerce)
エレクトロニック・コマース (electronic commerce)
エンコーダ (encoder)
エンコード (encode)
エンタープライズXアーキテクチャ (Enterprise X Architecture)
エンディアン (endian)
エントリ・マシン (entry machine)
エントリ・モデル (entry model)
エンドユーザー (end user)
エンハンスト3DNow! (enhanced 3d now!)
オクテット (octet)
オフィスコンピュータ (office computer)
オフ会 (offline meeting)
オフコン (office computer)
オフショア開発 (offshore development)
オフスクリーンメモリ (off-screen memory)
オフセット (offset)
オフトラック (off-track)
オフミ (offline meeting)
オフライン (off-line)
オフラインミーティング (offline meeting)
オブジェクト (object)
オブジェクト (object)
オブジェクト (object)
オブジェクト・コード (object code)
オブジェクト・ファイル (object file)
オプティカルマウス (optical mouse)
オプティマイザ (optimizer)
オプティマイズ (optimize)
オペレーティングシステム (operating system)
オンサイトサポート (on-site support)
オンザフライ書き込み (on-the- fly recording)
オンスクリーン機能 (on-screen function)
オンスクリーン・ディスプレイ (on-screen display)
音声会議システム (voice conferencing system)
音声認識 (voice recognition)
オンダイ (On-die)
オンデマンド ダイヤルアップ接続 (on demand dial-up)
オンボード (onboard)
オンボードデバイス (onboard device)
オンライン (on-line)
オンラインサインアップ (online sign-up)
オンラインショッピング (on-line shopping)
オンラインショップ (online shop)
オンラインソフトウェア (online software)
オンライントレーディング (on-line trading)
オンラインバンキング (online banking)
オンラインヘルプ (on-line help)
オンライン申し込み (online sign-up)
オートノミック・コンピューティング (autonomic computing)
オートパイロット (auto pilot)
オーバークロッキング (overclocking)
オーバークロック (overclock)
オーバーフロー (overflow)
オーバーフロー・エラー (overflow error)
オーバーヘッド (overhead)
オーバーライト (overwrite)
オーバーラップ ウィンドウ方式 (overlapped windowing)
オープン・アーキテクチャ (open architecture)
オープン価格 (open price)
オープンソース (open source)
オープンプライス (open price)
オールインワン (all-in-one)
オールインワンPC (all-in-one Personal Computer)
オールインワン・パソコン (all-in-one personal computer)

Detection of SQL Injection and Cross-site Scripting Attacks

Detection of SQL Injection and Cross-site Scripting Attacks
K. K. Mookhey, Nilesh Burghate 2004-03-17

1. Introduction
In the last couple of years, attacks against the Web application layer have required increased attention from security professionals. This is because no matter how strong your firewall rulesets are or how diligent your patching mechanism may be, if your Web application developers haven’t followed secure coding practices, attackers will walk right into your systems through port 80. The two main attack techniques that have been used widely are SQL Injection [ref 1] and Cross Site Scripting [ref 2] attacks. SQL Injection refers to the technique of inserting SQL meta-characters and commands into Web-based input fields in order to manipulate the execution of the back-end SQL queries. These are attacks directed primarily against another organization’s Web server. Cross Site Scripting attacks work by embedding script tags in URLs and enticing unsuspecting users to click on them, ensuring that the malicious Javascript gets executed on the victim’s machine. These attacks leverage the trust between the user and the server and the fact that there is no input/output validation on the server to reject Javascript characters.
This article discusses techniques to detect SQL Injection and Cross Site Scripting (CSS) attacks against your networks. There has been a lot of discussion on these two categories of Web-based attacks about how to carry them out, their impact, and how to prevent these attacks using better coding and design practices. However, there is not enough discussion on how these attacks can be detected. We take the popular open-source IDS Snort [ref 3], and compose regular-expression based rules for detecting these attacks. Incidentally, the default ruleset in Snort does contain signatures for detecting cross-site scripting, but these can be evaded easily. Most of them can be evaded by using the hex-encoded values of strings such as %3C%73%63%72%69%70%74%3E instead of . This is likely because most of the printed and online literature on CSS use this script as an example for determining if a site is vulnerable to CSS. These attempts can be trivially detected. However, the advanced attacker may attempt to camouflage the entire string by entering its Hex equivalents. So the

February 24, 2006

Paragon Solutions Vietnam

Filed under: hoc tap

1. INTRODUCTION AND EXECUTIVE SUMMARY 1.1 INTRODUCTION

1.1 INTRODUCTION

This proposal is the result of Paragon Solutions Vietnam (PSV)’s discussion with Maxport¬HanoiGarment40.com (Maxport) during the course of the meeting on May 26, 2001. In addition, Maxport has provided additional information in the form of a user requirements document, a report index document, and a brochure on an existing competitive product. This information has been incorporated into our proposal.

1.2 EXECUTIVE SUMMARY

Maxport is looking for an application system to manage the business operations at Hanoi Garment40 company. Starting out with office productivity software such as Word and Excel, Maxport has then developed an Access based application to increase the productivity, efficiency and accuracy of the daily business activities and operations. This system currently meets about 90% of HanoiGarment40 Company’s needs.
With the growing need for expansion with additional garment factories, clients and vendors in various locations in Vietnam and overseas, Maxport’s issues can be summarized as follows:
 Potential duplication of databases, causing complex, error-prone, repetitive work and inconsistent data.
 Potential incomplete coverage of system functions (new requirements), necessitating repetitive and manual works across departments to supplement essential functions such as management reporting;
 Current technologies utilized not allowing easy on-going improvements and expansion of business;
 Potentially limited budget for a complete IT solution due to licensing and software procurement.
PSV is pleased to propose a solution with the following characteristics:
 Solid design that emphasizes tight integration of data and functions across the organization and yet allows for high cooperation and real-time access between the various stake-holders world-wide;
 Open source software that takes advantage of royalty-free, state-of-the-art technologies to support future expansion (new features and requirements), scalability (increased number of users, increased number of deployment sites), and reusability;
 Proven methodology, to ensure highest possible quality be achieved;
 Utilizing the existing investment in current computer systems;
 A phased approach, to gain immediate return on investment and maintain true understanding of requirements.

2. COMPANY INFORMATION

2.1 PARAGON SOLUTIONS VETNAM
A wholly owned subsidiary of Paragon Solutions, Inc., Paragon Solutions Vietnam (PSV), was created in 1995 and is now the largest foreign-invested IT company in Vietnam. PSV currently has a staff of 210 of which 180 are in Ho Chi Minh City and 30 are in Hanoi. PSV’s team of experts undergoes extensive training, both locally and overseas through exchange programs with its parent company. PSV has actively been developing solutions for customers worldwide and in Vietnam. To domestic customers, PSV provides a full range of services from software development to complete turnkey solutions. Its expertise encompasses several platforms and technologies as well as IT consulting and project management of large-scale projects. The company’s infrastructure is world-class in a modern comfortable office setting. PSV have a 128K leased line in HCMC and a 64K leased line in Hanoi. In addition, PSV differentiates itself from other IT companies by the strong process used in the software development cycle and by the rigorous quality assurance procedures.

Paragon Solutions, Inc. (Paragon) is a U.S. company and a leaderin providing onshore and offshore IT services to premier organizations worldwide. In a highly competitive, resource-tight market, Paragon’s experienced and versatile employees are perfect resources for the immediate needs of its customers. Paragon is the only U.S.-based IT outsourcing company with established development centers in the United States, Ho Chi Minh City and Hanoi, Vietnam, and Bangalore, India. Paragon has a staff of experienced personnel who define customer requirements, design software solutions and coordinate the activities of our offshore development teams. Paragon has the ability to deliver large-scale, low cost outsourcing teams for long-term development projects. For more information please visit our website at www.paragonsolutions.com.

2.2 TECHNICAL EXPERTISE

Paragon Solutions Vietnam’s technical expertise includes: Analysis/Design: Rational Rose, Visio, Erwin
Language/Script: Visual Basic, C, C++, Java, Delphi, Perl, JavaScript, CGI, PHP, ASP, JSP, HTML, DHTML, XML, WML
IDE: Visual Studio, Forte for Java, Visual Cafe
Application Server/Web Server: IIS, Apache, Java Web Server, Domino, Tomcat, Netscape iPlanet, WebSphere, WebLogic, SilverStream, (boss, SiteServer, Cold Fusion, Jrun ‘
Middleware/Messaging: COM/DCOM, CORBA, EJB, RMI, JNI, sockets/IPC Database: Oracle, DB2, SQL Server, mySQL, Access
Operating System: WinNT, Win2000, Linux, Solaris Multimedia: Photoshop, Corel, 3D Studio Max, Director, Flash

2.3 DEVELOPMENT MODEL

2.3.1 DEVELOPMENTPROCESS

PSV’s approach to development blends traditional techniques such as data and process modeling (Rational Unified Process), which are required for rigor in applications development, with rapid, workshop-based prototyping and planning and progressive releases of production functionality. This results in robust applications that match user requirements and are delivered rapidly and on schedule. Rational Unified Process is briefly described in Appendix B.
Development and project management activities include kick-off meeting, weekly reports, monthly engagement meeting and reports, code reviews, etc… will always be strictly followed.

2.3.2 SOURCE CODE CONTROL

PSV uses Microsoft Visual Source Safe (VSS) (or CVS should Maxport requires) to manage the source code and all documents which are relevant to the project.

2.3.3 CHANGE REQUEST MANAGEMENT

PSV uses INTERSOLV PVCS Tracker to keep track of the change request of the software.

2.3.4 BACKUP & RECOVERY

All the documents and source code of the project are stored in the database of the Microsoft Visual Source Safe. PSV performs a periodic schedule to backup this database three times a week (could be more frequent per client’s requirements). Restoring the data from the backup data to the development environment is a simple task should there be a server crash.

PSV uses SQL server 7.0 to store data of PVCS Tracker. PSV backup this database three times a week.

2.3.5 QUALITYASSURANCE

In software development process, the entire QA team is involved from the beginning. The QA team must understand the customer requirement and system design and not just testing the functionality of the software application. A QA Plan and the Development Plan will be created for each project. A dedicate project Quality Control Team will be responsible for enforcing that process and procedures are always follow ed. This includes audits and reviews of milestones to gauge overall satisfaction. As for testing, all the typical testing categories such as unit test, user interface test, integration test, system test, beta test, regression test, performance test, and user acceptance test will be adhered to. Quality indicators such as defect and performance metrics are always visible to executive management.

3. PROJECT OVERVIEW

Maxport engages HanoiGarment40 Company as the garment manufacturer for its clients. In doing so it needs a software system to maintain an accurate information workflow for running the business processes. The activities and operations at Maxport/HanoiGarment40 are those lypical of a garment manufacturer business. The workflow nature of these operations necessitates the following basic functionality:

a. Data entry support: Covers the input of data from different sources

b. Order Entry and Fulfillment workflow: Covers all business processes for an order entry workflow, i.e. from the receipt of orders from customer through to generating tasks to relevant business units such as accounting (for financial matters) and production.

c. Procurement Fulfillment workflow: Covers all business lrocesses for a purchase order entry workflow, i.e. from the generation and receipt of proposals from vendors through to generating tasks to relevant business units such as accounting (for financial matters) and production.

d. Sales support management: This area provides assistance to sales support activities such as entry of sales data, re-orders, categorization, management reporting, checking data.

e. Customer Relations management: Supports customer relations activities such as reporting of sales order status, shipping inquiries, returns, complaints, etc…

f. Production planning and control: Assists in management of the interactions between Maxport and HanoiGarment40 in order to ensure efficiency in production.

g. Inventory control: Assists in management of the interactions between Maxport and HanoiGarment40 in order to ensure efficiency in procurement and usage of raw materials.

h. Billing data and collection workflow: Provides information to Accounting for billing, as well as keeping track of the payments so that the sabs team can follow up on debts.

i. Overall progress tracking support: Maintains a coherent view of the work progress, from order entry through to customer approval of products. This is to assist in controlling and managing works at all the business units by providing tracking data and early warnings.

j. Distribution management: Assists in the distribution of the products. This includes different distribution channels and mechanisms for different recipient groups. Shipment data are also collected for reporting purposes.

k. Reporting: A number of reports that are identified as essential to Maxport/HanoiGartment40 operations. They include control and management reports.

l. Business Interface: Provides electronic business transactions between clients/vendors via a standard protocol such as EDI/XML.

The current system at Maxport/HanoiGarment40 is a 40MB+ Access application running on a LAN. The current number of users is about 50 people. Due to the complex nature of the business, new functionalities are continuously added to he original design. Not all required or desired functionalities are in the current system. There is also a web inquiry module for clients to view sales order status and order tracking at www.hanoigarment4O.com. Additionally, the new system, MI-iBusiness, to be built or acquired by Maxport should have the following highly desirable features:

 Web based or at least a webenabling reporting function;

 Extensible to meet future requirements;

 Ease of maintenance and distributable to be used in various locations by the numerous stake-holders (clients, vendors, manufacturing factories, etc … );

 If economically and technically feasible, a preference is given for open source software;

 Meet the deadline of December 31, 2001 completion date.

With this understanding in mind, PSV is proposing a solution that will effectively address all current requirements, as well as allow for future growth and changes.

4. PROPOSED SOLUTION

4.1 TECHNOLOGY CONSIDERAION

From earlier discussions, Maxport has expressed a preference for an open source software solution. Suggestions were made for open source tools such as PHP, Zope, Python, mySQL and Apache. PHP is a server side scripting language that is powerful, flexible, and easy to use in web site development. Zope is an application server for web development that is catching attention from developers worldwide. From the Zope’s web site at http://www.zove.org the following statement was found:

“What Can Zope Do For You?
Zope can help you create dynamic web applications such as portal and intranet sites quickly. Zope comes with everything you need including support for membership, search, and news.
Its easy to use tools allow teams to productively and safely work together. Zope provides top-notch access to databases and other legacy data. Zope’s open support for web standards such as XMLRPC, DOM, and WebDAV allows you unparalleled flexibility and interoperability.”

A Zope/PHP combination, therefore, appears to be quite suitable for building a portal or intranet site.

MI-iBusiness system, as defmed, is an enterprise application system. To meet the time-to¬market and business requirements, development of such a system requires readily available toolkits or application libraries. With this in mind, PHP and Zope may not be a suitable technology choice for building the system. Looking closely at the features, these technologies are not yet matured in terms of support for different business needs besides portal development. These technologies, at this time, require substantial development effort for more tools and libraries (database concurrency, transaction integration, etc … ) in order to effectively and quickly develop an enterprise system.

There are two options for building MI-iBusiness:
1. A Microsoft solution based on Visual Basic, COM/DCOM, NITS, ASP, etc… The client interface can be a desktop application or web application.
2. A Java/J2EE solution based on open source software such as JBoss application server, Enhydra application server, JSP, etc…. Jboss and Enhydra are J2EE compliant application servers. For more information, please see:
JBoss: http://www.iboss.org
Enhydra: http://www.enhydra.org

The Microsoft solution is the quickest and easiest to implement given that Maxport’s current application is Access based. It may also have a better performance if the client interface is a desktop application. It is platform dependent and requires more efforts in deployment, installation and maintenance. Software licensing may also be an issue.

The Java/J2EE solution is open source and is royalty free or at a minimal cost. Like the Microsoft solution, J2EE has at its disposal an abundant availability of toolkits. It is more platform independent, extensible, scalable and will serve an enterprise’s business needs. The completed application is quite easy to deploy and maintain. If the client interface is through a browser, the client’s hardware requirement is minimal. Future business needs such as wireless access can also be readily supported.

Given the above analysis and the MI-iB usiness’ system requirements, PSV recommends that the new system leverages upon the business knowledge from the current Maxport’s Access application and builds upon it a Java/J2EE open source solution.

4.2 SYSTEM ARCHITECTURE

PSV proposes component-based, 3-tier application architecture. This architecture is chosen for the following reasons:
 It reflects truly he nature of the system that Maxport needs. Such a system is characterized by:
• A sophisticated database design that is capable of storing data from multiple physical sources, yet able to maintain their complex relationships, to provide a complete and unified view of the logical data to support workflow activities;
• Complex business rules associated with the workflows, where transactional integrity must be ensured and inter-department collaboration must be convenient;
• A flexible user interface (desktop or Internet)

The separation into layers (or tiers) within the architecture ensures that complexity is manageable, and inevitable changes of requirements (due to business growth or changing needs) will not severely impact the integrity of the system.

 It allows for system expansion, that is, additional functions can be easily integrated onto a common system platform without jeopardizing existing functions.
 It allows for scalability, that is, large number of users can be readily added simply by adding hardware to the system without major rework to the system software. This is particularly important if Maxport plans for increased number of internal users (as a result of more even distribution of work), or providing on-line services through the Internet.
 It allows for reusability, where developers can take advantage of existing components to implement new features. This helps minimize the development time and maximize business responsiveness to changing market conditions.
 It aligns well with proven methodologies in software development. PSV adopts Rational Unified Process (RUP) in developing software to ensure highest possible quality. RUP is characterized by an iterative approach, where a large, complex business problem is broken down into manageable chunks for which the development process will address in iterations based on a solid architecture. This approach will ensure that the system reflects the true reality, as well as making return on investment more immediate and visible.

The architecture is composed of 3 layers: data access, business logic, and presentation. See Figure 1 for a high-level view of the layers.

The data access layer is comprised of components responsible for the manipulation of the physical data, and presenting a user-friendly logical view of the data to the business logic layer. This layer will insulate the business logic components from specific database attributes and complexity, making maintenance of the business logic largely independent of the underlying physical data.
The business logic layer encapsulates all business requirements and rules. Depending on the complexity of the rules and their relationships, this layer may be comprised of several packages of components, each implementing a functional area of the system. A number of
core functions (security, organization, control data, etc) are grouped together and made available to all other specialized functions within the layer. Additional functions and features can readily be added to this layer without compromising system integrity. All data access activities are directed to the Data Access layer using logical representation of the data. This layer will present an interface comprised of various business services to the presentation layer.
The presentation layer is responsible for capturing requests and data from the user, formatting and validating them to a certain extent and calling appropriate services from the business layer to process the requests. The outcome from the execution of these services are returned and presented in a suitable format to the user.

4.3 SYSTEM TOPOLOGY

The proposed system will operate on the existing NT/Linux network at Maxport. This makes the re-use of the investment on existing systems possible. Maxport at the moment has some Linux servers, a number of client PCs, and suitable network infrastructure (LAN, hub, routers).

The required components for the new system excluding the Web Reporting Functionality include (see Figure 2)

Application/Web Server: This server houses all components making up the application. If a separate Primary Domain Controller is present, this server can act as a Backup Domain Controller. Otherwise, it can act as the Primary Domain Controller as well. All business
and system services are available from this server. This server is configured for maximum throughput.

Data Server: This server houses all the databases within the system. Data access requests will be directed from the Application Server to the Data Server. The data access tasks performed at this server also participates in transactions in the Application Server to ensure transaction integrity. This server is configured for maximum data safety. An off-line storage device (e.g. DAT tape) is required at this server for data backup. A RAID-3 configuration of hard disks is recommended.

File Server: This server serves as a data center for all data outside the system. This includes artworks, documents, and so on. It may also house archived transaction logs from the Data Server to allow for up-to-the-minute database recovery.

Future business requirements may necessitate the following changes:
• Increased number of internal users: Additional application servers; addition of load balancing middleware; distributed data.
• Remote connections: Additional server to manage connections and security.
• High availability: Addition of standby servers in a cluster configuration; addition of RAID disks.

The reasons for the new system not be placed on the Internet at this time are:
• Maxport/Hanoi Gartment40 will need a dedicate leased line to the Internet
• Current Internet bandwidth capacity in Vietnam is still limited and is not helped by current firewall restrictions.

As for the Web Reporting functionality, the system can operate on the Internet as current.

4.4 SYSTEM REQUIREMENTS

4.4.1 SYSTEM SOFTWARE REQUIREMENTS
 Server software: Linux Redhat 7.1, Apache 1.3.2, mySQL 3.23, Jboss 3.0, J2EE, JSP, Servlets
 Client software: any web browser such as EE, Netscape
 Development tools: Windows NT/2000, Linux Redhat 7.1, Jboss 3.0, Sun JDK 1.3, J2EE

4.4.2 HARDWARE REQUIREMENTS

 Application Server: Pentium II 500Mhz or above, with 512 MB RAM or more. Dual processor server is preferred. Minimum 5 Gb hard disk, CD-ROM drive.
 Database Server: Pentium II 500MHz or above, with 512 Mb RAM or more. Minimum IOGb hard disk for basic operations. Recommended 20 Gb hard disk for extended operations (on-line backup, print spool, etc). Tape drive, CD-ROM drive.
 Workstation: Pentium Pro or above, 1-2 GB hard disk, 64 Mb RAM or more.

Notes: The system should be able to operate on hardware with slightly lower specifications, at the expense of system performance.

5. APPLICATION DESCRIPTION

5.1 FUNCTIONAL DESCRIPTDN

5.1.1 DESIGN CONSIDERATIONS

The design of the system takes into account the following considerations:
 Workflow support: The business processes at Maxport make up relatively complex workflows with numerous rules, many of which are a result of the constraints imposed by the current system. Considerable efforts must be spent to capture the existing workflows and possibly give recommendations to streamline them;
 Web based application: Although this architecture greatly simplifies issues such as software installation/updates, hardware requirements, etc… the current limitations on Internet bandwidth and firewall systems by VDC (Vietnam Data Corporation) could adversely affect users accessing the system from within or outside of Vietnam. Therefore, at this time, the application will be placed on the LAN.
 Web reporting support: The web reporting system must ensure that it receives timely and accurate data propagation from the main application database.
 Legacy data conversion: The new system must ensure that it is possible for data from the current Access database system be converted and transferred to its database. All activities in the new system will be based on these converted data as well as the newly added one.

5.1.2 SYSTEM FUNCTIONS

All infrastructure and system components that make up the architecture, including:
 Layer abstraction mechanism: context cookie (to provide context such as user credentials, session information) to all components), type libraries, data access protocols.
 Exception handling and messaging: Exceptions (errors, warnings, information) are trapped, handled according to business rules, and propagated through the layers to the appropriate parties to take action (e.g. user, system administrators)
 Event logging: Where appropriate, exceptional conditions will be logged to a log for later examination. This will assist the development process and production support.

5.1.3 APPLICATION FUNCTIONS

The required functional areas are grouped in the following categories:

5.1.3.1 Order Processing

5.1.3.1.1 Sales Order Processing
a. Quotation preparation/Sample order
b. Proforma invoice/Sales confirmation
c. Invoicing/Packing lists
d. Reporting (see Reports Section for more details)

5.1.3.1.2 Purchase Order Processing
a. Quotation preparation
b. Quotation received and analysis
c. Purchase order
d. Supplier delivery note
e. Reporting (see Reports Section for more details)

5.1.3.2 Production Processing

5.1.3.2.1 Production Planning
a. Size and color (styles)
b. BOM
c. Reporting (see Reports Section for more details)

5.1.3.2.2 Inventory Control
a. Stock information (full, by product, finishedgoods, etc…)
b. Supplier delivery note/Good receive note
c. Delivery note to customer (this should be automatic upon printing of packing list and generation of invoice)
d. Reporting (see Reports Section for more details)

5.1.3.2.3 Production Control
a. Master production schedule
b. Production schedule for a specific product
c. Resource/Capacity analysis
d. Kit order
e. Job/work order
f. Material requisition planning and analysis/CRP sheet
g. Shop floor control (status only)
h. Consumption sheet (percentage of waste materials)
i. Reporting (see Reports Section for more details)

5.1.3.3 Administrative Maintenance

a. Product information/technical details
b. Customer information
c. Supplier information
d. Employee information
e. Bank information
f. Reporting (see Reports Section for more details)

5.1.3.4 Interfaces

a. Web Reporting system (data needed to be updated from the corporate mySQL database in LAN to the reporting database hosted on the Internet)
b. Bar code system (bar code generation for products)
c. EDI/XML (to be researched and decided further on either EDI or XML)

5.1.3.5 Accounting

a. General ledger (balance sheet, profit & loss, income statement, budget & actual, cash flow statement, general journal, trial balance)
b. Journal transaction ledger
c. Account receivable ledger
d. Account payable ledger
e. Account receipts
f. Account payments
g. System admin
h. Reporting (see Reports Section for more details)

5.1.3.6 Web/Online Query System

a. Order processing status (RFQ, sales)
b. History of quotations
c. Orders/Sales confirmation status
d. Shipment status and schedules
e. Invoices/Debit notes sent to customers
f. Customer statement g Inventory status

5.1.4 DATA CONVERSION

Due to its importance, data conversion will be seen as a separate project running in parallel with the development project The separation reflects the different nature of the task in terms of logistics, user involvement, and soon. Data conversion and development projects are tightly synchronized, however, and the former benefits directly from the analysis and design outcome of the latter.
The data conversion tasks will include:
 Analyzing the data structure of the current system
 Providing feedback to the design of the mainstream system
 Define data mappings between the old and the new systems.
 Develop code to perform conversion
 Test and run the code
 Fix any problems that arise from the conversion of data.

5.2 DATA DESIGN

Data is recognized as the most important factor in this system. Utmost attention will be paid to the design of a data model that reflects the true needs of Maxport. The data model
will be based on the current Access database that Maxport has created. The new data model will possess the following characteristics:

 Capable of capturing and representing data from multiple sources
 Maintaining the complex relationships between entities, and/or between different manifestations of an entity.
 Providing a complete and unified view of customers
 Maintaining consistency throughout the whole system
 Able to support all the current workflow activities
 Able to receive data from legacy systems
 Allowing for exporting to popular formats such as Excel
 Allowing for single point of entry, multiple uses - to avoid data duplications and double efforts

5.3 DATABASE REQUIREMENS

The database, besides implementing the data model above, also possesses the following characteristics:
 Centralized
 Secured
 Audit logged
 Recoverable, provided a suitable backup policy is in place mySQL Server is identified as the RDBMS product used in this system.

5.4 REPORTS

The following tentative list of reports will be developed. The exact reports for inclusion in the application are subject to further discussions with Maxport before deNelopment work is started.

5.4.1 SALES ORDER PROCESSING

 Quotation/Sample order confirmation
 Sales confirmation
 Job Order/Production Order • MRP/CRP
 Invoice
 Packing lists
 Sales Order status

5.4.2 PURCHASEORDER PROCESSING

 Purchase Order (Product or Material)
 Request for Quotation
 Supplier Delivery Note
 Supplier Quotation
 Supplier Statistics
 Weekly Report

5.4.3 PRODUCTION PLANNING

 BOM
 BOM Component listing
 Substitution listing
 Estimated consumption report (Component listing with cost)
 Estimated costing sheets (Cost comparison report)
 Consumption report - Detailed (Raw material specification)
 Consumption report - Summary (Raw material consumption)
 Pre-production plan
 Size & Color (Style)
 Color card Fabric summary
 Accessories summary
 Size measurement
 Thread color information
 Zip chart
 Product item breakdown into Size & Color combinations
 Product item breakdown into a sub-table of measurement in Proforma Invoice
 Lab Dip (Color Swatch)

5.4.4 INVENTORYCONTROL
 Stock list
 Daily transaction
 Re-order advice
 Inventory status
 Finished goods
 Slow moving products
 Product cross-references
 Material issue note
 Material returned

5.4.5 PRODUCTION CONTROL
 Master schedule
 Production schedule
 Resource/Capacity analysis
 Kit order
 JobiWork order
 MatRP sheet/CRP sheet
 Shop floor control
 Consumption sheet
 Technical details for a product

5.4.6 ADMINISTRATIVEMAINTENANCE
 Product information/technical details
 Customer information
 Supplier information
 Employee information

5.4.7 ACCOUNTING
 General ledger (balance sheet, profit & loss, income statement, budget & actual, cash flow statement, general journal, trial balance)
 Journal transaction ledger
 Account receivable ledger
 Account payable ledger
 Account receipts
 Account payments

5.5 GENERAL DESCRIPTIONS

5.5.1 PROGRAMMING LANGUAGES

HTML/DHTML/CSS/JavaScript is used to develop the client-side user interface. Jboss, ME, JSP, Java, servlets is used to develop the server-side components.

Database operations may be encapsulated in mySQL Server stored procedures to increase efficiency.

5.5.2 APPLICATION INSTALLATION

PSV shall provide detailed instructions on how to install and setup the MI-iBusiness system in addition to any necessary automated tools or scripts.

5.5.3 SECURITY

 The system shall provide a login and password mechanism to provide security. The Administrator can manage user profiles and privilege through specialized screens
 Each department can only update or view relevant data.

5.5.4 EXTERNALINTERFACES

 The system shall be able to generate bar codes for the products
 The system shall be, able to communicate with other business systems via EDI or XML.

5.5.5 UTILITIES

 The system shall provide backup and restore functionality.
 The application shall provide a function to archive old data.
 Information affecting system behaviors such as VAT will be user-configurable wherever possible
 The user shall be able to change his password.

5.5.6 SYSTEM FEATURES

 Industry-standard components
 Quality~controlled development process
 Proven design and development methodology (Rational Unified Process)
 Quality level of support

5.5.7 DOCUMENTATION

The following documents will be provided to Maxport as part of the product package.
 System requirement and analysis documents
 Design documents
 User Guide
 Installation instructions

5.5.8 OWNERSHIP

Maxport has complete ownership over the final product including source code; except for the common library code developed by PSV and other non-open source software vendors (e.g. Microsoft), if any, either in source code or executable formats.

5.6 AFTER-SALE SERVICES

5.6.1 TRAINING

PSV will provide a user manual to help guide new users who might be added on later.
PSV will provide a 7-day training course free of charge upon delivery of the system. Maxport may request further training for a set fee (see section 6.3.2).

5.6.2 SOFTWARE MAINTENANCE

The MI-iBusiness system will be warranted and maintained free-of-charge for three months by PSV. After that, maintenance service can be provided based on a pre-agreed fee structure.

6. SCHEDULE AND COST

6.1 DEVELOPMENT APPROACH

The system will be developed in iterations, based on Rational Unified Process methodology that PSV adopts. This approach ensures that requirements are well understood and results are visible early along the development process, thus risks are controlled and minimized.

The system will have 2 iterations. Each iteration goes through the same development life cycle to ensure the workloads are distributed evenly, and problems are identified early along the way.

Extensive involvement from Maxport personnel is expected throughout the development process. It is the commitment not only on PSV side to deliver the system, but also on Maxport side to ensure that the system meets its needs. The user involvement will be in terms of
 collating information and documents,
 coordinating the necessary resources on Maxport side for certain tasks
 being a single point of contact for the development team,
 providing business knowledge to the project,
 assisting in testing the system WHILE it is being developed.
Such involvement is vital to the success of the project, and Maxport must commit suitable resources and full support to make it possible.

The involvement from Maxport can be taken to a further step by committing developers to the project team. This will help minimize communication overhead by cutting down on the transfer of business knowledge from Maxport to PSV, and of technical knowledge in the opposite direction. The project will be better perceived as a joint effort due to the cooperation at this level.

Quality assurance is of utmost concern to PSV in its goal of achieving 100% customer satisfaction. As a result, PSV employs proven methodology and tools in its development process, and sees quality assurance as an inseparable part of system development.

6.2 SCHEDULE

The project is estimated to take 6.5 months to complete. It is tentatively scheduled to start on June 15th, 2001 and complete end on December 31St, 2001. This project has 2 overlapping iterations. A set of milestones for this phase is shown below:
 June 15, 2001: Contract signed - Invoice 20% of cost iteration 1 - begins June 15, 2000
 June 30, 2001: Requirements document sign-off
 July 15, 2001: Design documents sign off
 November 15, 2001: User acceptance test
 November 30, 2001: Iteration 1 sign-off- Invoice 40% of cost Iteration 2 - begins September 15, 2001
 September 30, 2001: . Requirements document sign-off
 October 15, 2001: Design documents sign-off
 December 15, 2001: User acceptance test
 December 31, 2001: Iteration 2 sign-off and delivery - Invoice 40% of cost
6.3 COSTS

6.3.1 DEVELOPMENTCOST

Resource requirement:

Role Number Utilization
Developer 7 100%
QA/Test 2 50%
Graphic Designer 1 50%
Project Manager 1 5001.
Maxport consultant & trainee 1 100%

Total Resources for costing purpose: 9 Rate per man month: USD 2,000.00 Total cost before discount: 18,000 per month * 6 months = USD 108,000.00
Total Cost for project after 25% discount: USD $81,000.00

Note: the Maxport consultant is not counted into our cost consideration. The 2 weeks requirements gathering period is also complimentary. After discount, our rate per man month is USD $1,500.00 and is extremely competitive worldwide.

6.3.2 TRAINING COST

Beyond the 7-day training course provided free-of-charge, PSV will charge USD 300 exclusive of travel/accommodation cost per day for any additional training requested by Maxport.

6.3.3 MATERIALCOST

PSV does not sell hardware and system software. However, we are glad to assist Maxport in the acquisition of any necessary hardware and software should the needs arise. Maxport will be responsible for any material costs that may arise.

6.3.4 VARIATIONSAND LIMITATIONS

PSV allows for approximately 10% of requirement changes from the sign-off of the requirements document. Beyond this limit PSV will inform Maxport of the cost for considerations. Abnormally large deviations from the signecloff requirements are not expected thanks to the iterative approach.
All changes (with or without charges) must go through PSV change management system.

7. APPENDIX A - PROJECT REFERENCES

Important notice- Confidential information:
The following is Paragon confidential information. It is disclosed for use by Maxport for the purposes of referexne and verification only. Use for purposes other than those stated must have written authorization from Paragon Solutions, Inc.

7.1 LABORERS PENSION & VELFARE FUND- USA

Project Name LPWF
Name and address of client Laborers Pension & Welfare Fund
11465 Cermak Road, Westchester, Il 60154
708/562-0200 ext 277
Client contact person Kristina M. Guasteferri, CPA, Operation Director
Period of contract 07/98 - 10/00
Description of services
provided Project management, design and system development
of a client/server-based accounting system for fund
management and pension distribution. Paragon
converted the entire IT infrastructure from an
antiquated VAX/VMS system to a 3-tier client/server
architecture. The project introduced modern user
interface design, customizable business rules and
workflow support.
Contract amount Confidential
Status and comments Completed

7.2 SITESHELL- USA

Project Name SiteShell
Name and address of client 2 Trap Falls Road, Shelton, CT 06484, USA
203/929-9101
203/929-9442
Client contact person Peter S. Schay, Vice President & CTO
Period of contract 1/10/00-05/31/00
Description of services
provided SiteShell Corporation creates, on a turnkey basis, an
array of dynamic e-Commerce, integrated Web site
formats for license to radio stations. SiteShell
contracted Paragon Solutions in October 1999 and
asked for a proposal to build a web application.
Paragon created a proof-off-concept prototype and a
requirements document for the design of the actual
application resulting in the development of a generic
portal for the company.
SiteShell now provides an encoder to radio stations to
capture the broadcast and forward to the portal site via
a 56k-communication link. The web site will then put
the signal on streaming server in order to broadcast to
listeners on the Internet. In addition to the basic
“listening” service, SiteShell also provides many other
services such as weather, free -email, news, various
search engines, classifieds, and more.
Contract amount Confidential
Status and comments Completed

7.3 NOVIENT, INC.- USA

Project Name Novient
Name and address of client Novient, Inc.
3525 Piedmont Road, Eight Piedmont Ctr. Ste. 500,
Atlanta, GA 30305
404/720-3600
404/720-3681
Client contact person Halsey Wise, CEO
Period of contract 10/06/00 - 12/31/03
Description of services
provided Novient is a global provider on Internet infrastructure
solutions for the services industry. Novient selected
Paragon to extend their development organization and
broaden the scope of the it Internet-based software
solution. Paragon will provide Novient with a
complete development team, comprised of onshore
and offshore resources, which will support Novient’s
software development projects.
Paragon’s resources will be integrated into Novient’s
plan to enhance current functionality and build new
modules for future releases of their Internet-based
software solutions. Paragon will work as an extension
of Novient’s development organization, collaborating
on the creation of requirements for strategic product
enhancements and the development and testing of the
code using offshore resources.
Contract amount
Status and comments Confidential
In Progress

7.4 IMEDEONr INC. USA

Project Name iMedeon
Name and address of client iMedeon, Inc.
11605 Haynes Bridge Road, Suite 600, Alpharetta,
GA 30004
770/777-8100
770-777/8111
Client contact person Jason Oliver, CTO
Period of contract 7/05/00-12/31/03
Description of services
provided iMedeon develops, markets, implements and support
iM: Work, a web-based workforce management
solution for businesses with large, remote and mobile
workforces. Their products, which are based on
leading web and wireless technologies, are used by a
wide variety of companies with substantial mobile
workforces in industries such as telecommunications,
utilities, and technology field service.
Paragon Solutions is in the early phase of engagement
with iMedeon writing their business requirements for
JEA and.GIS (a global positioning system model).
The long-term goal is for Paragon to provide end-to¬
end support for four (4) modules which are: The
Asset Tracking Module; The Provisioning Module;
The Exchange Module; The Event Module.
Contract amount Confidential
Status and comments In Progress

7.5 DATALEX- IRELAND

Project Name Airline Reservation Product Enhancement
Name and address of client Datalex
Howth House, Harbor Road, Howth Co Dublin,
Ireland
353/1-839-1787
Client contact person John McQuillan, Senior VP of Engineering
Period of contract 01/00 - 01/01
Description of services
provided Datalex is a leading provider of Information
Technology solutions to the airline and travel industry.
The company maintains offices in Amsterdam, the
Netherlands; Atlanta, Georgia, USA; Columbia South
Carolina, USA; Dublin, Ireland; Johannesburg, South
Africa; Manchester, England; Melbourne, Australia;
and Portland, Oregon, USA. Datalex unique blend of
industry specialization and IT experience allows it to
identify closely with the business needs of its clients.
Datalex’s focus is on devising solutions for e¬
commerce, Enterprise Application Integration, and
Customer Relationship Management. Its capabilities
include the development of Internet booking engines
and Web Technology solutions. Company
specializations extend from mainframe to desktop.
These include a comprehensive suite of products,
workstation software, communications gateways,
Internet products, middleware, mainframe
development and Professional Services.
Datalex contracted Paragon Solutions to work on
enhancing their airline reservation product using
advanced Java technologies. Paragon is also
developing tools that will help Datalex in the final
deployment of the product in the end user facility.
The software tools that Paragon has developed utilize
XML technology to facilitate easy transfer of data
between the airline data centers and web server
running the Datalex airline reservation product.
Contract amount Confidential
Status and comments In Progress

7.6 JUSTICELINK- USA

Project Name LAWPlus
Name and address of client
Client contact person JusticeLink
11482 Luna Road Ste. 100, Dallas, TX 75234
Scott Millis
Period of contract 2/98-4/99
Description of services
provided JusticeLink is an innovative technology-enabled
services company for courts, attorneys, their clients
and other interested parties in the legal community.
With its comprehensive, reliable and secure solution
for the electronic filing, service, retrieval and storage
of court documents and information (e-file),
JusticeLink helps reduce costs, boost productivity,
increase the speed and improve the overall
effectiveness of the court system and litigation
process.
Paragon Solutions planned and implemented the
strategic Internet-based information system for
JusticeLink. It is the most complete electronic filing
service available today.
Contract amount Confidential
Status and comments I Completed

7.7 CUSTOMERS IN VIETNAM

Paragon Solutions have performed services for a number of customers in Vietnam, including:
 Bayer Vietnam
 Nghe An Tate & Lyle Sugar (in partnership with Arthur Andersen, Vietnam) • Swire Pacific Cold Storage
 International School
The values for the above contracts are less than US $100,000 each.

7.7.1 SAYERVIETNAM (VIETNAM)

Development of a sales force and distribution management system for the local Vietnam business unit.

Proiect: Field Force Management Database System (FFMDS)

Customer: Bayer Vietnam
Location of Implementation: Ho Chi Minh City, Vietnam Architecture: Client/Server
ProgrammingLanguage: Visual Basic
Database: Microsoft Access.
General Features: FFMDS is a client/server application developed for Bayer Vietnam to manage customer contacts, marketing activities, sales force effectiveness. The database keep track of the authorized distributors of Bayer products and the product lines. Tools are available to evaluate product performance by region and results of promotional activities.

7.7.2 NGH E AN TATE & LYLE SUGAR (VIETNAM)

Development of contract management and payment control application for sugar production in Vietnam. The system manages information about growers and their delivery contracts with the company, records deliveries and creates payment vouchers for growers.

Proiect: CANE RECEIVABLES

Customer: NAT&L
Location of Implementation: Nghe An, Vietnam Architecture: Component based ProgmmmingLanguage: Visual Basic Database: Microsoft SQL Server 6.5
General Features: NAT&L (www.tate-lyle.co.uk) is a joint-venture company for producing sugar from cane in Nghe An. The application manages information about growers and their delivery contracts with the company. Once the crushing season starts, the application is used to records deliveries and creates payment vouchers for growers.

7.7.3 SWIRE PACIFIC COLD STORAGE (VIETNAM)

Development of an inventory and distribution management system for cold storage warehouses in Ho Chi Minh City, Vietnam.

Proiect: Warehouse Management System (WMS)
Customer: Swire Pacific Cold Storage
Location of Implementation: Ho Chi Minh City, Vietnam Architecture: Client/Server
ProgrammingLanguage: Visual Basic Database. Microsoft Access
General Feature: WMS is an application developed for Swire Pacific Cold Storage to manage warehouse distribution operations. WMS keep track of products coming in and out of the warehouse. Customer billings and inventory control activities are also maintained. WMS also keeps track of the location of the products in the warehouse and prints out “picking slips” to assist forklift drivers in retrieving ordered products.

7.7.4 INTERNATIONALSCHOOL (VIETNAM)

Development of an application to mana ge student enrollment information and interface with the school’s accounting system.

Proiect: Student Information Management System (SIMS)
Customer: International School
Location of Implementation: Ho Chi Minh City, Vietnam Architecture: Client/Server
ProgrammingLanguage: Visual Basic Database: Microsoft SQL Server 7.0
General Features: SIMS is a client/server application developed for the client to manage student enrollment information. In addition, it performs automatic scheduled invoice calculations and transfers data to Exact Software’s accounting system.

8. APPENDIX B - RATIONAL UNIFIED PROCESS

Paragon Solutions’ projects are executed closely along the guidance of Rational Unified Process. This process features iterative software development through four phases:
 Inception
 Elaboration
 Construction
 Transition

8.1 PHASES AND ITERATION

In each phase, key workflows and activities are carried out. Following is a brief overview of Phases and Iterations in Rational Unified Process:
Phase Goals/Activities Iterations Iterations
Inception The overriding goal of the inception phase is to achieve concurrence
among all stakeholders on the lifecycle objectives for the project. The
primary objectives of the inception phase include
 Establishing the project’s software scope and boundary
conditions, including an operational concept, acceptance criteria
and what is intended to be in the product and what is not.
 Discriminating the critical use cases of the system, the primary
scenarios of operation that will drive the major design trade-offs.
 Exhibiting, and maybe demonstrating, at least one candidate
architecture against some of the primary scenarios
 Estimating the overall cost and schedule for the entire project
(and more detailed estimates for the elaboration phase that will
immediately follow)
 Estimating potential risks (the sources of unpredictability)

Define the business context Inception phase usually takes place
in only one iteration. When new
technology or business concepts are
involved, multiple iterations might
be required.
Define the vision and scope of the
stem.
Outline and clarify the
functionality that is to be provided
by the system.
Consider the feasibility of the
project, and outline the project
plan.
Refine the project plan.
Elaboration The purpose of the elaboration phase is to analyze the problem aomain,
establish a sound architectural foundation, develop the project plan, and
eliminate the highest risk elements of the project. To accomplish these
objectives, you must have the “mile wide and inch deep” view of the
system. Architectural decisions have to be made with an understanding of
the whole system: its scope, major functionality and nonfunctional
requirements, such as performance requirements. It is easy to argue that
the elaboration phase is the most critical of the four phases. At the end of
this phase, the hard “engineering” is considered complete and the project
undergoes its most important day of reckoning, the decision on whether
or not to commit to the production phases. For most projects, this also
corresponds to the transition from a mobile, low-risk operation to a high
cost, high risk operation with substantial inertia.While the process must
always accommodate changes, the elaboration phase activities must
ensure that the achitecture, requirements and plans are stable enough,
and the risks sufficiently mitigated to be able to predictably determine the
cost and schedule for the completion of the development. Conceptually,
this level of fidelity would correspond to that necessary for an
organization to commit to a fixed price construction phase.
Decide what will drive the
development of the architecture.
Elaboration phase consists of one or
more iteration. Each iteration
begins with a planning step, and
ends with an assessment step.

Understand the drivers in detail, if
necessary; inspect result.
Use-Case Analysis: find obvious
classes, do an initial (high level)
subsystem partitioning and start
looking at the drivers in detail.
Design: adjust to the
.
implementation environment,
decide how the drivers are to be
designed, and refine the definition
of classes, packages and
subsystems; inspect results.
Consider the concurrency and
distribution aspect of the
architecture.
Inspect the architecture.
Implementation: implement the
classes and integrate.
Inte Irate the im demented arts.
Test: assess the executable
architecture.
Contruction During the construction phase, all remaining components and application
features are developed and integrated into the prodirt, and all features
are thoroughly tested. The construction phase is in some sense a
manufacturing process, where emphasis is placed on managing resources
and controlling operations to optimize costs, schedules, and quality. In
this sense the management mindset undergoes a transition from the
development of intellectual property during inception and elaboration, to
the development of deployable products during construction and
transition.
Many projects are large enough that parallel construction increments can
be spawned. These parallel activities can accelerate the availability of
deployable releases significantly; they can also increase the complexity
of resource management and workflow synchronization. A robust
architecture and an understandable plan are highly correlated. In other
words, one of the critical qualities of the architecture is its ease of
construction. This is one reason why the balanced development of the
architecture and the plan is stressed during the elaboration phase.
Plan system level integration. Construction phase consists of one
or more iterations. Again, each
iteration begins with planning and
ends with assessment.
Plan and design system-level test
Refine Use-Case Realization.
Plan and design integration tests at
the subsystem and system level.
Develop code and test unit.
Plan and implement unit tests.
Test unit within subsystems.
Integrate subsystems.
Release subsystems.
Test integration
Test Svstem.
Transition The purpose of the transition phase is to transition the software product
into the user community. Once the product has been given to the end
user, issues usually arise that require you to develop new releases, correct
some problems, or finish some of the features that may have been
postponed
The transition phase is entered when a baseline is mature enough to be
deployed in the end-user domain. This typically requires that some usable
subset of the system has been completed with acceptable quality level
and user documentation so that transition to the user will provide positive
results for all parties. This includes: 1) “beta testing” to validate the new
system against user expectations, 2) beta testing and parallel operation
relative to a legacy system that it is replacing, 3) conversion of
operational databases, 4) training of users and maintainers, 5) roll-out to
the marketing, distribution and sales forces. The transition phase
concludes when the deployment baseline has achieved the completed
vision. For some projects this lifecycle end point may coincide with the
lifecycle starting point of the next cycle, leading to the next generation or
version of the product. For other projects it may coincide with a complete
delivery of the artifacts to a third party responsible for operations,
maintenance and enhancements of the delivered system.
The transition focuses on the activities required to place the software into
the hands of the users. Typically this phase includes several iterations,
including beta releases, general availability releases, and bug-fix and
enhancement releases. Considerable effort is expended in developing
user-oriented documentation, training users, supporting users in their
initial product use, and reacting to user feedback. At this point in the
lifecycle, however, user feedback should be confined mostly to product
tuning, configuring, installing and usability issues.
Deployment-specific engineering:
cutover, commercial packaging
and production, sales roll-out, field
personnel training.
Tuning activities: bug fixing,
enhancement for performance and
usability.
Assessment of the deployment
baselines against the complete
vision and the acceptance criteria
for the product.

8.2 WORKFLOWS & DELIVERABLES

8.2.1 INCEPTIONACTIVITIES

The following activities take place primarily in the Inception phase. Review and additions are optionally made in subsequent phases:
 Business Modeling
 Requirements
 Analysis and Design

8.2.1.1 Business Modeling

This activity is a collection of detailed workflows aiming to produce the following documents (also ieferred to as “Artifacts”):
 Business Use Case Model
 Supplementary Business Specification
 Business Model
 Business Use Case
 Business Use Case Realization
 Business Entity
 Business Worker
 Organization Unit

8.2.1.2 Requirements

The artifacts delivered from this activity are:
 Stakeholder Requests
 Vision
 Use-Case Model
 Glossary
 Supplementary Specification
 Requirement Attributes
 Use Case
 Use Case Package
 Actor (human)
 User Interface Prototype
 User Case Storyboard
 Boundary Class
 Software Architecture Document

8.2.2 ELABORATIONACTIVITIES

The primary activity of this phase is Analysis and Design.

8.2.2.1 Analysis and Design
The following artifacts are to be delivered:
 Analysis Model
 Design Model
 Interface/Signal/Event
 Protocol
 Refined Software Architecture Document
 State Machine
 Design Package
 Use Case Realization
 Design Class
 Analysis Class
 Design Subsystem
 Capsule
 Data Model

8.2.3 CONSTRUCTIONACTIVITIES

In this phase the system is realized and tested in two set of activities:
 Implementation
 Test

8.2.3.1 Implementation

This activity delivers the system at its lowest level: component and the integration between components.
The deliverables are:
 Implementation model
 Integration plan
 Component
 Implementation subsystem

8.2.3.2 Test
The following artifacts are delivered:
 Test plan
 Workload model
 Test cases
 Test procedures
 Test model
 Test scripts
 Test procedure
 Test packages and classes
 Test subsystems and test components

8.2.4 TRANSITIONACTIVITIES

Transition transfers the system to the customer environment. Deployment is the only activity.

8.2.4.1 Deployment
This phase delivers the following:
 Deployment plans
 Release notes
 End-User support manual
 Installation artifacts
 Training material

8.3 CONFIGURATION &CHASE MANAGEMENT

A CM System is essential for controlling the numerous artifacts produced by the many people who work on a common project. Control helps avoid costly confusion, and ensures that resultant artifacts are not in conflict due to some of the following kinds of problems:
 Simultaneous Update

When two or more workers work separately on the same artifact, the last one to make changes destroys the work of the former. The basic problem is that if a system does not support simultaneous update this leads to serial changes and slows down the development process. However, with simultaneous update, the challenge is to detect flat updates have occurred simultaneously and to resolve any integration issues when these changes are incorporated

 Limited Notification

When a problem is fixed in artifacts shared by several developers, and some of them are not notified of the change.

 Multiple Versions

Most large programs are developed in evolutionary releases. One release could be in customer use, while another is in test, and the third is still in development. If problems are found in any one of the versions, fixes need to be propagated between them. Confusion can arise leading to costly fixes and rework unless changes are carefully controlled and monitored.

A CM System is useful for managing multiple variants of evolving software systems, tracking which versions are used in given software builds, performing builds of individual programs or entire releases according to user-defined version specifications, and enforcing site-specific development policies.
Some of the direct benefits provided by a CM System are that it:
 supports development methods,
 maintains product integrity,
 ensures completeness and correctness of the configured product,
 provides a stable environment within which to develop the product,
 restricts changes to artifacts based on project policies, and
 provides an audit trail on why, when and by whom any artifact was changed.

In addition, a CM System stores detailed `accounting’ data on the development process itself. who created a particular version (and when, and why), what versions of sources went into a particular build, and other relevant information.

TOEFL Practice Tests Vol 1

Filed under: hoc tap

http://englishtips.dl1.vipserver.ru/TpTvol1.rar
http://rapidshare.de/files/11594403/…ck_01.mp3.html
http://rapidshare.de/files/11598803/…ck_02.mp3.html

February 22, 2006

Protected: Cau truc thu muc du an

This post is password protected. To view it please enter your password below:

Danh sach cac ket qua khi trien khai du an

Khi trien khai du an se co 2 phan loai ket qua:

1. Ket qua ban giao den khach hang
2. Ket qua tao ra trong nhom, muc dich de de dang lien lac voi thanh vien va quan tri trong nhom hieu qua hon

Danh sach ket qua ban giao den khach hang gom:

1. Software Architecture Document-x.x.DOC ==>mo ta kien truc va thiet ke chi tiet cho cac chuc nang cua he thong
2. Software Deployment Document-x.x.DOC ==>mo ta huong dan chi tiet cach trien khai he thong tai moi truong khach hang cuoi cung
3. Software Database Specification Document-x.x.DOC ==>mo ta dac ta chi tiet thiet ke cac table trong database
4. Software Database Schema Document-x.x.DOC ==>mo ta so quan he giua cac tables trong dataabses
5. Software Database Script for ORACLE, Postgred (*.SQL;*.XML) ==>SQL script de: tao database, khoi tao du lieu ban dau cho database, xoa database, nang cap version he thong.
6. Source code
7. PHP document, Java Document ==>phien ban tieng nhat
8. Release notes ==>Mo ta nhung thay doi khi nang cap cac phien ban he thong, tao ra khi du an duoc trien khai thanh nhieu giai doan
9. Meeting report voi khach hang

Chu y: Trong thuc te, nhung ket qua du an phai ban giao, PM can phai xac dinh ro rang voi khach hang.

Danh sach ket qua tao ra trong nhom:

1. Programming Guidelines Document-x.x.DOC ==>mo ta coding conventions trong du an
2. Configuration Management Document-x.x.DOC ==>mo ta cach quan tri version cac ket qua trong du an
3. UC_BusinessComponent_FunctionName-x.x.DOC ==>mo ta dac ta chi tiet cac yeu cau cua du an theo tung business component, chuc nang
4. TC_BusinessComponent_FunctionName-x.x.DOC ==>mo ta dac ta chi tiet kich ban test cho cac yeu cau cua du an theo tung business component, chuc nang
5. Software Requirement Indices Document-x.x.XLS ==>ghi lai tracking trao doi ve yeu cau voi khach hang
6. Software Development Document-x.x.DOC ==>ghi lai cau hinh thiet lap moi truong de trien khai du an tren tat ca cac may cua thanh vien
7. Designing Guidelines Document-x.x.DOC ==>mo ta designing conventions trong du an
8. Meeting report trong nhom

Chu y: phu thuoc vao tung du an, PM co the tao ra cac tai lieu khac cu the cho yeu cau quan tri doi voi du an do, vi du nhu trong nhom can phai to chuc cross reviewing giua cac thiet ke, code cua cac thanh vien thi can phai tao template cho nhung yeu cau tren.

February 20, 2006

Hoc tieng Nhat cung nhom COM

Filed under: hoc tap, 日本語

6.
構成管理ツールのSYNERGY/CMは、ソースファイルなどソフトウェア開発で作成されるファイルのバージョンを管理し、リリースされたソフトウェアが、どのファイルから構成されているのかを管理するツールである。

A thực hiện 2 việc, và, 2 việc đó được ngăn cách bởi dấu phẩy, và được định nghĩa bởi 2 chữ “quản lý - KANRI”

日本テレロジック株式会社(以下、テレロジック)は2月21日、タスクベースでソフトウェアの開発プロセスをサポートする構成管理ツール「Telelogic SYNERGY/CM 6.4a 日本語版」(以下、SYNERGY/CM)、および変更管理ツール「Telelogic SYNERGY/Change 4.4a 日本語版」(以下、SYNERGY/Change)を発表した。

Chi tiết: A (..)は2月21日, B (…) および C (…)を発表した: Ngày 21 tháng 2, A (sau đây gọi là …) đã công bố B (sau đây gọi là …) và C (sau đây gọi là …) .

テレロジック、ソフト開発プロセスを改善する構成・変更管理ツールの新版
Telelogic, phiên bản mới Tool quản lý tổ chức-thay đổi nhằm cải thiện quy trình khai thác phần mềm

データが1件もない場合は表を表示させない処理を入れておいたほうが良いです。
Truong hop khong co du lieu thi nen them 1 doan xu li de khong hien thi list

5.管理ツール: Tool quan ly

4.Aを中心に: Lấy A làm trung tâm, lấy A làm trọng điểm, chú trọng đến A…..
ex: 今回は春節に沸く長崎の中華街で撮影した作例を中心に掲載する
dich: Lần này, dự tính sau mùa Xuân, Pentax sẽ công bố (đăng tải) tập trung cho các ảnh mẫu (sản phẩm mẫu) đã chụp tại Khu người Hoa ở Nagasaki

3.【作例速報】ペンタックス、5点測距の6万円台デジ一眼「*ist DL2」
dich: (Tin nhanh về mẫu sản phẩm)Pentax, máy ảnh kỹ thuật số đơn mắt giá 60.000 yên, độ phân giải 5 chấm

2.ペンタックスは2月下旬、デジタル一眼レフカメラ「*ist(イスト) DL2」を発売する。
dich: Cuoi thang 2, hang Pentax se tung ra thi truong may anh ky thuat so don mat.

1. Co cau trúc câu: A を B として = lay A làm B, coi A là B (hoac nguoi lai tuy theo nghia cua cau)
ex: このほか、重要なニュース映像号外として速報することも検討している
dich: Ngoai ra, (cac kenh truyen hinh) can nhac viec dua tin nhanh nhu mot so bao dac biet ve cac tin tuc hinh anh quan trong.

Writing Mail by Japanese

Filed under: hoc tap, 日本語

Note: Chy y mot dieu khi doc bai nay, ban chi duoc phep doc ma thoi [read only]. Khong duoc phep copy hay sua doi. Kien thuc nay thuoc ve cong ty Luvina. Than ai!

cau chu tieng nhat nghia tieng viet
お力にならなくて申し訳ありません。 Xin loi vi da khong giup do duoc
お手数ですが、 viec nay se gay phien phuc cho ong , nhung ma ….
ここに謹んでご報告申し上げます Toi xin tran trong thong bao o day
このたび, この度, 今度 Lan nay
この次, 今度の 〈次の〉 Lan toi, tiep theo, ve sau
この事を取り急ぎご通知申し上げます Toi voi vang thong bao viec nay
ご報告申し上げますとともに、~ Cung voi viec thong bao,…
ご了承お願いします。 Lam on hay nhan thuc duoc dieu nay
さんを1時間程度会社でお話をすることができますが co the noi chuyen voi .. trong khoang 1 h
ちょうど今、LEさんから、返事もらいました。 vua dung luc , cung co mail tu Lesan
どちらの方法を取っても構いません theo cach nao cung duoc, khong co van de gi
ならびに, 並びに、及び Va, cung
なるべく早めに予定を決めたいので、返信お願いしますね。 Neu co the, vi muon nhanh chong quyet dinh ke hoach, de nghi tra loi som
ひとかたならず お世話になりました Ngoai ra, mong anh quan tam giup do them.
まずは取り急ぎ、ご通知かたがたごあいさつ申し上げます Toi voi vang gui loi thong bao va loi chao toi cac ngai.
もっと hon
矛盾 mau thuan
長々と書く必要はなく Khong can viet dai dong
関係官庁 Ban nganh co lien quan
順序(じゅんじょ) xap xep
行を飛ばして bo? cach hang
誤ってください Hay xin loi di
請け負い Nhan tron goi
請負(うけおい) Giao chon goi
1名を整(ととの)えています chuan bi 1 nguoi
~するようお願い申し上げます Rat mong duoc ngai ~
全部の修正終わる日時も教えてください。 Hay cho biet ngay gio sua het toan bo
夕食などはちょっと難しいです ve chuyen an toi thi chac la kho
委託(いたく) giao gi lam nay kieu ODC
平素 thuong ngay, hang ngay, moi khi
平仮名 hiragana
引き続き、明日以降に触ってみます Toi lam viec tiep day, mai se thu
当社 Cong ty chung toi
彼は転倒され、現在の傷は非常に痛い様ですが、彼自身は痛みがある程度軽減すれば、すぐその仕事を始めたいとおっしゃいました。 Anh muon viet TN la: ANh ay bi nga rat dau. Nhung ban than anh ay noi la, co gang neu do dau hon thi se bat tay vao lam cong viec do.
愛顧 Khach quen
接待をする。 tiep khach
政府に提出用書類は必ずベトナム語であるが Cac tai lieu nop cho chinh phu deu phai la tieng Viet
早急にお返事くださいますようお願いします Cho hoi am som cua ngai.
本プロジェクトの準備に先立(さきだ)ち Chuan bi truoc cho du an nay
本社 Tru so cong ty
本気であせっているので、 Thuc su la rat voi, khong the kien nhan duoc nua
業務委託 Hop dong da.ng ODC
一応、希望は21日の週を考えてます Tam thoi, hy vong la nghi den cai tuan co ngay 21
今後とも Lan toi cung
件は意外に発生されてしまい、予防案の準備もなかったのですが、再度御検討をし、今後に向けて予防策を両側の協力により作成する必要があると思います Truong hop nay la truong hop dac biet dot xuat, nen chung ta da khong co phuong an chuan bi. De nghi ong can nhac va chung ta se phai dua ra cac phuong an du phong cho tuong lai.
~の承認を得て Co duoc su thua nhan (cong nhan) cua ~

February 15, 2006

Cerfiticate

Filed under: thong tin ca nhan

Hinh anh scan cac bang cap

February 13, 2006

Cau hoi khi tuyen dung Tester

Danh sach cau hoi khi phong van ky su kiem thu:
1. What are the differences in testing the web application and client server application?
2. How would you say that a bug is 100 % fixed ?
3. How we can explain a bug which may arrive at the time of tesing. explain that bugs in details.
4. how do you test whether a database in updated when information is entered in the front end?
5. what SQL statements have you used in Database Testing?
6. What is way of writing testcases for database testing?
7. what is database testing and what we test in database testing
8. What is scenario and end to end scenario
9. Given an yahoo application how many test cases u can write?
10. what is bad defect?
11. What is integration test plan?
12. How do you know when you have enough test cases to adequately test a software system or module?
13. how will we prepare test cases
14. How is test case write?
15. How can we write a good test case?
16. How will you check that your test cases covered all the requirements
17. How can we write a good test case?
18. what bugs are mainly come in webtesting what severity and priority we are giving
19. what is latent bug?
20. when we know that testing is complete?
Refer Link: http://www.geekinterview.com






















Get free blog up and running in minutes with Blogsome
Theme designed by Hadley Wickham