<h3>Reviewing my life in 2017.</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*EMrEUYYjQC161tydzisZug.jpeg" /><figcaption>Photo by <a href="https://unsplash.com/photos/EAvS-4KnGrk?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Pablo Heimplatz</a> on <a href="https://unsplash.com/?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText">Unsplash</a></figcaption></figure><p>The year 2017 was great for me. A lot has happened that I’m very grateful for in 2017. As always, a person has ups and downs during the year, but it is important to focus on the ups to set the new year on a positive tone.</p><h4>Life</h4><p>The biggest change and best change in 2017 for me was the birth of my third child in February 2017. That caused the house to become very busy with three children around. I also have to do better planning to find time to keep up with technology changes and reserve time for programming like getting up at 05:00 in the morning before everyone else is awake.</p><p>I can recommend getting up early in the morning to do some research and programming while your mind is fresh after a good night’s rest.</p><h4>Technology</h4><p>As always, the exciting world of technology is ever-changing. A lot has happened in 2017 that makes me excited to learn constantly. In 2017, I focused on increasing my knowledge around Microsoft ecosystems like Azure, Office 365 and dotNet Core developments. I have learned a lot through the year to build better solutions on the Microsoft ecosystem.</p><p>Another aspect was trying to keep up with the Web front-end frameworks like Angular and React. It is difficult to keep up, but it was great to see the development of each framework and rapid releases of Angular and React. All I can say is choose wisely which web framework to use that will solve your solution problems.</p><p>Every year I try to learn a new programming language. Not to become an expert in the language but to understand the constructs and design thinking around the programming language. In 2017 it was the Elixir programming language, and I was very impressed by Elixir and recommend everyone to play around with the Elixir programming language.</p><p>Another area of focus for me was around increasing my knowledge and understanding around architecture at the Enterprise and Software level. At Enterprise Architecture level it was around getting deeper knowledge in information architecture and governance. In Software Architecture it was the design and usage of micro-services with containers. I almost want to say that micro-services with containers are a silver bullet to building solutions, but things can change. It is to great benefit to learn at these two different levels of architecture to understand and see the bigger picture in the architecture landscapes.</p><h4>Work</h4><p>In the last four and half years, I have been working in the chemicals and paints sector which was a great experience and to see how the usage of paints, chemicals, and technology comes together to create a better world for all. In October 2017, I started to work at a new employer in the aviation sector. So far it has been a very interesting journey and again a lot to learn about the aviation sector. Technology and aviation work together to make it easier for people to see the world and goods to become available everywhere in the world. I’m excited to be part of the aviation sector and contribute to improving the systems.</p><h4>Studies</h4><p>My initial ambition to get certifications in certain aspect did not come to reality since I was over-committing myself. The highlight for me was in starting and participating in the master class in Enterprise Architecture of the Netherlands Architecture Forum. This course was an eye-opener and has given me more insights and new perspectives on implementing and using Enterprise Architectures. Some of my learnings in the study I will write articles about in the coming months in 2018.</p><h4>Focus for 2018</h4><p>What is my focus in 2018? In 2018, I want to focus more on stability and not over-committing myself to keep track of all technology changes. From a life perspective, I want to continue improving my personal productivity.</p><p>In technology side, I want to focus on Angular, dotNet Core and Azure. Additionally, I want to learn more about Kubernetes to orchestrate containers. As mentioned earlier every new year I would like to pick up a new programming language to learn. In 2018, I will focus on the Rust programming language. I have poked around the last couple of weeks in Rust and looks like a very interesting programming language. Maybe it will replace my love for the C# programming language. 😉</p><p>One extra study focus for me would be Cloud Security Architecture certification. I believe that every developer and architect should get some form of security certification. Especially what is happing around security breaches in the world, it would help all to build better-secured systems.</p><h4>Summary</h4><p>In summary, I’m excited to see how technologies will change over the new year and affect our lives. Hopefully for the greater good. There are many developments I still want to get into like block-chain, AI, and quantum computing. For now, I will hold off until 2019 when these technologies are more matured. What is your focus for 2018?</p><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=1701b1e8c5a" width="1" height="1" alt="">

Reviewing my life in 2017

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*wLmiE0n9g1uRQZKS0StxUA.png" /></figure><p><a href="https://www.elastic.co/products/elasticsearch">ElasticSearch </a>and <a href="https://www.elastic.co/products/kibana">Kibana </a>are two great products to use in your solution. They provide various values to a solution. If you don’t know ElasticSearch and Kibana then I recommend you read more about these technologies or follow me to get more insight on them.</p><h4>Prerequisites</h4><ul><li><a href="https://www.microsoft.com/net/download/windows">dotNet Core 2.0 SDK</a></li><li><a href="https://docs.microsoft.com/en-us/aspnet/core/">ASP.Net Core 2.0</a></li><li><a href="https://www.docker.com/get-docker">Docker Community Edition</a></li></ul><h4>Create new project folder</h4><p>Open a command prompt and run the following commands:</p><pre>mkdir aspnet.kibana<br>cd aspnet.kibana</pre><h4>Create new ASP.Net Core project</h4><p>In the command line create a new ASP.Net Core web application.</p><pre>dotnet new mvc</pre><p>The following additional packages are needed to log information to ElasticSearch using <a href="https://serilog.net/">Serilog</a>.</p><pre>dotnet add package Serilog -v 2.5.0<br>dotnet add package Serilog.Extensions.Logging -v 2.0.2<br>dotnet add package Serilog.Sinks.ElasticSearch -v 5.4.0<br>dotnet restore</pre><h4>Update Startup.cs file to enable logging to ElasticSearch</h4><p>By enabling the logging from your web application to ElasticSearch you need to make the following changes in the Startup.cs file.</p><iframe src="" width="0" height="0" frameborder="0" scrolling="no"><a href="https://medium.com/media/aa7551bae03b31c371293c95dfe2e093/href">https://medium.com/media/aa7551bae03b31c371293c95dfe2e093/href</a></iframe><h4>Use Docker to startup and use ElasticSearch and Kibana</h4><p>In the command line run the following Docker commands to download an ElasticSearch with Kibana docker image.</p><pre>docker pull nshou/elasticsearch-kibana<br>docker run -d -p 9200:9200 -p 5601:5601 nshou/elasticsearch-kibana</pre><p>It can take a while to download the docker image from the docker registry. Once the download is finished, you can confirm if an instance is running of the image by executing the following command.</p><pre>docker ps</pre><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*S0UTvBVQlxLJSkZU4_kjZw.png" /><figcaption>Docker running container images.</figcaption></figure><h4>Run your ASP.Net Core project</h4><p>Now you must run your ASP.Net Core web application for example from the command line.</p><pre>dotnet run</pre><p>Open the web application in your favorite browser: <a href="http://localhost:5000">http://localhost:5000</a></p><p>Click around in the web application to generate web traffic. You have to generate first some web traffic before opening the Kibana web application.</p><h4>Setup and use Kibana</h4><p>Open in your favorite browser the following URL: <a href="http://localhost:5601.">http://localhost:5601</a></p><p>This will open the Kibana application. The first thing to do is to configure the index pattern before you can start using the goodies in the Kibana web application.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*F8Zkqkz5_4seeSaeD2kxsw.png" /><figcaption>Configure index pattern in Kibana.</figcaption></figure><p>After the index pattern is configured then you can click on the Discover menu option to see each of the logging information generated by the web requests you have created.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*UGHGCZuebULvZp8xWp_2xQ.png" /><figcaption>Web application logging information in Kibana.</figcaption></figure><p>Feel free now to explore and create vizualizations, dashboards and timelines in Kibana based on the logging information.</p><h4>Summary</h4><p>ElasticSearch and Kibana provides many benefits to you which you can utilize in your web application solution. ElasticSearch specifically is a great search engine that you can use as a view cache to search quickly through information. There is a lot more capabilities ElasticSearch and Kibana have for you to explore and use in your next great ASP.Net Core 2.0 solution.</p><p>With the help of containers you can get setup quickly and deploy your solution quickly to any environment. Let me know how you use ElasticSeach and Kibana in your solutions!</p><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=6f179b6d2d02" width="1" height="1" alt="">

Quick start using ElasticSearch, Kibana with ASP.Net Core 2.0

<figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*TVp8BcwidxU2rec2loOdEg.png" /><figcaption>Figure 1 — Renewing SharePoint Add-ins client secret article mind map.</figcaption></figure><h3>Introduction</h3><p>When you create a provider add-in you need to create a client ID and client secret in SharePoint. In SharePoint, you will access the page appregnew.aspx in a site.</p><p><a href="https://contoso.sharepoint.com/_layouts/15/appregnew.aspx">https://contoso.sharepoint.com/_layouts/15/appregnew.aspx</a></p><p>By default, the client secret that is generated for you is valid for one year only. The client secret must be renewed otherwise the application will stop working. I will describe the steps required to renew the client secret and make the client secret valid for three years.</p><h3>Prerequisites</h3><p>To create a new client secret, you must delete the old keys before generating a new client secret. The best approach is to perform these actions using PowerShell. For this reason, you will need the following components on your local machine:</p><ol><li>PowerShell (Latest Version)</li><li><a href="http://www.microsoft.com/download/details.aspx?id=39267">Microsoft Online Services Sign-In Assistant</a></li><li><a href="http://go.microsoft.com/fwlink/p/?linkid=236297">Microsoft Online Services PowerShell Module</a></li></ol><h3>When is the end date?</h3><p>To get the end date of when the client secret will expire you have to query the application keys using the client ID.</p><p>We use a command Connect-MsolService which will authenticate you to your Office 365 tenant. At the login prompt, enter tenant administrator credentials for the Office 365 tenancy where the add-in is registered.</p><p>To query the end date open Windows PowerShell and run the following cmdlet:</p><pre>Connect-MsolService</pre><pre>$clientID = “d65cdd2b-9e19–4076–901f-9f9031080339”</pre><pre>Get-MsolServicePrincipal -AppPrincipalId $clientID</pre><pre>Get-MsolServicePrincipalCredential -AppPrincipalId $clientID -ReturnKeyValues $false | Where-Object { ($_.Type -ne “Other”) -and ($_.Type -ne “Asymmetric”) }</pre><p>You will see the result as similar as below:</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/1*AbLCFYWJEl4fesGqlW7bgw.png" /><figcaption>Figure 2 — Results of querying SharePoint Online add-in keys expiration end date.</figcaption></figure><h3>Creating a new secret</h3><p>The following steps will guide you how to generate a new client secret. It is broken down into four steps:</p><ol><li>Query the add-in keys to confirm the right client ID is being used.</li><li>Remove current keys used for client secret.</li><li>Create a new client secret.</li><li>Confirm the new end date of the client secret.</li></ol><p>Connect to your tenant using the tenant admin user with the below markup using SharePoint Windows PowerShell. Get the ServicePrincipals and keys. Printing $keys return three records. You will also see the EndDate of each key. Confirm whether your expired key appears there.</p><pre>## Step 1<br># Get keys</pre><pre>Connect-MsolService</pre><pre>$clientID = “9825a06f-61de-461d-9efa-a28a9c3b1917” # Update to application client ID</pre><pre>Get-MsolServicePrincipal -AppPrincipalId $clientID</pre><pre>$keys = Get-MsolServicePrincipalCredential -AppPrincipalId $clientID -ReturnKeyValues $true</pre><pre>$keys</pre><p>Remove the existing keys by <strong>replacing</strong> each KeyID in KeyID1, KeyID2, and KeyID3.</p><pre>## Step 2<br># Remove keys</pre><pre>Remove-MsolServicePrincipalCredential -KeyIds @(“KeyID1”,”KeyID2",”KeyID3") -AppPrincipalId $clientID</pre><p>Generate a new ClientSecret for this clientID. It uses the same clientID as set in the above step. The new ClientSecret is valid for 3 years.</p><pre>## Step 3 — Recommended to wait 24 hours before creating new keys<br># Create new keys for three years</pre><pre>$bytes = New-Object Byte[] 32<br>$rand = [System.Security.Cryptography.RandomNumberGenerator]::Create()</pre><pre>$rand.GetBytes($bytes)<br>$rand.Dispose()</pre><pre>$newClientSecret = [System.Convert]::ToBase64String($bytes)<br>$dtStart = [System.DateTime]::Now<br>$dtEnd = $dtStart.AddYears(3)</pre><pre>New-MsolServicePrincipalCredential -AppPrincipalId $clientID -Type Symmetric -Usage Sign -Value $newClientSecret -StartDate $dtStart -EndDate $dtEnd</pre><pre>New-MsolServicePrincipalCredential -AppPrincipalId $clientID -Type Symmetric -Usage Verify -Value $newClientSecret -StartDate $dtStart -EndDate $dtEnd</pre><pre>New-MsolServicePrincipalCredential -AppPrincipalId $clientID -Type Password -Usage Verify -Value $newClientSecret -StartDate $dtStart -EndDate $dtEnd</pre><pre>$newClientSecret</pre><p>Copy the output of $newClientSecret and update the respective Web.config of the add-in with the new ClientSecret. Wait at least 24 hours for the ClientSecret to propagate in SharePoint Office (SPO).</p><p>To confirm the new end dates execute the following commands:</p><pre>## Step 4<br># Confirm new end dates</pre><pre>Get-MsolServicePrincipal -AppPrincipalId $clientID</pre><pre>$keys = Get-MsolServicePrincipalCredential -AppPrincipalId $clientID -ReturnKeyValues $true</pre><pre>$keys</pre><h3>Summary</h3><p>The steps are straight forward. I recommend that you perform these steps immediately when you deploy your SharePoint provider add-in. This will ensure the client secret is valid for three years rather than the default one year.</p><p>If you find that this will be too much of a hassle. I would then suggest to stop developing SharePoint Provider add-ins. Rather develop an application that you register in Azure Active Directory which you can manage through the Azure Portal. In a future article post, I will compare SharePoint Provider add-ins versus Azure Active Directory Applications.</p><p>If you enjoyed this article, please let me know and share the article. If you have questions or need more information, please let me know.</p><h3>Extra resources</h3><ul><li><a href="https://dev.office.com/sharepoint/docs/sp-add-ins/replace-an-expiring-client-secret-in-a-sharepoint-add-in">https://dev.office.com/sharepoint/docs/sp-add-ins/replace-an-expiring-client-secret-in-a-sharepoint-add-in</a></li></ul><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=ba2828a49e7" width="1" height="1" alt="">

Renewing SharePoint Online Provider add-ins client secret

<p>Have you ever heard of TOGAF and never really understood it? In my TOGAF 9.1 series of articles, I will give you summary points what TOGAF is and what you will learn in TOGAF.</p><p>I have written the TOGAF exam a while back. I thought that writing this series will let me review the TOGAF content and believe that it would be valuable to others. It is always a good practice to regularly review the contents of a topic that you have learned.</p><p>I’m not going to rewrite the official TOGAF books content in my article series. Some sections will only contain bullet points of key terms used in TOGAF. Always reference the <a href="http://pubs.opengroup.org/architecture/togaf9-doc/arch/">official TOGAF book</a> for more details.</p><h3>Legal Points</h3><p>TOGAF is a trademark of <a href="http://www.opengroup.org/">The Open Group</a>. They maintain the TOGAF standard and release new versions of the framework. I highly recommend that you read the official website and content of TOGAF on the official site: <a href="http://www.opengroup.org/subjectareas/enterprise/togaf">http://www.opengroup.org/subjectareas/enterprise/togaf</a></p><p>The contents in my article series are my opinions and in no way reflects the views of The Open Group.</p><p>If you are interested in learning all the finer details of TOGAF or want to write the exam then buy the <a href="http://www.amazon.com/TOGAF-Version-9-1-Van-Haren/dp/9087536798/ref=sr_1_3?ie=UTF8&qid=1457270270&sr=8-3&keywords=TOGAF">official book</a>:</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/354/0*q03zADChW7ujUKgP.jpg" /><figcaption><em>Figure 1: TOGAF Version 9.1 book</em></figcaption></figure><h3>ADM Phase — E — Opportunities and Solutions</h3><h4>Objectives</h4><ul><li>Generate the initial complete version of the Architecture Roadmap, based upon the gap analysis and candidate Architecture Roadmap components from Phases B, C and D.</li><li>Determine whether an incremental approach is required and if so identify Transition Architecture that will deliver continuous business value.</li></ul><h4>Steps</h4><ul><li>Determine/confirm key corporate change attributes.</li><li>Determine business constraints for implementation.</li><li>Review and consolidate gap analysis results from Phases B to D.</li><li>Review consolidated requirements across related business functions.</li><li>Consolidate and reconcile interoperability requirements.</li><li>Refine and validate dependencies.</li><li>Confirm readiness and risk for business transformation.</li><li>Formulate implementation and Migration Strategy.</li><li>Identify and group major work packages.</li><li>Identify Transition Architecture.</li><li>Create Architecture Roadmap & Implementation and Migration Plan.</li></ul><h4>Inputs</h4><ul><li>Product Information</li><li>Request for Architecture Work</li><li>Capability Assessment</li><li>Communication Plan</li><li>Planning methodologies</li><li>Governance models and frameworks</li><li>Tailored Architecture Framework</li><li>Statement of Architecture Work</li><li>Architecture Vision</li><li>Architecture Repository</li><li>Draft Architecture Definition Document</li><li>Draft Architecture Requirements Specification</li><li>Change Requests for existing programs and projects.</li><li>Candidate Architecture Roadmap components from Phases B, C and D</li></ul><h4>Outputs</h4><ul><li>Statement of Architecture Work, updated if necessary.</li><li>Architecture Vision, updated if necessary.</li></ul><p>Draft Architecture Definition Document</p><ul><li>Transition Architecture, number, and scope</li></ul><p>Draft Architecture Requirements Specification, updated if necessary.</p><p>Consolidate and validate Architecture Roadmap.</p><p>Capability Assessment, including</p><ul><li>Business Capability</li><li>IT Capability</li></ul><p>Architecture Roadmap, including</p><ul><li>Work Package portfolio</li><li>Identification of Transition Architecture</li><li>Impact analysis — project list</li><li>Implementation Recommendations</li></ul><p>Implementation and Migration Plan, including</p><ul><li>Implementation and Migration Strategy</li></ul><p><em>Originally published at </em><a href="https://cecilblog.com/togaf-9-1-series-adm-phase-d-technology-architecture/"><em>cecilblog.com</em></a><em> on March 16, 2016.</em></p><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=a729e86e47b3" width="1" height="1" alt="">

TOGAF 9.1 Series — ADM Phase — E — Opportunities and Solutions

<p><em>This article was originally published on my old blog.</em></p><p>Protecting and securing your business information is critical to your business survival and this article shows you how to do that in Office 365. What do you do to protect your organization from leaking or exposing private personal information and complying with governments’ laws?</p><p>Most people don’t have an answer or rely on an external audit company to ensure the organization complies with applicable laws, but they have no visibility on what and how information is shared across the organization.</p><p>Microsoft Office 365 platform provides security, compliance, and privacy capabilities. Some of the capabilities are built-in and other capabilities the customer can control. This article focuses on the Data Loss Prevention (DLP) compliance capability in Office 365 that the customer can control.</p><h3>What is DLP?</h3><p>Data Loss Prevention is the capability to monitor potential data breaches inside your organization that must comply with a set of policies. It allows a system to control and block sensitive information from leaving an organization.</p><p>In Office 365, the platform helps you to identify, track and protect sensitive information in your organization through deep content analysis and makes it easy to setup the policies. The DLP capability applies to content in Exchange Online, SharePoint Online and OneDrive for Business services on Office 365.</p><h3>How to use DLP in Office 365</h3><p>In Office 365, the DLP capability is only available in the following subscription plans:</p><ul><li>Enterprise E3</li><li>Enterprise E4</li><li>Government E3</li><li>Government E4</li><li>Nonprofit E3</li><li>Nonprofit E4</li></ul><h4>Setup of DLP policies</h4><p>Administrators enable and manage this capability in the Admin portal of Office 365. In the Admin portal on the left navigation (figure 1) go to Admin and then select <strong>Compliance</strong>.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/523/0*fIOXor87W2dL8edd.png" /><figcaption>Figure 1: Office 365 Administration Portal Compliance Menu.</figcaption></figure><p>Once the Compliance Center opens (figure 2), on the left menu click <strong>Data loss prevention</strong> to access the policies.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*0v3ra5BDe2NrqJW5.png" /><figcaption>Figure 2: Compliance Center Data loss prevention policies configurations.</figcaption></figure><p>On this page you can manage DLP policies that must be applied in the organization. The policies applied in figure 2 is for SharePoint Online and OneDrive for business documents. You manage DLP policies for emails in the Exchange admin center page. I hope that in the future, the Exchange admin center will not be needed anymore to apply DLP policies to emails and everything can be managed from the Compliance Center.</p><p>On the current Compliance Center DLP page in the second paragraph, you will see a link to the Exchange admin center.</p><p>SharePoint Online and OneDrive for Business DLP</p><p>On the Compliance Center Data loss prevention policies page, you can click the plus sign button (figure 3) to add a new policy.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/125/0*8kws90_DA7e_9grG.png" /><figcaption>Figure 3: Add new DLP policy.</figcaption></figure><p>A new window appears (figure 4) where you can specify the policy you want to apply to you organization’s documents.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/800/0*NM6ZxexGEmYWxvbx.png" /><figcaption>Figure 4: New DLP policy information protection selection.</figcaption></figure><p>In the New DLP policy window (figure 4), you will see that the available policies are categorized in four groups: Custom, Financial, Medical, and Privacy. Once you have selected your policy to apply, like in this example of the article the policy <strong>PCI Data Security Standard (PCI DSS)</strong>, then you can click Next. On the next page (figure 5), you can specify where to apply this policy. You can choose to protect all sites or you can choose specific sites in SharePoint Online or OneDrive for Business services.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/800/0*_8e_eklBkP9CBcTU.png" /><figcaption>Figure 5: New DLP policy sites selection for SharePoint Online and OneDrive for Business.</figcaption></figure><p>When you click Next, you get to the Customize rules page where you can customize specific rules of the policy. For this article, the default rules are correct so click Next to continue. On the last page (figure 6), you need to provide your name for the new DLP Policy and optionally a description if needed. You can specify if you first want to test the policy, which will not apply any of the actions set in the policy. The policy can still send notifications and policy tips to end users. Ultimately, you can turn on the policy that will execute the relevant actions for policies. Once you click the Create button, Office 365 will start applying the policy in your tenant.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/800/0*Ieyk4GRp0YZRdS9b.png" /><figcaption>Figure 6: New DLP policy creation and enablement options.</figcaption></figure><p><strong>Exchange Online DLP</strong></p><p>If you go to the Exchange admin center (figure 7), the experience to apply DLP policies on email information is a bit different. The concepts are the same as in the Compliance Center DLP setup.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/800/0*F6LsjsKK8YOi_Zf4.png" /><figcaption>Figure 7: Office 365 Exchange Online Administration Center DLP configuration.</figcaption></figure><p>You can click on the plus button to add a new policy with the following options:</p><ul><li>New DLP policy from template</li><li>Import DLP policy</li><li>New custom DLP policy</li></ul><p>Office 365 comes with various government and industry standard policy templates (figure 8) that you can quickly apply in your organization. At the time of writing this article, there are 40 different templates available. The available templates include HRIP Act, PII, PIPA, PIPEDA, PCI DSS, HIPAA and more.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/800/0*csXBGISpESQyurPV.png" /><figcaption>Figure 8: Office 365 DLP Policy Templates.</figcaption></figure><p>The administrator can also enforce encryption on the private information or block the user from sending the private information like credit card number via email as shown in figure 9. The administrator can apply fine grain control on each policy. The DLP configuration options provide flexibility for administrators to provide the exact needs of an organization or industry.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/977/0*Ha7K1ibKSqScFf0l.png" /><figcaption>Figure 9: Office 365 DLP Policy rule configuration.</figcaption></figure><h4>End user experience</h4><p>When an end user interacts with content that does not comply with a DLP policy, they will get a Policy Tip in the relevant Microsoft Office application on the desktop or online version. They will see the Policy Tip in the Outlook, Word, Excel or PowerPoint application. Based on the Policy Tip (figure 10) provided to the end user, the user can decide to override the policy or get more information on the policy for better guidance to comply with the policy.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*trvXXbXgtNbXIU7E.png" /><figcaption>Figure 10: Policy Tip notification to end user in Outlook.</figcaption></figure><p>The end user can also report a false positive if the policy was triggered incorrectly. In addition, the end user can decide to break the policy and provide business feedback (figure 11) for the exception of non-compliance to the policy.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/580/0*59lSZxrI8xm6sim6.png" /><figcaption>Figure 11: End user DLP Policy Tip override business justification dialog.</figcaption></figure><p>In SharePoint Online and OneDrive for Business, you also get notification (figure 12) of documents that contain sensitive information and does not comply with DLP policies.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/1024/0*LXiJ0872ELqsQEtZ.png" /><figcaption>Figure 12: Office 365 SharePoint Online and OneDrive for Business DLP Policy Tip.</figcaption></figure><p><em>(Note, figure 12 comes from the Office Blog article: </em><a href="https://blogs.office.com/2015/09/30/data-loss-prevention-in-onedrive-for-business-sharepoint-online-and-office-2016-is-rolling-out/"><em>Data Loss Prevention in OneDrive for Business, SharePoint Online and Office 2016 is rolling out</em></a></p><h4>Reports</h4><p>The Administrator can enable Incident Reports to run if a piece of information does not comply with a policy. The Incident Report can be mailed immediately to a particular user or a ticket system where further actions can be taken.</p><p>The DLP also provides full audit data where the Administrators can export the data to another reporting system or use the available out-of-box reports. As figure 13 shows, the following reports are available in Office 365:</p><ul><li>Top DLP policy matches for mail</li><li>DLP policy matches, overrides, and false positives for mail</li><li>Top DLP rule matches for mail</li><li>DLP policy matches by severity for mail</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/800/0*e27JTq1j1HiRO3fF.png" /><figcaption>Figure 13: Office 365 DLP Reports.</figcaption></figure><h3>Benefits of DLP</h3><p>The DLP offerings in Office 365 let businesses quickly and easily comply with various industry or government standards without making a big expensive investment. Which in the end puts you and your organization in a much better place. It provides easier control over auditing information exchange inside your organization. It will also keep the Security Officers more relaxed in your organization!</p><p>The DLP policies provide Policy Tips to your end users without affecting their productivity and allows users to get educated into being compliant with organizational policies. There are more benefits to list here, but you get the idea by now.</p><h3>Summary</h3><p>I believe that the expansion of the DLP across the Office 365 services provides great value to an organization. The new Compliance Center brings a central experience to manage and monitor policies across all services. The rate of innovation from Microsoft on security, privacy and compliance brings major benefits to everyone in Office 365 without needing to make a big investment.</p><p>One topic I did not write about that is part of the DLP capability is the Document Fingerprint capability. For now, I’ll let that be a little bit of homework for you to go and investigate. In a future article, I will explain the Document Fingerprint capability in detail.</p><p>Feel free to add a comment below to share your experience in using DLP or if you have any questions.</p><h4>References</h4><ul><li><a href="https://www.microsoftvirtualacademy.com/en-us/training-courses/data-loss-prevention-in-office-365-8390">Microsoft Virtual Academy DLP Course</a></li><li><a href="https://blogs.office.com/2013/10/28/office-365-compliance-controls-data-loss-prevention/">Office 365 DLP Article</a></li><li><a href="https://blogs.office.com/2015/04/21/evolving-data-loss-prevention-in-sharepoint-onlineonedrive-for-business-and-office-applications/">Evolving Data Loss Prevention Article</a></li></ul><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=c52c3dcdef2a" width="1" height="1" alt="">

Securing Information with DLP in Office 365

<p><em>This article was originally published on my old blog.</em></p><p>This article is more a personal note on standard git commands that I regularly use or sometimes forget. It might be useful to you in your source control flow with git. If you want to know about more git commands checkout <a href="http://gitready.com/">gitready.com</a></p><h3>Local branches</h3><p>Create local branch</p><pre>git checkout -b newfeature</pre><p>Delete local branch</p><pre>git branch -d newfeature</pre><p>Merge branches (newfeature branch into master branch)</p><pre>git checkout master  <br>git merge newfeature</pre><p>Switch to specific branch</p><pre>git checkout newfeature</pre><p>List all branches (remote and local branches)</p><pre>git branch -a</pre><h3>Remote branches</h3><p>Create remote branch (origin being the remote git host repository)</p><pre>git push origin newfeature</pre><p>Delete a remote branch.</p><pre>git push origin :newfeature</pre><p>Get remote branch latest changes</p><pre>git checkout master  <br>git pull</pre><p>List remote branches</p><pre>git branch -r</pre><p>Update your local dev branch to be a mirror of what’s in the main repository.</p><pre>git checkout dev  <br>git pull --rebase upstream dev</pre><h3>Manage file changes</h3><p>Add new file</p><pre>git add newfile.js</pre><p>Commit all changes.</p><pre>git commit -am "A very nice commit message."</pre><p>Revert one file back to its original state</p><pre>git checkout -- file.js</pre><p>Temporary exclude the file from the commit.</p><pre>git update-index --assume-unchanged path/to/file.txt  <br>git commit -a -m "Commit Comment."  <br>git update-index --no-assume-unchanged path/to/file.txt</pre><h3>Tagging</h3><p>Create a tag</p><pre>git tag -a v1.0.0.0 -m "First release"</pre><p>Show specific tag</p><pre>git show v1.0.0.0</pre><p>Show Tags</p><pre>git describe --tags</pre><p>Push tags to remote repository</p><pre>git push --tags</pre><p>Push one tag to remote repository</p><pre>git push origin v1.0.0.0</pre><h3>Move git repository to a new server host</h3><p>The best article that I found on how to do this is the <a href="http://www.smashingmagazine.com/2014/05/19/moving-git-repository-new-server/">Smashing Magazine article</a>.</p><p><strong>Short notes from the article:</strong></p><p>Fetch all branches and tags from remote repository into local index</p><pre>git fetch origin</pre><p>Check out remote branches locally</p><pre>git checkout -b develop origin/develop</pre><p>Add new remote repository</p><pre>git remote add new-origin git@github.com:blahblah.git</pre><p>Push all local branches to new remote repository</p><pre>git push --all new-origin</pre><p>Push all local tags to new remote repository</p><pre>git push --tags new-origin</pre><p>Make new remote repository the default remote repository</p><pre>git remote rm origin  <br>git remote rename new-origin origin</pre><p>You are done. Thanks git for making it easy!</p><h3>Summary</h3><p>Let me know which other git commands you use on a regular basis.</p><p>Here are some fun ones you can look up yourself:</p><pre>git diff --name-status master..branch  <br>git diff master..branch  <br>git log master..branch  <br>git shortlog master..branch</pre><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=d0006812b5ea" width="1" height="1" alt="">

Notes on Git Commands

<p><em>This article was originally published on my old blog.</em></p><h3>Introduction</h3><p>If you never heard or used the curl command line tool then this post is for you. This post will teach you some basic curl commands. I recommend that you read the official site for more details: <a href="http://curl.haxx.se/">http://curl.haxx.se/</a></p><h3>Curl Setup</h3><ol><li>Download curl zip</li><li>Extract the contents (if you have downloaded the correct version you should find curl.exe)</li><li>Place curl.exe in a folder where you keep your software (e.g. D:\software\curl\curl.exe)</li></ol><p><strong>To run curl from the command line</strong></p><p>a) Right-hand click on “My Computer” icon</p><p>b) Select Properties</p><p>c) Click ‘Advanced system settings’ link</p><p>d) Go to tab [Advanced] — ‘Environment Variables’ button</p><p>e) Under System variable select ‘Path’ and Edit button</p><p>f) Add a semicolon followed by the path to where you placed your curl.exe (e.g. ;D:\software\curl)</p><p>Now you can run from the command line by typing the following commands.</p><h3>Get Commands</h3><p>Basic Get</p><pre>curl <a href="http://www.google.com">www.google.com</a></pre><p>Basic Get output to file</p><pre>curl -o google.html <a href="http://www.google.com">www.google.com</a></pre><p>Specify Header</p><pre>curl www.google.com -H X-ApiKey:17263jhbjh1gjhgb</pre><p>Display all response headers and body</p><pre>curl www.google.com -i</pre><p>Display only all headers</p><pre>curl www.google.com -I</pre><h3>Post Commands</h3><p>Send post request</p><pre>curl -X POST <a href="http://www.google.com">www.google.com</a></pre><p>Send post request with data</p><pre>curl -X POST www.google.com -d '{ data: value}'</pre><p>Send JSON data</p><pre>curl -X POST https://api.cloudmine.me/v1/app/928a78ffd73e4ff78383d1d4c06dd5a7/text \  <br>-d '{"myrandomkey":{"name":"ethan"}}' \<br>-H X-CloudMine-ApiKey:e90ef1aeaadd48de93b45038ed592a06 \<br>-H "content-type:application/json"</pre><pre>Common content-type: application/xml application/x-www-form-urlencoded</pre><p>Send delete request</p><pre>curl -X DELETE <a href="http://www.google.com">www.google.com</a></pre><p>Send content in file in request (Great for large amount of data)</p><pre>curl -X POST www.google.com -d @./path/to/file</pre><p>HTTP Basic Authentication request</p><pre>curl -X POST www.google.com -u username:password</pre><p>Make request verbose</p><pre>curl www.google.com -v</pre><p>These commands just provide a small taste of what is possible with curl.</p><h3>Summary</h3><p>I hope these commands help you get started in using curl. I use curl to quickly test APIs. It is a very helpful little tool. <br>Again I would recommend reading the <a href="http://curl.haxx.se/docs/">official documentation</a> to understand some of the more advanced features.</p><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=6b4280773bc5" width="1" height="1" alt="">

Notes on using Curl

<p><em>This article was originally published on my old blog.</em></p><p>If you have not heard of Docker yet, then this will help you understand what it is and how to use Docker effectively.</p><h3>What is Docker?</h3><p>Here is the definition of the Docker site:</p><blockquote><em>Docker containers wrap up a piece of software in a complete filesystem that contains everything it needs to run: code, runtime, system tools, system libraries — anything you can install on a server. This guarantees that it will always run the same, regardless of the environment it is running in.</em></blockquote><p>Learn more here: <a href="https://www.docker.com/what-docker">https://www.docker.com/what-docker</a></p><h3>Setup Docker</h3><p>Docker provides an easy setup package to get you started fast. Just follow the following instructions depending on you operating system.</p><p>Windows: <a href="https://docs.docker.com/engine/installation/windows/">https://docs.docker.com/engine/installation/windows/</a> <br>Mac OSX: <a href="https://docs.docker.com/engine/installation/mac/">https://docs.docker.com/engine/installation/mac/</a> <br>Linux: <a href="https://docs.docker.com/engine/installation/linux/">https://docs.docker.com/engine/installation/linux/</a></p><h3>Starting a docker container</h3><p>Once you have completed the setup of Docker it is relatively straight forward to start your first container. Open a command line console and type the following command:</p><pre>docker run hello-world</pre><p>Docker will go to their online repository and pull down the specified container image “hello-world” to your machine. Docker will then start the container as well.</p><p>You should see the following output in your command line console</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/748/0*SyFvudNWlv89QqYt.png" /><figcaption><em>Figure 1 — Docker Pull Console Output</em></figcaption></figure><p>You can explore the public registry available from Docker here:</p><p><a href="https://hub.docker.com/explore/">https://hub.docker.com/explore/</a></p><p>Once you have created an account you can setup your own private registry at Docker.</p><h3>Important Docker commands</h3><p>There are various Docker commands that you can use, but I found the below commands the most used commands in daily development practice.</p><pre># Pulls an image from the registry to your local machine.<br>docker pull hello-world</pre><pre># Creates and starts a container in one operation.<br>docker run hello-world</pre><pre># Lists containers that are running.<br>docker ps -a</pre><pre># Show list of images on your machine.<br>docker images</pre><pre># Delete a particular image.<br>docker rmi 2873hh433</pre><p>Here are relevant commands but can be dangerous to use.</p><pre># Delete every Docker image<br>docker rmi $(docker images -q)</pre><pre># Delete every Docker containers<br>docker rm $(docker ps -a -q)</pre><p>Here is a very helpful cheat sheet on Docker commands: <br><a href="https://github.com/wsargent/docker-cheat-sheet">https://github.com/wsargent/docker-cheat-sheet</a></p><h3>Create Dockerfile</h3><p>What is a Dockerfile? Well, it is a configuration file to setup a custom container. Here is an example of setting up a Nodejs container:</p><pre>FROM risingstack/alpine:3.3-v5.5.0-1.1.3</pre><pre>COPY package.json package.json  <br>RUN npm install  <br>COPY . .  </pre><pre>EXPOSE 1337</pre><pre>ENTRYPOINT ["npm","start"]</pre><p>Execute the following commands to build the container based off your Dockerfile.</p><pre>docker build -t test/test:latest .</pre><pre>docker run --name nodetest -p 127.0.0.1:80:8080 -i test/test:latest /bin/sh</pre><p>Read more about details on the Docker configuration file here:</p><p><a href="https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/">https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/</a></p><h3>Latest Docker for Windows and Mac OS X release</h3><p>Recently Docker has released a new Docker for Windows and Docker for Mac OS X beta to make it easier to work with Docker on Windows and Mac OS X. The Docker for Windows tool now works with HyperV so you don’t need Virtualbox anymore which was required with Docker Toolbox.</p><p>Here are a couple screenshots from a Windows machine:</p><p>Once Docker is installed, you will see a new Docker icon in the bottom right of your desktop toolbar.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/348/0*97y58W_mqh8n-XPL.png" /><figcaption><em>Figure 2 — Docker icon on desktop toolbar</em></figcaption></figure><p>You can right-click on the icon to get access to various options for Docker.</p><p>After Docker has started up and is initialized, you will see this screen.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/434/0*BkeHQP2_4mMZVp5C.png" /><figcaption><em>Figure 3 — Docker up and running successfully</em></figcaption></figure><h3>Summary</h3><p>I hope this article helps you and gives you the confidence to get started with Docker. I challenge you to try and setup a basic three-tier application (Web Application Layer, Database Service Layer, and Cache Service Layer) with Docker.</p><p>If you have any problem, there is a big Docker community to help you. You can also contact me via <a href="http://twitter.com/cecildt">Twitter</a>. Let me know what you like or dislike about using Docker in your development flow.</p><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=6bd2fbdc45d3" width="1" height="1" alt="">

Quick guide to Docker containers

<p><em>This article was originally published on my old blog.</em></p><h3>Introduction</h3><p>If you work in a business where there is a complex environment of business processes and information systems it can become very difficult to get a good understanding of what is going on in the business. This could lead to wasting money inside the business and not effectively execution of business processes in the business environment.</p><p>Enter the <strong>APQC Process Classification Framework</strong>. This process classification framework assists you to align your business process to industry best practices and benchmark your business processes. The process classification framework is a taxonomy of cross-functional business processes intended to allow the objective comparison of organizational performance within and among organizations.</p><p>The process classification framework was developed by APQC and its member companies as an open standard to facilitate improvement through process management and benchmarking, regardless of industry, size, or location.</p><h3>Who is APQC?</h3><p>Here is the official about statement from the APQC site:</p><pre>APQC is a member-based nonprofit and one of the world’s leading proponents of business benchmarking, best practices, and knowledge management research. We follow our mission to help organizations around the world improve productivity and quality by discovering effective methods of improvement, broadly disseminating findings, and connecting individuals with one another and with the knowledge they need to improve.</pre><p>APQC focus on the following topics:</p><ul><li>Knowledge Management</li><li>Process and Performance Management</li><li>Education</li><li>Financial Management</li><li>Human Capital Management</li><li>Supply Chain Management</li></ul><p>I highly recommend that you visit the APQC site: <a href="https://www.apqc.org/">https://www.apqc.org/</a></p><h3>Overview of Process Classification Framework</h3><p>The process classification framework is organized in operating and management processes into 12 enterprise-level categories, including process groups and more than 1000 processes and associated activities.</p><p>Here is an overview image:</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/705/0*R5MiP1iDXBqrzklc.png" /><figcaption>Figure 1 — Process classification framework</figcaption></figure><p>You can download the official document here: <a href="https://www.apqc.org/pcf">https://www.apqc.org/pcf</a></p><h3>Summary</h3><p>I believe the APQC Process Classification Framework provides an excellent framework to manage business processes and provide benchmarks to ensure you are effectively executing your business processes. Does not matter how big or small your business is the framework will guide you to use a structured approach to managing your business processes.</p><p>Currently where I work the Process Classification Framework is used to classify all internal information systems to business processes. This assists to identify if there are duplicated information systems for the same business process and does the information system provide value to a specific business process.</p><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=1f9d5a7a602c" width="1" height="1" alt="">

APQC — Process Classification Framework

<p><em>This article was originally published on my old blog.</em></p><p>Governance is essential for any organization to be in place, be it in the enterprise, function, platform or solution level. In this article, I will discuss how you can get started with governance with the Cobit 5 framework.</p><figure><img alt="" src="https://cdn-images-1.medium.com/max/386/0*vBoP48hgCobh-efG.png" /><figcaption><em>Figure 1 — Cobit 5 Logo</em></figcaption></figure><h3>The sales pitch for Cobit</h3><p>I have seen many initiatives and projects failed due to the lack or having proper governance in place. Let’s be realistic it can be difficult to get governance correct and in most cases people don’t even know where to get started with governance.</p><p>This is where Cobit 5 comes to the rescue. <a href="http://www.isaca.org/Cobit/pages/default.aspx">Cobit 5</a> is the leading framework for the governance and management of enterprise IT. It is maintained by the ISACA institute.</p><p>You might want to run away now and stop reading this article because you think governance of enterprise IT is scary. If you continue reading, you will see it is not that scary and valuable to have the insights of the Cobit 5 governance framework.</p><p>So what does the Cobit 5 framework offer? Continue reading to get a better idea of the Cobit 5 governance framework.</p><h3>What is Cobit 5?</h3><p>The following is the definition from the <a href="https://cobitonline.isaca.org/publications">official book</a>:</p><blockquote><em>COBIT 5 provides a comprehensive framework that assists enterprises in achieving their objectives for the governance and management of enterprise IT. Simply stated, it helps enterprises create optimal value from IT by maintaining a balance between realizing benefits and optimizing risk levels and resource use.</em></blockquote><h3>Cobit goals cascade</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/230/0*9OEHVFFABuWkGDq9.png" /><figcaption><em>Figure 2 — Cobit 5 Goals Cascade Diagram</em></figcaption></figure><ol><li>Stakeholder drivers influence stakeholder needs.</li><li>Stakeholder needs cascade to enterprise goals.</li><li>Enterprise goals cascade to IT-related goals.</li><li>IT-related goals cascade to enabler goals.</li></ol><p>There are 17 generic and IT-related goals, distributed according to balance score card’s four dimensions (Financial, Customer, Internal, Learning / Growth).</p><h3>Principles of Cobit</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/350/0*pCzXi7gU7MDoHMvp.png" /><figcaption><em>Figure 3 — Cobit 5 Principles Diagram</em></figcaption></figure><p>Cobit defines 5 key principles for governance and management of enterprise information technology.</p><ul><li>Principle 1 — Meeting stakeholders needs.</li><li>Principle 2 — Covering the enterprise end-to-end.</li><li>Principle 3 — Applying a single integrated framework.</li><li>Principle 4 — Enable a holistic approach.</li><li>Principle 5 — Separating governance from management.</li></ul><h3>Cobit Areas</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/649/0*Gcfb39exenCIcIB_.jpg" /><figcaption><em>Figure 4 — Cobit 5 Areas and Domains Diagram</em></figcaption></figure><p>The Cobit framework has two areas namely Governance and Management. Each area contains domains with three letter acronym names, and each domain has its own unique processes. In total, there are 5 domains and 37 processes. Here is the structure for areas and domains:</p><p><strong>Governance of Enterprise IT</strong></p><ul><li>Evaluate, Direct, Monitor (EDM)</li><li>5 processes</li></ul><p><strong>Management</strong></p><ul><li>Plan (APO — Align, Plan, and Organize)</li><li>13 processes</li><li>Build (BAI — Build, Aquire, and Implement)</li><li>10 processes</li><li>Run (DSS — Deliver, Service, and Support)</li><li>6 processes</li><li>Monitor (MEA — Monitor, Evaluate, and Assess)</li><li>3 processes</li></ul><h3>Cobit Processes</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/700/0*QZ3pSZfrt6rmJ_kd.jpg" /><figcaption><em>Figure 5 — Cobit 5 Processes Diagram</em></figcaption></figure><p>The following is the detailed processes for each domain in the Cobit 5 framework.</p><h4>Evaluate, Direct, Monitor (EDM)</h4><ul><li>EDM 1 — Set and maintain the governance framework.</li><li>EDM 2 — Ensure value optimization.</li><li>EDM 3 — Ensure risk optimization.</li><li>EDM 4 — Ensure resource optimization.</li><li>EDM 5 — Ensure stakeholder transparency.</li></ul><h4>Align, Plan, and Organize (APO)</h4><ul><li>APO 1 — Define the management framework for IT.</li><li>APO 2 — Manage strategy.</li><li>APO 3 — Manage enterprise architecture.</li><li>APO 4 — Manage innovation.</li><li>APO 5 — Manage portfolio.</li><li>APO 6 — Manage budget and cost.</li><li>APO 7 — Manage human resources</li><li>APO 8 — Manage relationships.</li><li>APO 9 — Manage service agreements.</li><li>APO 10 — Manage suppliers.</li><li>APO 11 — Manage quality.</li><li>APO 12 — Manage risk.</li><li>APO 13 — Manage security.</li></ul><h4>Build, Acquire, and Implement (BAI)</h4><ul><li>BAI 1 — Manage programs and projects.</li><li>BAI 2 — Define requirements.</li><li>BAI 3 — Identify and build solutions.</li><li>BAI 4 — Manage availability and capacity.</li><li>BAI 5 — Manage organizational change enablement for delivery, service and support.</li><li>BAI 6 — Manage changes.</li><li>BAI 7 — Manage change acceptance and transitioning.</li><li>BAI 8 — Manage knowledge.</li><li>BAI 9 — Manage assets.</li><li>BAI 10 — Manage configuration.</li></ul><h4>Deliver, Service, and Support (DSS)</h4><ul><li>DSS 1 — Manage operations.</li><li>DSS 2 — Manage service requests and incidents.</li><li>DSS 3 — Manage problems.</li><li>DSS 4 — Manage continuity.</li><li>DSS 5 — Manage security services.</li><li>DSS 6 — Manage business process controls.</li></ul><h4>Monitor, Evaluate, and Assess (MEA)</h4><ul><li>MEA 1 — MEA performance and conformance.</li><li>MEA 2 — MEA the system of internal control.</li><li>MEA 3 — MEA compliance with external requirements.</li></ul><p>If you want to know more about each process’ practices and activities, then please read the publication <a href="https://cobitonline.isaca.org/publications">Cobit 5 Enabling Processes</a></p><h3>Cobit Enterprise Enablers</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/455/0*HZIm4U-aUhcwfTGV.png" /><figcaption><em>Figure 6 — Cobit 5 Enterprise Enablers Diagram</em></figcaption></figure><p>The Cobit 5 framework contains seven enterprise enablers. The following are the defined enablers:</p><p><strong>Principles, Policies, and Frameworks.</strong></p><ul><li>Are the vehicle to translate the desired behavior into practical guidance for day-to-day management. Internal and External stakeholders.</li></ul><p><strong>Processes</strong></p><ul><li>Describe an organized set of properties and activities.</li><li>Lifecycle of a process.</li><li>Governance and management processes.</li></ul><p><strong>Organisational Structures</strong></p><ul><li>Describe <a href="https://en.wikipedia.org/wiki/Responsibility_assignment_matrix">RACI</a> and roles.</li></ul><p><strong>Culture, ethics and behavior of individuals</strong></p><ul><li>In the enterprise, it is very often underestimated as a success factor in governance and management activities.</li></ul><p><strong>Information</strong></p><ul><li>Define its attributes: Physical, Empirical, Syntactic, Semantic, Type, Currency, Pragmatic, Retention, Status, Contingency, Novelty, Social.</li></ul><p><strong>Services, infrastructure, and applications</strong></p><ul><li>Includes: Reuse, Buy vs Build, Agility, Simplicity and openness, Definition of Architecture Principles, Architecture Viewpoints, Service Levels.</li></ul><p><strong>People, Skills, and Competencies</strong></p><ul><li>Are linked to people.</li><li>Define role skills.</li><li>Requirements.</li><li>Skill levels.</li><li>Skill categories.</li><li>Skill definitions</li></ul><figure><img alt="" src="https://cdn-images-1.medium.com/max/640/0*bVh-s0a4iHrsKt8q.png" /><figcaption><em>Figure 7 — Cobit 5 Enabler Dimensions Diagram</em></figcaption></figure><p>These enablers are measured by four dimensions as follow:</p><p><strong>Stakeholders</strong></p><ul><li>Internal Stakeholders</li><li>External Stakeholders</li></ul><p><strong>Goals</strong></p><ul><li><em>Intrinsic Quality</em></li><li>Results.</li><li>Process according to best practices.</li><li>Information is actual and true.</li><li><em>Contextual Quality</em></li><li>Fit for purpose.</li><li>Relevant.</li><li>Easy to apply.</li><li>Effectiveness</li><li><em>Access and security</em></li></ul><p><strong>Lifecycle</strong></p><ul><li>Plan</li><li>Design</li><li>Build / Acquire / Create / Implement</li><li>Use / Operate</li><li>Evaluate / Monitor</li><li>Update / Dispose</li></ul><p><strong>Good Practices</strong></p><h3>Process Capability Model and Levels</h3><figure><img alt="" src="https://cdn-images-1.medium.com/max/997/0*jkMcA37e-_T6eeMa.jpeg" /><figcaption><em>Figure 8 — Cobit 5 Process Capability Model and Levels Diagram</em></figcaption></figure><p>The capability model is based on ISO/IEC 15504 (SPICE). The capability model defines six levels as follow:</p><p><strong>Level 0 — Incomplete</strong></p><ul><li>The process is not implemented or fails to achieve its purpose.</li></ul><p><strong>Level 1 — Performed (Informed)</strong></p><ul><li>The process is implemented and achieves its purpose.</li></ul><p><strong>Level 2 — Managed (Planned and monitored)</strong></p><ul><li>The process is managed and results are specified, controlled and maintained.</li></ul><p><strong>Level 3 — Established (Well defined)</strong></p><ul><li>A standard process is defined and used throughout the organization.</li></ul><p><strong>Level 4 — Predictable (Quantitively managed)</strong></p><ul><li>The process is executed consistently within defined limits.</li></ul><p><strong>Level 5 — Optimizing (Continuous improvement)</strong></p><ul><li>The process is continuously improved to meet relevant current and projected business goals.</li></ul><p>The capability of processes is measured using process attributes. The international standard defines nine process attributes as follow:</p><p>1.1 Process Performance <br>2.1 Performance Management <br>2.2 Work Product Management <br>3.1 Process Definition <br>3.2 Process Deployment <br>4.1 Process Measurement <br>4.2 Process Control <br>5.1 Process Innovation <br>5.2 Process Optimization</p><p>Each process attribute is assessed on a four-point (N-P-L-F) rating scale:</p><ul><li>Not achieved — 0–15%</li><li>Partially achieved →15% — 50%</li><li>Largely achieved →50% — 85%</li><li>Fully achieved →85% — 100%</li></ul><h3>Summary</h3><p>The Cobit 5 framework has clear guidance and information available on how to setup and maintains a governance implementation. Even if you start small at taking small pieces of the framework to get started on governance, then you are on the right path. Let me challenge you to pick a couple of elements of the framework and apply it to your next project or solution. Then start building it up from there. If you have an Enterprise Architecture Board in your organization, then ask them for help and guidance to implement Cobit 5.</p><p>I hope you enjoyed this article and let me know if you have any feedback or questions.</p><img src="https://medium.com/_/stat?event=post.clientViewed&referrerSource=full_rss&postId=19c25bc2ed15" width="1" height="1" alt="">

Make your life easier with our services

How can we support your IT strategy.

How we help to improve your cybersecurity.