What are different Service level requirements (SLRs) ?

Service level requirements (SLRs) also called as : 

• Non-functional requirements
• Software Quality Attributes
• xabilities or ilities

LIST OF SLRs
1. Performance

• Response Time

2. Scalability

• Increasing load without changing the system
• Types : 
• Vertical Scalability
• Horizontal Scalability

3. Reliability

• Integrity
• Consistency

4. Availability

• System is always accessible

5. Extensibility

• Add / modify functionalities without impacting existing system functionalities

6. Maintainability

• Ability to correct flaws in the existing functionality without impacting other components of the system

7. Manageability

• Ability to manage the system to ensure the continued health of a system with respect to scalability, reliability, availability, performance, and security
• Monitoring of the QoS requirements and the ability to change the system configuration to improve the QoS dynamically without changing the system

9. Security

• Ability to ensure that the system cannot be compromised
• Key concepts : 
• Integrity
• Availability
• Confidentially
• Non-repudiation

What are the common Security threats ?

• Man in the middle attacks (MIM / MITM / MITMA)
• Attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.
• Example
• Alice "Hi Bob, it's Alice. Give me your key." →     Mallory     Bob
• Alice     Mallory "Hi Bob, it's Alice. Give me your key." →     Bob
• Alice     Mallory     ← [Bob's key] Bob

• Session hijacking (replaying data)
• Exploitation of a valid computer session
• Also called Cookie hijacking
•  Theft of a magic cookie used to authenticate a user to a remote server

• Password cracking

• Phishing
• Attempt to acquire sensitive information such as usernames, passwords, and credit card details
• Phishing emails may contain links to websites that are infected with malware 
• Often directs users to enter details at a fake website with similar look and feel

• Social hacking / engineering
• Psychological manipulation of people into performing actions or divulging confidential information.
• Techniques
• Baiting : Leaving a malware infected CD / USB drive (preferably, Auto-run) expected to be used by a company staff
• Quid pro quo : Calling random numbers at a company, claiming to be calling back from technical support and gain access or launch malware for the solution of the problem
• Phishing, IVR and Phone Phishing
• Tailgating
• Pretexting, Diversion theft

• Network sniffing
• Locating network problems by allowing you to capture and view the packet level data on your network 

• Cross-site scripting
• Injecting client-side scripts into web pages viewed by other users
• used to bypass access controls 

• SQL Injection
• SQL code injection technique, used to attack data-driven applications 

• Denial-of-service (DoS)
  
• Attempt to make a machine or network resource unavailable to its intended users
  

What a Security Model should contain ?

• Underlying System infrastructure (Hardware, including the Networking layer and components)
• User Authentication
• User Authorization
• Auditing
• Data encryption
• System hardening against specific attacks
  

How many ways to implement Application Security ?

Application security

• Authentication and Authorization : Using credentials
• Message-level data integrity : Using XML signatures 
• Message-level and transport confidentiality : Using encryption (SSL)

What are different terminologies in Security ?

• Principal : Entity (Person/System) that can be authenticated by a security module before system access.

• Credential : Container of information used to authenticate a principal

What technologies can be used across the tiers ?

TECHNOLOGIES USED IN TIERS

Client

• Java AWT / Swing
• Applets
• Android SDK
• HTML / CSS
• JS - AngularJS, jQuery, Bootstrap

Presentation (Web)

• JSP / Servlet
• JSF
• Spring MVC
• Templates : Thymleaf, Velocity, Freemarker

Business

• Spring
• EJB

Resource

• SQL : MySQL, PostGreSQL, Oracle etc.
• NoSQL : MongoDB etc.

Integration

• Shared DB
• Features : Shares data, Timely, High coupling
• File transfer / Shared file
• Features : Shares data, Loose coupling, Less timely
• RPC
• RMI, Corba
• Features : Shares functionality, Less complex, High coupling , Less reliability
• Messaging 
• Web services : JAX-WS, SOAP, REST
• JMS / MQ / ESB : RabbitMQ, ActiveMQ
• Features : Shares functionality + data , Loose coupling, Timely, Middleware dependent
• Channel (Queue) : Pipe b/w sender and reciever 
• Endpoint : Gateway of each system (sender and reciever
• Flow : Endpoint1 (sender) ---> channel ---> Endpoint2 (reciever)
  

• Interaction types
• Request-driven : Client requests a service from a server and waits for the response
• Event-driven : Agent publishes an event and interested subscribers receive the event.

• Others
• JDBC
• JCA (Java Connector Architecture)
• Apache Camel, Spring Integration : prefer these over Workflow engines for managing WS calls for talking to different systems

What is a Tier and what tiers could be there in Architecture ?

Tier

• A logical or physical organization of components into an ordered chain of service providers and consumers.
  
• Components within a tier typically consume / provide services to their "adjacent" tiers.

Tiers in Architecture

• Client
• Web / Presentation
• Business
• Integration
• Resource

2 Tier Architecture

• A Client/Server Architecture

3/Multi Tier Architecture

• Typically has :
• Client/Presentation Tier : UI which translates results to the format understandable by user
• Business Tier : Processing, Business logic and calculations
• Database Tier : Retrieve / Store info to database